Bug 1444431

Summary: ERR - symload_report_error - Netscape Portable Runtime error -5975: /usr/lib64/dirsrv/plugins/libsyntax-plugin.so: undefined symbol: nis_plugin_init_betxn_postop
Product: Red Hat Enterprise Linux 7 Reporter: Sudhir Menon <sumenon>
Component: 389-ds-baseAssignee: mreynolds
Status: CLOSED ERRATA QA Contact: Viktor Ashirov <vashirov>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 7.4CC: msauton, nkinder, rmeggins, tbordaz
Target Milestone: rcKeywords: Regression
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 389-ds-base-1.3.6.1-10.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-01 21:16:38 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
dse.ldif none

Description Sudhir Menon 2017-04-21 10:24:25 UTC
Description of problem: 'ERR - symload_report_error - Could not load symbol "nis_plugin_init_betxn_postop" from "libsyntax-plugin" for plugin nis-server-plugin-betxn_postop'


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Install IPA Server
2. ipa-compat-manage enable
3. ipa-nis-manage enable
4. service rpcbind restart
5. systemctl restart dirsrv 
6. ldapsearch -xLLL -D 'cn=Directory Manager' -w 'Secret123' -b cn=NIS\ Server,cn=plugins,cn=config dn|grep nis-map=passwd
7. ipa-nis-manage disable
8. systemctl stop dirsrv.target
9. cp /etc/dirsrv/slapd-$SUFFIX/dse.ldif /root/dse.ldif.backup
10. Remove all NIS plugins
sed -i '/NIS/,/^$/d' /etc/dirsrv/slapd-TESTRELM-TEST/dse.ldif
11. systemctl start dirsrv.target
12. ipa-nis-manage enable
13. Check the dse.ldif file in instance directory

Actual results:
6. Below is the output when ldapsearch is done.
dn: nis-domain=testrelm.test+nis-map=passwd.byname,cn=NIS Server,cn=plugins,cn
dn: nis-domain=testrelm.test+nis-map=passwd.byuid,cn=NIS Server,cn=plugins,cn=


11. Below is the message displayed on the dirsrv error log.

[21/Apr/2017:03:42:26.617643804 -0400] - ERR - symload_report_error - Netscape Portable Runtime error -5975: /usr/lib64/dirsrv/plugins/libsyntax-plugin.so: undefined symbol: nis_plugin_init_betxn_postop
[21/Apr/2017:03:42:26.619305942 -0400] - ERR - symload_report_error - Could not load symbol "nis_plugin_init_betxn_postop" from "libsyntax-plugin" for plugin nis-server-plugin-betxn_postop
[21/Apr/2017:03:42:26.620576438 -0400] - ERR - slapd_bootstrap_config - The plugin entry [cn=nis-server-plugin-betxn_postop,cn=plugins,cn=config] in the configfile /etc/dirsrv/slapd-TESTRELM-TEST/dse.ldif was invalid. Failed to load plugin's init function.
[21/Apr/2017:03:42:26.621255641 -0400] - EMERG - main - The configuration files in directory /etc/dirsrv/slapd-TESTRELM-TEST could not be read or were not found.  Please refer to the error log or output for more information.

12. Below is the message displayed when ipa-nis-manage enable' is run
Directory Manager password: Unexpected error
NetworkError: cannot connect to 'ldapi://%2fvar%2frun%2fslapd-TESTRELM-TEST.socket': 

13. Attached the dse.ldif file.

Expected results: Fix the above issue
Additional info: https://bugzilla.redhat.com/show_bug.cgi?id=1286781#c1
Attaching the dse.ldif file

Comment 2 Sudhir Menon 2017-04-21 10:27:08 UTC
Created attachment 1273282 [details]
dse.ldif

Comment 4 thierry bordaz 2017-04-21 12:31:11 UTC
Have seen two issues in that BZ and I do not know if they are separated or not:

1rst ISSUE
----------
we can see that unexpected entries are found related Schema-Compat or NIS plugins WHEN those plugins are enabled AND server restart
Those entries are looking like:

dn: cn=nis-server-plugin-betxn_postop,cn=plugins,cn=config
cn: nis-server-plugin-betxn_postop
objectClass: top
objectClass: extensibleObject
nsslapd-pluginType: betxnpostoperation
nsslapd-pluginInitfunc: nis_plugin_init_betxn_postop
nsslapd-pluginprecedence: 50
nsslapd-pluginId: nis-plugin
nsslapd-pluginVersion: 0.56.1 (betxn support available and enabled by default)
nsslapd-pluginVendor: redhat.com
nsslapd-pluginDescription: NIS Server Plugin
creatorsName: cn=server,cn=plugins,cn=config
modifiersName: cn=server,cn=plugins,cn=config

or 

dn: cn=schema-compat-plugin-betxn_postop,cn=plugins,cn=config
cn: schema-compat-plugin-betxn_postop
createTimestamp: 20170421095647Z
creatorsName: cn=server,cn=plugins,cn=config
modifiersName: cn=server,cn=plugins,cn=config
modifyTimestamp: 20170421095647Z
nsslapd-pluginDescription: Schema Compatibility Plugin
nsslapd-pluginId: schema-compat-plugin
nsslapd-pluginInitfunc: schema_compat_plugin_init_betxn_postop
nsslapd-pluginType: betxnpostoperation
nsslapd-pluginVendor: redhat.com
nsslapd-pluginVersion: 0.56.1 (betxn support available and enabled by default)
nsslapd-pluginprecedence: 40
objectClass: top
objectClass: extensibleObject


It exists as much "dummy" entries as there are callback init funct

grep '^dn: ' /etc/dirsrv/slapd-TEST-COM/dse.ldif | grep -i compat
dn: cn=Schema Compatibility,cn=plugins,cn=config
dn: cn=schema-compat-plugin-betxn_postop,cn=plugins,cn=config
dn: cn=schema-compat-plugin-betxn_preop,cn=plugins,cn=config
dn: cn=schema-compat-plugin-extop-preop,cn=plugins,cn=config
dn: cn=schema-compat-plugin-internal-postop,cn=plugins,cn=config
dn: cn=schema-compat-plugin-postop,cn=plugins,cn=config
dn: cn=schema-compat-plugin-preop,cn=plugins,cn=config
dn: cn=computers,cn=Schema Compatibility,cn=plugins,cn=config
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
dn: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config
dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config
dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config


ipa-nis-manage enable
grep '^dn: ' /etc/dirsrv/slapd-TEST-COM/dse.ldif | grep -i nis
dn: cn=NIS Server,cn=plugins,cn=config
dn: nis-domain=test.com+nis-map=ethers.byaddr,cn=NIS Server,cn=plugins,cn=conf
dn: nis-domain=test.com+nis-map=ethers.byname,cn=NIS Server,cn=plugins,cn=conf
dn: nis-domain=test.com+nis-map=group.bygid,cn=NIS Server,cn=plugins,cn=config
dn: nis-domain=test.com+nis-map=group.byname,cn=NIS Server,cn=plugins,cn=confi
dn: nis-domain=test.com+nis-map=netgroup,cn=NIS Server,cn=plugins,cn=config
dn: nis-domain=test.com+nis-map=netid.byname,cn=NIS Server,cn=plugins,cn=confi
dn: nis-domain=test.com+nis-map=passwd.byname,cn=NIS Server,cn=plugins,cn=conf
dn: nis-domain=test.com+nis-map=passwd.byuid,cn=NIS Server,cn=plugins,cn=confi
  #
  # So here there is not yet dummy entries
  #
ipactl start
grep '^dn: ' /etc/dirsrv/slapd-TEST-COM/dse.ldif | grep -i nis
dn: cn=NIS Server,cn=plugins,cn=config
dn: cn=nis-server-plugin-betxn_postop,cn=plugins,cn=config
dn: cn=nis-server-plugin-internal-postop,cn=plugins,cn=config
dn: cn=nis-server-plugin-postop,cn=plugins,cn=config
dn: nis-domain=test.com+nis-map=ethers.byaddr,cn=NIS Server,cn=plugins,cn=conf
dn: nis-domain=test.com+nis-map=ethers.byname,cn=NIS Server,cn=plugins,cn=conf
dn: nis-domain=test.com+nis-map=group.bygid,cn=NIS Server,cn=plugins,cn=config
dn: nis-domain=test.com+nis-map=group.byname,cn=NIS Server,cn=plugins,cn=confi
dn: nis-domain=test.com+nis-map=netgroup,cn=NIS Server,cn=plugins,cn=config
dn: nis-domain=test.com+nis-map=netid.byname,cn=NIS Server,cn=plugins,cn=confi
dn: nis-domain=test.com+nis-map=passwd.byname,cn=NIS Server,cn=plugins,cn=conf
dn: nis-domain=test.com+nis-map=passwd.byuid,cn=NIS Server,cn=plugins,cn=confi
  #
  # Here they are
  #



Not I can reproduce the issue on F26 (389-ds-base-1.3.6.3-4.fc26.x86_64) BUT NOT on F25 (389-ds-base-1.3.5.16-1.fc25.x86_64) with the following testcase

1) ipa-server-install --hostname=`hostname`  -p Secret123 -a Secret123 --domain test.com --realm TEST.COM -U
2) ipa-compat-manage enable
3) ipactl restart (not sure it is required, compat entries may already exist)
4) grep '^dn: ' /etc/dirsrv/slapd-TEST-COM/dse.ldif | grep -i compat
5) ipa-nis-manage enable
6) grep '^dn: ' /etc/dirsrv/slapd-TEST-COM/dse.ldif | grep -i nis


SECOND issue
The following message is weird
Could not load symbol "nis_plugin_init_betxn_postop" from "libsyntax-plugin" for plugin nis-server-plugin-betxn_postop

nis_plugin_init_betxn_postop should exist in the nis-plugin and in addition I see no reason why libsyntax would refer that callback

Comment 5 thierry bordaz 2017-04-25 12:21:04 UTC
The first issue is related to https://pagure.io/389-ds-base/issue/49230.

I have not been able to reproduce the second issue

Comment 6 thierry bordaz 2017-04-26 15:20:06 UTC
Upstream ticket (https://pagure.io/389-ds-base/issue/49230) was pushed

Comment 8 Sudhir Menon 2017-05-15 09:28:33 UTC
Tested using below rpms

389-ds-base-1.3.6.1-13.el7.x86_64
ipa-server-4.5.0-11.el7.x86_64

Observations:
1. Found there are only 2 maps displayed.

[root@master ~]# ipa-compat-manage enable
Directory Manager password: 

Plugin already Enabled
[root@master ~]# ipa-nis-manage enable
Directory Manager password: 

Enabling plugin
This setting will not take effect until you restart Directory Server.
The rpcbind service may need to be started.
[root@master ~]# service rpcbind restart
Redirecting to /bin/systemctl restart rpcbind.service
[root@master ~]# systemctl restart dirsrv
[root@master ~]# ldapsearch -xLLL -D 'cn=Directory Manager' -w 'Secret123' -b cn=NIS\ Server,cn=plugins,cn=config dn|grep nis-map=passwd
dn: nis-domain=testrelm.test+nis-map=passwd.byname,cn=NIS Server,cn=plugins,cn
dn: nis-domain=testrelm.test+nis-map=passwd.byuid,cn=NIS Server,cn=plugins,cn=

2. Also the dse.ldif file contains various entires related to betxn
dn: cn=7-bit check,cn=plugins,cn=config
cn: 7-bit check
nsslapd-plugin-depends-on-type: database
nsslapd-pluginDescription: Enforce  7-bit clean attribute values
nsslapd-pluginEnabled: on
nsslapd-pluginId: NS7bitAttr
nsslapd-pluginInitfunc: NS7bitAttr_Init
nsslapd-pluginPath: libattr-unique-plugin
nsslapd-pluginType: betxnpreoperation
nsslapd-pluginVendor: 389 Project
nsslapd-pluginVersion: 1.3.6.1
nsslapd-pluginarg0: uid
nsslapd-pluginarg1: mail
nsslapd-pluginarg2: ,
nsslapd-pluginarg3: dc=testrelm,dc=test
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject

3. However the below issue is no more seen
Could not load symbol "nis_plugin_init_betxn_postop" from "libsyntax-plugin" for plugin nis-server-plugin-betxn_postop

Comment 9 thierry bordaz 2017-05-15 09:38:19 UTC
From the https://bugzilla.redhat.com/show_bug.cgi?id=1444431#c8:

Observations:

2) This is normal many plugins are now betxn and this one (7-bit) has nothing suspicious.
The purpose of the fix was to prevent creation of entries likes:
dn: cn=schema-compat-plugin-betxn_postop,cn=plugins,cn=config
dn: cn=schema-compat-plugin-betxn_preop,cn=plugins,cn=config
dn: cn=schema-compat-plugin-extop-preop,cn=plugins,cn=config
dn: cn=schema-compat-plugin-internal-postop,cn=plugins,cn=config
dn: cn=schema-compat-plugin-postop,cn=plugins,cn=config
dn: cn=schema-compat-plugin-preop,cn=plugins,cn=config

3)
I was not able to reproduce following message
Could not load symbol "nis_plugin_init_betxn_postop" from "libsyntax-plugin" for plugin nis-server-plugin-betxn_postop

Now I believe it was a consequence of dummy entries being created (like cn=schema-compat-plugin-betxn_postop,cn=plugins,cn=config)

So IMHO if you do not detect those dummy entries and not see libsyntax-plugin message, that means the bug is fixed.

Comment 11 Sudhir Menon 2017-05-19 13:05:16 UTC
marking the bug verified as per comment 8 and 9.

Comment 12 errata-xmlrpc 2017-08-01 21:16:38 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2086