Bug 1757089

Summary:	/usr/lib64/samba/pdb/ipasam.so: undefined symbol: unixid_from_gid, version SAMBA_PASSDB_0.2.0
Product:	[Fedora] Fedora	Reporter:	Steven Haigh <netwiz>
Component:	freeipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	31	CC:	abokovoy, contribs, gmarr, ipa-maint, jcholast, jhrozek, pvoborni, rcritten, robatino, ssorce, twoerner
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:	RejectedBlocker AcceptedFreezeException
Fixed In Version:	freeipa-4.8.1-2.fc31	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-10-03 00:36:51 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1644940

Description Steven Haigh 2019-09-30 14:27:16 UTC

When upgrading a working FreeIPA install from F30 to F31, I find the following problem when launching FreeIPA.

# ipactl start --ignore-service-failure
Existing service file detected!
Assuming stale, cleaning and proceeding
Starting Directory Service
Starting krb5kdc Service
Starting kadmin Service
Starting named Service
Starting httpd Service
Starting ipa-custodia Service
Starting pki-tomcatd Service
Starting smb Service
Failed to start smb Service
Forced start, ignoring smb Service, continuing normal operation
Starting winbind Service
Failed to start winbind Service
Forced start, ignoring winbind Service, continuing normal operation
Starting ipa-otpd Service
Starting ipa-ods-exporter Service
Starting ods-enforcerd Service
Starting ipa-dnskeysyncd Service
ipa: INFO: The ipactl command was successful

In debugging this, starting samba via `smbd -i -d 10` ends with the following debug output:
No builtin backend found, trying to load plugin                                                                        
load_module_absolute_path: Probing module '/usr/lib64/samba/pdb/ipasam.so'                   
Error loading module '/usr/lib64/samba/pdb/ipasam.so': /usr/lib64/samba/pdb/ipasam.so: undefined symbol: unixid_from_gid, version SAMBA_PASSDB_0.2.0
No builtin nor plugin backend for ipasam found                                                                         

Versions:
# rpm -qa | grep freeipa | sort
freeipa-client-4.8.1-1.fc31.x86_64
freeipa-client-common-4.8.1-1.fc31.noarch
freeipa-common-4.8.1-1.fc31.noarch
freeipa-server-4.8.1-1.fc31.x86_64
freeipa-server-common-4.8.1-1.fc31.noarch
freeipa-server-dns-4.8.1-1.fc31.noarch
freeipa-server-trust-ad-4.8.1-1.fc31.x86_64

Comment 1 Alexander Bokovoy 2019-09-30 14:46:26 UTC

Thanks for the report. This is due to commit c906153cc7af21abe508ddd30c447642327d6a5d in Samba which went into 4.11 release. I'm working on a fix.

Comment 2 Alexander Bokovoy 2019-09-30 14:52:16 UTC

Pull request upstream: https://github.com/freeipa/freeipa/pull/3751

Comment 3 Fedora Blocker Bugs Application 2019-09-30 14:56:17 UTC

Proposed as a Blocker and Freeze Exception for 31-final by Fedora user abbra using the blocker tracking app because:

 Samba 4.11 did remove a set of functions required by FreeIPA. This breaks upgrade of Fedora 30 to Fedora 31 if trust to Active Directory is configured in FreeIPA. A fix upstream for FreeIPA is available at https://github.com/freeipa/freeipa/pull/3751 and is currently being reviewed.

It could be Freeze Exception but I also asked for a blocker due to how it affects upgrade process.

Comment 4 Geoffrey Marr 2019-09-30 22:29:29 UTC

Discussed during the 2019-09-30 blocker review meeting: [0]

The decision to classify this bug as a "RejectedBlocker" and an "AcceptedFreezeException" was made as it breaks only if a non-default feature not in the criteria (AD trust) is enabled, but accepted as a freeze exception to help minimize the number of affected upgrades.

[0] https://meetbot.fedoraproject.org/fedora-blocker-review/2019-09-30/f31-blocker-review.2019-09-30-16.00.txt

Comment 5 Fedora Update System 2019-10-01 07:05:16 UTC

FEDORA-2019-658592a357 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-658592a357

Comment 6 Fedora Update System 2019-10-01 07:08:40 UTC

FEDORA-2019-b63884f469 has been submitted as an update to Fedora 32. https://bodhi.fedoraproject.org/updates/FEDORA-2019-b63884f469

Comment 7 Rob Crittenden 2019-10-01 14:39:12 UTC

Fixed upstream
master:
https://pagure.io/freeipa/c/19d51683cad9ee091d25c56431a8b5a538e3fe10

Comment 8 Rob Crittenden 2019-10-01 20:59:50 UTC

Fixed upstream
ipa-4-8:
https://pagure.io/freeipa/c/3f98406bcbafc3b6e1e75ca38bec8e1c9cc8bd12

Comment 9 Fedora Update System 2019-10-02 15:53:05 UTC

freeipa-4.8.1-2.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-658592a357

Comment 10 Fedora Update System 2019-10-03 00:36:51 UTC

freeipa-4.8.1-2.fc31 has been pushed to the Fedora 31 stable repository. If problems still persist, please make note of it in this bug report.