Bug 2082843

Description of problem:

On Fedora 36 users in nis database cannot login on graphical desktop (e.g. GNOME).

I have installed a system with Fedora 36 (RC5; without and with packages from updates-testing), using the same configuration as for Fedora 35.

NIS users can login on Fedora 35 systems, but not on Fedora 36 systems.


If using ssh, users can log in, but the system log contains a line like this:

sshd[17565]: pam_systemd(sshd:session): Failed to get user record: No such process


If using desktop with gdm, then the user cannot log in and lines like this are logged:

gdm-password][13488]: pam_systemd(gdm-password:session): Failed to get user record: Kein passender Prozess gefunden
gdm-password][13488]: pam_unix(gdm-password:session): session opened for user myusername(uid=XXXX) by (uid=0)
gdm-password][13488]: gkr-pam: unable to locate daemon control file
...
dbus-daemon[13513]: [session uid=XXXX pid=13513] Activating service name='org.freedesktop.systemd1' requested by ':1.0' (uid=XXXX pid=13511 comm="/usr/libexec/gdm-wayland-session /usr/bin/gnome-se" label="unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023")
dbus-daemon[13513]: [session uid=XXXX pid=13513] Activated service 'org.freedesktop.systemd1' failed: Process org.freedesktop.systemd1 exited with status 1
...
pam_unix(gdm-password:session): session closed for user myusername


I have investigated the problem and found that "userdbctl" has changed the behavior and also doesn't find the user.

> userdbctl user myusername
User myusername does not exist.

>userdbctl --service=x user myusername
Enabled services: x
   User name: myusername
 Disposition: regular
 Last Passw.: Mon 2018-02-12 01:00:00 CET
    Login OK: yes
 Password OK: yes
         UID: XXXX
         GID: YYYY (groupy)
 Aux. Groups: group1
              group2
   Real Name: My Name
   Directory: /home/myusername
     Storage: classic
       Shell: /bin/bash
 Passwd Chg.: max 5y 5month 3w 13h 30min/warn 4w 2d
Pas. Ch. Now: no
   Passwords: 1

lists the complete nis user data. The value after "--service=" seems to be ignored, any value results in the same data.


On Fedora 35 both commands return user data, but differ in shadow data:

> userdbctl user myusername
   User name: myusername
 Disposition: regular
    Login OK: yes
 Password OK: yes
         UID: XXXX
         GID: YYYY (groupy)
 Aux. Groups: group1
              group2
   Real Name: My Name
   Directory: /home/myusername
     Storage: classic
       Shell: /bin/bash
   Passwords: none
     Service: io.systemd.NameServiceSwitch


> userdbctl --service=x user myusername
Enabled services: x
   User name: myusername
 Disposition: regular
 Last Passw.: Mon 2018-02-12 01:00:00 CET
    Login OK: yes
 Password OK: yes
         UID: XXXX
         GID: YYYY (groupy)
 Aux. Groups: group1
              group2
   Real Name: My Name
   Directory: /home/myusername
     Storage: classic
       Shell: /bin/bash
 Passwd Chg.: max 5y 5month 3w 13h 30min/warn 4w 2d
Pas. Ch. Now: no
   Passwords: 1


I know nscd was removed from Fedora 36. But on Fedora 35 users can log in with and without running nscd. So it should be the case on Fedora 36.

I use authselect with profile nis:

> LANG=C authselect current
Profile ID: nis
Enabled features:
- with-nispwquality
- without-nullok


So nss is configured to use nis:

> grep passwd /etc/nsswitch.conf 
passwd:     files nis systemd


Has anyone an idea what has changed in Fedora 36, what may be the reason for this behavior?
Is it an error in systemd or glibc or nss_nis, or an access problem (SELinux, sandbox)?

Do I need to change some files?


I looked at userdbctl with strace and ltrace and found that it communicates with /run/systemd/userdb/io.systemd.Multiplexer, but I don't know how to see what the processes at the other end of the socked does.


>strace -s 200 -v -f userdbctl user myusername
...
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.Multiplexer"}, 45) = 0
epoll_create1(EPOLL_CLOEXEC)            = 4
timerfd_create(CLOCK_MONOTONIC, TFD_CLOEXEC|TFD_NONBLOCK) = 5
epoll_ctl(4, EPOLL_CTL_ADD, 5, {events=EPOLLIN, data={u32=2994818672, u64=94569584742000}}) = 0
epoll_ctl(4, EPOLL_CTL_ADD, 3, {events=0, data={u32=2994820880, u64=94569584744208}}) = 0
gettid()                                = 18613
futex(0x7f0b375ec424, FUTEX_WAKE_PRIVATE, 2147483647) = 0
epoll_ctl(4, EPOLL_CTL_MOD, 3, {events=EPOLLIN|EPOLLOUT, data={u32=2994820880, u64=94569584744208}}) = 0
openat(AT_FDCWD, "/proc/sys/kernel/random/boot_id", O_RDONLY|O_NOCTTY|O_CLOEXEC) = 6
read(6, "e5d2bfc0-7213-4232-a385-8aec869b5718\n", 38) = 37
read(6, "", 1)                          = 0
close(6)                                = 0
timerfd_settime(5, TFD_TIMER_ABSTIME, {it_interval={tv_sec=0, tv_nsec=0}, it_value={tv_sec=29552, tv_nsec=738102000}}, NULL) = 0
epoll_wait(4, [{events=EPOLLOUT, data={u32=2994820880, u64=94569584744208}}], 8, 0) = 1
timerfd_create(CLOCK_BOOTTIME, TFD_CLOEXEC|TFD_NONBLOCK) = 6
close(6)                                = 0
sendto(3, "{\"method\":\"io.systemd.UserDatabase.GetUserRecord\",\"parameters\":{\"userName\":\"myusername\",\"service\":\"io.systemd.Multiplexer\"}}\0", 120, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 120
epoll_ctl(4, EPOLL_CTL_MOD, 3, {events=EPOLLIN, data={u32=2994820880, u64=94569584744208}}) = 0
epoll_wait(4, [], 8, 0)                 = 0
mmap(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0b3728a000
recvfrom(3, "{\"error\":\"io.systemd.UserDatabase.NoRecordFound\",\"parameters\":{}}\0", 135152, MSG_DONTWAIT, NULL, NULL) = 66
epoll_ctl(4, EPOLL_CTL_MOD, 3, {events=0, data={u32=2994820880, u64=94569584744208}}) = 0
epoll_wait(4, [], 8, 0)                 = 0
epoll_wait(4, [], 8, 0)                 = 0
epoll_ctl(4, EPOLL_CTL_DEL, 3, NULL)    = 0
close(3)                                = 0
...


I have set systemd logging to debug level. Loging in with ssh has created the following lines:


varlink: New incoming connection.
varlink: Connections of user 0: 0 (of 1024 max)
varlink-25: Setting state idle-server
varlink-25: New incoming message: {"method":"io.systemd.UserDatabase.GetUserRecord","parameters":{"userName":"myusername","service":"io.systemd.DynamicUser"}}
varlink-25: Changing state idle-server → processing-method
varlink-25: Sending message: {"error":"io.systemd.UserDatabase.NoRecordFound","parameters":{}}
varlink-25: Changing state processing-method → processed-method
varlink-25: Changing state processed-method → idle-server
varlink-25: Got POLLHUP from socket.
varlink-25: Changing state idle-server → pending-disconnect
varlink-25: Changing state pending-disconnect → processing-disconnect
varlink-25: Changing state processing-disconnect → disconnected





Version-Release number of selected component (if applicable):
systemd-250.3-8.fc36.x86_64
glibc-2.35-5.fc36.x86_64
authselect-1.3.0-10.fc36.x86_64
nss_nis-3.1-11.fc36.x86_64
ypbind-2.7.2-8.fc36.x86_64
pam-1.5.2-12.fc36.x86_64


How reproducible:
Always

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: