Bug 846605
| Summary: | Kerberos authentication broken on Fedora 18 | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Martin Kosek <mkosek> | ||||||
| Component: | mod_auth_kerb | Assignee: | Joe Orton <jorton> | ||||||
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | rawhide | CC: | dpal, jorton, ssorce | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | mod_auth_kerb-5.4-19.fc18 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2012-08-13 06:31:41 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
|
Description
Martin Kosek
2012-08-08 08:45:18 UTC
I see that the %install phase seem to create the tmpfile.d entry and creates the /run/usr/apache directory. But shouldn't the creation of the directory be done during the %post phase ? Also I am not sure apache should own it, it is not a persistent directory, but I'll leave the ownership problem to people with better knowledge than me on packaging guidelines. Ah, we had a discussion about this, but it looks like I never actually pushed the change, sorry guys. This: http://pkgs.fedoraproject.org/cgit/mod_auth_kerb.git/commit/?id=6546d41e7fd8268f356a05d7f91dd596eb76d619 switches to /run/httpd/krbcache, owned by apache:apache Can you test this build? http://koji.fedoraproject.org/koji/buildinfo?buildID=346712 Generally, this issue is now gone and I was able to run FreeIPA CLI commands. I just now sometimes experience a hang in httpd service restart executed during IPA installation. I am investigating this issue to check if it is related to this bug. I did various tests of the httpd, I can experience the hang quite often. I am still not sure if this is caused by mod_auth_kerb, but I am seeing a suspicious pattern in strace of the hanging httpd processes:
6522 stat("/run/httpd/krbcache/krb5cc_apache_aPKQ7Y", {st_mode=S_IFREG|0600, st_size=2174, ...}) = 0
6522 unlink("/run/httpd/krbcache/krb5cc_apache_aPKQ7Y") = 0
...
6492 open("/run/httpd/krbcache/krb5cc_apache_aPKQ7Y", O_RDWR <unfinished ...>
6492 <... open resumed> ) = -1 ENOENT (No such file or directory)
6492 gettimeofday( <unfinished ...>
6492 <... gettimeofday resumed> {1344587919, 766350}, NULL) = 0
6492 open("/run/httpd/krbcache/krb5cc_apache_aPKQ7Y", O_RDWR <unfinished ...>
6492 <... open resumed> ) = -1 ENOENT (No such file or directory)
6492 gettimeofday( <unfinished ...>
6492 <... gettimeofday resumed> {1344587919, 766969}, NULL) = 0
6492 semop(2359305, {{0, -1, SEM_UNDO}}, 1 <unfinished ...>
It looks like that the krb5cc_apache_aPKQ7Y tempfile was removed, but then still referenced and read somewhere in mod_auth_kerb. Is this an expectable behavior? May it be related to the httpd hang?
I will attached debug httpd log + the referenced strace.
Created attachment 603462 [details]
httpd error log
Created attachment 603463 [details]
httpd strace
The cache is only intended to last as long as the client connection, so it should get deleted when the connection is terminated. I'm not sure why it could get re-used. Exactly. That's why I paid an attention to this and would like to ask you if you could check in the mod_auth_kerb if this is not a bad handling of the cache file name, or some kind of use-after-cleanup misuse. I wonder how move to the common location and DIR vs FILE cchec type affects this. It should not. I will thus close this Bugzilla as the issue with invalid directory for CCACHE files is now resolved. I was just curious if Joe would see some specific issue with mod_auth_kerb based on the strace and that would help us fix httpd hangs. We will continue our investigation on F18 and open another Bug when we find the root cause. |