Bug 1579703

Verified the bug on SSSD Version: sssd-1.16.0-19.el7_5.5.x86_64

Steps followed during verification:

1. Reproduce the bug by installing an older SSSD version : sssd-1.16.0-19.el7.x86_64 in the client system.

2. Add large number of netgroups to your 389-ds ldap server, lets say around 10000.

3. Configure sssd.conf as follows :
[sssd]
services = nss, pam
config_file_version = 2
reconnection_retries = 5
sbus_timeout = 30
domains = LDAP
debug_level = 1

[nss]
filter_users = root
filter_groups = root
debug_level = 9

[pam]
reconnection_retries = 5
offline_credentials_expiration = 0
offline_failed_login_attempts = 0
offline_failed_login_delay = 5
debug_level = 1

[sudo]
[autofs]
[ssh]

[domain/LDAP]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
cache_credentials = true
enumerate = false
ldap_schema = rfc2307
ldap_uri = ldaps://SERVER
ldap_search_base = dc=example,dc=com
ldap_id_use_start_tls = true
ldap_tls_cacertdir = /etc/openldap/certs
ldap_tls_reqcert = allow
debug_level = 1

4. Execute continuous netgroup lookup on one terminal. Following is a test script which will execute lookup in the background:
function lookup1()
{
for i in {1..3000}; do
getent netgroup Testqe$i
sleep 1
done
}

function lookup2()
{
for i in {3001..6000}; do
getent netgroup Testqe$i
sleep 1
done
}
lookup1 &
lookup2 &
 
5. On another terminal, run "sss_cache -E" and monitor the pid of sssd_nss. With the old sssd build, SSSD_NSS should restart/crash. You can see the process restart by checking the status in a loop. Following is a test script which checks the same:
function chk_crash()
{
NSS_PR1=`pidof sssd_nss`
for i in {1..100}; do
echo "Test attempt number: $i"
sss_cache -E
sleep 3
NSS_PR2=`pidof sssd_nss`
if [ $NSS_PR1 -eq $NSS_PR2 ]; then 
   echo "Pid of nss is $NSS_PR1,Test works fine."
else
   echo "Initial nss pid was $NSS_PR1, now it is $NSS_PR2. SSSD_NSS restarted, test failed"; exit
fi
done
}
chk_crash

6. Install the latest build and repeat steps 4,5. We don't see any issues with nss process. I ran the loop for 100 iterations and found sssd_nss steady.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1986