RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1794016 - sssd_be frequent crash
Summary: sssd_be frequent crash
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: sssd
Version: 8.2
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: rc
: 8.0
Assignee: SSSD Maintainers
QA Contact: sssd-qe
URL:
Whiteboard: sync-to-jira
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-01-22 14:01 UTC by Sumit Bose
Modified: 2023-03-07 12:10 UTC (History)
14 users (show)

Fixed In Version: sssd-2.2.3-12.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1792184
Environment:
Last Closed: 2020-04-28 16:56:29 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 5100 0 None closed sssd_be frequent crash 2021-01-15 05:21:58 UTC
Red Hat Issue Tracker RHELPLAN-33269 0 None None None 2023-03-07 12:08:28 UTC
Red Hat Issue Tracker SSSD-1956 0 None None None 2023-03-07 12:10:50 UTC
Red Hat Product Errata RHBA-2020:1863 0 None None None 2020-04-28 16:56:40 UTC

Description Sumit Bose 2020-01-22 14:01:15 UTC
+++ This bug was initially created as a clone of Bug #1792184 +++

Description of problem:

after upgrading to fedora 31 (no problem before), I face very frequent sssd_be crashes.
Issue seems related to sssd_ldap though can't be sure.

System is up-to-date with latest components

Version-Release number of selected component (if applicable):
sssd-common-pac-2.2.2-3.fc31.x86_64
sssd-nfs-idmap-2.2.2-3.fc31.x86_64
sssd-krb5-common-2.2.2-3.fc31.x86_64
sssd-krb5-2.2.2-3.fc31.x86_64
sssd-proxy-2.2.2-3.fc31.x86_64
sssd-2.2.2-3.fc31.x86_64
sssd-common-2.2.2-3.fc31.x86_64
sssd-ipa-2.2.2-3.fc31.x86_64
sssd-client-2.2.2-3.fc31.x86_64
sssd-tools-2.2.2-3.fc31.x86_64
python3-sssdconfig-2.2.2-3.fc31.noarch
sssd-client-2.2.2-3.fc31.i686
sssd-ldap-2.2.2-3.fc31.x86_64
sssd-ad-2.2.2-3.fc31.x86_64
sssd-kcm-2.2.2-3.fc31.x86_64


How reproducible:

Happens when using sudo commands, getting error message:

    sudo: PAM account management error: Protocol not supported

Executing sudo multiple times will show same error then works.

Steps to Reproduce:
1.
2.
3.

Actual results:
sudo often fails with message "sudo: PAM account management error: Protocol not supported"

Expected results:
sudo should work

Additional info:

/var/log/message extract:

Jan 17 09:36:57 maelle systemd-coredump[37859]: Process 37803 (sssd_be) of user 0 dumped core.#012#012Stack trace of thread 37803:#012#0  0x00007f957a350d76 sysdb_user_base_dn (libsss_util.so)#012#1  0x0000558301f47d4b be_refresh_step (sssd_be)#012#2  0x0000558301f480b2 be_refresh_send (sssd_be)#012#3  0x0000558301f47531 be_ptask_execute (sssd_be)#012#4  0x00007f957a266f3d tevent_common_invoke_timer_handler (libtevent.so.0)#012#5  0x00007f957a2670e0 tevent_common_loop_timer_delay (libtevent.so.0)#012#6  0x00007f957a2684a9 epoll_event_loop_once (libtevent.so.0)#012#7  0x00007f957a26653b std_event_loop_once (libtevent.so.0)#012#8  0x00007f957a2615d8 _tevent_loop_once (libtevent.so.0)#012#9  0x00007f957a26187b tevent_common_loop_wait (libtevent.so.0)#012#10 0x00007f957a2664cb std_event_loop_wait (libtevent.so.0)#012#11 0x00007f957a380e17 server_loop (libsss_util.so)#012#12 0x0000558301f3ec42 main (sssd_be)#012#13 0x00007f957a0a41a3 __libc_start_main (libc.so.6)#012#14 0x0000558301f3edfe _start (sssd_be)
Jan 17 09:36:57 maelle systemd[1]: systemd-coredump: Succeeded.
Jan 17 09:36:57 maelle abrt-dump-journal-core[993]: Failed to obtain all required information from journald
Jan 17 09:36:57 maelle abrt-server[37872]: Deleting problem directory ccpp-2020-01-17-09:36:57.463705-37803 (dup of ccpp-2020-01-14-09:52:17.183530-1002)
Jan 17 09:36:58 maelle abrt-notification[37906]: Process 1002 (sssd_be) crashed in sysdb_user_base_dn()



sssd config:

[sssd]
domains = XXX.XXX, files
services = nss, pam, autofs
config_file_version = 2

[domain/files]
#A new files provider was added. This provider mirrors the contents of /etc/passwd and /etc/group into the SSSD database
id_provider = files

[domain/XXX.XX]
#debug_level = 9 #/var/log/sssd/
id_provider = ldap
auth_provider = ldap
cache_credentials = true
entry_cache_timeout = 5400
#entry_cache_netgroup_timeout = 
#You can consider setting this value to 3/4 * entry_cache_timeout. 
refresh_expired_interval = 4000
ldap_uri = ldaps://ldap.XXX.XXX.XXX
ldap_search_base = ou=XXX,dc=XXX,dc=XXX
#ldap_id_use_start_tls = true
ldap_tls_cacert = /etc/ssl/certs/chain-TCS.pem
ldap_schema = rfc2307bis
#Number of days entries are left in cache after last successful login before being removed during a cleanup of the cache. 0 means keep forever. The value of this parameter must be greater than or equal to offline_credentials_expiration
#account_cache_expiration = 45 

# By default SSSD will use the value retrieved from LDAP
homedir_substring = /home
override_homedir = %H/%u
override_shell = /usr/bin/bash

autofs_provider = ldap
entry_cache_autofs_timeout = 86400
ldap_autofs_search_base=ou=autofs,ou=XXX,dc=XXX,dc=XXX
#ldap_autofs_map_master_name=

[pam]
# If the authentication provider is offline, how long should we allow cached logins (in days since the last successful online login). 0 means no limit. 
offline_credentials_expiration = 0

[nss]
filter_users = root
filter_groups = root

[autofs]

--- Additional comment from Lukas Slebodnik on 2020-01-17 09:18:24 UTC ---

Could you attach coredump as an attachment?

It would be good also to provide log files with high debug_level
https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html#sssd-debug-logs

--- Additional comment from osallou on 2020-01-17 09:59:43 UTC ---

Here is coredumpctl output

coredumpctl dump /usr/libexec/sssd/sssd_be --output=/tmp/sssd_be.core 
           PID: 50664 (sssd_be)
           UID: 0 (root)
           GID: 0 (root)
        Signal: 11 (SEGV)
     Timestamp: Fri 2020-01-17 10:53:04 CET (48s ago)
  Command Line: /usr/libexec/sssd/sssd_be --domain XXX.XXX --uid 0 --gid 0 --logger=files
    Executable: /usr/libexec/sssd/sssd_be
 Control Group: /system.slice/sssd.service
          Unit: sssd.service
         Slice: system.slice
       Boot ID: 81462c3f4e274edf897e2c49530319de
    Machine ID: 170ce127062f4dd1870833a9667a4889
      Hostname: maelle.irisa.fr
       Storage: /var/lib/systemd/coredump/core.sssd_be.0.81462c3f4e274edf897e2c49530319de.50664.1579254784000000000000.lz4 (inaccessible)
       Message: Process 50664 (sssd_be) of user 0 dumped core.
                
                Stack trace of thread 50664:
                #0  0x00007f25fd0bfd76 sysdb_user_base_dn (libsss_util.so)
                #1  0x000055f98c683d4b be_refresh_step (sssd_be)
                #2  0x000055f98c6840b2 be_refresh_send (sssd_be)
                #3  0x000055f98c683531 be_ptask_execute (sssd_be)
                #4  0x00007f25fcfd5f3d tevent_common_invoke_timer_handler (libtevent.so.0)
                #5  0x00007f25fcfd60e0 tevent_common_loop_timer_delay (libtevent.so.0)
                #6  0x00007f25fcfd74a9 epoll_event_loop_once (libtevent.so.0)
                #7  0x00007f25fcfd553b std_event_loop_once (libtevent.so.0)
                #8  0x00007f25fcfd05d8 _tevent_loop_once (libtevent.so.0)
                #9  0x00007f25fcfd087b tevent_common_loop_wait (libtevent.so.0)
                #10 0x00007f25fcfd54cb std_event_loop_wait (libtevent.so.0)
                #11 0x00007f25fd0efe17 server_loop (libsss_util.so)
                #12 0x000055f98c67ac42 main (sssd_be)
                #13 0x00007f25fce131a3 __libc_start_main (libc.so.6)
                #14 0x000055f98c67adfe _start (sssd_be)

Attaching core dump file

--- Additional comment from osallou on 2020-01-17 10:04:24 UTC ---

I failed to upload core, you can download it here: https://genostack-api-swift.genouest.org/v1/AUTH_db3183b479c9476b8d3c4948d27f247e/osallou_testelixir/sssd_be/core.sssd_be.0.81462c3f4e274edf897e2c49530319de.50664.1579254784000000000000.lz4

--- Additional comment from Lukas Slebodnik on 2020-01-17 11:44:17 UTC ---

(In reply to osallou from comment #3)
> I failed to upload core, you can download it here:
> https://genostack-api-swift.genouest.org/v1/
> AUTH_db3183b479c9476b8d3c4948d27f247e/osallou_testelixir/sssd_be/core.
> sssd_be.0.81462c3f4e274edf897e2c49530319de.50664.1579254784000000000000.lz4

It is dereference of NULL pointer
(gdb) l 141
136     }
137
138     struct ldb_dn *sysdb_user_base_dn(TALLOC_CTX *mem_ctx,
139                                       struct sss_domain_info *dom)
140     {
141         return ldb_dn_new_fmt(mem_ctx, dom->sysdb->ldb,
142                               SYSDB_TMPL_USER_BASE, dom->name);
143     }
144
145     struct ldb_dn *sysdb_group_dn(TALLOC_CTX *mem_ctx,
(gdb) p dom->sysdb
$13 = (struct sysdb_ctx *) 0x0

(gdb) p dom[0]
$15 = {type = DOM_TYPE_POSIX, name = 0x55f98d4c1bd0 "files", conn_name = 0x55f98d4c1bd0 "files", provider = 0x55f98d4adce0 "files", timeout = 0, enumerate = false, 
  sd_enumerate = 0x55f98d4ad2b0, fqnames = false, mpg_mode = MPG_DISABLED, ignore_group_members = false, id_min = 1, id_max = 0, pwfield = 0x7f25fd1023d3 "x", cache_credentials = false, 
  cache_credentials_min_ff_length = 8, case_sensitive = true, case_preserve = true, override_gid = 0, override_homedir = 0x0, fallback_homedir = 0x0, 
  subdomain_homedir = 0x55f98d4adbf0 "/home/%d/%u", homedir_substr = 0x0, override_shell = 0x0, default_shell = 0x0, user_timeout = 5400, group_timeout = 5400, netgroup_timeout = 5400, 
  service_timeout = 5400, autofsmap_timeout = 5400, sudo_timeout = 5400, ssh_host_timeout = 5400, refresh_expired_interval = 0, subdomain_refresh_interval = 14400, 
  cached_auth_timeout = 0, pwd_expiration_warning = -1, sysdb = 0x0, names = 0x0, parent = 0x0, subdomains = 0x0, realm = 0x0, flat_name = 0x0, domain_id = 0x0, trust_direction = 0, 
  subdomains_last_checked = {tv_sec = 0, tv_usec = 0}, has_views = false, view_name = 0x0, prev = 0x55f98d4c1f20, next = 0x0, state = DOM_ACTIVE, sd_inherit = 0x0, forest = 0x0, 
  forest_root = 0x0, upn_suffixes = 0x0, certmaps = 0x0, user_name_hint = false, output_fqnames = false}

But the issue is that it tries "refresh" data in "files" domain even thought the process crashed in "XXX.XXX" domain.


It would be good to add "debug_level = 9 " into "domain/XXX.XX" section. Reproduce issue and provide log files.

I assume that commenting out "refresh_expired_interval" in domain section might be a workaround for crash.
Could you confirm that?

BTW may we know why there is explicit files domain? "domain/files"?
Because implicit files domain is used by default on fedora (as the 1st domain) in case of missing explicit files domain.
BTW

--- Additional comment from osallou on 2020-01-17 12:31:37 UTC ---

with debug log level 9

--- Additional comment from osallou on 2020-01-17 12:44:10 UTC ---

Attached sssd_domain log file with debug log level 9
there is an error for sure in this file, but logs are really versbose....

regarding configuration, I do not know, this was configured this way.

I can see that cache files are "updated" /var/lib/sss/db (their timestamp), and even tried a cache clear, just in case, but same issue.

You mean commenting "refresh_expired_interval"? (because it is set for the moment).
Commenting this paremeter and restarting sssd seems to work for the moment. However, this value being 4000 (quite large) I would not expect to see a change as refresh will not be done so often.

--- Additional comment from Lukas Slebodnik on 2020-01-17 12:57:17 UTC ---

(In reply to osallou from comment #6)
> You mean commenting "refresh_expired_interval"? (because it is set for the
> moment).
> Commenting this paremeter and restarting sssd seems to work for the moment.
> However, this value being 4000 (quite large) I would not expect to see a
> change as refresh will not be done so often.

Commenting out the line "refresh_expired_interval" should disable the feature which trigger the crash.
I would say it is caused by a change introduced in sssd-2.2.1 [1,2].

Another possible workaround might be to change order of domains in "[sssd]" section

[sssd]
domains = files, XXX.XXX


[1] https://pagure.io/SSSD/sssd/c/1a08b53defa7f921a9b0f9e839ca90f91b5f86d2?branch=master
[2] https://pagure.io/SSSD/sssd/issue/4012

--- Additional comment from osallou on 2020-01-17 15:30:32 UTC ---

I confirm commenting refresh_expired_interval *fixed* the issue (well, as a workaround...)
At least, I did not face the issue again since....

--- Additional comment from Lukas Slebodnik on 2020-01-18 22:51:42 UTC ---

This scratch build should solve crash without any workaround.
https://koji.fedoraproject.org/koji/taskinfo?taskID=40712566

--- Additional comment from osallou on 2020-01-20 07:47:42 UTC ---

any way to use yum.repo.d to get them ?
Or should I download them all for manual install? (quite a lot package...)

--- Additional comment from Lukas Slebodnik on 2020-01-20 11:20:34 UTC ---

(In reply to osallou from comment #10)
> any way to use yum.repo.d to get them ?
> Or should I download them all for manual install? (quite a lot package...)

Here you are https://copr.fedorainfracloud.org/coprs/lslebodn/test_BZ1792184/

--- Additional comment from osallou on 2020-01-20 14:53:48 UTC ---

unfortunatly I cannot test packages, installation fails with conflicts with other packages.

Among other issues there is:

- cannot install both libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 and libsss_nss_idmap-2.2.2-3.fc31.x86_64

and uninstalling sssd will remove other packages...

it tries to install it as a "side" package instead of upgrading it.

--- Additional comment from Lukas Slebodnik on 2020-01-20 15:30:23 UTC ---

(In reply to osallou from comment #12)
> unfortunatly I cannot test packages, installation fails with conflicts with
> other packages.
> 
> Among other issues there is:
> 
> - cannot install both libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 and
> libsss_nss_idmap-2.2.2-3.fc31.x86_64
> 
> and uninstalling sssd will remove other packages...
> 
> it tries to install it as a "side" package instead of upgrading it.

There are more ways how to enable copr repos but I did not have any issues with updatrade

sh-5.0# rpm -q sssd libsss_nss_idmap                                                                                                                                                       
sssd-2.2.2-3.fc31.x86_64                                                                                                                                                                   
libsss_nss_idmap-2.2.2-3.fc31.x86_64                                                                                                                                                       
sh-5.0# curl -o /etc/yum.repos.d/copr.repo https://copr.fedorainfracloud.org/coprs/lslebodn/test_BZ1792184                                                                                 /repo/fedora-31/lslebodn-test_BZ1792184-fedora-31.repo                                                                                                                                     
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                                                                                            
                                 Dload  Upload   Total   Spent    Left  Speed                                                                                                              
100   403  100   403    0     0   1665      0 --:--:-- --:--:-- --:--:--  1665                                                                                                             
sh-5.0# dnf update -y  \*sss\*                                                                                                                                                             
Copr repo for test_BZ1792184 owned by lslebodn                            6.5 kB/s | 3.3 kB     00:00                                                                                      
Dependencies resolved.                                                                                                                                                                     
==========================================================================================================                                                                                 
 Package      Arch   Version                 Repository                                              Size                                                                                  
==========================================================================================================                                                                                 
Upgrading:                                                                                                                                                                                 
 libipa_hbac  x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184  41 k                                                                                  
 libsss_autofs                                                                                                                                                                             
              x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184  43 k                                                                                  
 libsss_certmap                                                                                                                                                                            
              x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184  70 k                                                                                  
 libsss_idmap x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184  45 k                                                                                  
 libsss_nss_idmap                                                                                                                                                                          
              x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184  53 k                                                                                  
 libsss_sudo  x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184  41 k                                                                                  
 sssd         x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184  31 k                                                                                  
 sssd-ad      x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 175 k                                                                                  
 sssd-client  x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 104 k                                                                                  
 sssd-common  x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 1.4 M                                                                                  
 sssd-common-pac                                                                                                                                                                           
              x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 104 k                                                                                  
 sssd-ipa     x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 269 k                                                                                  
 sssd-kcm     x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 158 k                                                                                  
 sssd-krb5    x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184  68 k                                                                                  
 sssd-krb5-common                                                                                                                                                                          
              x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 115 k                                                                                  
 sssd-ldap    x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184 147 k                                                                                  
 sssd-nfs-idmap                                                                                                                                                                            
              x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184  39 k                                                                                  
 sssd-proxy   x86_64 2.2.2-3.1bz1792184.fc31 copr:copr.fedorainfracloud.org:lslebodn:test_BZ1792184  69 k   
                                                                                                                                                                                           
Transaction Summary                                                                                                                                                                        
==========================================================================================================                                                                                 
Upgrade  18 Packages                                                                                                                                                                       
                                                                                                                                                                                           
Total download size: 3.0 M                                                                                                                                                                 
Downloading Packages:                                                                                                                                                                      
(1/18): libsss_autofs-2.2.2-3.1bz1792184.fc31.x86_64.rpm                  119 kB/s |  43 kB     00:00                                                                                      
(2/18): libipa_hbac-2.2.2-3.1bz1792184.fc31.x86_64.rpm                     97 kB/s |  41 kB     00:00                                                                                      
(3/18): libsss_certmap-2.2.2-3.1bz1792184.fc31.x86_64.rpm                 160 kB/s |  70 kB     00:00                                                                                      
(4/18): libsss_idmap-2.2.2-3.1bz1792184.fc31.x86_64.rpm                   532 kB/s |  45 kB     00:00                                                                                      
(5/18): libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64.rpm               314 kB/s |  53 kB     00:00                                                                                      
(6/18): libsss_sudo-2.2.2-3.1bz1792184.fc31.x86_64.rpm                    180 kB/s |  41 kB     00:00                                                                                      
(7/18): sssd-2.2.2-3.1bz1792184.fc31.x86_64.rpm                            87 kB/s |  31 kB     00:00                                                                                      
(8/18): sssd-client-2.2.2-3.1bz1792184.fc31.x86_64.rpm                    316 kB/s | 104 kB     00:00                                                                                      
(9/18): sssd-ad-2.2.2-3.1bz1792184.fc31.x86_64.rpm                        245 kB/s | 175 kB     00:00                                                                                      
(10/18): sssd-common-pac-2.2.2-3.1bz1792184.fc31.x86_64.rpm               253 kB/s | 104 kB     00:00                                                                                      
(11/18): sssd-kcm-2.2.2-3.1bz1792184.fc31.x86_64.rpm                      813 kB/s | 158 kB     00:00                                                                                      
(12/18): sssd-ipa-2.2.2-3.1bz1792184.fc31.x86_64.rpm                      867 kB/s | 269 kB     00:00                                                                                      
(13/18): sssd-krb5-2.2.2-3.1bz1792184.fc31.x86_64.rpm                     757 kB/s |  68 kB     00:00                                                                                      
(14/18): sssd-krb5-common-2.2.2-3.1bz1792184.fc31.x86_64.rpm              980 kB/s | 115 kB     00:00                                                                                      
(15/18): sssd-ldap-2.2.2-3.1bz1792184.fc31.x86_64.rpm                     1.7 MB/s | 147 kB     00:00                                                                                      
(16/18): sssd-common-2.2.2-3.1bz1792184.fc31.x86_64.rpm                   1.4 MB/s | 1.4 MB     00:01                                                                                      
(17/18): sssd-nfs-idmap-2.2.2-3.1bz1792184.fc31.x86_64.rpm                289 kB/s |  39 kB     00:00                                                                                      
(18/18): sssd-proxy-2.2.2-3.1bz1792184.fc31.x86_64.rpm                    589 kB/s |  69 kB     00:00                                                                                      
----------------------------------------------------------------------------------------------------------                                                                                 
Total                                                                     1.6 MB/s | 3.0 MB     00:01                                                                                      
Running transaction check                                                                                                                                                                  
Transaction check succeeded.                                                                                                                                                               
Running transaction test                                                                                                                                                                   
Transaction test succeeded.                                                                                                                                                                
Running transaction                                                                                                                                                                        
  Preparing        :                                                                                  1/1                                                                                  
  Running scriptlet: libsss_certmap-2.2.2-3.1bz1792184.fc31.x86_64                                    1/1                                                                                  
  Upgrading        : libsss_certmap-2.2.2-3.1bz1792184.fc31.x86_64                                   1/36                                                                                  
  Upgrading        : libsss_idmap-2.2.2-3.1bz1792184.fc31.x86_64                                     2/36                                                                                  
  Upgrading        : sssd-nfs-idmap-2.2.2-3.1bz1792184.fc31.x86_64                                   3/36                                                                                  
  Upgrading        : libsss_sudo-2.2.2-3.1bz1792184.fc31.x86_64                                      4/36                                                                                  
  Upgrading        : libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64                                 5/36                                                                                  
  Upgrading        : sssd-client-2.2.2-3.1bz1792184.fc31.x86_64                                      6/36                                                                                  
  Running scriptlet: sssd-client-2.2.2-3.1bz1792184.fc31.x86_64                                      6/36                                                                                  
  Upgrading        : libsss_autofs-2.2.2-3.1bz1792184.fc31.x86_64                                    7/36                                                                                  
  Upgrading        : sssd-common-2.2.2-3.1bz1792184.fc31.x86_64                                      8/36                                                                                  
  Running scriptlet: sssd-common-2.2.2-3.1bz1792184.fc31.x86_64                                      8/36                                                                                  
  Upgrading        : sssd-krb5-common-2.2.2-3.1bz1792184.fc31.x86_64                                 9/36                                                                                  
  Upgrading        : sssd-common-pac-2.2.2-3.1bz1792184.fc31.x86_64                                 10/36                                                                                  
  Upgrading        : sssd-ad-2.2.2-3.1bz1792184.fc31.x86_64                                         11/36                                                                                  
  Upgrading        : sssd-krb5-2.2.2-3.1bz1792184.fc31.x86_64                                       12/36                                                                                  
  Upgrading        : sssd-ldap-2.2.2-3.1bz1792184.fc31.x86_64                                       13/36                                                                                  
  Upgrading        : sssd-proxy-2.2.2-3.1bz1792184.fc31.x86_64                                      14/36   
  Upgrading        : libipa_hbac-2.2.2-3.1bz1792184.fc31.x86_64                                     15/36                                                                                  
  Upgrading        : sssd-ipa-2.2.2-3.1bz1792184.fc31.x86_64                                        16/36                                                                                  
  Upgrading        : sssd-2.2.2-3.1bz1792184.fc31.x86_64                                            17/36                                                                                  
  Upgrading        : sssd-kcm-2.2.2-3.1bz1792184.fc31.x86_64                                        18/36                                                                                  
  Running scriptlet: sssd-kcm-2.2.2-3.1bz1792184.fc31.x86_64                                        18/36                                                                                  
  Cleanup          : sssd-2.2.2-3.fc31.x86_64                                                       19/36                                                                                  
  Cleanup          : sssd-ipa-2.2.2-3.fc31.x86_64                                                   20/36                                                                                  
  Cleanup          : sssd-ad-2.2.2-3.fc31.x86_64                                                    21/36                                                                                  
  Cleanup          : sssd-ldap-2.2.2-3.fc31.x86_64                                                  22/36                                                                                  
  Cleanup          : sssd-krb5-2.2.2-3.fc31.x86_64                                                  23/36                                                                                  
  Cleanup          : sssd-proxy-2.2.2-3.fc31.x86_64                                                 24/36                                                                                  
  Running scriptlet: sssd-kcm-2.2.2-3.fc31.x86_64                                                   25/36                                                                                  
  Cleanup          : sssd-kcm-2.2.2-3.fc31.x86_64                                                   25/36                                                                                  
  Running scriptlet: sssd-kcm-2.2.2-3.fc31.x86_64                                                   25/36                                                                                  
  Cleanup          : sssd-common-pac-2.2.2-3.fc31.x86_64                                            26/36                                                                                  
  Cleanup          : sssd-krb5-common-2.2.2-3.fc31.x86_64                                           27/36                                                                                  
  Running scriptlet: sssd-common-2.2.2-3.fc31.x86_64                                                28/36                                                                                  
  Cleanup          : sssd-common-2.2.2-3.fc31.x86_64                                                28/36                                                                                  
  Running scriptlet: sssd-common-2.2.2-3.fc31.x86_64                                                28/36                                                                                  
  Running scriptlet: sssd-client-2.2.2-3.fc31.x86_64                                                29/36                                                                                  
  Cleanup          : sssd-client-2.2.2-3.fc31.x86_64                                                29/36   
  Cleanup          : libsss_idmap-2.2.2-3.fc31.x86_64                                               30/36                                                                                  
  Cleanup          : libsss_nss_idmap-2.2.2-3.fc31.x86_64                                           31/36                                                                                  
  Cleanup          : libsss_certmap-2.2.2-3.fc31.x86_64                                             32/36                                                                                  
  Cleanup          : libsss_autofs-2.2.2-3.fc31.x86_64                                              33/36                                                                                  
  Cleanup          : libsss_sudo-2.2.2-3.fc31.x86_64                                                34/36                                                                                  
  Cleanup          : sssd-nfs-idmap-2.2.2-3.fc31.x86_64                                             35/36                                                                                  
  Cleanup          : libipa_hbac-2.2.2-3.fc31.x86_64                                                36/36                                                                                  
  Running scriptlet: sssd-common-2.2.2-3.1bz1792184.fc31.x86_64                                     36/36                                                                                  
  Running scriptlet: libipa_hbac-2.2.2-3.fc31.x86_64                                                36/36                                                                                  
  Verifying        : libipa_hbac-2.2.2-3.1bz1792184.fc31.x86_64                                      1/36                                                                                  
  Verifying        : libipa_hbac-2.2.2-3.fc31.x86_64                                                 2/36 
  Verifying        : libsss_autofs-2.2.2-3.1bz1792184.fc31.x86_64                                    3/36 
  Verifying        : libsss_autofs-2.2.2-3.fc31.x86_64                                               4/36 
  Verifying        : libsss_certmap-2.2.2-3.1bz1792184.fc31.x86_64                                   5/36 
  Verifying        : libsss_certmap-2.2.2-3.fc31.x86_64                                              6/36 
  Verifying        : libsss_idmap-2.2.2-3.1bz1792184.fc31.x86_64                                     7/36 
  Verifying        : libsss_idmap-2.2.2-3.fc31.x86_64                                                8/36 
  Verifying        : libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64                                 9/36 
  Verifying        : libsss_nss_idmap-2.2.2-3.fc31.x86_64                                           10/36 
  Verifying        : libsss_sudo-2.2.2-3.1bz1792184.fc31.x86_64                                     11/36 
  Verifying        : libsss_sudo-2.2.2-3.fc31.x86_64                                                12/36 
  Verifying        : sssd-2.2.2-3.1bz1792184.fc31.x86_64                                            13/36 
  Verifying        : sssd-2.2.2-3.fc31.x86_64                                                       14/36 
  Verifying        : sssd-ad-2.2.2-3.1bz1792184.fc31.x86_64                                         15/36 
  Verifying        : sssd-ad-2.2.2-3.fc31.x86_64                                                    16/36 
  Verifying        : sssd-client-2.2.2-3.1bz1792184.fc31.x86_64                                     17/36 
  Verifying        : sssd-client-2.2.2-3.fc31.x86_64                                                18/36 
  Verifying        : sssd-common-2.2.2-3.1bz1792184.fc31.x86_64                                     19/36 
  Verifying        : sssd-common-2.2.2-3.fc31.x86_64                                                20/36 
  Verifying        : sssd-common-pac-2.2.2-3.1bz1792184.fc31.x86_64                                 21/36 
  Verifying        : sssd-common-pac-2.2.2-3.fc31.x86_64                                            22/36 
  Verifying        : sssd-ipa-2.2.2-3.1bz1792184.fc31.x86_64                                        23/36 
  Verifying        : sssd-ipa-2.2.2-3.fc31.x86_64                                                   24/36 
  Verifying        : sssd-kcm-2.2.2-3.1bz1792184.fc31.x86_64                                        25/36 
  Verifying        : sssd-kcm-2.2.2-3.fc31.x86_64                                                   26/36 
  Verifying        : sssd-krb5-2.2.2-3.1bz1792184.fc31.x86_64                                       27/36 
  Verifying        : sssd-krb5-2.2.2-3.fc31.x86_64                                                  28/36 
  Verifying        : sssd-krb5-common-2.2.2-3.1bz1792184.fc31.x86_64                                29/36 
  Verifying        : sssd-krb5-common-2.2.2-3.fc31.x86_64                                           30/36 
  Verifying        : sssd-ldap-2.2.2-3.1bz1792184.fc31.x86_64                                       31/36 
  Verifying        : sssd-ldap-2.2.2-3.fc31.x86_64                                                  32/36 
  Verifying        : sssd-nfs-idmap-2.2.2-3.1bz1792184.fc31.x86_64                                  33/36 
  Verifying        : sssd-nfs-idmap-2.2.2-3.fc31.x86_64                                             34/36 
  Verifying        : sssd-proxy-2.2.2-3.1bz1792184.fc31.x86_64                                      35/36 
  Verifying        : sssd-proxy-2.2.2-3.fc31.x86_64                                                 36/36 

Upgraded:
  libipa_hbac-2.2.2-3.1bz1792184.fc31.x86_64            libsss_autofs-2.2.2-3.1bz1792184.fc31.x86_64      
  libsss_certmap-2.2.2-3.1bz1792184.fc31.x86_64         libsss_idmap-2.2.2-3.1bz1792184.fc31.x86_64       
  libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64       libsss_sudo-2.2.2-3.1bz1792184.fc31.x86_64        
  sssd-2.2.2-3.1bz1792184.fc31.x86_64                   sssd-ad-2.2.2-3.1bz1792184.fc31.x86_64            
  sssd-client-2.2.2-3.1bz1792184.fc31.x86_64            sssd-common-2.2.2-3.1bz1792184.fc31.x86_64        
  sssd-common-pac-2.2.2-3.1bz1792184.fc31.x86_64        sssd-ipa-2.2.2-3.1bz1792184.fc31.x86_64           
  sssd-kcm-2.2.2-3.1bz1792184.fc31.x86_64               sssd-krb5-2.2.2-3.1bz1792184.fc31.x86_64          
  sssd-krb5-common-2.2.2-3.1bz1792184.fc31.x86_64       sssd-ldap-2.2.2-3.1bz1792184.fc31.x86_64          
  sssd-nfs-idmap-2.2.2-3.1bz1792184.fc31.x86_64         sssd-proxy-2.2.2-3.1bz1792184.fc31.x86_64         

Complete!

sh-5.0# rpm -q sssd libsss_nss_idmap
sssd-2.2.2-3.1bz1792184.fc31.x86_64
libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64

--- Additional comment from osallou on 2020-01-20 16:33:36 UTC ---

nope sorry, can't on my side:

dnf update -y  \*sss\*
Last metadata expiration check: 1:15:13 ago on Mon 20 Jan 2020 03:47:36 PM CET.
Dependencies resolved.

 Problem 1: libsss_idmap-2.2.2-3.fc31.i686 has inferior architecture
  - cannot install both libsss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 and libsss_idmap-2.2.2-3.fc31.x86_64
  - cannot install the best update candidate for package libsss_idmap-2.2.2-3.fc31.i686
  - cannot install the best update candidate for package libsss_idmap-2.2.2-3.fc31.x86_64
 Problem 2: libsss_nss_idmap-2.2.2-3.fc31.i686 has inferior architecture
  - cannot install both libsss_nss_idmap-2.2.2-3.1bz1792184.fc31.x86_64 and libsss_nss_idmap-2.2.2-3.fc31.x86_64
  - cannot install the best update candidate for package libsss_nss_idmap-2.2.2-3.fc31.i686
  - cannot install the best update candidate for package libsss_nss_idmap-2.2.2-3.fc31.x86_64
 Problem 3: sssd-client-2.2.2-3.fc31.i686 has inferior architecture
  - cannot install both sssd-client-2.2.2-3.1bz1792184.fc31.x86_64 and sssd-client-2.2.2-3.fc31.x86_64
  - cannot install the best update candidate for package sssd-client-2.2.2-3.fc31.i686
  - cannot install the best update candidate for package sssd-client-2.2.2-3.fc31.x86_64

removing sssd would remove other extra packages and I'd like to avoid breaking things... as it occurs on my professional laptop.

I tried to reproduce in a docker container with base packages to test later upgrade but I cannot reproduce in a different env at the moment. As I am not in my ldap domain but at home, maybe this is the cause. Will try again later on.

Anyway, workaround is fine for me at this time.

--- Additional comment from Lukas Slebodnik on 2020-01-20 20:58:30 UTC ---

It looks like you also have some 32-bit  packages installed (sssd-client + deps)
I am not sure whether you still need them.
If you need them you will probably need to manually update them because
looks like automatic update does not work well
even though packages are there  also for i686
https://copr-be.cloud.fedoraproject.org/results/lslebodn/test_BZ1792184/fedora-31-i386/01169457-sssd/

--- Additional comment from Lukas Slebodnik on 2020-01-20 21:28:28 UTC ---

(In reply to Lukas Slebodnik from comment #15)
> It looks like you also have some 32-bit  packages installed (sssd-client +
> deps)
> I am not sure whether you still need them.
> If you need them you will probably need to manually update them because
> looks like automatic update does not work well
> even though packages are there  also for i686
> https://copr-be.cloud.fedoraproject.org/results/lslebodn/test_BZ1792184/
> fedora-31-i386/01169457-sssd/
            ^^^^
  maybe issue with i686 vs i386

--- Additional comment from osallou on 2020-01-21 07:50:20 UTC ---

after removal of i686 packages I could install from your repo.
Don't know why I got i686 packages, anyway....

After setting configuration back to original setup and restarting sssd service, things looks fine.

Will continue testing however, as PAM error did not appear all the time.

--- Additional comment from Sumit Bose on 2020-01-22 08:05:48 UTC ---

Upstream ticket:
https://pagure.io/SSSD/sssd/issue/4142

--- Additional comment from Lukas Slebodnik on 2020-01-22 11:57:15 UTC ---

master:
https://pagure.io/SSSD/sssd/c/007d5b79b7aef67dd843ed9a3b65095faaeb580f

Comment 1 Sumit Bose 2020-01-22 14:08:15 UTC
Hi,

I would suggest to include commit 007d5b79b7aef67dd843ed9a3b65095faaeb580f to RHEL-8.2 because it fixes an issue in the background refresh if multiple domains are configured in sssd.conf. Since on RHEL-8.2 the files provider is activated by default this might happen quite often.

Steeve, if you agree, please give qa_ack+.

bye,
Sumit

Comment 3 Niranjan Mallapadi Raghavender 2020-02-26 07:54:45 UTC
Version:

Reproducing the issue:

sssd-ldap-2.2.2-1.el8.x86_64
sssd-2.2.2-1.el8.x86_64
sssd-dbus-2.2.2-1.el8.x86_64
sssd-tools-2.2.2-1.el8.x86_64
sssd-client-2.2.2-1.el8.x86_64
sssd-common-2.2.2-1.el8.x86_64
sssd-ad-2.2.2-1.el8.x86_64
sssd-proxy-2.2.2-1.el8.x86_64
sssd-winbind-idmap-2.2.2-1.el8.x86_64
sssd-krb5-common-2.2.2-1.el8.x86_64
sssd-krb5-2.2.2-1.el8.x86_64
sssd-kcm-2.2.2-1.el8.x86_64


1. Join the system to Windows AD using realm 

3. Enable files provider and add refresh_expired_interval parameter as given below:
[sssd]
domains = SARABHAI.TEST, files
config_file_version = 2
services = nss, pam

[domain/files]
id_provider = files

[domain/SARABHAI.TEST]
ad_domain = SARABHAI.TEST
krb5_realm = SARABHAI.TEST
realmd_tags = manages-system joined-with-adcli 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
entry_cache_timeout = 5400
refresh_expired_interval = 4000

4. Restart sssd 

5. sssd crashes:
Feb 26 12:09:12 vm-10-0-154-49.hosted.upshift.rdu2.redhat.com systemd-coredump[10352]: Process 10329 (sssd_be) of user 0 dumped core.

                                                                                       Stack trace of thread 10329:
                                                                                       #0  0x00007ff432c38206 sysdb_user_base_dn (libsss_util.so)
                                                                                       #1  0x00005592fd1543b3 be_refresh_step (sssd_be)
                                                                                       #2  0x00005592fd1547a3 be_refresh_send (sssd_be)
                                                                                       #3  0x00005592fd153bff be_ptask_execute (sssd_be)
                                                                                       #4  0x00007ff42fcd7279 tevent_common_invoke_timer_handler (libtevent.so.0)
                                                                                       #5  0x00007ff42fcd741e tevent_common_loop_timer_delay (libtevent.so.0)
                                                                                       #6  0x00007ff42fcd8959 epoll_event_loop (libtevent.so.0)
                                                                                       #7  0x00007ff42fcd685b std_event_loop_once (libtevent.so.0)
                                                                                       #8  0x00007ff42fcd1a55 _tevent_loop_once (libtevent.so.0)
                                                                                       #9  0x00007ff42fcd1cfb tevent_common_loop_wait (libtevent.so.0)
                                                                                       #10 0x00007ff42fcd67eb std_event_loop_wait (libtevent.so.0)
                                                                                       #11 0x00007ff432c67dc7 server_loop (libsss_util.so)
                                                                                       #12 0x00005592fd14b36b main (sssd_be)
                                                                                       #13 0x00007ff42f1a9873 __libc_start_main (libc.so.6)
                                                                                       #14 0x00005592fd14b52e _start (sssd_be)
-- Subject: Process 10329 (sssd_be) dumped core


6. Update sssd to sssd-2.2.3-17.el8.x86_64 

Restart sssd and no crashes seen.

Comment 5 errata-xmlrpc 2020-04-28 16:56:29 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:1863


Note You need to log in before you can comment on or make changes to this bug.