Bug 690866 – Groups with a zero-length memberuid attribute can cause SSSD to stop caching and responding to requests

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 690866 - Groups with a zero-length memberuid attribute can cause SSSD to stop caching and responding to requests

Summary:	Groups with a zero-length memberuid attribute can cause SSSD to stop caching ...

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	sssd (Show other bugs)
Sub Component:
Version:	6.1
Hardware:	All Linux

Priority	urgent Severity urgent
Target Milestone:	rc
Target Release:	---
Assigned To:	Stephen Gallagher
QA Contact:	Chandrasekar Kannan
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:	642407 579778 690867
	Show dependency tree / graph

Reported:	2011-03-25 12:09 EDT by Stephen Gallagher
Modified:	2015-01-04 18:47 EST (History)
CC List:	7 users (show)

See Also:
Fixed In Version:	sssd-1.5.1-21.el6
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Clones:	690867 (view as bug list)
Environment:
Last Closed:	2011-05-19 07:39:52 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2011:0560	normal	SHIPPED_LIVE	Low: sssd security, bug fix, and enhancement update	2011-05-19 07:38:17 EDT

Groups: None (edit)

Description Stephen Gallagher 2011-03-25 12:09:39 EDT

Description of problem:
We are not properly handling the case where a group might have a memberuid attribute with no name (zero-length string). This causes a failure in the code that does not properly clean up after itself, resulting in SSSD holding open a transaction to the ldb, making it unable to cache new lookups properly (as data is only saved when all nested transactions are marked complete).

Version-Release number of selected component (if applicable):
sssd-1.5.1-20.el6


How reproducible:
Every time

Steps to Reproduce:
1. Create an LDAP group in RFC2307 with a memberuid attribute of zero length
2. Purge the cache and restart SSSD
3. run 'getent group <groupname>'
4. run 'getent passwd <valid user>'
  
Actual results:
Neither command returns results

Expected results:
The group request should ignore the empty name and return successfully. The user request should return the user properly.


Additional info:

Comment 3 Gowrishankar Rajaiyan 2011-04-06 06:58:35 EDT

~]# getent group shanks1
shanks1:*:1921:

~]# getent passwd shanks1
shanks1:*:1921:1921:shanks1:/home/shanks1:/bin/bash


Verified.

# rpm -qi sssd | head
Name        : sssd                         Relocations: (not relocatable)
Version     : 1.5.1                             Vendor: Red Hat, Inc.
Release     : 24.el6                        Build Date: Sat 02 Apr 2011 01:24:54 AM IST
Install Date: Tue 05 Apr 2011 11:11:29 AM IST      Build Host: x86-012.build.bos.redhat.com
Group       : Applications/System           Source RPM: sssd-1.5.1-24.el6.src.rpm
Size        : 3462740                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://fedorahosted.org/sssd/
Summary     : System Security Services Daemon

Comment 4 errata-xmlrpc 2011-05-19 07:39:52 EDT

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0560.html

Comment 5 errata-xmlrpc 2011-05-19 09:10:12 EDT

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0560.html

Note You need to log in before you can comment on or make changes to this bug.