URL:
https://github.com/SSSD/sssd/pull/202
Title: #202: T3315 infopipe group users master
fidencio commented:
"""
**Issue**: UpdateMemberList fails in case there's no ghost attribute in the group
**Steps to reproduce**:
- In an IPA server, create a user:
```
[root@master x86_64]# ipa user-add tuser99 --first="Test"
--last="User"
--------------------
Added user "tuser99"
--------------------
User login: tuser99
First name: Test
Last name: User
Full name: Test User
Display name: Test User
Initials: TU
Home directory: /home/tuser99
GECOS: Test User
Login shell: /bin/bash
Principal name: tuser99(a)IPA.EXAMPLE
Principal alias: tuser99(a)IPA.EXAMPLE
Email address: tuser99(a)ipa.example
UID: 1927800008
GID: 1927800008
Password: False
Member of groups: ipausers
Kerberos keys available: False
```
- Create a new group:
```
[root@master x86_64]# ipa group-add tgroup99
----------------------
Added group "tgroup99"
----------------------
Group name: tgroup99
GID: 1927800009
```
- Add the newly created user to the newly created group:
```
[root@master x86_64]# ipa group-add-member --users=tuser99 tgroup99
Group name: tgroup99
GID: 1927800009
Member users: tuser99
-------------------------
Number of members added 1
```
- Checking the cache you'll notice that the newly created user and group are not
there:
```
[root@master x86_64]# ldbsearch -H /var/lib/sss/db/cache_ipa.example.ldb
asq: Unable to register control with rootdse!
# record 1
dn: cn=views,cn=sysdb
viewName: default
distinguishedName: cn=views,cn=sysdb
# record 2
dn: cn=ipa.example,cn=sysdb
cn: ipa.example
realmName: IPA.EXAMPLE
distinguishedName: cn=ipa.example,cn=sysdb
# record 3
dn: cn=ranges,cn=sysdb
cn: ranges
distinguishedName: cn=ranges,cn=sysdb
# record 4
dn: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb
cn: sudorules
sudoLastFullRefreshTime: 1501501934
distinguishedName: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb
# record 5
dn: cn=users,cn=ipa.example,cn=sysdb
cn: Users
distinguishedName: cn=users,cn=ipa.example,cn=sysdb
# record 6
dn: cn=sysdb
cn: sysdb
description: base object
version: 0.18
distinguishedName: cn=sysdb
# record 7
dn: cn=groups,cn=ipa.example,cn=sysdb
cn: Groups
distinguishedName: cn=groups,cn=ipa.example,cn=sysdb
# record 8
dn: cn=certmap,cn=sysdb
cn: certmap
userNameHint: FALSE
distinguishedName: cn=certmap,cn=sysdb
# returned 8 records
# 8 entries
# 0 referrals
```
- Call the FindByName method for the group:
```
[root@master x86_64]# dbus-send --print-reply --system
--dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Groups
org.freedesktop.sssd.infopipe.Groups.FindByName string:tgroup99
method return time=1501502395.330843 sender=:1.544 -> destination=:1.546 serial=5
reply_serial=2
object path
"/org/freedesktop/sssd/infopipe/Groups/ipa_2eexample/1927800009"
```
- Checking the cache you'll notice that the group is there and the user is shown there
in the ghost attribute:
```
[root@master x86_64]# ldbsearch -H /var/lib/sss/db/cache_ipa.example.ldb
asq: Unable to register control with rootdse!
# record 1
dn: name=tgroup99(a)ipa.example,cn=groups,cn=ipa.example,cn=sysdb
createTimestamp: 1501502395
gidNumber: 1927800009
name: tgroup99(a)ipa.example
objectClass: group
uniqueID: d51d90a0-75e6-11e7-b172-52540072ab99
isPosix: TRUE
originalDN: cn=tgroup99,cn=groups,cn=accounts,dc=ipa,dc=example
originalModifyTimestamp: 20170731115328Z
entryUSN: 5288
orig_member: uid=tuser99,cn=users,cn=accounts,dc=ipa,dc=example
ghost: tuser99(a)ipa.example
nameAlias: tgroup99(a)ipa.example
lastUpdate: 1501502395
dataExpireTimestamp: 1501507795
overrideDN: name=tgroup99(a)ipa.example,cn=groups,cn=ipa.example,cn=sysdb
distinguishedName: name=tgroup99(a)ipa.example,cn=groups,cn=ipa.example,cn=sysdb
# record 2
dn: cn=views,cn=sysdb
viewName: default
distinguishedName: cn=views,cn=sysdb
# record 3
dn: cn=ipa.example,cn=sysdb
cn: ipa.example
realmName: IPA.EXAMPLE
distinguishedName: cn=ipa.example,cn=sysdb
# record 4
dn: cn=ranges,cn=sysdb
cn: ranges
distinguishedName: cn=ranges,cn=sysdb
# record 5
dn: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb
cn: sudorules
sudoLastFullRefreshTime: 1501501934
distinguishedName: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb
# record 6
dn: cn=users,cn=ipa.example,cn=sysdb
cn: Users
distinguishedName: cn=users,cn=ipa.example,cn=sysdb
# record 7
dn: cn=sysdb
cn: sysdb
description: base object
version: 0.18
distinguishedName: cn=sysdb
# record 8
dn: cn=groups,cn=ipa.example,cn=sysdb
cn: Groups
distinguishedName: cn=groups,cn=ipa.example,cn=sysdb
# record 9
dn: cn=certmap,cn=sysdb
cn: certmap
userNameHint: FALSE
distinguishedName: cn=certmap,cn=sysdb
# returned 9 records
# 9 entries
# 0 referrals
```
- Call the UpdateMemberList method:
```
[root@master x86_64]# dbus-send --print-reply --system
--dest=org.freedesktop.sssd.infopipe
/org/freedesktop/sssd/infopipe/Groups/ipa_2eexample/1927800009
org.freedesktop.sssd.infopipe.Groups.Group.UpdateMemberList
method return time=1501502656.424735 sender=:1.544 -> destination=:1.547 serial=7
reply_serial=2
```
- Checking the cache you'll notice that the group has no more the ghost attribute and
that the user entry was added to the cache:
```
[root@master x86_64]# ldbsearch -H /var/lib/sss/db/cache_ipa.example.ldb
asq: Unable to register control with rootdse!
# record 1
dn: name=tgroup99(a)ipa.example,cn=groups,cn=ipa.example,cn=sysdb
createTimestamp: 1501502395
gidNumber: 1927800009
name: tgroup99(a)ipa.example
objectClass: group
uniqueID: d51d90a0-75e6-11e7-b172-52540072ab99
isPosix: TRUE
originalDN: cn=tgroup99,cn=groups,cn=accounts,dc=ipa,dc=example
originalModifyTimestamp: 20170731115328Z
entryUSN: 5288
orig_member: uid=tuser99,cn=users,cn=accounts,dc=ipa,dc=example
nameAlias: tgroup99(a)ipa.example
lastUpdate: 1501502395
dataExpireTimestamp: 1501507795
overrideDN: name=tgroup99(a)ipa.example,cn=groups,cn=ipa.example,cn=sysdb
member: name=tuser99(a)ipa.example,cn=users,cn=ipa.example,cn=sysdb
memberuid: tuser99(a)ipa.example
distinguishedName: name=tgroup99(a)ipa.example,cn=groups,cn=ipa.example,cn=sysdb
# record 2
dn: cn=views,cn=sysdb
viewName: default
distinguishedName: cn=views,cn=sysdb
# record 3
dn: name=tuser99(a)ipa.example,cn=users,cn=ipa.example,cn=sysdb
createTimestamp: 1501502656
fullName: Test User
gecos: Test User
gidNumber: 1927800008
homeDirectory: /home/tuser99
loginShell: /bin/bash
name: tuser99(a)ipa.example
objectClass: user
uidNumber: 1927800008
uniqueID: c874c08a-75e6-11e7-afeb-52540072ab99
originalDN: uid=tuser99,cn=users,cn=accounts,dc=ipa,dc=example
originalMemberOf: cn=ipausers,cn=groups,cn=accounts,dc=ipa,dc=example
originalMemberOf: cn=tgroup99,cn=groups,cn=accounts,dc=ipa,dc=example
originalModifyTimestamp: 20170731115328Z
entryUSN: 5289
userPrincipalName: tuser99(a)IPA.EXAMPLE
mail: tuser99(a)ipa.example
nameAlias: tuser99(a)ipa.example
isPosix: TRUE
lastUpdate: 1501502656
dataExpireTimestamp: 1501508056
memberof: name=tgroup99(a)ipa.example,cn=groups,cn=ipa.example,cn=sysdb
overrideDN: name=tuser99(a)ipa.example,cn=users,cn=ipa.example,cn=sysdb
distinguishedName: name=tuser99(a)ipa.example,cn=users,cn=ipa.example,cn=sysdb
# record 4
dn: cn=ipa.example,cn=sysdb
cn: ipa.example
realmName: IPA.EXAMPLE
distinguishedName: cn=ipa.example,cn=sysdb
# record 5
dn: cn=ranges,cn=sysdb
cn: ranges
distinguishedName: cn=ranges,cn=sysdb
# record 6
dn: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb
cn: sudorules
sudoLastFullRefreshTime: 1501501934
distinguishedName: cn=sudorules,cn=custom,cn=ipa.example,cn=sysdb
# record 7
dn: cn=users,cn=ipa.example,cn=sysdb
cn: Users
distinguishedName: cn=users,cn=ipa.example,cn=sysdb
# record 8
dn: cn=sysdb
cn: sysdb
description: base object
version: 0.18
distinguishedName: cn=sysdb
# record 9
dn: cn=groups,cn=ipa.example,cn=sysdb
cn: Groups
distinguishedName: cn=groups,cn=ipa.example,cn=sysdb
# record 10
dn: cn=certmap,cn=sysdb
cn: certmap
userNameHint: FALSE
distinguishedName: cn=certmap,cn=sysdb
# returned 10 records
# 10 entries
# 0 referrals
```
- Now, this is the point where you can see a bug in the UpdateMemberList method and
it'll happen by calling the method again, for the very same group (as, right now, this
group has no ghost attribute there):
```
[root@master x86_64]# dbus-send --print-reply --system
--dest=org.freedesktop.sssd.infopipe
/org/freedesktop/sssd/infopipe/Groups/ipa_2eexample/1927800009
org.freedesktop.sssd.infopipe.Groups.Group.UpdateMemberList
Error org.freedesktop.DBus.Error.Failed: Unable to resolve ghost members [12]: Cannot
allocate memory
```
The error basically happens because, in `resolv_ghosts_group_done()`, a SYSDB_GHOST
element is always expected, while it would be perfectly fine that the element is not
there.
That's what @celestian's patch is about and I've changed a little but the
commit message in order to make it cleaner.
@mzidek-rh: Please, let me know whether the description is clear enough and whether
you're able to reproduce the issue following the step-by-step I've provided.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/202#issuecomment-319049987