On Thu, Jul 12, 2012 at 11:12:50AM +0200, Jan Engelhardt wrote:
as part of my ongoing investigation on sssd-1.8.93's bugs, here is
another distilled item:
- when /var/lib/sss/db is missing, sssd does not start. That's ok,
though the syslog error message "Cannot load configuration database"
is *very* sparse. (It could, for example, say what file it failed to
open, and strerror(errno)).
SSSD warns about the inability to open configuration database in the
debug logs in more detail than syslog, the syslog pretty much just
tells the admin to go look into the debug logs:
[sssd] [confdb_init] (0x0010): Unable to open config database
[sssd] [load_configuration] (0x0010): The confdb initialization failed
[sssd] [main] (0x0020): Error loading configuration database: : Input/output error
This is the case with many other severe errors we log to syslog, because
quite often it would be impossible to report the whole error to syslog
without polluting it.
We might want to include errno and strerror(errno), though..
- when /var/lib/sss/mc is missing, sssd does start, and emits a
warning message into sssd_nss.log, but only at debug_level=9.
This needs to be "louder". (Perhaps terminate sssd, like in the /db
There's a SSSDBG_CRIT_FAILURE-level debug message, but it lacks a
newline, so it's quite easy to overlook it:
(Thu Jul 12 12:01:17 2012) [sssd[nss]] [nss_process_init] (0x0020): passwd mmap cache is
DISABLED(Thu Jul 12 12:01:17 2012) [sssd[nss]] [sss_mc_create_file] (0x0020): Failed to
open mmap file /var/lib/sss/mc/group: 2(No such file or directory)
I have pushed a trivial fix to this.
I think that the SSSD should start, but just disable the fast cache
feature. It claims to be doing that, but as you noticed, group lookups
no longer work correctly. passwd lookups seems to be working fine.
This is being tracked by:
- Can't sssd just create all the directories it needs in /var/lib/sss
I haven't tested this, but I'm not sure if SELinux would allow the
mkdir. This seems like quite a corner case, why would the directories be
- if /var/lib/sss/mc is missing, the inability to read /mc/group
goes in silence. (Well, that's perhaps a "bug" of id(1)
and getent(1).) It requires that one checks the return code
and errno to see that getgrid returns EBADMSG.
I think this would be solved by fixing #1415.