https://bugzilla.redhat.com/show_bug.cgi?id=2373979
Bug ID: 2373979
Summary: python3-sssdconfig packs outdated .pyc files
Product: Fedora
Version: rawhide
Status: NEW
Component: sssd
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: adelton(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Reoccurence of bug #2319608:
The /usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/*.cpython-314.pyc
/usr/lib/files get regenerated when SSSDConfig module is used.
Reproducible: Always
Steps to Reproduce:
1. dnf install -y python3-sssdconfig
2. stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
3. python3 -c 'import SSSDConfig'
4. stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
Actual Results:
bash-5.2# stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
File:
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
Size: 59904 Blocks: 120 IO Block: 4096 regular file
Device: 0,142 Inode: 1085021 Links: 2
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2025-06-06 00:00:00.000000000 +0000
Modify: 2025-06-06 00:00:00.000000000 +0000
Change: 2025-06-20 05:52:59.146656555 +0000
Birth: 2025-06-20 05:52:59.146512950 +0000
bash-5.2# python3 -c 'import SSSDConfig'
bash-5.2# stat
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
File:
/usr/lib/python3.14/site-packages/SSSDConfig/__pycache__/__init__.cpython-314.pyc
Size: 61398 Blocks: 120 IO Block: 4096 regular file
Device: 0,142 Inode: 1081628 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2025-06-20 05:53:34.790753836 +0000
Modify: 2025-06-20 05:53:34.792024966 +0000
Change: 2025-06-20 05:53:34.792024966 +0000
Birth: 2025-06-20 05:53:34.790753836 +0000
Expected Results:
The Size and Modify time in the second stat run should match the output from
the first one.
First found by
https://github.com/freeipa/freeipa-container/actions/runs/15771389975.
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2373979
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2375213
Bug ID: 2375213
Summary: Transition of log file ownership to sssd user/group
does not fix logrotated files, which breaks logrotate
Product: Fedora
Version: 42
OS: Linux
Status: NEW
Component: sssd
Severity: medium
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: jbilling(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
When the sssd-common package introduced a change to the permissions of the log
files in /var/log/sssd/, this was added to the RPM %postinstall scriptlet:
/usr/bin/chown -f sssd:sssd /var/log/sssd/*.log || true
(Ref: https://src.fedoraproject.org/rpms/sssd/blob/f42/f/sssd.spec#_1119 )
However, there is also a logrotate configuration in sssd-common that rotates
and compresses the log files /var/log/sssd/*.log, and it also has "su sssd
sssd" in the configuration. (Ref:
https://github.com/SSSD/sssd/blob/master/src/examples/logrotate.in)
If sssd had been running before the transition to using sssd user/groups for
log file ownership, there were several root:root owned files that had been
rotated earlier. However, logrotate can no longer rotate them because their
permissions were restricted to root and logrotate is running as sssd:sssd.
You'll get an error that looks like:
logrotate[61244]: error: unable to open /var/log/sssd/sssd_pam.log-20250511
(read-only) for compression: Permission denied
This causes the logrotate.service to error out immediately, rather than
continuing to rotate log files.
I think the glob in the rpm %post install scriptlet should be changed to
/var/log/sssd/*.log* to address this.
Reproducible: Always
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2375213
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2375570
Bug ID: 2375570
Summary: Sssd 2.11.x doesn't use Kerberos cached auth:
get_password_for_cache_auth: Unsupported auth token
type [17]
Product: Fedora
Version: 42
Hardware: x86_64
OS: Linux
Status: NEW
Component: sssd
Keywords: Regression
Severity: high
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: ksuszyns(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
After upgrading Fedora 42, the sssd has been upgraded to 2.11.0-1.fc42 and with
that, the caching of the auth broke. Without a connection to the Kerberos
server, the user can't authenticate/log in to the machine.
Downgrading to 2.10.2-3.fc42 solves the issue.
Lots of logs (hundreds of megabytes) like the following (from
/var/log/sssd/sssd_ipa.redhat.com.log):
(2025-06-23 19:06:39): [be[ipa.redhat.com]] [sbus_issue_request_done] (0x0040):
sssd.dataprovider.getAccountInfo: Error [1432158212]: SSSD is offline
and also from /var/log/sssd/sssd_nss.log:
(2025-06-23 19:06:39): [nss] [cache_req_common_process_dp_reply] (0x3f7c0):
[CID#7] CR #769: Could not get account info [1432158212]: SSSD is offline
While authentication without VPN I also see (in /var/log/sssd/sssd_pam.log):
(2025-06-23 19:05:52): [pam] [get_password_for_cache_auth] (0x0010): [CID#3]
Unsupported auth token type [17].
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [get_password_for_cache_auth] (0x0010): [CID#3]
Failed to get password.
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [pam_reply] (0x0010): [CID#3]
get_password_and_type_for_cache_auth failed.
* ... skipping repetitive backtrace ...
(2025-06-23 19:05:52): [pam] [client_send] (0x0010): [CID#3] Failed to send
data, aborting client!
Reproducible: Always
Steps to Reproduce:
1. Have a Kerberos auth setup and working both with connection and without it,
running on sssd < 2.11.0
2. Upgrade to 2.11.x
Actual Results:
Without the network connection, the auth does not work
Expected Results:
The auth should work regardless of the network connection. Credentials should
be cached.
Additional Information:
Possible upstream issue: https://github.com/SSSD/sssd/issues/7968
More info:
https://redhat-internal.slack.com/archives/C05AWLALLP6/p1749486720894889
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2375570
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2372533
Bug ID: 2372533
Summary: Use `systemctl kill` in logrotate postrotate script
Product: Fedora
Version: 42
OS: Linux
Status: NEW
Component: sssd
Severity: low
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: marcosfrm(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, pbrezina(a)redhat.com,
sbose(a)redhat.com, ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
`systemctl kill` leverages systemd's knowledge of the daemon's main PID,
eliminating the need to rely on PID files or external tools like `killall` or
`pkill`. This ensures precise signal sending to the intended process, reducing
the risk of errors in process identification. Additionally, using `systemctl
kill` logs the signal sending in the service's journal, providing a record of
actions taken. Requires selinux-policy-41.43 or higher (see
https://bugzilla.redhat.com/show_bug.cgi?id=2369644) available as an update
for F41, F42, and Rawhide.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-eb98eb9e24 (F41 -- will go
to stable in a few days)
https://bodhi.fedoraproject.org/updates/FEDORA-2025-f9f097f491 (F42 -- stable)
https://bodhi.fedoraproject.org/updates/FEDORA-2025-3db4c0ec1c (Rawhide)
The logrotate configuration snippet:
# cat /etc/logrotate.d/sssd
/var/log/sssd/*.log {
weekly
missingok
notifempty
sharedscripts
rotate 2
compress
delaycompress
su sssd sssd
postrotate
/bin/kill -HUP `cat /run/sssd/sssd.pid 2>/dev/null` 2> /dev/null ||
true
/bin/pkill -HUP sssd_kcm 2> /dev/null || true
endscript
}
In the postrotate script, kill and pkill can be replaced by:
/usr/bin/systemctl kill --signal=HUP --kill-whom=main sssd.service
sssd-kcm.service 2>/dev/null || true
Because:
# systemctl show -P MainPID sssd.service
1225
# cat /run/sssd/sssd.pid
1225
# systemctl show -P MainPID sssd-kcm.service
1447
# pgrep sssd_kcm
1447
Reproducible: Always
Additional Information:
sssd-common-2.11.0-1.fc42.x86_64
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2372533
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2372833
shane.jansen(a)gmail.com <shane.jansen(a)gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(shane.jansen@gmai |
|l.com) |
--- Comment #15 from shane.jansen(a)gmail.com <shane.jansen(a)gmail.com> ---
The information you requested is below. I noticed an error in the Problem
Reporting tool and forwarded it to Bugzilla and was otherwise unaware of any
issue, so I'm not really able to reproduce this.
root@thenv15:~# grep "^group:" /etc/nsswitch.conf
group: files [SUCCESS=merge] sss [SUCCESS=merge] systemd
root@thenv15:~# getent -s files group sssd
sssd:x:972:
root@thenv15:~# rpm -qV sssd-client
root@thenv15:~#
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2372833
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2319608
Bug ID: 2319608
Summary: python3-sssdconfig packs outdated .pyc files
Product: Fedora
Version: rawhide
OS: Linux
Status: NEW
Component: sssd
Keywords: Regression
Severity: medium
Assignee: sssd-maintainers(a)lists.fedoraproject.org
Reporter: jpazdziora(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: abokovoy(a)redhat.com, atikhono(a)redhat.com,
lslebodn(a)redhat.com, mzidek(a)redhat.com,
pbrezina(a)redhat.com, sbose(a)redhat.com,
ssorce(a)redhat.com,
sssd-maintainers(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
The /usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/*.cpython-313.pyc
/usr/lib/files get regenerated when SSSDConfig module is used.
Reproducible: Always
Steps to Reproduce:
1. dnf install -y python3-sssdconfig
2. stat
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
3. python3 -c 'import SSSDConfig'
4. stat
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
Actual Results:
[root@0890eef375bc /]# stat
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
File:
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
Size: 57759 Blocks: 120 IO Block: 4096 regular file
Device: 0,109 Inode: 1226072 Links: 2
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2024-10-15 00:00:00.000000000 +0000
Modify: 2024-10-15 00:00:00.000000000 +0000
Change: 2024-10-18 09:46:42.433097566 +0000
Birth: 2024-10-18 09:46:42.432097551 +0000
[root@0890eef375bc /]# python3 -c 'import SSSDConfig'
[root@0890eef375bc /]# stat
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
File:
/usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc
Size: 59402 Blocks: 120 IO Block: 4096 regular file
Device: 0,109 Inode: 1196042 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2024-10-18 09:47:14.646592272 +0000
Modify: 2024-10-18 09:47:14.646592272 +0000
Change: 2024-10-18 09:47:14.646592272 +0000
Birth: 2024-10-18 09:47:14.646592272 +0000
Expected Results:
The Size and Modify time in the second stat run should match the output from
the first one.
First found by
https://github.com/freeipa/freeipa-container/actions/runs/11397511703/job/3….
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2319608
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2372833
Alexey Tikhonov <atikhono(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(shane.jansen@gmai
| |l.com)
--- Comment #14 from Alexey Tikhonov <atikhono(a)redhat.com> ---
(In reply to Lukáš Zaoral from comment #12)
> The backtrace suggests that this is likely an issue in libnss_sss.so which
> is provided by the sssd-client package.
Well, `libc` didn't even finish loading `libnss_sss.so`, so this is hardly an
issue in this lib:
```
Program terminated with signal SIGABRT, Aborted.
#0 __GI___read_nocancel
#1 0x00007fb76d5efad0 in open_verify (name=name@entry=0x5555e186b3c0
"/lib64/libnss_sss.so.2"
#2 0x00007fb76d5f313e in _dl_map_object
#3 0x00007fb76d5f6baa in dl_open_worker_begin (a=0x7ffdb236d7f0) at
dl-open.c:542
args = 0x7ffdb236d7f0
file = 0x5555e186b3a0 "libnss_sss.so.2"
```
Open FDs also say:
```
3:/usr/lib64/libnss_sss.so.2
pos: 832
```
What is weird is that entire chain is triggered by
```
#19 0x00007fb76d4f28ce in getgrnam (name=name@entry=0x7ffdb236edf1 "sssd")
```
that must be a local group, resolvable by `libnss_files.so.2`
shane.jansen(a)gmail.com, what is the output of:
(1) `grep "^group:" /etc/nsswitch.conf`
(2) `getent -s files group sssd`
(3) `rpm -qV sssd-client`
on your system?
Are you able to reproduce this?
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2372833
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2372833
Lukáš Zaoral <lzaoral(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |abokovoy(a)redhat.com,
| |atikhono(a)redhat.com,
| |lslebodn(a)redhat.com,
| |pbrezina(a)redhat.com,
| |sbose(a)redhat.com,
| |ssorce(a)redhat.com,
| |sssd-maintainers(a)lists.fedo
| |raproject.org
Assignee|lzaoral(a)redhat.com |sssd-maintainers(a)lists.fedo
| |raproject.org
Component|coreutils |sssd
--- Comment #12 from Lukáš Zaoral <lzaoral(a)redhat.com> ---
The backtrace suggests that this is likely an issue in libnss_sss.so which is
provided by the sssd-client package.
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2372833
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…