[SSSD] [PATCH] The new memberof plugin

Stephen Gallagher sgallagh at redhat.com
Fri Sep 30 19:32:37 UTC 2011


On Fri, 2011-09-30 at 14:55 -0400, Stephen Gallagher wrote:
> On Thu, 2011-09-29 at 16:56 +0200, Jan Zelený wrote:
> > > Jan Zelený <jzeleny at redhat.com> writes:
> > > >> > As you described it, it looks like issue similar to what Stephen found
> > > >> > earlier and is now fixed. It probably isn't caused by the size of
> > > >> > groups but rather membership structure. Could you be more specific how
> > > >> > the structure is organized? Do you use rfc2307 or rfc2307bis? If the
> > > >> > latter is the case, how deep your membership structure goes and how
> > > >> > does it approximately look like?
> > > >> 
> > > >> This is rfc2307.
> > > > 
> > > > There must be something else going on. I tested 2307 on a group with
> > > > ~1000 users and I found no problem.
> > > > 
> > > > Could you provide me a backtrace of the place where the process hangs?
> > > > Any other information you might have will be useful as well.
> > > 
> > > I don't have a backtrace, since I compiled this as an rpm. However, an
> > > strace of sssd_be hopefully holds a clue or two:
> > > PS. I forgot to mention that I'm using sssd 1.5.12 + memberof patch on
> > > rhel6 x86_64, since it required the least amount of effort to compile
> > > and install.
> > > 
> > > Regards,
> > 
> > I managed to reproduce this issue, however I'm not sure it was related to the 
> > plugin itself. What seemed to resolve it was update to latest packages in F15 
> > and restart. However I did a small memory optimization, so I'm sending the 
> > corrected patch. Please let me know if everything works for you now. In not, 
> > try attaching gdb to sssd_be process *after* it freezes and send me a 
> > backtrace.
> > 
> 
> Still seeing issues with this latest round of patches (by the way,
> please always send all patches in a series when updating, it makes it
> easier to keep track of them).
> 
> 
> I had JR try out this patch on his setup, and he hit a crash while
> saving about 4100 memberships to a small set of groups.
> 
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x0000003e01003277 in _talloc_free () from /usr/lib64/libtalloc.so.2
> (gdb) bt full
> #0  0x0000003e01003277 in _talloc_free () from /usr/lib64/libtalloc.so.2
> No symbol table info available.
> #1  0x00002af7396056fb in mbof_update (update_ctx=0x23c7a9d0) at
> src/ldb_modules/memberof.c:1456
>         ldb = 0x1b267890
>         msg = 0x1
>         member = 0x21e6dab0
>         el = 0x237ac5c0
>         rc_el = 0xa5
>         new_el = <value optimized out>
>         new_rc_el = <value optimized out>
>         valdn = 0x54
>         i = 0
>         rc = 588275056
>         first_rc = 588275056
>         key = {type = 152, {str = 0x237ac5c0 "\220x&\033", ul =
> 595248576}}
>         value = {type = 584457008, {ptr = 0x3e01005952, i = 16800082, ui
> = 16800082, l = 266304772434, ul = 266304772434, f = 2.35739712e-38, d =
> 1.315720393832104e-312}}
>         process = 0x0
>         ret = 1
>         hret = 0
>         is_user = false
>         member_name = 0x0
>         mod_req = 0x23c7a9d0
>         flags = 0
>         del_ctx = <value optimized out>
> #2  0x00002af739605e1c in mbof_add_next_member_cb (pvt=<value optimized
> out>, members=0x229eefb0, num=1) at src/ldb_modules/memberof.c:1908
>         add_ctx = 0x23844380
>         update_ctx = 0x1
>         ldb = 0x1b267890
>         el = 0x23105d70
>         valdn = <value optimized out>
>         ret = 455506064
>         key = {type = HASH_KEY_STRING, {str = 0x222a0dd0 "", ul =
> 573181392}}
>         value = {type = HASH_VALUE_LONG, {ptr = 0x3df9874e2e, i =
> -108573138, ui = 4186394158, l = 266179399214, ul = 266179399214, f =
> -8.78182185e+34, d = 1.315100967822999e-312}}
> #3  0x00002af7396033e2 in mbof_membertree_get_cb (req=<value optimized
> out>, ares=0x230fe300) at src/ldb_modules/memberof.c:1613
>         membertree_ctx = 0x0
>         ctx = 0x2311aba0
>         ret = <value optimized out>
> #4  0x0000003e02c1a0cc in ?? () from /usr/lib64/libldb.so.0
> No symbol table info available.
> #5  0x0000003e014034d3 in ?? () from /usr/lib64/libtevent.so.0
> No symbol table info available.
> #6  0x0000003e0140509b in ?? () from /usr/lib64/libtevent.so.0
> No symbol table info available.
> #7  0x0000003e01402690 in _tevent_loop_once ()
> from /usr/lib64/libtevent.so.0
> No symbol table info available.
> #8  0x0000003e02c09a0f in ldb_wait () from /usr/lib64/libldb.so.0
> No symbol table info available.
> #9  0x0000003e02c0b13c in ?? () from /usr/lib64/libldb.so.0
> No symbol table info available.
> #10 0x0000003e02c0b2c0 in ldb_modify () from /usr/lib64/libldb.so.0
> No symbol table info available.
> #11 0x00002af73982f070 in ipa_hbac_sysdb_save (sysdb=0x1b268660,
> domain=0x1b269130, primary_subdir=0x2af739881f12 "hbac_hosts",
> attr_name=<value optimized out>, primary_count=<value optimized out>,
> primary=<value optimized out>, 
>     group_subdir=0x2af739881f1d "hbac_hostgroups",
> groupattr_name=0x2af739880833 "cn", group_count=62, groups=0x1dc50610)
> at src/providers/ipa/ipa_hbac_common.c:268
>         lret = <value optimized out>
>         ret = 0
>         orig_member_dns = 0x2352ebb0
>         i = 0
>         member_count = 1
>         members = 0x230060c0
>         tmp_ctx = 0x238900d0
>         member_dn = <value optimized out>
> ---Type <return> to continue, or q <return> to quit--- 
>         group_id = 0x1db230f0 "eng-zenoss"
>         msg = 0x2340f170
>         member_filter = 0x21490870
> "originalDN=fqdn=zoentdev1.ops.expertcity.com,cn=computers,cn=accounts,dc=expertcity,dc=com"
>         __FUNCTION__ = "ipa_hbac_sysdb_save"
> #12 0x00002af73982394e in hbac_sysdb_save (req=<value optimized out>) at
> src/providers/ipa/ipa_access.c:484
>         ret = <value optimized out>
>         hbac_ctx = 0x1b291a70
>         domain = 0x1b269130
>         sysdb = 0x1b268660
>         base_dn = <value optimized out>
>         be_ctx = <value optimized out>
>         tmp_ctx = <value optimized out>
>         __FUNCTION__ = "hbac_sysdb_save"
> #13 0x00002af7398296a2 in ipa_hbac_rule_info_done (subreq=<value
> optimized out>) at src/providers/ipa/ipa_hbac_rules.c:213
>         ret = 0
>         req = 0x1dc60b20
>         state = 0x1c1ee730
>         __FUNCTION__ = "ipa_hbac_rule_info_done"
> #14 0x00002af73983ed39 in sdap_get_generic_done (op=<value optimized
> out>, reply=0x0, error=<value optimized out>, pvt=<value optimized out>)
> at src/providers/ldap/sdap_async.c:1022
>         req = 0x1b299120
>         state = <value optimized out>
>         attrs = <value optimized out>
>         errmsg = 0x0
>         result = 0
>         ret = <value optimized out>
>         lret = 1
>         total_count = 0
>         cookie = {bv_len = 0, bv_val = 0x1ccfab10 "\260\263\367\034"}
>         returned_controls = 0x1d8fcc20
>         page_control = <value optimized out>
>         __FUNCTION__ = "sdap_get_generic_done"
> #15 0x00002af739840c8a in sdap_process_message (ev=<value optimized
> out>, pvt=<value optimized out>) at src/providers/ldap/sdap_async.c:307
>         msgtype = 101
>         ret = 0
>         reply = 0x1dc69460
>         op = 0x1dc62cf0
>         msgid = <value optimized out>
>         __FUNCTION__ = "sdap_process_message"
> #16 sdap_process_result (ev=<value optimized out>, pvt=<value optimized
> out>) at src/providers/ldap/sdap_async.c:207
>         sh = <value optimized out>
>         no_timeout = {tv_sec = 0, tv_usec = 0}
>         te = <value optimized out>
>         msg = 0x1c8adf20
>         ret = <value optimized out>
>         __FUNCTION__ = "sdap_process_result"
> #17 0x0000003e014034d3 in ?? () from /usr/lib64/libtevent.so.0
> No symbol table info available.
> #18 0x0000003e0140509b in ?? () from /usr/lib64/libtevent.so.0
> No symbol table info available.
> #19 0x0000003e01402690 in _tevent_loop_once ()
> from /usr/lib64/libtevent.so.0
> No symbol table info available.
> #20 0x0000003e014026fb in ?? () from /usr/lib64/libtevent.so.0
> No symbol table info available.
> #21 0x0000000000433db1 in server_loop (main_ctx=0x1b252b10) at
> src/util/server.c:526
> No locals.
> #22 0x000000000040ee7f in main (argc=6, argv=0x7fff460731c8) at
> src/providers/data_provider_be.c:1333
>         opt = <value optimized out>
>         pc = 0x1b2505e0
>         be_domain = 0x1b2509c0 "expertcity.com"
>         srv_name = <value optimized out>
>         conf_entry = <value optimized out>
> ---Type <return> to continue, or q <return> to quit---
>         main_ctx = 0x1b252b10
>         ret = <value optimized out>
>         long_options = {{longName = 0x0, shortName = 0 '\000', argInfo =
> 4, arg = 0x647760, val = 0, descrip = 0x438df2 "Help options:",
> argDescrip = 0x0}, {longName = 0x438e00 "debug-level", shortName = 100
> 'd', argInfo = 2, arg = 0x647838, val = 0, 
>             descrip = 0x438dd1 "Debug level", argDescrip = 0x0},
> {longName = 0x438e0c "debug-to-files", shortName = 102 'f', argInfo = 0,
> arg = 0x64783c, val = 0, descrip = 0x439a68 "Send the debug output to
> files instead of stderr", argDescrip = 0x0}, {
>             longName = 0x438e1b "debug-timestamps", shortName = 0
> '\000', argInfo = 2, arg = 0x647740, val = 0, descrip = 0x438ddd "Add
> debug timestamps", argDescrip = 0x0}, {longName = 0x43a408 "domain",
> shortName = 0 '\000', argInfo = 1, 
>             arg = 0x7fff46073088, val = 0, descrip = 0x439aa0 "Domain of
> the information provider (mandatory)", argDescrip = 0x0}, {longName =
> 0x0, shortName = 0 '\000', argInfo = 0, arg = 0x0, val = 0, descrip =
> 0x0, argDescrip = 0x0}}
>         __FUNCTION__ = "main"
> 
> 
> 
> 
> 
> Please note that the issue is that we're calling talloc_free(msg) on msg
> at a time when msg = 0x1. (This can only happen in two error conditions,
> 1) member_name = ldb_msg_find_attr_as_string(member, DB_NAME, NULL);
> has returned NULL for member_name, or
> 
> 2) entry_is_user_object() returned something other than LDB_SUCCESS or
> LDB_ERR_NO_SUCH_ATTRIBUTE
> 
> 
> So there are two bugs here. 1) We need to initialize msg to NULL. 2) We
> need to figure out which of the above two failures is happening, and
> why.
> 


Ok, I did a little more digging. Aside from the initialization error,
the real problem here is that the memberUID code is breaking when it's
dealing with non-posixGroups.

In this case, we have a bunch of hosts being added to hostgroups. They
don't use a 'name=' attribute, so they're failing the memberuid linkage.
We need to make the memberUID feature only happen for posixGroups. If
this is too much work for the immediate future, we should just skip
memberUID if the name attribute is missing, rather than fail.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110930/83b40d07/attachment.sig>


More information about the sssd-devel mailing list