[SSSD] [PATCH] pam: Incerease p11 child timeout

Roland Mainz rmainz at redhat.com
Fri Aug 14 13:05:37 UTC 2015


On 14 August 2015 at 14:40, Michal Židek <mzidek at redhat.com> wrote:
> Hi,
>
> this patch is a hotfix for pam-srv-failing
> tests.
>
> Increasing the timeout to 30 seconds seems
> to be enough. I do not want to make it too
> big because the timeout is currently not
> configurable.
>
> I'd like to talk to Sumit about what he thinks
> the proper solution should be. I am not sure
> if it times out because we do something
> unnecessary in p11 child.

One "simple" fix for this kind of failures is to use dbx/gdb/pstack to
wait for a specific "checkpoint" in the code. For example
http://svn.nrubsig.org/svn/people/gisburn/code/kdctest/test3.sh
demonstrates this by waiting for the krb5kdc to enter the poll event
loop:
-- snip --
function run_kdc
{
    typeset -x KRB5_KDC_PROFILE="${_.krb5_kdc_profile}"
    typeset -x KRB5_CONFIG='/dev/null'

    (( _.kdc_pid != -1 )) && return 1

    krb5kdc -n -r "${_.realmname}" &
    (( _.kdc_pid=$! ))

    # Wait until the KDC becomes ready
    # (we probe the KDC process itself because a simple
    # $ sleep 10 # is not reliable when the system
    # is paging/swapping or simply too slow (e.g.
    # embedded system))
    typeset pout
    integer i pres
    for (( i=100; i > 0 ; i-- )) ; do
        sleep 0.25

        pout="${ /usr/bin/pstack ${_.kdc_pid} 2>'/dev/null' ;
            (( pres=$? )) ; }"
        if (( pres != 0 )) || \
            [[ "${pout}" == ~(E)[[:space:]]+_*(epoll|poll) ]] ; then
            break
        fi
    done

    # KDC process still running ?
    kill -0 ${_.kdc_pid} 2>'/dev/null' || \
        { print -u2 -f $"KDC failed.\n" ; return 1 ; }

    return 0
}
-- snip --

----

Bye,
Roland

-- 
  __ .  . __
 (o.\ \/ /.o) rmainz at redhat.com
  \__\/\/__/  IPA/Identity Management/Kerberos 5
  /O /==\ O\
 (;O/ \/ \O;)



More information about the sssd-devel mailing list