[SSSD] [PATCH] pam: Incerease p11 child timeout

Michal Židek mzidek at redhat.com
Mon Aug 17 12:45:52 UTC 2015


On 08/17/2015 01:22 PM, Lukas Slebodnik wrote:
> On (14/08/15 14:40), Michal Židek wrote:
>> Hi,
>>
>> this patch is a hotfix for pam-srv-failing
>> tests.
>>
>> Increasing the timeout to 30 seconds seems
>> to be enough. I do not want to make it too
>> big because the timeout is currently not
>> configurable.
>>
> The observation seems to be correct; at least according to log file
> http://sssd-ci.duckdns.org/logs/job/23/21/rhel7/ci-build-debug/pam-srv-tests.log
>
> There is a 3.5 seconds delays between creating child handler and 1st message in
> child.
> (Mon Aug 17 10:50:35:304490 2015) [sssd] [child_handler_setup] (0x2000): Setting up signal handler up for pid [30764]
> (Mon Aug 17 10:50:35:305471 2015) [sssd] [child_handler_setup] (0x2000): Signal handler set up for pid [30764]
> (Mon Aug 17 10:50:35:306615 2015) [sssd] [pam_initgr_cache_remove] (0x2000): [pamuser] removed from PAM initgroup cache
> (Mon Aug 17 10:50:35:307109 2015) [sssd] [pam_initgr_cache_remove] (0x2000): [wronguser] removed from PAM initgroup cache
> (Mon Aug 17 10:50:38:972629 2015) [[sssd[p11_child[30764]]]] [main] (0x0400): p11_child started.
>
>
> And another 5 seconds between starting real work in the child
> (Mon Aug 17 10:50:39:091652 2015) [[sssd[p11_child[30764]]]] [main] (0x0020): setuid failed: 1, p11_child might not work!
> (Mon Aug 17 10:50:39:093917 2015) [[sssd[p11_child[30764]]]] [main] (0x0020): setgid failed: 1, p11_child might not work!
> (Mon Aug 17 10:50:39:094746 2015) [[sssd[p11_child[30764]]]] [main] (0x2000): Running with real IDs [499][499].
> (Mon Aug 17 10:50:44:375594 2015) [[sssd[p11_child[30764]]]] [do_work] (0x4000): Default Module List:
>
> It might be caused either by valgrind or by high load on machine.
> IMHO changing default from 10 seconds to 30 is too much.
>
> We can use the same trick in dyndns_test
> dyndns_tests_CFLAGS = \
>      $(AM_CFLAGS) \
>      -DDYNDNS_TIMEOUT=2
>
> and in pamsrv_cmd.c use conditional default value.
> #ifndef SSS_P11_CHILD_TIMEOUT
> # define SSS_P11_CHILD_TIMEOUT 30
> #endif
>
>
>
>> I'd like to talk to Sumit about what he thinks
>> the proper solution should be. I am not sure
>> if it times out because we do something
>> unnecessary in p11 child.
>>
>> See the simple patch.
>>
> LS

Thank you for comments. I pushed the newly attached
patch to CI (5 times, essential tests only, with
disabled be_req tests). To see if it fails. I
am waiting for the results now.

Michal
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-pam-Incerease-p11-child-timeout.patch
Type: text/x-patch
Size: 2314 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150817/4a189658/attachment.bin>


More information about the sssd-devel mailing list