SSSD / sssd

Clone

#3077 sssd does not work under non-root user
Closed: Fixed None Opened 7 years ago by jhrozek.

Closed: Fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1349882

Description of problem:
When we try to start sssd with:

[sssd]
user = sssd

The daemon does not start. I can see this in journal:

Jun 24 13:33:58 cc-vtoe13b.lab.eng.brq.redhat.com sssd[23367]: Exiting the
SSSD. Could not restart critical service [ssh].
Jun 24 13:33:58 cc-vtoe13b.lab.eng.brq.redhat.com systemd[1]: sssd.service:
control process exited, code=exited status=1

More interesting stuff is in sssd_cctest.com.log (with level 4):

(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [be_res_get_opts] (0x0100):
Lookup order: ipv4_first
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [recreate_ares_channel]
(0x0100): Initializing new c-ares channel
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [monitor_common_send_id]
(0x0100): Sending ID: (%BE_cctest.com,1)
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [sss_names_init_from_args]
(0x0100): Using re [(((?P<domain>[^\\]+)\\(?P<name>.+$))|((?P<name>[^@]+)@(?P<d
omain>.+$))|(^(?P<name>[^@\\]+)$))].
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [sss_fqnames_init] (0x0100):
Using fq format [%1$s@%2$s].
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [dp_load_configuration]
(0x0100): Using [ipa] provider for [id]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [dp_load_configuration]
(0x0100): Using [ipa] provider for [auth]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [dp_load_configuration]
(0x0100): Using [ipa] provider for [access]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [dp_load_configuration]
(0x0100): Using [ipa] provider for [chpass]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [dp_load_configuration]
(0x0100): Using [ipa] provider for [sudo]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [dp_load_configuration]
(0x0100): Using [ipa] provider for [autofs]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [dp_load_configuration]
(0x0100): Using [ipa] provider for [selinux]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [dp_load_configuration]
(0x0100): Using [ipa] provider for [hostid]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [dp_load_configuration]
(0x0100): Using [ipa] provider for [subdomains]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added: [DEFAULT][cn=accounts,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [sdap_set_sasl_options]
(0x0100): Will look for cc-vtoe13b.lab.eng.brq.redhat.com@CCTEST in default
keytab
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [sdap_set_sasl_options]
(0x0100): Option ldap_sasl_authid set to host/cc-vtoe13b.lab.eng.brq.redhat.com
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [sdap_set_sasl_options]
(0x0100): Option ldap_sasl_realm set to CCTEST
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added: [USER][cn=accounts,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added: [GROUP][cn=accounts,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added: [NETGROUP][cn=ng,cn=alt,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [ipa_get_id_options]
(0x0100): Option ipa_host_search_base set to cn=accounts,dc=cctest
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added: [IPA_HOST][cn=accounts,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added: [IPA_HBAC][cn=hbac,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [ipa_get_id_options]
(0x0100): Option ipa_selinux_search_base set to cn=selinux,dc=cctest
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added: [IPA_SELINUX][cn=selinux,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added: [SERVICE][cn=accounts,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [ipa_get_id_options]
(0x0100): Option ipa_subdomains_search_base set to cn=trusts,dc=cctest
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added: [IPA_SUBDOMAINS][cn=trusts,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [ipa_get_id_options]
(0x0100): Option ipa_master_domain_search_base set to cn=ad,cn=etc,dc=cctest
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added:
[IPA_MASTER_DOMAIN][cn=ad,cn=etc,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [ipa_get_id_options]
(0x0100): Option ipa_ranges_search_base set to cn=ranges,cn=etc,dc=cctest
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added:
[IPA_RANGES][cn=ranges,cn=etc,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [ipa_get_id_options]
(0x0100): Option ipa_views_search_base set to cn=views,cn=accounts,dc=cctest
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added:
[IPA_VIEWS][cn=views,cn=accounts,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [ipa_init_dyndns] (0x0100):
Dynamic DNS updates are of.
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [krb5_try_kdcip] (0x0100): No
KDC found in configuration, trying legacy option
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [ipa_get_auth_options]
(0x0100): Option krb5_fast_principal set to
host/cc-vtoe13b.lab.eng.brq.redhat.com@CCTEST
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [ipa_get_auth_options]
(0x0100): Option krb5_use_kdcinfo set to true
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [check_and_export_options]
(0x0100): No KDC explicitly configured, using defaults.
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [check_and_export_options]
(0x0100): No kpasswd server explicitly configured, using the KDC or defaults.
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added:
[AUTOFS][cn=default,cn=automount,dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [fo_resolve_service_send]
(0x0100): Trying to resolve service 'IPA'
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [resolv_getsrv_send]
(0x0100): Trying to resolve SRV record of '_ldap._tcp.cctest.com'
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [id_callback] (0x0100): Got
id ack and version (1) from Monitor
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [resolv_discover_srv_done]
(0x0040): SRV query failed [4]: Domain name not found
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [fo_set_port_status]
(0x0100): Marking port 0 of server '(no name)' as 'not working'
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [resolve_srv_done] (0x0040):
Unable to resolve SRV [1432158233]: SRV record not found
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [set_srv_data_status]
(0x0100): Marking SRV lookup of service 'IPA' as 'not resolved'
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [be_resolve_server_process]
(0x0080): Couldn't resolve server (SRV lookup meta-server), resolver returned
[1432158233]: SRV record not found
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [fo_resolve_service_send]
(0x0100): Trying to resolve service 'IPA'
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]]
[resolv_gethostbyname_files_send] (0x0100): Trying to resolve A record of
'cc-ipa.lab.eng.brq.redhat.com' in files
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [set_server_common_status]
(0x0100): Marking server 'cc-ipa.lab.eng.brq.redhat.com' as 'resolving name'
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]]
[resolv_gethostbyname_files_send] (0x0100): Trying to resolve AAAA record of
'cc-ipa.lab.eng.brq.redhat.com' in files
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]]
[resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of
'cc-ipa.lab.eng.brq.redhat.com' in DNS
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [set_server_common_status]
(0x0100): Marking server 'cc-ipa.lab.eng.brq.redhat.com' as 'name resolved'
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [sdap_set_search_base]
(0x0100): Setting option [ldap_sudo_search_base] to [dc=cctest].
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [common_parse_search_base]
(0x0100): Search base added: [SUDO][dc=cctest][SUBTREE][]
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [fo_resolve_service_send]
(0x0100): Trying to resolve service 'IPA'
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [child_sig_handler] (0x0100):
child [23406] finished successfully.
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [sdap_cli_auth_step]
(0x0100): expire timeout is 900
(Fri Jun 24 13:39:21 2016) [sssd[be[cctest.com]]] [sasl_bind_send] (0x0100):
Executing sasl bind mech: GSSAPI, user: host/cc-vtoe13b.lab.eng.brq.redhat.com
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [fo_set_port_status]
(0x0100): Marking port 0 of server 'cc-ipa.lab.eng.brq.redhat.com' as 'working'
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [set_server_common_status]
(0x0100): Marking server 'cc-ipa.lab.eng.brq.redhat.com' as 'working'
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [be_run_online_cb] (0x0080):
Going online. Running callbacks.
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [sysdb_range_create]
(0x0040): Invalid range, skipping. Expected that either the secondary base RID
or the SID of the trusted domain is set, but not both or none of them.
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]]
[sss_write_krb5_localauth_snippet] (0x0040): creating the temp file
[/var/lib/sss/pubconf/krb5.include.d/localauth_pluginj9HtDC] for domain-realm
mappings failed.
                                                     (Fri Jun 24 13:39:22 2016)
[sssd[be[cctest.com]]] [sss_write_krb5_localauth_snippet] (0x0080): Could not
remove file [/var/lib/sss/pubconf/krb5.include.d/localauth_pluginj9HtDC]: [2]:
No such file or directory
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [sss_write_krb5_conf_snippet]
(0x0040): sss_write_krb5_localauth_snippet failed.
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [sss_krb5_touch_config]
(0x0020): Unable to change mtime of "/etc/krb5.conf" [13]: Permission denied
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [sss_write_krb5_conf_snippet]
(0x0020): Unable to change last modification time of krb5.conf. Created
mappings may not be loaded.
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [ipa_subdom_reinit] (0x0080):
sss_write_krb5_conf_snippet failed.
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [sss_write_domain_mappings]
(0x0040): creating the temp file
[/var/lib/sss/pubconf/krb5.include.d/domain_realm_cctest_comF6IolL] for
domain-realm mappings failed.
                                                     (Fri Jun 24 13:39:22 2016)
[sssd[be[cctest.com]]] [sss_krb5_touch_config] (0x0020): Unable to change mtime
of "/etc/krb5.conf" [13]: Permission denied
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [sss_write_domain_mappings]
(0x0020): Unable to change last modification time of krb5.conf. Created
mappings may not be loaded.
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [sss_write_domain_mappings]
(0x0080): Could not remove file
[/var/lib/sss/pubconf/krb5.include.d/domain_realm_cctest_comF6Iol?]: [2]: No
such file or directory
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [ipa_subdom_reinit] (0x0080):
sss_krb5_write_mappings failed.
(Fri Jun 24 13:39:22 2016) [sssd[be[cctest.com]]] [be_ptask_enable] (0x0080):
Task [Subdomains Refresh]: already enabled

Version-Release number of selected component (if applicable):
sssd-ipa-1.14.0-0.1.alpha.el7.x86_64
sssd-krb5-common-1.14.0-0.1.alpha.el7.x86_64
sssd-common-1.14.0-0.1.alpha.el7.x86_64
sssd-client-1.14.0-0.1.alpha.el7.x86_64
sssd-common-pac-1.14.0-0.1.alpha.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Setup sssd for an IPA server (via ipa_client)
2. Set user=sssd in sssd.conf [sssd] section
3. Restart sssd

Actual results:
sssd does not start

Expected results:
sssd works as in RHEL7.2

Additional info:
This is an regression. I do not think this has anything to do with out IPA
server's config running currently on RHEL7.2. We can provide test machine for
reference if needed. We are able to test this concrete bug but we cannot
provide extended testing of sssd itself.

This was caused by the data provider refactoring code. Moving to 1.14.1.

blockedby: =>
blocking: =>
changelog: =>
coverity: =>
design: =>
design_review: => 0
feature_milestone: =>
fedora_test_page: =>
mark: no => 0
milestone: NEEDS_TRIAGE => SSSD 1.14.1
review: True => 0
selected: =>
testsupdated: => 0

Fields changed

owner: somebody => pcech

Fields changed

status: new => assigned

There is a bug in pipes during SSSD start if it runs like sssd user. You can catch errors like:

[sssd[nss]] [sbus_new_connection] (0x0020): Failed to open connection: name=org.freedesktop.DBus.Error.AccessDenied, message=Failed to connect to socket /var/lib/sss/pipes/private/sbus-dp_cygnus.dev: Permission denied

We need to get rid of regressions before next release.

priority: critical => blocker

Fields changed

patch: 0 => 1

master:

resolution: => fixed
status: assigned => closed

Metadata Update from @jhrozek:
- Issue assigned to pcech
- Issue set to the milestone: SSSD 1.14.1
7 years ago

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4110

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Login to comment on this ticket.

Metadata
None
None
None
blocker
defect
SSSD
None
None
0
1
https://bugzilla.redhat.com/show_bug.cgi?id=1349882
0
0
None
None
None
0
None
None
0
None
None
None
Powered by Pagure 5.13.3
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.