[regression] sssd won't start if autofs is not installed

Status changed to 'Confirmed' because the bug affects multiple users.

The attachment "trusty-sssd_1.11.8-0ubuntu0.7.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

Can the importance be increased on this one? Central authentication failing on systems using this package (the impact of this bug) might be a bit more important than medium.

A fix has been uploaded to trusty-proposed, so please test it and change the tag to 'verification-done' if it works.

I have just tested the package (1.11.8-0ubuntu0.7) on Trusty and I confirm that it fixes the issue: sssd starts correctly without autofs installed.

#VERIFICATION FOR LP#1695870

- Version of the package: 1.11.8-0ubuntu0.7

ubuntu@sssd-trusty:~$ dpkg -l | grep -i sssd
ii libsss-idmap0 1.11.8-0ubuntu0.7 amd64 ID mapping library for SSSD
ii sssd 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- metapackage
ii sssd-ad 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- Active Directory back end
ii sssd-ad-common 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- PAC responder
ii sssd-common 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- common files
ii sssd-ipa 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- IPA back end
ii sssd-krb5 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- Kerberos back end
ii sssd-krb5-common 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- Kerberos helpers
ii sssd-ldap 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- LDAP back end
ii sssd-proxy 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- proxy back end

- After installing sssd from -proposed in a machine without autofs, sssd starts automatically after a reboot:

ubuntu@sssd-trusty:~$
Broadcast message from ubuntu@sssd-trusty
 (/dev/pts/0) at 10:05 ...

The system is going down for reboot NOW!

...

# confirmation of autofs not installed:
ubuntu@sssd-trusty:~$ dpkg -l | grep -i autofs
ubuntu@sssd-trusty:~$ ls /etc/init/aut*
ls: cannot access /etc/init/aut*: No such file or directory
ubuntu@sssd-trusty:~$ ls /etc/init.d/aut*
ls: cannot access /etc/init.d/aut*: No such file or directory

ubuntu@sssd-trusty:~$ status sssd
sssd start/running, process 943
ubuntu@sssd-trusty:~$ ps -ef | grep sss
root 943 1 0 10:05 ? 00:00:00 sssd -i -f
root 1045 943 0 10:05 ? 00:00:00 /usr/lib/x86_64-linux-gnu/sssd/sssd_be --domain openstacklocal --debug-to-files
root 1070 943 0 10:05 ? 00:00:00 /usr/lib/x86_64-linux-gnu/sssd/sssd_nss --debug-to-files
root 1071 943 0 10:05 ? 00:00:00 /usr/lib/x86_64-linux-gnu/sssd/sssd_pam --debug-to-files
ubuntu 1244 1218 0 10:06 pts/0 00:00:00 grep --color=auto sss

- And from /var/log/syslog:
...
Jun 6 10:05:38 sssd-trusty kernel: [ 1.212080] usb 1-1: new full-speed USB device number 2 using uhci_hcd
Jun 6 10:05:38 sssd-trusty kernel: [ 1.377041] usb 1-1: New USB device found, idVendor=0627, idProduct=0001
Jun 6 10:05:38 sssd-trusty kernel: [ 1.378846] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=5
Jun 6 10:05:38 sssd-trusty kernel: [ 1.380419] usb 1-1: Product: QEMU USB Tablet
Jun 6 10:05:38 sssd-trusty kernel: [ 1.381515] usb 1-1: Manufacturer: QEMU
J...

Proposed worked for me too on one of my impacted systems.

Before reboot:

sudo vi /etc/apt/sources.list ; sudo vi /etc/apt/preferences.d/proposed-updates ; sudo apt-get update ; sudo apt-get --only-upgrade install sssd/trusty-proposed libsss-sudo/trusty-proposed

After reboot:

uptime ; dpkg -l | grep -E 'sss|autofs'

This bug just knocked out all of our development environments, how long before a fix will be downloadable as an update?

@Graham Leggett (minfrin-y)

The SRU team will evaluate the testing feedback and they will move the package into -updates after it has passed a minimum aging period of 7 days.

As of today, we are at day 1 :

Package -release -updates -proposed (signer, creator) changelog bugs days
sssd 1.11.5-1ubuntu3 1.11.8-0ubuntu0.6 1.11.8-0ubuntu0.7 (slashd, vtapia) 1566508 1695870 1

Reference:
https://people.canonical.com/~ubuntu-archive/pending-sru.html

- Eric

Moving to Critical as this fully breaks the purpose of SSSD.

Forgive me, I am a newbie. How do I apply the proposed patch?

The easiest/recommended way is to follow https://wiki.ubuntu.com/Testing/EnableProposed for enabling -proposed.

The package was also built and is available at https://launchpad.net/ubuntu/+source/sssd/1.11.8-0ubuntu0.7. You could use that to do a manual install.

Please if you post a comment saying it worked mention (or didn't) which method you used and report the version of sssd you have installed (something like dpkg -l | grep sss I think should capture all sss libs and sssd).

Thanks to all who test!

Our tests on two computers are working. Our process:
1. enable apt.conf to get through proxy
2. update sources.list with https://wiki.ubuntu.com/Testing/EnableProposed for enabling -proposed.
3. apt-get upgrade -s sssd
4. rerun our AD integration script
5. reboot

We will be testing this process on a few more computers as we can get our hands on them.

== Trusty Verification ==

[Before the patch]

# dpkg
ii libsss-idmap0 1.11.8-0ubuntu0.6 amd64 ID mapping library for SSSD
ii sssd 1.11.8-0ubuntu0.6 amd64 System Security Services Daemon -- metapackage
ii sssd-ad 1.11.8-0ubuntu0.6 amd64 System Security Services Daemon -- Active Directory back end
ii sssd-ad-common 1.11.8-0ubuntu0.6 amd64 System Security Services Daemon -- PAC responder
ii sssd-common 1.11.8-0ubuntu0.6 amd64 System Security Services Daemon -- common files
ii sssd-ipa 1.11.8-0ubuntu0.6 amd64 System Security Services Daemon -- IPA back end
ii sssd-krb5 1.11.8-0ubuntu0.6 amd64 System Security Services Daemon -- Kerberos back end
ii sssd-krb5-common 1.11.8-0ubuntu0.6 amd64 System Security Services Daemon -- Kerberos helpers
ii sssd-ldap 1.11.8-0ubuntu0.6 amd64 System Security Services Daemon -- LDAP back end
ii sssd-proxy 1.11.8-0ubuntu0.6 amd64 System Security Services Daemon -- proxy back end

# Reboot

# service sssd status
sssd stop/waiting

It does start manually but not at boot time

---

[After the patch (trusty-proposed)]
# dpkg
ii libsss-idmap0 1.11.8-0ubuntu0.7 amd64 ID mapping library for SSSD
ii sssd 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- metapackage
ii sssd-ad 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- Active Directory back end
ii sssd-ad-common 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- PAC responder
ii sssd-common 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- common files
ii sssd-ipa 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- IPA back end
ii sssd-krb5 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- Kerberos back end
ii sssd-krb5-common 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- Kerberos helpers
ii sssd-ldap 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- LDAP back end
ii sssd-proxy 1.11.8-0ubuntu0.7 amd64 System Security Services Daemon -- proxy back end

# Reboot

# service sssd status
sssd start/running, process 669

It does start manually and at boot time, as expected.

This bug was fixed in the package sssd - 1.11.8-0ubuntu0.7

---------------
sssd (1.11.8-0ubuntu0.7) trusty; urgency=medium

  * Fix regression where SSSD doesn't start on boot if autofs is not
    installed (LP: #1695870):
    - rules: Support new service
    - sssd-common.sssd-autofs.upstart.in: Restart autofs to read direct mounts
    after SSSD and autofs have started (only on startup). This keeps the fix
    for the autofs and SSSD race condition (LP: #1566508)
    - sssd-common.sssd.upstart.in: Remove "starting autofs" to allow SSSD to
    start without autofs.

 -- Victor Tapia <email address hidden> Mon, 05 Jun 2017 12:41:12 +0200

The verification of the Stable Release Update for sssd has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Uploaded into Xenial upload queue. Now waiting for SRU team approval to start building in xenial-proposed.

- Eric

I have accepted the xenial version (1.13.4-1ubuntu1.6) of this upload just now. The usual tool for doing reviews has exploded so the usual SRU-notification wasn't sent out - reason for that was that the changelog mentioned an already Fix Released bug as being fixed by this release here (LP: #1566508). I expected this to be just a no-op, but I guess I should have requested a re-upload without it being mentioned instead... Now it's too late.

Anyway, please test the sssd package in xenial-proposed and mark the bug as verification-done-xenial if the bug is fixed (or verification-failed-xenial if the verification failed).

Thank you!

#VERIFICATION FOR XENIAL+Upstart (LP#1695870)

- Version of the package: 1.13.4-1ubuntu1.6

ubuntu@xenial-upstart:~$ dpkg -l | grep sssd
ii sssd 1.13.4-1ubuntu1.6 amd64 System Security Services Daemon -- metapackage
ii sssd-ad 1.13.4-1ubuntu1.6 amd64 System Security Services Daemon -- Active Directory back end
ii sssd-ad-common 1.13.4-1ubuntu1.6 amd64 System Security Services Daemon -- PAC responder
ii sssd-common 1.13.4-1ubuntu1.6 amd64 System Security Services Daemon -- common files
ii sssd-ipa 1.13.4-1ubuntu1.6 amd64 System Security Services Daemon -- IPA back end
ii sssd-krb5 1.13.4-1ubuntu1.6 amd64 System Security Services Daemon -- Kerberos back end
ii sssd-krb5-common 1.13.4-1ubuntu1.6 amd64 System Security Services Daemon -- Kerberos helpers
ii sssd-ldap 1.13.4-1ubuntu1.6 amd64 System Security Services Daemon -- LDAP back end
ii sssd-proxy 1.13.4-1ubuntu1.6 amd64 System Security Services Daemon -- proxy back end

- After installing sssd from -proposed in a machine without autofs, sssd starts automatically after a reboot:

# confirmation of autofs not installed:
ubuntu@xenial-upstart:~$ dpkg -l | grep -i autofs
ubuntu@xenial-upstart:~$ ls /etc/init/aut*
ls: cannot access /etc/init/aut*: No such file or directory
ubuntu@xenial-upstart:~$ ls /etc/init.d/aut*
ls: cannot access /etc/init.d/aut*: No such file or directory

ubuntu@xenial-upstart:~$
Broadcast message from ubuntu@xenial-upstart
        (/dev/pts/0) at 11:03 ...

The system is going down for reboot NOW!

...

Last login: Wed Jul 12 11:02:45 2017 from 10.5.1.55
ubuntu@xenial-upstart:~$ status sssd
sssd start/running, process 1109

ubuntu@xenial-upstart:~$ ps -ef | grep sss
root 1109 1 0 11:03 ? 00:00:00 sssd -D -f
root 1126 1109 0 11:03 ? 00:00:00 /usr/lib/x86_64-linux-gnu/sssd/sssd_be --domain openstacklocal --uid 0 --gid 0 --debug-to-files
root 1164 1109 0 11:03 ? 00:00:00 /usr/lib/x86_64-linux-gnu/sssd/sssd_nss --uid 0 --gid 0 --debug-to-files
root 1165 1109 0 11:03 ? 00:00:00 /usr/lib/x86_64-linux-gnu/sssd/sssd_pam --uid 0 --gid 0 --debug-to-files
root 1166 1109 0 11:03 ? 00:00:00 /usr/lib/x86_64-linux-gnu/sssd/sssd_autofs --uid 0 --gid 0 --debug-to-files
ubuntu 1546 1530 0 11:05 pts/0 00:00:00 grep --color=auto sss

- And from /var/log/syslog:

...
Jul 12 11:03:39 xenial-upstart kernel: [ 9.028635] audit: type=1400 audit(1499857419.712:11): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/sbin/dhclient" pid=950 comm="apparmor_parser"
Jul 12 11:03:39 xenial-upstart dbus[953]: [system] AppArmor D-Bus mediation is enabled
Jul 12 11:03:39 xenial-upstart pollinate[892]: sys...

This bug was fixed in the package sssd - 1.13.4-1ubuntu1.6

---------------
sssd (1.13.4-1ubuntu1.6) xenial; urgency=medium

  * Fix regression where SSSD doesn't start on boot if autofs is not
    installed (LP: #1695870):
    - rules: Support new service
    - sssd-common.sssd-autofs.upstart.in: Restart autofs to read direct mounts
    after SSSD and autofs have started (only on startup). This keeps the fix
    for the autofs and SSSD race condition (LP: #1566508)
    - sssd-common.sssd.upstart.in: Remove "starting autofs" to allow SSSD to
    start without autofs.

 -- Victor Tapia <email address hidden> Mon, 05 Jun 2017 12:41:12 +0200