#3729 Blank /etc/sssd/sssd.conf causes startup failure

Created 2 months ago by jlebon
Modified 2 months ago

Migrated from https://github.com/pbrezina/authselect/issues/48#issuecomment-385973737.

I'm trying to work around the conf.d issue by simply having a blank /etc/sssd/sssd.conf as suggested there. But I get an error on startup:

May 02 20:31:42 f28-sssd sssd[1738]: SSSD couldn't load the configuration database [5]: Input/output error.
May 02 20:31:42 f28-sssd audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sssd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
May 02 20:31:42 f28-sssd systemd[1]: sssd.service: Main process exited, code=exited, status=4/NOPERMISSION
May 02 20:31:42 f28-sssd systemd[1]: sssd.service: Failed with result 'exit-code'.
May 02 20:31:42 f28-sssd systemd[1]: Failed to start System Security Services Daemon.

To reproduce this:

  1. Boot up Fedora Atomic Host 28
  2. Fetch RPMs listed in the next step from this git snapshot scratch build I made a few days ago: https://koji.fedoraproject.org/koji/taskinfo?taskID=26594328
  3. Run:
rpm-ostree override replace libsss_idmap-1.16.2.g77d63f5-0.jl.fc28.x86_64.rpm libsss_nss_idmap-1.16.2.g77d63f5-0.jl.fc28.x86_64.rpm sssd-client-1.16.2.g77d63f5-0.jl.fc28.x86_64.rpm libsss_sudo-1.16.2.g77d63f5-0.jl.fc28.x86_64.rpm python3-sssdconfig-1.16.2.g77d63f5-0.jl.fc28.noarch.rpm --install sssd-common-1.16.2.g77d63f5-0.jl.fc28.x86_64.rpm
  1. Reboot
  2. Run:
# touch /etc/sssd/sssd.conf
# chmod 0600 /etc/sssd/sssd.conf
# systemctl restart sssd

You can also use the container build-and-sync pattern to try out patches:

# rpm-ostree usroverlay
# docker run -ti -v /srv:/srv ... registry.fedoraproject.org/fedora:28 /bin/bash
# (in container): <clone sssd, install deps, build it>
# (in container): make install DESTDIR=/srv/installdir
# (on host): rsync -rlv /srv/installdir/usr/ /usr/

After some discussion with the other developers, it appears that the best way would be to solve this along with #3439 which shouldn't even be that much work..

I started working on this, but was sidetracked with some customer cases..

2 months ago

Metadata Update from @jhrozek:
- Issue assigned to jhrozek

Login to comment on this ticket.