|
 |
e3ffab |
From f91b6dd2ac7ee2d3444929e0d8649c9f355bdcd2 Mon Sep 17 00:00:00 2001
|
|
|
e3ffab |
From: "Thierry bordaz (tbordaz)" <tbordaz@redhat.com>
|
|
|
e3ffab |
Date: Wed, 29 Oct 2014 16:23:03 +0100
|
|
|
e3ffab |
Subject: [PATCH] Deadlock in schema compat plugin (between
|
|
|
e3ffab |
automember_update_membership task and dse update)
|
|
|
e3ffab |
|
|
|
e3ffab |
Defining schema-compat-ignore-subtree values for schema compat plugin config entries removes the
|
|
|
e3ffab |
default value (ignore: cn=tasks,cn=config). This default value prevented deadlocks.
|
|
|
e3ffab |
Schema plugin needs to scope the $SUFFIX and also any updates to its configuration.
|
|
|
e3ffab |
This change restrict the schema compat to those subtrees. It replaces the definition of ignored subtrees
|
|
|
e3ffab |
that would be too long for cn=config (tasks, mapping tree, replication, snmp..)
|
|
|
e3ffab |
|
|
|
e3ffab |
https://fedorahosted.org/freeipa/ticket/4635
|
|
|
e3ffab |
|
|
|
e3ffab |
Reviewed-By: Martin Basti <mbasti@redhat.com>
|
|
|
e3ffab |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
e3ffab |
---
|
|
|
e3ffab |
install/updates/10-schema_compat.update | 30 ++++++++++++++++++++----------
|
|
|
e3ffab |
1 file changed, 20 insertions(+), 10 deletions(-)
|
|
|
e3ffab |
|
|
|
e3ffab |
diff --git a/install/updates/10-schema_compat.update b/install/updates/10-schema_compat.update
|
|
|
e3ffab |
index 7b75ba532612bbdaf9c85f8c88b0c8b8454e5969..b8c79012d121116f9cf53908fbe4eeeebe9d3d82 100644
|
|
|
e3ffab |
--- a/install/updates/10-schema_compat.update
|
|
|
e3ffab |
+++ b/install/updates/10-schema_compat.update
|
|
|
e3ffab |
@@ -18,15 +18,19 @@ add: schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCatego
|
|
|
e3ffab |
add: schema-compat-entry-attribute: 'sudoRunAsUser=%ifeq("ipaSudoRunAsUserCategory","all","ALL","%deref_f(\"ipaSudoRunAs\",\"(objectclass=posixAccount)\",\"uid\")")'
|
|
|
e3ffab |
add: schema-compat-entry-attribute: 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%{ipaSudoRunAsExtGroup}")'
|
|
|
e3ffab |
add: schema-compat-entry-attribute: 'sudoRunAsGroup=%ifeq("ipaSudoRunAsGroupCategory","all","ALL","%deref_f(\"ipaSudoRunAsGroup\",\"(objectclass=posixGroup)\",\"cn\")")'
|
|
|
e3ffab |
-add: schema-compat-ignore-subtree: cn=changelog
|
|
|
e3ffab |
-add: schema-compat-ignore-subtree: o=ipaca
|
|
|
e3ffab |
+remove: schema-compat-ignore-subtree: cn=changelog
|
|
|
e3ffab |
+remove: schema-compat-ignore-subtree: o=ipaca
|
|
|
e3ffab |
+add: schema-compat-restrict-subtree: '$SUFFIX'
|
|
|
e3ffab |
+add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config'
|
|
|
e3ffab |
|
|
|
e3ffab |
# Change padding for host and userCategory so the pad returns the same value
|
|
|
e3ffab |
# as the original, '' or -.
|
|
|
e3ffab |
dn: cn=ng,cn=Schema Compatibility,cn=plugins,cn=config
|
|
|
e3ffab |
replace: schema-compat-entry-attribute:'nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","-",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","-"),%{nisDomainName:-})::nisNetgroupTriple=(%link("%ifeq(\"hostCategory\",\"all\",\"\",\"%collect(\\\"%{externalHost}\\\",\\\"%deref(\\\\\\\"memberHost\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberHost\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"fqdn\\\\\\\")\\\")\")","%ifeq(\"hostCategory\",\"all\",\"\",\"-\")",",","%ifeq(\"userCategory\",\"all\",\"\",\"%collect(\\\"%deref(\\\\\\\"memberUser\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\",\\\"%deref_r(\\\\\\\"memberUser\\\\\\\",\\\\\\\"member\\\\\\\",\\\\\\\"uid\\\\\\\")\\\")\")","%ifeq(\"userCategory\",\"all\",\"\",\"-\")"),%{nisDomainName:-})'
|
|
|
e3ffab |
-add: schema-compat-ignore-subtree: cn=changelog
|
|
|
e3ffab |
-add: schema-compat-ignore-subtree: o=ipaca
|
|
|
e3ffab |
+remove: schema-compat-ignore-subtree: cn=changelog
|
|
|
e3ffab |
+remove: schema-compat-ignore-subtree: o=ipaca
|
|
|
e3ffab |
+add: schema-compat-restrict-subtree: '$SUFFIX'
|
|
|
e3ffab |
+add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config'
|
|
|
e3ffab |
|
|
|
e3ffab |
dn: cn=computers, cn=Schema Compatibility, cn=plugins, cn=config
|
|
|
e3ffab |
default:objectClass: top
|
|
|
e3ffab |
@@ -41,19 +45,25 @@ default:schema-compat-entry-attribute: objectclass=device
|
|
|
e3ffab |
default:schema-compat-entry-attribute: objectclass=ieee802Device
|
|
|
e3ffab |
default:schema-compat-entry-attribute: cn=%{fqdn}
|
|
|
e3ffab |
default:schema-compat-entry-attribute: macAddress=%{macAddress}
|
|
|
e3ffab |
-add: schema-compat-ignore-subtree: cn=changelog
|
|
|
e3ffab |
-add: schema-compat-ignore-subtree: o=ipaca
|
|
|
e3ffab |
+remove: schema-compat-ignore-subtree: cn=changelog
|
|
|
e3ffab |
+remove: schema-compat-ignore-subtree: o=ipaca
|
|
|
e3ffab |
+add: schema-compat-restrict-subtree: '$SUFFIX'
|
|
|
e3ffab |
+add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config'
|
|
|
e3ffab |
|
|
|
e3ffab |
dn: cn=sudoers,cn=Schema Compatibility,cn=plugins,cn=config
|
|
|
e3ffab |
add:schema-compat-entry-attribute: sudoOrder=%{sudoOrder}
|
|
|
e3ffab |
|
|
|
e3ffab |
dn: cn=users,cn=Schema Compatibility,cn=plugins,cn=config
|
|
|
e3ffab |
-add: schema-compat-ignore-subtree: cn=changelog
|
|
|
e3ffab |
-add: schema-compat-ignore-subtree: o=ipaca
|
|
|
e3ffab |
+remove: schema-compat-ignore-subtree: cn=changelog
|
|
|
e3ffab |
+remove: schema-compat-ignore-subtree: o=ipaca
|
|
|
e3ffab |
+add: schema-compat-restrict-subtree: '$SUFFIX'
|
|
|
e3ffab |
+add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config'
|
|
|
e3ffab |
|
|
|
e3ffab |
dn: cn=groups,cn=Schema Compatibility,cn=plugins,cn=config
|
|
|
e3ffab |
-add: schema-compat-ignore-subtree: cn=changelog
|
|
|
e3ffab |
-add: schema-compat-ignore-subtree: o=ipaca
|
|
|
e3ffab |
+remove: schema-compat-ignore-subtree: cn=changelog
|
|
|
e3ffab |
+remove: schema-compat-ignore-subtree: o=ipaca
|
|
|
e3ffab |
+add: schema-compat-restrict-subtree: '$SUFFIX'
|
|
|
e3ffab |
+add: schema-compat-restrict-subtree: 'cn=Schema Compatibility,cn=plugins,cn=config'
|
|
|
e3ffab |
|
|
|
e3ffab |
dn: cn=Schema Compatibility,cn=plugins,cn=config
|
|
|
e3ffab |
# We need to run schema-compat pre-bind callback before
|
|
|
e3ffab |
--
|
|
|
e3ffab |
2.1.0
|
|
|
e3ffab |
|