** Description changed:

  NOTE TO SRU REVIEWER:
  
- The stonking upload is ready to go. I didn't do to avoid putting more
- load on the ubuntu release team for the stonking beta.
+ The stonking upload is in stonking-unapproved, held because of the beta
+ freeze.
  
  [ Impact ]
  
  sssd joined to an IPA or Active Directory domain will leak an ldap_child
  zombie process upon every restart. The amount of zombies stays the same
  with every restart, so at least it doesn't pile up, but it's incorrect
  behavior and troubling to see from a system administration and health
  perspective.
  
  [ Test Plan ]
  
  To avoid having to prepare a samba active directory server and join a
  test system to it to reproduce the bug, a minimal setup was created with
  the assistance of AI that will exhibit the bug, and show the fix works.
  
  Inside a container another system representing the ubuntu release under
  test, perform the following steps:
  
  # Install packages. Just accept default answers when prompted for kerberos 
details
  sudo apt update && sudo apt install -y sssd-common sssd-krb5-common sssd-ad 
krb5-user
  
  # Generate keytab, necessary to trigger the code path which has the bug. This 
command is all one long line:
  printf 'addent -password -p host/[email protected] -k 1 -e 
aes256-cts-hmac-sha1-96\npw\nwkt /etc/sssd/lp2164856.keytab\nquit\n' | sudo 
ktutil
  
  # Write /etc/sssd/sssd.conf (must be root-owned, mode 600) with this content:
  [sssd]
  services = nss
  domains = example.com
  
  [domain/example.com]
  id_provider = ad
  ad_domain = example.com
  ad_hostname = lp2164856
  ad_server = 127.0.0.1
  krb5_realm = EXAMPLE.COM
  krb5_keytab = /etc/sssd/lp2164856.keytab
  
  # Start sssd
  sudo systemctl start sssd
  
  # Verify process list. You may already see the ldap_child zombie
  process:
  
  ps -eo pid,ppid,stat,comm,args | grep ldap_child | awk 'NR==1 || $3 ~ /^Z/'
     4774    4773 Z    ldap_child <def [ldap_child] <defunct>
  
  If you don't see it yet, restart sssd and try a few more times:
  sudo systemctl restart sssd
  
  With the packages from proposed, there will be no ldap_child zombie
  process.
  
  [ Where problems could occur ]
  
  sssd is in the login path of an ubuntu system, and regressions in this 
package could be serious. To prevent the most obvious, and some complex, 
regressions, the autopkgtests of sssd, and its dependent package samba, 
exercise several login paths:
  - ubuntu system joined to a samba Active Directory controller (samba 
autopkgtests)
  - sssd pointing to a kerberos-only, and kerberos plus openldap servers, and 
exercising terminal login via both ldap auth and kerberos auth, and user 
information provided by openldap (via /etc/nsswitch.conf)
  - smartcard login tested with sssd autopkgtests
  
  [ Other Info ]
  The minimal reproducer was created with the assistance of AI, after it 
analyzed the code and the patch. I also manually validated that after the fix 
there are no zombie ldap_child processes in the more complex and real-world 
samba active directory test from the samba package.
  
  [ Original Description ]
  
  On Ubuntu 26.04 LTS with sssd 2.12.0-1ubuntu5.2, every start of sssd_be
  leaves behind exactly one zombie process. The host is domain-joined and
  uses the IPA provider. Domain and server names are redacted below.
  
  OBSERVED BEHAVIOUR
  
  The zombie and its parent:
  
      $ ps -eo pid,ppid,stat,etime,comm,args | awk 'NR==1 || $3 ~ /^Z/'
          PID    PPID STAT     ELAPSED COMMAND         COMMAND
         1481    1439 Z       13:10:06 ldap_child      [ldap_child] <defunct>
  
      $ ps -o pid,ppid,stat,lstart,comm,args -p 1439
          PID    PPID STAT                  STARTED COMMAND         COMMAND
         1439    1376 S    Sat Aug 22 20:07:04 2026 sssd_be         
/usr/libexec/sssd/sssd_be --domain EXAMPLE.COM --logger=files
  
  The elapsed time of the zombie matches the start time of its parent, so
  the child is forked and exits during backend startup and is then never
  reaped. It persists for the lifetime of the backend process.
  
  The domain is fully operational:
  
      $ sssctl domain-status EXAMPLE.COM
      Online status: Online
  
      Active servers:
      IPA: ipa-server.example.com
  
  /var/log/sssd/ldap_child.log exists but is empty (0 bytes) at the
  default debug level.
  
  UPSTREAM FIX
  
  The upstream release notes list this change under SSSD 2.13.0, released
  on 2026-04-27:
  
      pull request #8473, "sdap_select_principal_from_keytab_sync:
  waitpid() synchronously"
  
      https://github.com/SSSD/sssd/pull/8473
  
  The title indicates a forked child that was not being waited on
  synchronously, which matches the symptom observed here: a single child,
  forked at backend startup, never reaped. I have not reviewed the diff
  itself.
  
  The change does not appear in the changelogs of the earlier maintenance
  releases listed on that page, so it is unlikely to reach Ubuntu 26.04
  through a point release and would need an individual cherry-pick.
  
  The current development release is affected as well. It ships upstream
  2.12.0, and its changelog up to 2.12.0-4ubuntu1 shows no distribution
  patch addressing this.
  
  IMPACT
  
  One PID slot leaks for the lifetime of every sssd_be process.
  
  The count does not grow across restarts: when sssd_be exits, its zombie
  is reparented to the init system and reaped there, and the new backend
  creates exactly one replacement. Measured over five consecutive
  restarts, the count stayed at one. It also stayed at one over 13 hours
  of uninterrupted uptime.
  
  The practical cost is a single PID slot plus a defunct process that is
  permanently visible in the process table.
  
  Observed with the IPA provider. Judging by the function name the code
  path belongs to the LDAP provider layer, so AD and LDAP providers
  binding via GSSAPI from a keytab may be affected in the same way, but
  that has not been verified here.
  
  STEPS TO REPRODUCE
  
  On a host joined to an IPA domain:
  
      sudo systemctl restart sssd
      sleep 20
      ps -eo pid,ppid,stat,comm | awk '$3 ~ /^Z/'
  
  Expected: no output.
  Actual:   one [ldap_child] entry in state Z, whose parent is sssd_be.
  
  Allow the full delay before sampling. The child is forked during backend
  startup, and a shorter wait can miss it.
  
  PACKAGE INFORMATION
  
      $ lsb_release -rd
      Description:    Ubuntu 26.04 LTS
      Release:        26.04
  
      $ sssd --version
      2.12.0
  
      $ apt policy sssd
      sssd:
        Installed: 2.12.0-1ubuntu5.2
        Candidate: 2.12.0-1ubuntu5.2
        Version table:
       *** 2.12.0-1ubuntu5.2 500
              500 http://archive.ubuntu.com/ubuntu resolute-updates/main 
amd64v3 Packages
              100 /var/lib/dpkg/status
           2.12.0-1ubuntu5.1 500
              500 http://archive.ubuntu.com/ubuntu resolute-security/main 
amd64v3 Packages
           2.12.0-1ubuntu5 500
              500 http://archive.ubuntu.com/ubuntu resolute/main amd64v3 
Packages

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164856

Title:
  sssd_be leaves an [ldap_child] <defunct> zombie on every backend start

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/2164856/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to