freeipa

#7010 ipa-backup fails silently
Closed: fixed Opened by pvoborni.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1457876

Description of problem:
When ipa-backup is called for the first time, the LDAP database is exported to
/var/lib/dirsrv/slapd-<instance>/ldif/<instance>-userRoot.ldif. db2ldif is
called for this. The tool runs under the dirsrv user context. When you call
ipa-restore, the same ldif file is mangled by RemoveRUVParser(). Since the tool
runs under root, also the mangled ldif file is now owned by root.
When you now call ipa-backup the next time, the db2ldif fails, because the tool
does not have permissions to write to the ldif file which is owned by root
(instead of dirsrv).
I think this is the problematic code in ldif2db():
  ipautil.backup_file(ldiffile)
        with open(ldiffile, 'wb') as out_file:
            ldif_writer = ldif.LDIFWriter(out_file)
            with open(srcldiffile, 'rb') as in_file:
                ldif_parser = RemoveRUVParser(in_file, ldif_writer, self.log)
                ldif_parser.parse()
Another problem is, that ipa-backup returns with "The ipa-backup command was
successful" although the db2ldif failed.
Version-Release number of selected component (if applicable):
ipa-4.4
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1457876

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1457876

master:

  • e8358eaea9ccf05c5c5ac0bf5c970663c611e333 Changed ownership of ldiffile to DS_USER

Metadata Update from @mbasti:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-5:

  • 58f3af38f8a0853b4a74c86e5f6252684f814a26 Changed ownership of ldiffile to DS_USER

Metadata Update from @frenaud:
- Issue set to the milestone: FreeIPA 4.5.5 (was: FreeIPA 4.6)

Moving milestone to FreeIPA 4.5.5 as there was a backport to ipa-4-5 branch

master:

  • 80585f5c563b3f3ea8e907656fd4c9baff2d5ec4 Before the fix, when ipa-backup was called for the first time, the LDAP database exported to /var/lib/dirsrv/slapd-/ldif/-userRoot.ldif. db2ldif is called for this and it runs under root, hence files were owned by root.

ipa-4-6:

  • 9b92e8fab1f3531021aacce0f6e3c14144320887 Before the fix, when ipa-backup was called for the first time, the LDAP database exported to /var/lib/dirsrv/slapd-/ldif/-userRoot.ldif. db2ldif is called for this and it runs under root, hence files were owned by root.

ipa-4-5:

  • de5f047f410d2ac3e1933ce3e4bfe29c5137ca71 Before the fix, when ipa-backup was called for the first time, the LDAP database exported to /var/lib/dirsrv/slapd-/ldif/-userRoot.ldif. db2ldif is called for this and it runs under root, hence files were owned by root.

master:

  • 51240f3558b60f35d551188f88329f48fc456778 Check if user permssions and umask 0022 is set when executing ipa-restore

ipa-4-6:

  • 683324271027e2cc64634bb6bdadb47d849931cc Check if user permssions and umask 0022 is set when executing ipa-restore

ipa-4-7:

  • 9d5cc29d33e18e36f95d875ce4154d00e154db5b Check if user permssions and umask 0022 is set when executing ipa-restore
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.