[Bug 1922976] Re: iscsid fails to log out from target on shutdown

[Timo Aaltonen]

Hello Michael, or anyone else affected,

Accepted open-iscsi into focal-proposed. The package will build now and
be available at https://launchpad.net/ubuntu/+source/open-
iscsi/2.0.874-7.1ubuntu6.2 in a few hours, and then in the -proposed
repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
focal to verification-done-focal. If it does not fix the bug for you,
please add a comment stating that, and change the tag to verification-
failed-focal. In either case, without details of your testing we will
not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: open-iscsi (Ubuntu Focal)
       Status: Triaged => Fix Committed

** Tags added: verification-needed-focal

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to open-iscsi in Ubuntu.
https://bugs.launchpad.net/bugs/1922976

Title:
  iscsid fails to log out from target on shutdown

Status in open-iscsi package in Ubuntu:
  Fix Released
Status in open-iscsi source package in Focal:
  Fix Committed
Status in open-iscsi source package in Groovy:
  Fix Committed

Bug description:
  [Impact]

   * The finalrd hook [1] of openiscsi runs iscsid which wants to
     check for users [2] of its IPC peers. That fails for issues
     with nss in that environment.

   * The changes prep nss (libs) and if necesary fake a trivial
     /etc/passwd so that the code runs as expected

   * This avoids a delay or hang when running that code

  [1]: https://git.launchpad.net/ubuntu/+source/open-iscsi/tree/debian/open-iscsi.finalrd?h=ubuntu/hirsute-devel
  [2]: https://git.launchpad.net/ubuntu/+source/open-iscsi/tree/usr/mgmt_ipc.c?h=ubuntu/hirsute-devel#n371

  [Test Plan]

   * Set up iscsi root and then shut-down the system
   * Check for errors or delay on the final cleanup which is here
     this code runs.

  [Where problems could occur]

   * Since the only thin the update touches is the finalrd hook
     there are two places to look out for
     a) finalrd generation which means look for finalrd.service
     b) shutdown of a system (as this is when systemd-shutdown pivots into 
        this environment)

  [Other Info]
   
   * nss is in use very indirectly here from getpwuid in glibc via nssswicth 
     config into the default value "file" to the lib
   * if unaware it might be worth to have a look at finalrd itself
     http://manpages.ubuntu.com/manpages/focal/man1/finalrd.1.html

  
  --- original report ---

  When using an iSCSI root filesystem, the /usr/share/finalrd/open-
  iscsi.finalrd script runs an instance of iscsid, waits for iscsid to
  find the existing logged-in sessions, and then logs out from the iSCSI
  target.

  This currently fails because iscsid happens to call getpwuid() on UID
  0.  Within the finalrd there are no libnss_*.so libraries and no
  /etc/passwd file, so the getpwuid() call returns NULL.  This causes
  iscsid to report an error "peeruser_unix: unknown local user with uid
  0", and prevents iscsid from recovering the existent session.  The end
  result is that the open-iscsi.finalrd script waits for its maximum 30
  seconds and then fails to log out from the iSCSI target.

  The error message is most easily observed by modifying
  /usr/share/finalrd/open-iscsi.finalrd to run iscsid as "iscsid -f -d
  8".

  An example of a minimal workaround may be seen at
  https://github.com/ipxe/sanbootable/commit/30bc58ce013a4db6b6d3480e42d4dc42d927fc5f

  (Ubuntu 20.04)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/open-iscsi/+bug/1922976/+subscriptions