#895981 please cleanup /var/cache/nscd on restart

Package:
nscd
Source:
glibc
Description:
GNU C Library: Name Service Cache Daemon
Submitter:
Harald Dunkel
Date:
2023-11-01 11:15:07 UTC
Severity:
normal
#895981#5
Date:
2018-04-18 08:18:44 UTC
From:
To:
If I change nscd.conf (to adjust some ttl or to disable some cache)
and restart the service, then the cache files in /var/cache/nscd
are not adjusted accordingly, AFIACS. In worst case the passwd cache
is kept forever and never adjusted, even though it has been disabled
in nscd.conf.

nscd's caches should be deleted or recreated at service start or
restart, as applicable.


Regards
Harri
#895981#10
Date:
2018-04-18 22:43:20 UTC
From:
To:
Hi,

Could you please tell me if you use systemd or sysvinit, to know if the
systemd service file is used, or the old init script.

With both the systemd service and the old init script, the caches should
be invalidated through nscd -i, which is the proper way to start with a
clean cache. Now there might be a case which is not handled correctly.

Aurelien
#895981#15
Date:
2018-04-19 10:25:50 UTC
From:
To:
Hi Aurelien,

I am using both systemd and sysvinit-core, but I am not sure which one
was active when I ran into this problem.

Consider a split DNS setup for a remote network. I had started an IPsec
connection to the remote side. /etc/resolv.conf was changed to include
the new internal DNServer on the remote side, but a host lookup gave me
still the old external address. Stopping nscd did not help, AFAIR.

See also #895977 (resolvconf).


Regards
Harri
#895981#20
Date:
2018-04-29 18:56:48 UTC
From:
To:
* Harald Dunkel:

That's arguably a bug in nscd.  It should flush the cache each time it
detects a change in /etc/resolv.conf (or /etc/gai.conf, for that
matter).
#895981#25
Date:
2018-04-30 11:51:55 UTC
From:
To:
 And it does, this is what define_traced_file/init_traced_file do in
nss/nss_files/files-init.c.

Then via the nscd callback nscd_init_cb, we call register_traced_file for
each loaded database.

Then each registered file, like /etc/resolv.conf, is watched via inotify
for any changes, and if
a change is detected and finfo->call_res_init was true (and it's true only
for resolv.conf) then
we call res_init().

We do not handle anything for changes in gai.conf, we would have to add
that.

Cheers,
Carlos.
#895981#30
Date:
2018-04-30 12:45:12 UTC
From:
To:
* Carlos O'Donell:

But res_init does not flush the nscd cache, doesn't it?
#895981#35
Date:
2018-04-30 13:59:37 UTC
From:
To:
Not sure if it matters, but if resolvconf is active, then /etc/resolv.conf
is a symbolic link.


Regards
Harri
#895981#40
Date:
2018-06-08 09:25:40 UTC
From:
To:
Any news on this? Did you report this bug upstream?


Here is a sample session showing the effect:

# ping lxc01
PING lxc01.example.de (172.16.99.198) 56(84) bytes of data.
 From dpcl082.example.de (172.16.97.128) icmp_seq=1 Destination Host Unreachable
 From dpcl082.example.de (172.16.97.128) icmp_seq=2 Destination Host Unreachable
 From dpcl082.example.de (172.16.97.128) icmp_seq=3 Destination Host Unreachable
^C
--- lxc01.example.de ping statistics ---
4 packets transmitted, 0 received, +3 errors, 100% packet loss, time 3050ms
pipe 4

# service nscd stop

# ping lxc01
PING lxc01.example.de (172.16.99.28) 56(84) bytes of data.
64 bytes from lxc01.example.de (172.16.99.28): icmp_seq=1 ttl=64 time=0.362 ms
64 bytes from lxc01.example.de (172.16.99.28): icmp_seq=2 ttl=64 time=0.396 ms
^C
--- lxc01.example.de ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.362/0.379/0.396/0.017 ms

# service nscd start

# ping lxc01
PING lxc01.example.de (172.16.99.198) 56(84) bytes of data.
 From dpcl082.example.de (172.16.97.128) icmp_seq=1 Destination Host Unreachable
 From dpcl082.example.de (172.16.97.128) icmp_seq=2 Destination Host Unreachable
 From dpcl082.example.de (172.16.97.128) icmp_seq=3 Destination Host Unreachable
^C
--- lxc01.example.de ping statistics ---
4 packets transmitted, 0 received, +3 errors, 100% packet loss, time 3050ms
pipe 4


See how the old IP address pops up again, as soon as nscd is active?
Obviously "service nscd stop" did not flush the cache.


Regards
Harri
#895981#45
Date:
2023-11-01 11:07:59 UTC
From:
To:
See manapge for nscd.conf, for me it looks like it is intended
behavior of that setting.

       persistent service bool
              bool  must  be  one of yes (default) or no.  Keep the content of
              the  cache  for  service  over  nscd(8)  restarts.  Useful  when
              paranoia mode is set.

Does it work if that is set to no?