Bug 16104 - nscd statistics are inaccurate when local client searches cache.
Summary: nscd statistics are inaccurate when local client searches cache.
Status: NEW
Alias: None
Product: glibc
Classification: Unclassified
Component: nscd (show other bugs)
Version: 2.19
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-10-31 05:13 UTC by Carlos O'Donell
Modified: 2014-06-13 12:27 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos O'Donell 2013-10-31 05:13:19 UTC
A local client making use of nscd may request via GETFDPW, GETFDGR, GETFDHST, GETFDSERV, or GETFDNETGR that an mmap-able fd of the entire cache be made available such that that client can search the cache itself.

This behaviour is the fast path and allows the client to offload some processing from the server process to the client process, and is in general faster than waiting for an nscd worker thread to complete the lookup.

The problem is that if a positive hit or negative hit is found in the cache there is no way to update the server statistics on the successful hit and therefore in some cases the server statistics are completely inaccurate.

I do not suggest that we slow down the fast path, but the server did receive one of the GETFD* request packets and therefore should have been able to record receiving one of those and display that as a statistic.

I propose we display:

%d number of client-side cache searches

This way if you run `getent netgroup foo' in a loop you will at least see this statistic incrementing showing that the client's are doing all the lookups. Obviously a failed search via the client of the memory mapped cache means that the client must fall back on having nscd do the actual lookup and that will show up in the statistics (usually as a positive cache miss).
Comment 1 Carlos O'Donell 2013-10-31 05:16:48 UTC
The only way to get fully accurate statistics is to use SELinux to disable the permissions that control access to doing the local client-side cache search via shared memory.
Comment 2 Carlos O'Donell 2013-11-02 04:46:28 UTC
Patch:
https://sourceware.org/ml/libc-alpha/2013-11/msg00029.html