Bug 41458

Summary: SIP passes UID instead of GID to Net::Server causing error
Product: Koha Reporter: Slava Shishkin <slavashishkin>
Component: SIP2Assignee: Slava Shishkin <slavashishkin>
Status: Signed Off --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: david
Version: Main   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
This fixes an error that may occur when starting the SIP server: "...Couldn't become gid "<uid>": Operation not permitted...". Koha was passing an incorrect value to the Net::Server "group" parameter.
Version(s) released in:
Circulation function:
Bug Depends on: 36386    
Bug Blocks:    
Attachments: Bug 41458: Pass a valid GID to Net::Server This change ensures that a valid numeric GID is passed instead.
Bug 41458: Pass a valid GID to Net::Server for SIP

Description Slava Shishkin 2025-12-16 17:20:34 UTC
When starting SIP, Koha passes an incorrect value to the Net::Server "group" parameter.

The code passes the effective UID ($>) instead of a group ID.
On systems where UID and GID differ, Net::Server attempts to switch
to a non-permitted group and logs an error.
SIP starts with this error and continues running.

To test:
1. Enter KTD shell.
2. Run:
     sudo koha-sip --restart kohadev
3. Check SIP logs and observe:
     [ERROR] [undef]@[undef]: Couldn't become gid "501": Operation not permitted C4::SIP::Trapper::__ANON__ /kohadevbox/koha/C4/SIP/Trapper.pm (70)
Comment 1 Slava Shishkin 2025-12-16 17:28:37 UTC
Created attachment 190555 [details] [review]
Bug 41458: Pass a valid GID to Net::Server This change ensures that a valid numeric GID is passed instead.

KTD Test Plan:
1) Enter KTD shell.
2) Restart SIP:
     sudo koha-sip --restart kohadev
3) Check SIP logs:
     /var/log/koha/kohadev/sip-output.log
4) Observe the error:
     Couldn't become gid "<uid>": Operation not permitted
5) Apply this patch.
6) Repeat step 2.
7) Verify that the "Couldn't become gid" error is no longer logged.
Comment 2 David Nind 2025-12-16 18:21:59 UTC
Added assignee, changed status from "enhancement" to normal (as it fixes an error).
Comment 3 David Nind 2025-12-22 03:58:12 UTC
I attempted to test, but I don't see the error mentioned in step 4 of the test plan (koha clone = up-to-date with main, KTD = up-to-date with main, fresh images pulled).

This is what is in the log file after entering sudo koha-sip --restart kohadev:

 16 2025/12/22-03:54:44 Server closing!
 17 [2025/12/22 03:54:44] [980] [WARN] [undef]@[undef]: 2025/12/22-03:54:44 Server closing! Net::Server::PreFork::__ANON__ /usr/share/perl5/Net/Server/PreFork.pm (266)
 18 [2025/12/22 03:54:44] [980] [WARN] [undef]@[undef]: 2025/12/22-03:54:44 Server closing! Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 19 [2025/12/22 03:54:46] [2092] [ERROR] [undef]@[undef]: ERROR: Institution MAIN does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::sip    log /kohadevbox/koha/C4/SIP/Sip.pm (327)
 20 [2025/12/22 03:54:46] [2092] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary2 does does not match a branchcode. This can cause unexpected behavior. C4::SIP::    Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327)
 21 [2025/12/22 03:54:46] [2092] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary does does not match a branchcode. This can cause unexpected behavior. C4::SIP::S    ip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327)
 22 2025/12/22-03:54:46 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2092)
 23 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: 2025/12/22-03:54:46 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2092) Net::Server::run /usr/sha    re/perl5/Net/Server.pm (52)
 24 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: 2025/12/22-03:54:46 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2092) Net::Server::log /usr/sha    re/perl5/Net/Server.pm (962)
 25 Binding to TCP port 8023 on host 127.0.0.1 with IPv4
 26 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
 27 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 28 Binding to TCP port 6001 on host 127.0.0.1 with IPv4
 29 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
 30 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 31 Setting gid to "1000 1000"
 32 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::post_bind /usr/share/perl5/Net/Server.pm (391)
 33 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::log /usr/share/perl5/Net/Server.pm (962)
Comment 4 Slava Shishkin 2025-12-22 16:20:56 UTC
I updated the main branch for KohaCommunity.
KTD also has an updated main branch.

I start Docker with the command ktd --search-engine es7 up,
then enter the shell with ktd --shell,
and run sudo koha-sip --restart kohadev.

Here is my fully log:

==> /var/log/koha/kohadev/sip-output.log <==
2025/12/22-15:47:27 Server closing!
[2025/12/22 15:47:27] [998] [WARN] [undef]@[undef]: 2025/12/22-15:47:27 Server closing! Net::Server::PreFork::__ANON__ /usr/share/perl5/Net/Server/PreFork.pm (266)
[2025/12/22 15:47:27] [998] [WARN] [undef]@[undef]: 2025/12/22-15:47:27 Server closing! Net::Server::log /usr/share/perl5/Net/Server.pm (962)
[2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary2 does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327)
[2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327)
[2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: ERROR: Institution MAIN does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327)
2025/12/22-15:47:29 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2138)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: 2025/12/22-15:47:29 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2138) Net::Server::run /usr/share/perl5/Net/Server.pm (52)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: 2025/12/22-15:47:29 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2138) Net::Server::log /usr/share/perl5/Net/Server.pm (962)
Binding to TCP port 8023 on host 127.0.0.1 with IPv4
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
Binding to TCP port 6001 on host 127.0.0.1 with IPv4
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
Setting gid to "501 501"
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Setting gid to "501 501" Net::Server::post_bind /usr/share/perl5/Net/Server.pm (391)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Setting gid to "501 501" Net::Server::log /usr/share/perl5/Net/Server.pm (962)
[2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: Couldn't become gid "501": Operation not permitted C4::SIP::Trapper::__ANON__ /kohadevbox/koha/C4/SIP/Trapper.pm (70)
Couldn't become gid "501": Operation not permitted
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Couldn't become gid "501": Operation not permitted Net::Server::PreForkSimple::post_bind /usr/share/perl5/Net/Server/PreForkSimple.pm (64)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Couldn't become gid "501": Operation not permitted Net::Server::log /usr/share/perl5/Net/Server.pm (962)
Comment 5 David Nind 2025-12-22 17:51:05 UTC
Hi Slava.

Sorry, still not seeing the error on my KTD, it is setting gid to 1000 (I'm running the latest everything with fresh pulls and ktd up on an Ubuntu 22.04 desktop using docker engine - not the docker desktop for Linux).

I don't know enough about SIP or docker to comment on why this is happening.

Log from restarting:

 16 2025/12/22-17:46:23 Server closing!
 17 [2025/12/22 17:46:23] [982] [WARN] [undef]@[undef]: 2025/12/22-17:46:23 Server closing! Net::Server::PreFork::__ANON__ /usr/share/perl5/Net/Server/PreFork.pm (266)
 18 [2025/12/22 17:46:23] [982] [WARN] [undef]@[undef]: 2025/12/22-17:46:23 Server closing! Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 19 [2025/12/22 17:46:25] [2204] [ERROR] [undef]@[undef]: ERROR: Institution MAIN does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohad    evbox/koha/C4/SIP/Sip.pm (327)
 20 [2025/12/22 17:46:25] [2204] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary2 does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplo    g /kohadevbox/koha/C4/SIP/Sip.pm (327)
 21 [2025/12/22 17:46:25] [2204] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog     /kohadevbox/koha/C4/SIP/Sip.pm (327)
 22 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: 2025/12/22-17:46:25 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2204) Net::Server::run /usr/share/perl5/N    et/Server.pm (52)
 23 2025/12/22-17:46:25 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2204)
 24 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: 2025/12/22-17:46:25 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2204) Net::Server::log /usr/share/perl5/N    et/Server.pm (962)
 25 Binding to TCP port 8023 on host 127.0.0.1 with IPv4
 26 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
 27 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 28 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
 29 Binding to TCP port 6001 on host 127.0.0.1 with IPv4
 30 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 31 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::post_bind /usr/share/perl5/Net/Server.pm (391)
 32 Setting gid to "1000 1000"
 33 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::log /usr/share/perl5/Net/Server.pm (962)

David
Comment 6 Slava Shishkin 2025-12-22 18:28:44 UTC
Thanks for checking this.

Yes, I understand your point.

On your test system the UID and GID are the same, so the problem does not
manifest there.

However, on systems where the GID differs from the UID, SIP starts with
a group privilege error. This happens because Koha currently passes the
effective UID as the Net::Server "group" parameter.

Problematic code:
    push @params, 'user='  . $>;
    push @params, 'group=' . $>;

Here the UID ($>) is passed for both user and group, while Net::Server
expects a GID for the "group" parameter.

This works on your system only because UID == GID.
In that case the incorrect value happens to work by accident.
Comment 7 Slava Shishkin 2025-12-22 19:05:46 UTC
David, you can reproduce this by changing the GID of the existing Koha group.
In the KTD koha container run:
    sudo groupmod -g 8001 kohadev-koha

Then restart SIP:
    sudo koha-sip --restart kohadev

SIP will start with the error:
    Couldn't become gid "<uid>": Operation not permitted

After applying the patch, the error is no longer logged.

I hope this helps to reproduce and verify the ERROR on your KTD.
Comment 8 David Nind 2025-12-23 22:28:01 UTC
Created attachment 190706 [details] [review]
Bug 41458: Pass a valid GID to Net::Server for SIP

When starting SIP, Koha passes an incorrect value to the
Net::Server "group" parameter, which can generate an
error in the logs":
  Couldn't become gid "<uid>": Operation not permitted

This change ensures that a valid numeric GID is passed instead.

Test plan:
1. Enter KTD shell.
2. To reproduce the error: sudo groupmod -g 8001 kohadev-koha
3. Restart SIP: sudo koha-sip --restart kohadev
4. Check SIP logs:
     /var/log/koha/kohadev/sip-output.log
5. Observe the error:
     Couldn't become gid "<uid>": Operation not permitted
6. Apply this patch.
7. Repeat steps 2 to 4.
8. Verify that the "Couldn't become gid" error is no longer logged.

Signed-off-by: David Nind <david@davidnind.com>
Comment 9 David Nind 2025-12-23 22:31:52 UTC
Thanks for the steps on how to reproduce in KTD!

Now signed off.

I amended the commit message (title, description, and added the steps to the test plan).