When starting SIP, Koha passes an incorrect value to the Net::Server "group" parameter. The code passes the effective UID ($>) instead of a group ID. On systems where UID and GID differ, Net::Server attempts to switch to a non-permitted group and logs an error. SIP starts with this error and continues running. To test: 1. Enter KTD shell. 2. Run: sudo koha-sip --restart kohadev 3. Check SIP logs and observe: [ERROR] [undef]@[undef]: Couldn't become gid "501": Operation not permitted C4::SIP::Trapper::__ANON__ /kohadevbox/koha/C4/SIP/Trapper.pm (70)
Created attachment 190555 [details] [review] Bug 41458: Pass a valid GID to Net::Server This change ensures that a valid numeric GID is passed instead. KTD Test Plan: 1) Enter KTD shell. 2) Restart SIP: sudo koha-sip --restart kohadev 3) Check SIP logs: /var/log/koha/kohadev/sip-output.log 4) Observe the error: Couldn't become gid "<uid>": Operation not permitted 5) Apply this patch. 6) Repeat step 2. 7) Verify that the "Couldn't become gid" error is no longer logged.
Added assignee, changed status from "enhancement" to normal (as it fixes an error).
I attempted to test, but I don't see the error mentioned in step 4 of the test plan (koha clone = up-to-date with main, KTD = up-to-date with main, fresh images pulled). This is what is in the log file after entering sudo koha-sip --restart kohadev: 16 2025/12/22-03:54:44 Server closing! 17 [2025/12/22 03:54:44] [980] [WARN] [undef]@[undef]: 2025/12/22-03:54:44 Server closing! Net::Server::PreFork::__ANON__ /usr/share/perl5/Net/Server/PreFork.pm (266) 18 [2025/12/22 03:54:44] [980] [WARN] [undef]@[undef]: 2025/12/22-03:54:44 Server closing! Net::Server::log /usr/share/perl5/Net/Server.pm (962) 19 [2025/12/22 03:54:46] [2092] [ERROR] [undef]@[undef]: ERROR: Institution MAIN does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::sip log /kohadevbox/koha/C4/SIP/Sip.pm (327) 20 [2025/12/22 03:54:46] [2092] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary2 does does not match a branchcode. This can cause unexpected behavior. C4::SIP:: Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327) 21 [2025/12/22 03:54:46] [2092] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary does does not match a branchcode. This can cause unexpected behavior. C4::SIP::S ip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327) 22 2025/12/22-03:54:46 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2092) 23 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: 2025/12/22-03:54:46 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2092) Net::Server::run /usr/sha re/perl5/Net/Server.pm (52) 24 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: 2025/12/22-03:54:46 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2092) Net::Server::log /usr/sha re/perl5/Net/Server.pm (962) 25 Binding to TCP port 8023 on host 127.0.0.1 with IPv4 26 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328) 27 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962) 28 Binding to TCP port 6001 on host 127.0.0.1 with IPv4 29 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328) 30 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962) 31 Setting gid to "1000 1000" 32 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::post_bind /usr/share/perl5/Net/Server.pm (391) 33 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::log /usr/share/perl5/Net/Server.pm (962)
I updated the main branch for KohaCommunity. KTD also has an updated main branch. I start Docker with the command ktd --search-engine es7 up, then enter the shell with ktd --shell, and run sudo koha-sip --restart kohadev. Here is my fully log: ==> /var/log/koha/kohadev/sip-output.log <== 2025/12/22-15:47:27 Server closing! [2025/12/22 15:47:27] [998] [WARN] [undef]@[undef]: 2025/12/22-15:47:27 Server closing! Net::Server::PreFork::__ANON__ /usr/share/perl5/Net/Server/PreFork.pm (266) [2025/12/22 15:47:27] [998] [WARN] [undef]@[undef]: 2025/12/22-15:47:27 Server closing! Net::Server::log /usr/share/perl5/Net/Server.pm (962) [2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary2 does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327) [2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327) [2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: ERROR: Institution MAIN does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327) 2025/12/22-15:47:29 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2138) [2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: 2025/12/22-15:47:29 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2138) Net::Server::run /usr/share/perl5/Net/Server.pm (52) [2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: 2025/12/22-15:47:29 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2138) Net::Server::log /usr/share/perl5/Net/Server.pm (962) Binding to TCP port 8023 on host 127.0.0.1 with IPv4 [2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328) [2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962) Binding to TCP port 6001 on host 127.0.0.1 with IPv4 [2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328) [2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962) Setting gid to "501 501" [2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Setting gid to "501 501" Net::Server::post_bind /usr/share/perl5/Net/Server.pm (391) [2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Setting gid to "501 501" Net::Server::log /usr/share/perl5/Net/Server.pm (962) [2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: Couldn't become gid "501": Operation not permitted C4::SIP::Trapper::__ANON__ /kohadevbox/koha/C4/SIP/Trapper.pm (70) Couldn't become gid "501": Operation not permitted [2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Couldn't become gid "501": Operation not permitted Net::Server::PreForkSimple::post_bind /usr/share/perl5/Net/Server/PreForkSimple.pm (64) [2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Couldn't become gid "501": Operation not permitted Net::Server::log /usr/share/perl5/Net/Server.pm (962)
Hi Slava. Sorry, still not seeing the error on my KTD, it is setting gid to 1000 (I'm running the latest everything with fresh pulls and ktd up on an Ubuntu 22.04 desktop using docker engine - not the docker desktop for Linux). I don't know enough about SIP or docker to comment on why this is happening. Log from restarting: 16 2025/12/22-17:46:23 Server closing! 17 [2025/12/22 17:46:23] [982] [WARN] [undef]@[undef]: 2025/12/22-17:46:23 Server closing! Net::Server::PreFork::__ANON__ /usr/share/perl5/Net/Server/PreFork.pm (266) 18 [2025/12/22 17:46:23] [982] [WARN] [undef]@[undef]: 2025/12/22-17:46:23 Server closing! Net::Server::log /usr/share/perl5/Net/Server.pm (962) 19 [2025/12/22 17:46:25] [2204] [ERROR] [undef]@[undef]: ERROR: Institution MAIN does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohad evbox/koha/C4/SIP/Sip.pm (327) 20 [2025/12/22 17:46:25] [2204] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary2 does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplo g /kohadevbox/koha/C4/SIP/Sip.pm (327) 21 [2025/12/22 17:46:25] [2204] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327) 22 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: 2025/12/22-17:46:25 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2204) Net::Server::run /usr/share/perl5/N et/Server.pm (52) 23 2025/12/22-17:46:25 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2204) 24 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: 2025/12/22-17:46:25 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2204) Net::Server::log /usr/share/perl5/N et/Server.pm (962) 25 Binding to TCP port 8023 on host 127.0.0.1 with IPv4 26 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328) 27 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962) 28 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328) 29 Binding to TCP port 6001 on host 127.0.0.1 with IPv4 30 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962) 31 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::post_bind /usr/share/perl5/Net/Server.pm (391) 32 Setting gid to "1000 1000" 33 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::log /usr/share/perl5/Net/Server.pm (962) David
Thanks for checking this. Yes, I understand your point. On your test system the UID and GID are the same, so the problem does not manifest there. However, on systems where the GID differs from the UID, SIP starts with a group privilege error. This happens because Koha currently passes the effective UID as the Net::Server "group" parameter. Problematic code: push @params, 'user=' . $>; push @params, 'group=' . $>; Here the UID ($>) is passed for both user and group, while Net::Server expects a GID for the "group" parameter. This works on your system only because UID == GID. In that case the incorrect value happens to work by accident.
David, you can reproduce this by changing the GID of the existing Koha group. In the KTD koha container run: sudo groupmod -g 8001 kohadev-koha Then restart SIP: sudo koha-sip --restart kohadev SIP will start with the error: Couldn't become gid "<uid>": Operation not permitted After applying the patch, the error is no longer logged. I hope this helps to reproduce and verify the ERROR on your KTD.