Bug 41458 - SIP passes UID instead of GID to Net::Server causing error
Summary: SIP passes UID instead of GID to Net::Server causing error
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: SIP2 (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Slava Shishkin
QA Contact: Testopia
URL:
Keywords:
Depends on: 36386
Blocks:
  Show dependency treegraph
 
Reported: 2025-12-16 17:20 UTC by Slava Shishkin
Modified: 2025-12-22 19:05 UTC (History)
1 user (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 41458: Pass a valid GID to Net::Server This change ensures that a valid numeric GID is passed instead. (1.26 KB, patch)
2025-12-16 17:28 UTC, Slava Shishkin
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Slava Shishkin 2025-12-16 17:20:34 UTC
When starting SIP, Koha passes an incorrect value to the Net::Server "group" parameter.

The code passes the effective UID ($>) instead of a group ID.
On systems where UID and GID differ, Net::Server attempts to switch
to a non-permitted group and logs an error.
SIP starts with this error and continues running.

To test:
1. Enter KTD shell.
2. Run:
     sudo koha-sip --restart kohadev
3. Check SIP logs and observe:
     [ERROR] [undef]@[undef]: Couldn't become gid "501": Operation not permitted C4::SIP::Trapper::__ANON__ /kohadevbox/koha/C4/SIP/Trapper.pm (70)
Comment 1 Slava Shishkin 2025-12-16 17:28:37 UTC
Created attachment 190555 [details] [review]
Bug 41458: Pass a valid GID to Net::Server This change ensures that a valid numeric GID is passed instead.

KTD Test Plan:
1) Enter KTD shell.
2) Restart SIP:
     sudo koha-sip --restart kohadev
3) Check SIP logs:
     /var/log/koha/kohadev/sip-output.log
4) Observe the error:
     Couldn't become gid "<uid>": Operation not permitted
5) Apply this patch.
6) Repeat step 2.
7) Verify that the "Couldn't become gid" error is no longer logged.
Comment 2 David Nind 2025-12-16 18:21:59 UTC
Added assignee, changed status from "enhancement" to normal (as it fixes an error).
Comment 3 David Nind 2025-12-22 03:58:12 UTC
I attempted to test, but I don't see the error mentioned in step 4 of the test plan (koha clone = up-to-date with main, KTD = up-to-date with main, fresh images pulled).

This is what is in the log file after entering sudo koha-sip --restart kohadev:

 16 2025/12/22-03:54:44 Server closing!
 17 [2025/12/22 03:54:44] [980] [WARN] [undef]@[undef]: 2025/12/22-03:54:44 Server closing! Net::Server::PreFork::__ANON__ /usr/share/perl5/Net/Server/PreFork.pm (266)
 18 [2025/12/22 03:54:44] [980] [WARN] [undef]@[undef]: 2025/12/22-03:54:44 Server closing! Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 19 [2025/12/22 03:54:46] [2092] [ERROR] [undef]@[undef]: ERROR: Institution MAIN does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::sip    log /kohadevbox/koha/C4/SIP/Sip.pm (327)
 20 [2025/12/22 03:54:46] [2092] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary2 does does not match a branchcode. This can cause unexpected behavior. C4::SIP::    Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327)
 21 [2025/12/22 03:54:46] [2092] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary does does not match a branchcode. This can cause unexpected behavior. C4::SIP::S    ip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327)
 22 2025/12/22-03:54:46 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2092)
 23 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: 2025/12/22-03:54:46 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2092) Net::Server::run /usr/sha    re/perl5/Net/Server.pm (52)
 24 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: 2025/12/22-03:54:46 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2092) Net::Server::log /usr/sha    re/perl5/Net/Server.pm (962)
 25 Binding to TCP port 8023 on host 127.0.0.1 with IPv4
 26 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
 27 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 28 Binding to TCP port 6001 on host 127.0.0.1 with IPv4
 29 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
 30 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 31 Setting gid to "1000 1000"
 32 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::post_bind /usr/share/perl5/Net/Server.pm (391)
 33 [2025/12/22 03:54:46] [2092] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::log /usr/share/perl5/Net/Server.pm (962)
Comment 4 Slava Shishkin 2025-12-22 16:20:56 UTC
I updated the main branch for KohaCommunity.
KTD also has an updated main branch.

I start Docker with the command ktd --search-engine es7 up,
then enter the shell with ktd --shell,
and run sudo koha-sip --restart kohadev.

Here is my fully log:

==> /var/log/koha/kohadev/sip-output.log <==
2025/12/22-15:47:27 Server closing!
[2025/12/22 15:47:27] [998] [WARN] [undef]@[undef]: 2025/12/22-15:47:27 Server closing! Net::Server::PreFork::__ANON__ /usr/share/perl5/Net/Server/PreFork.pm (266)
[2025/12/22 15:47:27] [998] [WARN] [undef]@[undef]: 2025/12/22-15:47:27 Server closing! Net::Server::log /usr/share/perl5/Net/Server.pm (962)
[2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary2 does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327)
[2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327)
[2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: ERROR: Institution MAIN does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohadevbox/koha/C4/SIP/Sip.pm (327)
2025/12/22-15:47:29 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2138)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: 2025/12/22-15:47:29 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2138) Net::Server::run /usr/share/perl5/Net/Server.pm (52)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: 2025/12/22-15:47:29 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2138) Net::Server::log /usr/share/perl5/Net/Server.pm (962)
Binding to TCP port 8023 on host 127.0.0.1 with IPv4
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
Binding to TCP port 6001 on host 127.0.0.1 with IPv4
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
Setting gid to "501 501"
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Setting gid to "501 501" Net::Server::post_bind /usr/share/perl5/Net/Server.pm (391)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Setting gid to "501 501" Net::Server::log /usr/share/perl5/Net/Server.pm (962)
[2025/12/22 15:47:29] [2138] [ERROR] [undef]@[undef]: Couldn't become gid "501": Operation not permitted C4::SIP::Trapper::__ANON__ /kohadevbox/koha/C4/SIP/Trapper.pm (70)
Couldn't become gid "501": Operation not permitted
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Couldn't become gid "501": Operation not permitted Net::Server::PreForkSimple::post_bind /usr/share/perl5/Net/Server/PreForkSimple.pm (64)
[2025/12/22 15:47:29] [2138] [WARN] [undef]@[undef]: Couldn't become gid "501": Operation not permitted Net::Server::log /usr/share/perl5/Net/Server.pm (962)
Comment 5 David Nind 2025-12-22 17:51:05 UTC
Hi Slava.

Sorry, still not seeing the error on my KTD, it is setting gid to 1000 (I'm running the latest everything with fresh pulls and ktd up on an Ubuntu 22.04 desktop using docker engine - not the docker desktop for Linux).

I don't know enough about SIP or docker to comment on why this is happening.

Log from restarting:

 16 2025/12/22-17:46:23 Server closing!
 17 [2025/12/22 17:46:23] [982] [WARN] [undef]@[undef]: 2025/12/22-17:46:23 Server closing! Net::Server::PreFork::__ANON__ /usr/share/perl5/Net/Server/PreFork.pm (266)
 18 [2025/12/22 17:46:23] [982] [WARN] [undef]@[undef]: 2025/12/22-17:46:23 Server closing! Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 19 [2025/12/22 17:46:25] [2204] [ERROR] [undef]@[undef]: ERROR: Institution MAIN does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog /kohad    evbox/koha/C4/SIP/Sip.pm (327)
 20 [2025/12/22 17:46:25] [2204] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary2 does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplo    g /kohadevbox/koha/C4/SIP/Sip.pm (327)
 21 [2025/12/22 17:46:25] [2204] [ERROR] [undef]@[undef]: ERROR: Institution kohalibrary does does not match a branchcode. This can cause unexpected behavior. C4::SIP::Sip::siplog     /kohadevbox/koha/C4/SIP/Sip.pm (327)
 22 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: 2025/12/22-17:46:25 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2204) Net::Server::run /usr/share/perl5/N    et/Server.pm (52)
 23 2025/12/22-17:46:25 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2204)
 24 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: 2025/12/22-17:46:25 C4::SIP::SIPServer (type Net::Server::PreFork) starting! pid(2204) Net::Server::log /usr/share/perl5/N    et/Server.pm (962)
 25 Binding to TCP port 8023 on host 127.0.0.1 with IPv4
 26 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
 27 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 8023 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 28 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::bind /usr/share/perl5/Net/Server.pm (328)
 29 Binding to TCP port 6001 on host 127.0.0.1 with IPv4
 30 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Binding to TCP port 6001 on host 127.0.0.1 with IPv4 Net::Server::log /usr/share/perl5/Net/Server.pm (962)
 31 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::post_bind /usr/share/perl5/Net/Server.pm (391)
 32 Setting gid to "1000 1000"
 33 [2025/12/22 17:46:25] [2204] [WARN] [undef]@[undef]: Setting gid to "1000 1000" Net::Server::log /usr/share/perl5/Net/Server.pm (962)

David
Comment 6 Slava Shishkin 2025-12-22 18:28:44 UTC
Thanks for checking this.

Yes, I understand your point.

On your test system the UID and GID are the same, so the problem does not
manifest there.

However, on systems where the GID differs from the UID, SIP starts with
a group privilege error. This happens because Koha currently passes the
effective UID as the Net::Server "group" parameter.

Problematic code:
    push @params, 'user='  . $>;
    push @params, 'group=' . $>;

Here the UID ($>) is passed for both user and group, while Net::Server
expects a GID for the "group" parameter.

This works on your system only because UID == GID.
In that case the incorrect value happens to work by accident.
Comment 7 Slava Shishkin 2025-12-22 19:05:46 UTC
David, you can reproduce this by changing the GID of the existing Koha group.
In the KTD koha container run:
    sudo groupmod -g 8001 kohadev-koha

Then restart SIP:
    sudo koha-sip --restart kohadev

SIP will start with the error:
    Couldn't become gid "<uid>": Operation not permitted

After applying the patch, the error is no longer logged.

I hope this helps to reproduce and verify the ERROR on your KTD.