Bug 1788718

Sorry the expected should be

OPTIONS="-g -q"

-q "exits just after setting the clock for the first time" so I don't think that is valid.

Is the concern that slew mode is not announced or that it is set at all?

This has been set since 2010.

Decision was made to fix in new installations only

The requested expected configuration goes beyond just dropping -x. It also suggests dropping -g (allow big time gaps) and adds -q (quit after sync).

-g is there to do the best possible to bring the machine into sync with current time in order to increase the chance that it can communicate with other machines over Kerberos and TLS. I guess it is normally used in conjunction with -x. What would the impact be if time is quite off without -g and -x? I assume the server will quite with a non-zero return code? We could catch that and quit installation if time can't be brought into sync.

Adding -q seems like something we don't want since we want ntpd to continue running, right?

Note to self: -x is also used in the client installer and also needs to be dropped.

Upstream ticket:
https://pagure.io/freeipa/issue/8242

Upstream PR https://github.com/freeipa/freeipa/pull/4454

Clearing needinfo, only removing -x.

Fixed upstream
ipa-4-6:
https://pagure.io/freeipa/c/2c1495460fcb0d58d27579bfbd6aba63b91bf985

Test added upstream
ipa-4-6:
https://pagure.io/freeipa/c/81b859795c72f6c96b27137cc24d6df327ca8471

version : ipa-server-4.6.8-1.el7


api.env: 
{'api_version': u'2.237',
 'bin': u'/bin',
 'ca_agent_install_port': None,
 'ca_agent_port': 443,
 'ca_ee_install_port': None,
 'ca_ee_port': 443,
 'ca_host': u'runner.testrelm.test',
 'ca_install_port': None,
 'ca_port': 80,
 'conf': u'/root/.ipa/cli.conf',
 'conf_default': u'/root/.ipa/default.conf',
 'confdir': u'/root/.ipa',
 'container_accounts': ipapython.dn.DN('cn=accounts'),
 'container_adtrusts': ipapython.dn.DN('cn=ad,cn=trusts'),
 'container_applications': ipapython.dn.DN('cn=applications,cn=configs,cn=policies'),
 'container_automember': ipapython.dn.DN('cn=automember,cn=etc'),
 'container_automount': ipapython.dn.DN('cn=automount'),
 'container_ca': ipapython.dn.DN('cn=cas,cn=ca'),
 'container_ca_renewal': ipapython.dn.DN('cn=ca_renewal,cn=ipa,cn=etc'),
 'container_caacl': ipapython.dn.DN('cn=caacls,cn=ca'),
 'container_certmap': ipapython.dn.DN('cn=certmap'),
 'container_certmaprules': ipapython.dn.DN('cn=certmaprules,cn=certmap'),
 'container_certprofile': ipapython.dn.DN('cn=certprofiles,cn=ca'),
 'container_cifsdomains': ipapython.dn.DN('cn=ad,cn=etc'),
 'container_configs': ipapython.dn.DN('cn=configs,cn=policies'),
 'container_custodia': ipapython.dn.DN('cn=custodia,cn=ipa,cn=etc'),
 'container_deleteuser': ipapython.dn.DN('cn=deleted users,cn=accounts,cn=provisioning'),
 'container_dna': ipapython.dn.DN('cn=dna,cn=ipa,cn=etc'),
 'container_dna_posix_ids': ipapython.dn.DN('cn=posix-ids,cn=dna,cn=ipa,cn=etc'),
 'container_dns': ipapython.dn.DN('cn=dns'),
 'container_dnsservers': ipapython.dn.DN('cn=servers,cn=dns'),
 'container_group': ipapython.dn.DN('cn=groups,cn=accounts'),
 'container_hbac': ipapython.dn.DN('cn=hbac'),
 'container_hbacservice': ipapython.dn.DN('cn=hbacservices,cn=hbac'),
 'container_hbacservicegroup': ipapython.dn.DN('cn=hbacservicegroups,cn=hbac'),
 'container_host': ipapython.dn.DN('cn=computers,cn=accounts'),
 'container_hostgroup': ipapython.dn.DN('cn=hostgroups,cn=accounts'),
 'container_locations': ipapython.dn.DN('cn=locations,cn=etc'),
 'container_masters': ipapython.dn.DN('cn=masters,cn=ipa,cn=etc'),
 'container_netgroup': ipapython.dn.DN('cn=ng,cn=alt'),
 'container_otp': ipapython.dn.DN('cn=otp'),
 'container_permission': ipapython.dn.DN('cn=permissions,cn=pbac'),
 'container_policies': ipapython.dn.DN('cn=policies'),
 'container_policygroups': ipapython.dn.DN('cn=policygroups,cn=configs,cn=policies'),
 'container_policylinks': ipapython.dn.DN('cn=policylinks,cn=configs,cn=policies'),
 'container_privilege': ipapython.dn.DN('cn=privileges,cn=pbac'),
 'container_radiusproxy': ipapython.dn.DN('cn=radiusproxy'),
 'container_ranges': ipapython.dn.DN('cn=ranges,cn=etc'),
 'container_realm_domains': ipapython.dn.DN('cn=Realm Domains,cn=ipa,cn=etc'),
 'container_rolegroup': ipapython.dn.DN('cn=roles,cn=accounts'),
 'container_roles': ipapython.dn.DN('cn=roles,cn=policies'),
 'container_s4u2proxy': ipapython.dn.DN('cn=s4u2proxy,cn=etc'),
 'container_selinux': ipapython.dn.DN('cn=usermap,cn=selinux'),
 'container_service': ipapython.dn.DN('cn=services,cn=accounts'),
 'container_stageuser': ipapython.dn.DN('cn=staged users,cn=accounts,cn=provisioning'),
 'container_sudocmd': ipapython.dn.DN('cn=sudocmds,cn=sudo'),
 'container_sudocmdgroup': ipapython.dn.DN('cn=sudocmdgroups,cn=sudo'),
 'container_sudorule': ipapython.dn.DN('cn=sudorules,cn=sudo'),
 'container_sysaccounts': ipapython.dn.DN('cn=sysaccounts,cn=etc'),
 'container_topology': ipapython.dn.DN('cn=topology,cn=ipa,cn=etc'),
 'container_trusts': ipapython.dn.DN('cn=trusts'),
 'container_user': ipapython.dn.DN('cn=users,cn=accounts'),
 'container_vault': ipapython.dn.DN('cn=vaults,cn=kra'),
 'container_views': ipapython.dn.DN('cn=views,cn=accounts'),
 'container_virtual': ipapython.dn.DN('cn=virtual operations,cn=etc'),
 'context': u'cli',
 'debug': False,
 'delegate': False,
 'dogtag_version': 9,
 'dot_ipa': u'/root/.ipa',
 'enable_ra': False,
 'env_confdir': None,
 'fallback': False,
 'fips_mode': False,
 'force_schema_check': False,
 'home': u'/root',
 'host': u'runner.testrelm.test',
 'http_timeout': 30,
 'in_server': False,
 'in_tree': True,
 'interactive': True,
 'ipalib': u'/usr/lib/python2.7/site-packages/ipalib',
 'kinit_lifetime': None,
 'log': u'/root/.ipa/log/cli.log',
 'logdir': u'/root/.ipa/log',
 'mode': u'developer',
 'mount_ipa': u'/ipa/',
 'nss_dir': u'/root/.ipa/nssdb',
 'plugins_on_demand': True,
 'prompt_all': False,
 'ra_plugin': u'selfsign',
 'recommended_max_agmts': 4,
 'replication_wait_timeout': 300,
 'rpc_protocol': u'jsonrpc',
 'script': u'/bin/ipa-run-tests',
 'site_packages': u'/usr/lib/python2.7/site-packages',
 'skip_version_check': False,
 'startup_timeout': 300,
 'startup_traceback': False,
 'tls_ca_cert': u'/root/.ipa/ca.crt',
 'tls_version_max': u'tls1.2',
 'tls_version_min': u'tls1.2',
 'validate_api': False,
 'verbose': 0,
 'version': u'4.6.8',
 'wait_for_dns': 0,
 'webui_prod': True}
uname: ('Linux', 'runner.testrelm.test', '3.10.0-1133.el7.x86_64', '#1 SMP Fri Apr 3 04:18:59 EDT 2020', 'x86_64')
euid: 0, egid: 0
working dir: /usr/lib/python2.7/site-packages/ipatests
sys.version: 2.7.5 (default, Mar 20 2020, 17:08:22) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-39)]
============================= test session starts ==============================
platform linux2 -- Python 2.7.5, pytest-3.10.1, py-1.8.1, pluggy-0.13.1 -- /usr/bin/python2
cachedir: .pytest_cache
metadata: {'Python': '2.7.5', 'Platform': 'Linux-3.10.0-1133.el7.x86_64-x86_64-with-redhat-7.9-Maipo', 'Packages': {'py': '1.8.1', 'pytest': '3.10.1', 'pluggy': '0.13.1'}, 'Plugins': {u'html': u'1.22.1', u'multihost': u'1.1', u'sourceorder': u'0.5', u'metadata': u'1.8.0'}}
rootdir: /usr/lib/python2.7/site-packages/ipatests, inifile:
plugins: metadata-1.8.0, html-1.22.1, multihost-1.1, sourceorder-0.5
collecting ... collected 10 items

test_integration/test_installation.py::TestInstallMaster::test_install_master PASSED [ 10%]
test_integration/test_installation.py::TestInstallMaster::test_slew_mode_not_configured PASSED [ 20%]   <<<<<<
test_integration/test_installation.py::TestInstallMaster::test_schema_compat_attribute_and_tree_disable PASSED [ 30%]


Automation passed. Hence marking the bug as verified.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: ipa security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:3936