Bug 1895435
| Summary: | Adding DISA STIG during OS installation causes 'ipa-server-install' to fail | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | aheverle | ||||
| Component: | fapolicyd | Assignee: | Radovan Sroka <rsroka> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Dalibor Pospíšil <dapospis> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 8.3 | CC: | cilmar, dapospis, frenaud, lvrabec, mralph, rcritten, sgrubb, tscherf | ||||
| Target Milestone: | rc | Keywords: | Triaged, ZStream | ||||
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | fapolicyd-1.0.2-2.el8 | Doc Type: | No Doc Update | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 1905895 (view as bug list) | Environment: | |||||
| Last Closed: | 2021-05-18 16:22:41 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1905895 | ||||||
| Attachments: |
|
||||||
Re-assigning to pki-core component as the issue happens during the pkispawn step of ipa-server-install. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (fapolicyd bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2021:1952 |
Created attachment 1727184 [details] install log from test server Description of problem: When adding the DISA STIG security profile during OS installation causes 'ipa-server-install' to fail Version-Release number of selected component (if applicable): ipa-server-4.8.7-13.module+el8.3.0+8376+0bba7131.x86_64 How reproducible: Everytime Steps to Reproduce: 1. Add DISA security profile in OS installation UI 2. Attempt to install IDM Actual results: Failure Expected results: Success Additional info: A couple of things I have noticed during my testing. 1 - If you install the OS, enable FIPS post OS installation via CLI, and then execute 'ipa-server-install' it is successful. 2 - During the failed attempt, I was prompted to confirm I wanted to proceed with the installation with the modified umask from the STIG. I was not prompted for this change when I enabled FIPS via CLI. Error install log: DEBUG: Command: sudo -u pkiuser /usr/lib/jvm/jre-openjdk/bin/java -classpath /usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet-api.jar:/usr/share/pki/ca/webapps/ca /WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/* -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dcatalina.base=/var/lib/pki/pk i-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/etc/pki/pki-tomcat/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.redhat.fips=false org.dogtagpki.server.cli.PKIServerCLI ca-db-remove --force --debug Error: Could not find or load main class org.dogtagpki.server.cli.PKIServerCLI ERROR: CalledProcessError: Command '['sudo', '-u', 'pkiuser', '/usr/lib/jvm/jre-openjdk/bin/java', '-classpath', '/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/tomcat-servlet -api.jar:/usr/share/pki/ca/webapps/ca/WEB-INF/lib/*:/var/lib/pki/pki-tomcat/common/lib/*:/usr/share/pki/lib/*', '-Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourc eFactory', '-Dcatalina.base=/var/lib/pki/pki-tomcat', '-Dcatalina.home=/usr/share/tomcat', '-Djava.endorsed.dirs=', '-Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp', '-Djava.util.logg ing.config.file=/etc/pki/pki-tomcat/logging.properties', '-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager', '-Dcom.redhat.fips=false', 'org.dogtagpki.server.cli.PKI ServerCLI', 'ca-db-remove', '--force', '--debug']' returned non-zero exit status 1. File "/usr/lib/python3.6/site-packages/pki/server/pkispawn.py", line 575, in main scriptlet.spawn(deployer) File "/usr/lib/python3.6/site-packages/pki/server/deployment/scriptlets/configuration.py", line 820, in spawn subsystem.remove_database(force=True) File "/usr/lib/python3.6/site-packages/pki/server/subsystem.py", line 945, in remove_database self.run(cmd, as_current_user=as_current_user) File "/usr/lib/python3.6/site-packages/pki/server/subsystem.py", line 1137, in run subprocess.run(cmd, check=True) File "/usr/lib64/python3.6/subprocess.py", line 438, in run output=stdout, stderr=stderr)