Bug 1991840

Description of problem:

The below error is observed in RHEL 8.4 in customer IPA environment where FIPS is enabled. The error is observed for IPA services. 

But this error can be observed in both FIPS and Non-FIPS environment.

- /var/log/messages

  ----------------------------------------------------------------------------
  Jul  6 12:35:21 ipaserver java[4621]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
  Jul  6 12:37:40 ipaserver sslget[4663]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
  Jul  6 12:37:42 ipaserver dogtag-ipa-renew-agent-submit[4783]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
  Jul  6 12:37:52 ipaserver certutil[5026]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
  Jul  6 12:39:55 ipaserver ns-slapd[5205]: usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock
  ----------------------------------------------------------------------------

- The customer environment is as below. 

  * /etc/redhat-release 
    Red Hat Enterprise Linux release 8.4 (Ootpa)

  * sos_commands/crypto/fips-mode-setup_--check
    FIPS mode is enabled.


1) Issue IPA server contains following files.
   
     - crypto-policies-20210209-1.gitbfb6bed.el8_3.noarch: /etc/crypto-policies/back-ends/nss.config

        ----------------------------------------------------------------------
        library=
        name=Policy
        NSS=flags=policyOnly,moduleDB
        config="disallow=ALL allow=HMAC-SHA256:HMAC-SHA1:HMAC-SHA384:HMAC-SHA512:SECP256R1:SECP384R1:SECP521R1:aes256-gcm:aes256-cbc:aes128-gcm:aes128-
        cbc:SHA256:SHA384:SHA512:SHA224:ECDHE-RSA:ECDHE-ECDSA:DHE-RSA:tls-version-min=tls1.2:dtls-version-min=dtls1.2:DH-MIN=2048:DSA-MIN=2048:RSA-
        MIN=2048"

        name=p11-kit-proxy
        library=p11-kit-proxy.so
        ----------------------------------------------------------------------

     - nss-3.53.1-17.el8_3.x86_64: /etc/crypto-policies/local.d/nss-p11-kit.config

       ---------------------------------
       name=p11-kit-proxy
       library=p11-kit-proxy.so
       ---------------------------------

     $ ls -l etc/crypto-policies/back-ends/nss.config
        -rw-rwxrw-+ 1 yank yank 391 Jun 23 18:05 etc/crypto-policies/back-ends/nss.config  

2) Removing parameters "name=p11-kit-proxy" and "library=p11-kit-proxy.so" resolves the error generation in "/var/log/messages" files.

3) If the file "/etc/crypto-policies/local.d/nss-p11-kit.config" is not present then when the below command is run a soft link file is created.

     # fips-mode-setup --enable

     After above command is run  the file "/etc/crypto-policies/back-ends/nss.config" is create as soft link to "/usr/share/crypto-policies/FIPS/nss.txt"
     which does not have the 2 parameter and no error is observed.

   
     - # cat /usr/share/crypto-policies/FIPS/nss.txt
       ----------------------------------------------------------------------
       library=
       name=Policy
       NSS=flags=policyOnly,moduleDB
       config="disallow=ALL allow=HMAC-SHA256:HMAC-SHA1:HMAC-SHA384:HMAC-SHA512:SECP256R1:SECP384R1:SECP521R1:aes256-gcm:aes256-cbc:aes128-gcm:aes128-
       cbc:SHA256:SHA384:SHA512:SHA224:ECDHE-RSA:ECDHE-ECDSA:DHE-RSA:tls-version-min=tls1.2:dtls-version-min=dtls1.2:DH-MIN=2048:DSA-MIN=2048:RSA-
       MIN=2048"
       ----------------------------------------------------------------------

      $ ls -l /etc/crypto-policies/back-ends/nss.config
         lrwxrwxrwx. 1 root root 39 Jul 28 16:33 /etc/crypto-policies/back-ends/nss.config -> /usr/share/crypto-policies/FIPS/nss.txt

4) As per link [1] it was mentioned that the issue was fixed in IPA 4.8.0 for softHSM but on further review it was only for testing. 
   Please refer PR links [2] and [3]

5) As mentioned in point 2, the error is not observed if the 2 parameter is removed from the file.

    But instead of work around, is there any other method through which we can avoid the error? 


[1]: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/XFYVC6MUAKYLRIR6H6WM6SD4USLMIG2E/
[2]: https://github.com/freeipa/freeipa/pull/2680
[3]: https://github.com/freeipa/freeipa/pull/2679



Version-Release number of selected component (if applicable):

ipa-server-4.9.2-3.module+el8.4.0+10412+5ecb5b37.x86_64

How reproducible:

Always

Steps to Reproduce:

1. Make sure file "/etc/crypto-policies/local.d/nss-p11-kit.config" is present.

2. Enable FIPS as below.

   # fips-mode-setup --enable
 
3. Reboot the server.

4. Make sure the below is a normal file and has entries entries parameters 
   "name=p11-kit-proxy" and "library=p11-kit-proxy.so" 

   # ls -l /etc/crypto-policies/back-ends/nss.config

   # cat /etc/crypto-policies/back-ends/nss.config

5. Restart IPA service

   # ipactl restart
   # ipactl status

6. Check for the error in "/var/log/messages" file.

   # grep LCK..APIlock /var/log/messages


Actual results:

Error "usr/lib/api/apiutil.c Could not open /run/lock/opencryptoki/LCK..APIlock" is observed for IPA services in "/var/log/messages".

Expected results:

The error should not be observed.

Additional info:

There does not seems to be any impact on IPA performance / operations.