Bug 2487452
| Summary: | upgrade f42->f44 is stuck , certmonger %post scriptlet deadlocks on /var/lib/certmonger/lock | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | pascal.tempier |
| Component: | certmonger | Assignee: | Rob Crittenden <rcritten> |
| Status: | NEW --- | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | urgent | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 44 | CC: | rcritten |
| Target Milestone: | --- | Keywords: | Upgrades |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Where are you seeing a certmonger -L invocation? This post-script removal of certmaster was added 6 years ago. It is surprising to see issues now. A workaround would be to disable running scripts during the update of certmonger, something like dnf --setopt=noscripts update certmonger. No idea why it was never encountered before, but here s the scriplet thats running
cat /var/tmp/rpm-tmp.tED3hO
if test $1 -eq 1 ; then
/usr/bin/dbus-send --system --type=method_call --dest=org.freedesktop.DBus / org.freedesktop.DBus.ReloadConfig 2>&1 || :
fi
# remove any existing certmaster CA configuration
if test $1 -gt 1 ; then
/usr/bin/getcert remove-ca -c certmaster 2>&1 || :
fi
if test $1 -eq 1 ; then
/bin/systemctl daemon-reload >/dev/null 2>&1 || :
fi
No idea why it was never encountered before, but here s the scriplet thats running
cat /var/tmp/rpm-tmp.tED3hO
if test $1 -eq 1 ; then
/usr/bin/dbus-send --system --type=method_call --dest=org.freedesktop.DBus / org.freedesktop.DBus.ReloadConfig 2>&1 || :
fi
# remove any existing certmaster CA configuration
if test $1 -gt 1 ; then
/usr/bin/getcert remove-ca -c certmaster 2>&1 || :
fi
if test $1 -eq 1 ; then
/bin/systemctl daemon-reload >/dev/null 2>&1 || :
fi
(In reply to pascal.tempier from comment #3) > No idea why it was never encountered before, but here s the scriplet thats > running > ... > # remove any existing certmaster CA configuration > if test $1 -gt 1 ; then > /usr/bin/getcert remove-ca -c certmaster 2>&1 || : > fi Right, so the getcert remove-ca should be using dbus to make the request, not invoking the certmonger daemon directly. Hence my confusion. ... any news ? Fix upstream there : https://codeberg.org/freeipa/certmonger/issues/312 |
During a dnf distro-sync upgrade (Fedora 41 → 44), the certmonger package update hangs indefinitely in its %post scriptlet: if test $1 -gt 1 ; then /usr/bin/getcert remove-ca -c certmaster 2>&1 || : fi This invokes: /usr/bin/certmonger -n -L -c /usr/bin/getcert remove-ca -c certmaster This process blocks forever in state S on fcntl_setlk, waiting for a lock on /var/lib/certmonger/lock. Root cause: The running certmonger daemon (/usr/sbin/certmonger -S -p /run/certmonger.pid -n -d2, started long before the upgrade) already holds an exclusive POSIX lock on /var/lib/certmonger/lock. The %post scriptlet's getcert -L (local/offline mode) invocation tries to take the same exclusive lock on the same file and deadlocks, since the running daemon never releases it. /proc/locks confirms the deadlock: 13: POSIX ADVISORY WRITE <daemon_pid> ... /var/lib/certmonger/lock 13: -> POSIX ADVISORY WRITE <scriptlet_pid> ... (waiting) This hangs the entire dnf transaction (and any wrapper, e.g. make upgrade), requiring manual intervention. Reproducible: Always Steps to Reproduce: Have certmonger daemon running (systemctl status certmonger active). Run dnf upgrade certmonger (or a full distro-sync that includes a certmonger update). Observe the transaction hangs on the %post scriptlet. Expected Results: The %post scriptlet should not deadlock against a running daemon instance — either by talking to the daemon over D-Bus instead of using -n -L (local/offline lock-based mode), or by using a non-blocking lock attempt with a timeout/fallback. Additional Information: certmonger-0.79.21-1.fc42.x86_64 certmonger-0.79.21-4.fc44.x86_64