Bug 732064
| Summary: | IPA 2.1 won't start if SELinux is disabled | |||
|---|---|---|---|---|
| Product: | [Retired] freeIPA | Reporter: | Sigbjorn Lie <sigbjorn> | |
| Component: | ipa-server | Assignee: | Rob Crittenden <rcritten> | |
| Status: | CLOSED NEXTRELEASE | QA Contact: | Chandrasekar Kannan <ckannan> | |
| Severity: | high | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 2.0 | CC: | benl, dpal, dwalsh, jgalipea | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 732084 (view as bug list) | Environment: | ||
| Last Closed: | 2011-08-29 18:12:53 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 700505 | |||
| Bug Blocks: | 732084 | |||
This is fixed in upstream dogtag, bug https://bugzilla.redhat.com/show_bug.cgi?id=700505 Once a Fedora build is available with that fix we can update the minimum dogtag package requires. Upstream tracker https://fedorahosted.org/freeipa/ticket/1686 Fix in dogtag, updated deps in freeipa upstream: master: 3ef732d7381a8d59400a669009904e14c8265792 ipa-2-1: 28e6d137afa65f638ea6e748eb39bce9aa83e403 |
Description of problem: IPA 2.1 won't start if SELinux is disabled Version-Release number of selected component (if applicable): 2.1.0 How reproducible: I've just updated to FreeIPA 2.1.0. I disabled SELinux on this machine (Fedora 15) when I installed IPA, as there was a bug with IPA's SELinux ruleset, which made the ipa-server-install script fail. That decision seem to be biting my ass now, I get the following error message: "/usr/bin/runcon: /usr/bin/runcon may be used only on a SELinux kernel" whenever I attempt to start IPA. After configuring SELinux to be permissive the error disappears, and IPA starts normally. [root@ipa03 ~]# ipactl restart Restarting Directory Service Shutting down dirsrv: IX-TEST-COM... server already stopped [FAILED] PKI-IPA... server already stopped [FAILED] *** Error: 2 instance(s) unsuccessfully stopped [FAILED] Starting dirsrv: IX-TEST-COM... [ OK ] PKI-IPA... [ OK ] Restarting KDC Service Restarting krb5kdc (via systemctl): [ OK ] Restarting KPASSWD Service Restarting ipa_kpasswd (via systemctl): [ OK ] Restarting HTTP Service Restarting httpd (via systemctl): [ OK ] Restarting CA Service Stopping pki-ca: [ OK ] /usr/bin/runcon: /usr/bin/runcon may be used only on a SELinux kernel Failed to restart CA Service Shutting down Stopping krb5kdc (via systemctl): [ OK ] Stopping ipa_kpasswd (via systemctl): [ OK ] Stopping httpd (via systemctl): [ OK ] Stopping pki-ca: [ OK ] Shutting down dirsrv: IX-TEST-COM... [ OK ] PKI-IPA... [ OK ] Aborting ipactl [root@ipa03 ~]# getenforce Disabled Steps to Reproduce: 1. Disable SELinux 2. Reboot 3. Attempt to start IPA Actual results: IPA fails to start with the following error message: /usr/bin/runcon: /usr/bin/runcon may be used only on a SELinux kernel Expected results: IPA should check if SELinux is enabled before depending on SELinux commands to complete successfully Additional info: