Bug 990892

+++ This bug was initially created as a clone of Bug #989094 +++
...
--- Additional comment from Matthew Harmsen on 2013-07-31 21:01:00 EDT ---

(In reply to Ade Lee from comment #33)
> Actually, I think we found a case where the code above will fail.
> 
> The case is if the link exists and is pointing to the wrong location.  In
> that case, the -e test will fail - and then ln -s will fail because the link
> already exists.
> 
> That clearly is the case for the jss jar.  In F19, the JNI directory was
> moved as indicated.
> 
> The same is not true though for tomcatjss.  Can you tell us what the
> location of the tomcatjss link was?

Per Dean Hunter's info, the tomcatjss link would have been pointing to '/usr/share/java/tomcat7jss.jar' on Fedora 18, and once the tomcatjss was updated to the version on Fedora 19, it would have left the '/var/lib/pki/pki-tomcat/common/lib/tomcatjss.jar' still pointing to this non-existent file.  Consequently, the -e test would have failed exactly the same as in the jss case.

I believe that I have a potential solution - always attempt to remove a symbolic link prior to creating it (simply ignore the return value because it is a benign error if the symbolic link does not exist).

--- Additional comment from Matthew Harmsen on 2013-07-31 21:04:34 EDT ---

Per the previous comment, I would suggest adding the following in-line patch to the code from comment #30:

(In reply to Ade Lee from comment #30)
> I fixed the wiki entry.  Thanks for the catch.
> 
> I am totally befuddled by the messages though.  The startup code (in
> /usr/share/pki/scripts/operations does the following:
> 
> if [ -e ${symlink} ]; then
>    do stuff ..
> else 
>    echo "WARNING:  Symbolic link '${symlink}' does NOT exist!"
>    # Attempt to create the symbolic link and chown it.
>    make_symlink ${symlink} ${target} ${user} ${group}
> fi
> 
> 
> make_symlink()
> {
>     symlink="${1}"
>     target="${2}"
>     user="${3}"
>     group="${4}"
> 
>     rv=0
> 
>     echo "INFO:  Attempting to create '${symlink}' -> '${target}' . . ."
>     # Check to make certain that the expected target exists.
>     #
>     #     NOTE:  The symbolic link does NOT exist at this point.
>     #
>     if [ -e ${target} ]; then
>         # Check that the expected target is fully resolvable!
>         if [ ! `readlink -qe ${target}` ]; then
>             # Issue an ERROR that the target to which the
>             # symbolic link is expected to point is NOT fully resolvable!
>             echo "ERROR:  Failed making '${symlink}' -> '${target}'"\
>                  "since target '${target}' is NOT fully resolvable!"
>             rv=1
>         else
              # Always attempt to remove any existing symbolic link that may
              # already exist and be pointing to a non-existent target
              # (ignore any return value as the symlink will usually not exist)
              rm ${symlink}
>             # Attempt to create a symbolic link and 'chown' it.
>             ln -s ${target} ${symlink}
>             rv=$?
>             if [ $rv -eq 0 ]; then
>                 # NOTE:  Ignore 'chown' errors.
>                 chown -h ${user}:${group} ${symlink}
>                 echo "SUCCESS:  Created '${symlink}' -> '${target}'"
>             else
>                 echo "ERROR:  Failed to create '${symlink}' -> '${target}'!"
>                 rv=1
>             fi
>         fi
>     else
>         # Issue an ERROR that the target to which the
>         # symbolic link is expected to point does NOT exist.
>         echo "ERROR:  Failed making '${symlink}' -> '${target}'"\
>              "since target '${target}' does NOT exist!"
>         rv=1
>     fi
> 
>     return $rv
> }
> 
> So, its only trying to create the symlink if the symlink does not exist -
> and if the target exists, but then the ln -s is failing to create the link -
> and is reporting that it does so because the file exists!
> 
> Do the links -
> 
> /var/lib/pki/pki-tomcat/common/lib/jss4.jar -> /usr/lib/java/jss4.jar 
> /var/lib/pki/pki-tomcat/common/lib/tomcatjss.jar ->
> /usr/share/java/tomcatjss.jar
> 
> exist? (Along with their targets?)
> 
> I'll have to think more on how this could happen.  As a workaround, you can
> try to create them manually, and then try restarting the CA.
> 
> ln -s /usr/lib/java/jss4.jar /var/lib/pki/pki-tomcat/common/lib/jss4.jar
> ln -s /usr/share/java/tomcatjss.jar
> /var/lib/pki/pki-tomcat/common/lib/tomcatjss.jar
> systemctl restart pki-tomcatd

--- Additional comment from Martin Kosek on 2013-08-01 03:11:35 EDT ---

(In reply to Matthew Harmsen from comment #38)
> Per the previous comment, I would suggest adding the following in-line patch
> to the code from comment #30:

Ok, I will clone the bug to pki-ca so that you can track the proposed fix there.