Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1704227

Summary:	Wrong logic in ipactl restart leads to start instead of restart pki-tomcatd
Product:	Red Hat Enterprise Linux 7	Reporter:	Florence Blanc-Renaud <frenaud>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.7	CC:	myusuf, ndehadra, pvoborni, rcritten, tscherf
Target Milestone:	rc	Keywords:	TestBlocker
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-4.6.5-7.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-06 13:09:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Florence Blanc-Renaud 2019-04-29 11:39:45 UTC

Cloned from upstream: https://pagure.io/freeipa/issue/7927

### Issue
The first call to ipactl restart writes a wrong service list in `/var/run/ipa/services.list` (it removes pki-tomcatd). As a consequence, subsequent calls to `ipactl restart` call `systemctl start pki-tomcatd` instead of `systemctl restart pki-tomcatd`, and the service is not restarted, the current service is left running.

In some circumstances this can be problematic, for instance when a restart is needed in order to use a new server certificate.

#### Steps to Reproduce
1. Check pki-tomcat pid with `ps -ef | grep pki-tomcat`
2. Check the content of services.list:
```
$ cat /var/run/ipa/services.list
["dirsrv", "krb5kdc", "kadmin", "named", "httpd", "ipa-custodia", "ipa-otpd", "ipa-dnskeysyncd", "pki-tomcatd"]
```
3. restart the services
```
# ipactl restart
Stopping pki-tomcatd Service
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
Restarting ipa-dnskeysyncd Service
ipa: INFO: The ipactl command was successful
```
Note the first line contains `Stopping pki-tomcatd Service`, which is unexpected
4. Check the PID of pki-tomcatd: this is a new process
5. Check the content of services.list:
```
# cat /var/run/ipa/services.list
["dirsrv", "krb5kipactl restart", "ipa-custodia", "ipa-otpd", "ipa-dnskeysyncd"]
```
Note that pki-tomcatd has disappeared
6. restart the services
```
# ipactl restart
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting ipa-otpd Service
Restarting ipa-dnskeysyncd Service
Starting pki-tomcatd Service
ipa: INFO: The ipactl command was successful
```
Note the line `Starting pki-tomcatd` instead of `Restarting pki-tomcatd`.
7. Check the PID of pki-tomcatd: this is the same PID as in step 4, i.e. pki-tomcatd was not restarted.

#### Actual behavior
The second occurrence of `ipactl restart` did not restart pki-tomcatd.

#### Expected behavior
ipactl restart should restart pki-tomcatd.

#### Version/Release/Distribution
freeipa-server-4.7.2-1.1.fc29.x86_64

Comment 2 Florence Blanc-Renaud 2019-04-29 11:42:04 UTC

Upstream ticket:
https://pagure.io/freeipa/issue/7927

Comment 3 Florence Blanc-Renaud 2019-04-29 11:43:56 UTC

The most notable consequence of this BZ is that the second round of ipa-cert-fix will fail while restarting IPA services.

Comment 4 Florence Blanc-Renaud 2019-04-29 11:45:16 UTC

Fixed upstream:
master:
    https://pagure.io/freeipa/c/161008d5caea953973b3f70e1f9fc502bc211c68 ipactl restart: fix wrong logic when checking service list

ipa-4-7:
    https://pagure.io/freeipa/c/d792544d7fa084821d430c9f2eb9fc53fd6fd22e ipactl restart: fix wrong logic when checking service list

ipa-4-6:
    https://pagure.io/freeipa/c/0a8ca73324f9f1d600329dd6452e74ce398993a3 ipactl restart: fix wrong logic when checking service list

Comment 7 Mohammad Rizwan 2019-05-08 06:33:54 UTC

version:
ipa-server-4.6.5-7.el7.x86_64

Actual result:
[root@master ~]# ps -ef | grep pki-tomcat
pkiuser   8666     1  3 02:03 ?        00:00:32 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -DRESTEASY_LIB=/usr/share/java/resteasy-base -Djava.library.path=/usr/lib64/nuxwdog-jni -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.security.manager -Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy org.apache.catalina.startup.Bootstrap start
root      9966  4023  0 02:21 pts/0    00:00:00 grep --color=auto pki-tomcat
[root@master ~]# 
[root@master ~]# cat /var/run/ipa/services.list
["dirsrv", "krb5kdc", "kadmin", "named", "httpd", "ipa-custodia", "pki-tomcatd", "ipa-otpd", "ipa-dnskeysyncd"][root@master ~]# 
[root@master ~]# 
[root@master ~]# 
[root@master ~]# ipactl restart
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
Restarting ipa-dnskeysyncd Service
ipa: INFO: The ipactl command was successful
[root@master ~]# 
[root@master ~]# ps -ef | grep pki-tomcat
pkiuser  10422     1 99 02:23 ?        00:00:31 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -DRESTEASY_LIB=/usr/share/java/resteasy-base -Djava.library.path=/usr/lib64/nuxwdog-jni -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.security.manager -Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy org.apache.catalina.startup.Bootstrap start
root     10621  4023  0 02:23 pts/0    00:00:00 grep --color=auto pki-tomcat
[root@master ~]# 
[root@master ~]# cat /var/run/ipa/services.list
["dirsrv", "krb5kdc", "kadmin", "named", "httpd", "ipa-custodia", "pki-tomcatd", "ipa-otpd", "ipa-dnskeysyncd"][root@master ~]# 
[root@master ~]# ipactl restart
Restarting Directory Service
Restarting krb5kdc Service
Restarting kadmin Service
Restarting named Service
Restarting httpd Service
Restarting ipa-custodia Service
Restarting pki-tomcatd Service
Restarting ipa-otpd Service
Restarting ipa-dnskeysyncd Service
ipa: INFO: The ipactl command was successful
[root@master ~]# 
[root@master ~]# ps -ef | grep pki-tomcat
pkiuser  11090     1 99 02:28 ?        00:00:29 /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -DRESTEASY_LIB=/usr/share/java/resteasy-base -Djava.library.path=/usr/lib64/nuxwdog-jni -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/var/lib/pki/pki-tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/lib/pki/pki-tomcat/temp -Djava.util.logging.config.file=/var/lib/pki/pki-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.security.manager -Djava.security.policy==/var/lib/pki/pki-tomcat/conf/catalina.policy org.apache.catalina.startup.Bootstrap start
root     11291  4023  0 02:28 pts/0    00:00:00 grep --color=auto pki-tomcat
[root@master ~]# 


Expected result:
ipactl restart should restart pki-tomcatd.


ipactl restart restarted the pki-tomcat service. Based on above observations, marking the bug as verified.

Comment 9 Florence Blanc-Renaud 2019-05-28 07:45:02 UTC

Fixed upstream
master:
https://pagure.io/freeipa/c/581b7148f4560cd0595b2c771b6eef2fac5dc93b

Comment 10 Florence Blanc-Renaud 2019-05-28 13:31:16 UTC

Fixed upstream
ipa-4-6:
https://pagure.io/freeipa/c/4076c79d59a7086bde60b2effbb874b1fe1d2ed6

Comment 11 Rob Crittenden 2019-05-28 18:59:24 UTC

Fixed upstream
ipa-4-7:
https://pagure.io/freeipa/c/b4410ee5f5592f47cd44762c84b62c50a5b3e203

Comment 13 errata-xmlrpc 2019-08-06 13:09:37 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2241