Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
In ~50% of cases I am hitting this error
# pkcstok_migrate -s 3 -d /var/lib/opencryptoki/swtok -c /etc/opencryptoki/ -p 76543210 -u 01234567'
pkcstok_migrate: fopen(/proc/18832/cmdline) failed, errno=No such file or directory
pkcstok_migrate: Please stop pkcsslotd before running this utility.
pkcstok_migrate:
Summary of input parameters:
datastore = /var/lib/opencryptoki/swtok
confdir = /etc/opencryptoki
slot ID = 3
user PIN specified
SO PIN specified
pkcstok_migrate finished with warnings/errors.
I do not know what approach is used to check that pkcsslotd is stopped but it is definitely stopped.
I have added 5 seconds sleep to the test after pkcsslotd stop.
Also, there are no pkcsslotd services running and systemctl says:
pkcsslotd.service - Daemon which manages cryptographic hardware tokens for the openCryptoki package
Loaded: loaded (/usr/lib/systemd/system/pkcsslotd.service; disabled; vendor preset: disabled)
Active: inactive (dead)
May 24 12:32:46 foo.redhat.com systemd[1]: Stopping Daemon which manages cryptographic hardware tokens for the openCryptoki package...
May 24 12:32:46 foo.redhat.com pkcsslotd[18487]: Exiting on SIGTERM (15; 0xf)
May 24 12:32:46 foo.redhat.com systemd[1]: pkcsslotd.service: Succeeded.
May 24 12:32:46 foo.redhat.com systemd[1]: Stopped Daemon which manages cryptographic hardware tokens for the openCryptoki package.
Version-Release number of selected component (if applicable):
opencryptoki-3.15.1-5.el8
but happens also on RHEL-9 with opencryptoki-3.16.0-3.el9
How reproducible:
frequently
Steps to Reproduce:
1. stop pkcsslotd, wait a bit
2. run pkcstok_migrate utility
Actual results:
failure
Expected results:
migration proceeds
Additional info:
Automated test scenario is available at
https://src.fedoraproject.org/tests/opencryptoki/blob/main/f/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh
i have tried the openCryptoki-PIN-conversion-tool test more than 10 times on s390x beaker test machine without any problem. The test passed 100%
I don't have any idea why the test breaks randomly in your case. Without working testcase it's not possible to debug the problem.
Than
I understand. I am wondering what approach is the utility using to check that pkcsslotd has stopped. It could help me to add more checks to the test which could give us some hints where the problem is.
So I am able to reproduce the issue in about 1 out of 20 runs, this is obviously some race condition.
# echo y | pkcstok_migrate -s 3 -d /var/lib/opencryptoki/swtok -c /etc/opencryptoki/ -p 76543210 -u 01234567
pkcstok_migrate:
Summary of input parameters:
datastore = /var/lib/opencryptoki/swtok
confdir = /etc/opencryptoki
slot ID = 3
user PIN specified
SO PIN specified
pkcstok_migrate finished with warnings/errors.
pkcstok_migrate: fopen(/proc/1479737/cmdline) failed, errno=No such file or directory
pkcstok_migrate: Please stop pkcsslotd before running this utility.
I am not able to tell to which process the process ID 1479737 belongs to but I suspect it could be the 'echo y' process itself.
Anyway, looking at the source
https://github.com/opencryptoki/opencryptoki/blob/master/usr/sbin/pkcstok_migrate/pkcstok_migrate.c#L2496
it seems it cannot deal with a situation where the respective process is not running any more.
Unless a different method of checking if pkcsslotd is running (systemctl, PID file) can be used, the code should be at least able to handle a situation
when the required file does not exist, this is in fact quite expected for /proc content.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (opencryptoki bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2021:4448