RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1980378 - 'keyctl_search: Required key not available' message when running 'ipa-healthcheck'
Summary: 'keyctl_search: Required key not available' message when running 'ipa-healthc...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: pki-core
Version: 8.4
Hardware: x86_64
OS: Linux
high
medium
Target Milestone: beta
: ---
Assignee: Endi Sukma Dewata
QA Contact: PKI QE
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-07-08 14:12 UTC by Maria
Modified: 2024-12-20 20:25 UTC (History)
16 users (show)

Fixed In Version: pki-core-10.6-8060020211115121442.7e0b02f6
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-05-10 13:51:03 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHCS-2597 0 None None None 2021-11-11 15:11:41 UTC
Red Hat Product Errata RHSA-2022:1851 0 None None None 2022-05-10 13:51:29 UTC

Description Maria 2021-07-08 14:12:51 UTC 
Description of problem:

After the customer upgrade to the latest version of ipa-healthcheck the error "keyctl_search: Required key not available" below started to show up when they run ipa-healthcheck:

# ipa-healthcheck --debug --source pki.server.healthcheck.clones.connectivity_and_data
Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
keyctl_search: Required key not available
Enter password for :
...
...
...

Version-Release number of selected component (if applicable):

kernel-4.18.0-305.3.1.el8_4.x86_64
ipa-healthcheck-0.7-3.module+el8.4.0+9007+5084bdd8.noarch 

How reproducible:

always
Comment 3 Rob Crittenden 2021-07-13 19:07:26 UTC 
See upstream issue https://github.com/dogtagpki/pki/issues/3650
Comment 7 Mike Murphy 2021-10-26 21:56:08 UTC 
Hi,

Checking to see if we have an update on this. I have a customer experiencing the same issue after patching. They use this module to forward results to an upstream SIEM:

ipa-healthcheck-0.7-3.module+el8.4.0+9007+5084bdd8.noarch   Mon Oct 25 17:04:14 2021
kernel-4.18.0-305.19.1.el8_4.x86_64                         Mon Oct 25 17:04:16 2021

uname -a
4.18.0-305.19.1.el8_4.x86_64 #1 SMP Tue Sep 7 07:07:31 EDT 2021 x86_64 x86_64 x86_64 GNU/Linux



[root@<obfuscated ~]# ipa-healthcheck --failures-only
keyctl_search: Required key not available
Enter password for Internal Key Storage Token:

At this prompt if I do not enter a value and just hit enter at this promoted message I get this:
[root@<obfuscated> ~]# ipa-healthcheck --failures-only
keyctl_search: Required key not available
Enter password for Internal Key Storage Token:
[]
Comment 9 Endi Sukma Dewata 2021-10-27 01:21:18 UTC 
Fixed in v10.12 branch:
https://github.com/dogtagpki/pki/commit/d5801380f4b7ac3d7a81e63efbbddd15930b7b2a
Comment 15 Mike Murphy 2021-12-13 20:34:29 UTC 
Hi,

We are requesting an update. Is there anything we can provide to assist with this?
Comment 16 Chris Kelley 2021-12-14 10:34:53 UTC 
Hi Mike, the bug is ON_QA waiting to be verified by QE.
Comment 18 Sudhir Menon 2022-01-17 15:31:12 UTC 
Marking the bug as FailedQA based on observation

pki-ca-10.12.0-0.1.module+el8.6.0+13291+248751b1.noarch
pki-server-10.12.0-0.1.module+el8.6.0+13291+248751b1.noarch
ipa-healthcheck-0.7-8.module+el8.6.0+13764+6ba37dc8.noarch
ipa-server-4.9.8-2.module+el8.6.0+13621+937b8cd9.x86_64


[root@server ~]# ipa-healthcheck --debug --source pki.server.healthcheck.clones.connectivity_and_data
Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'
Source 'pki.server.healthcheck.clones.connectivity_and_data' not found
Comment 22 Endi Sukma Dewata 2022-01-25 17:30:54 UTC 
Just an update, it looks like the problem reported in the original
bug description (i.e. password prompt) was fixed, but apparently
there's a different issue affecting the healthcheck tool for KRA
clones. It's still being investigated.
Comment 23 Rob Crittenden 2022-01-26 12:49:45 UTC 
My apologies, I thought I had already restored the state. The healthcheck failure is being tracked in a separate BZ, https://bugzilla.redhat.com/show_bug.cgi?id=2041995 , and is unrelated to your change. You can continue the bug cycle on this one.
Comment 24 Rob Crittenden 2022-01-27 19:21:38 UTC 
Removing the FailedQA and moving back to ON_QA.

This change didn't fail. A different bug in ipa-healthcheck prevented the pki healthchecks from being run.
Comment 25 Endi Sukma Dewata 2022-01-28 20:04:59 UTC 
Just FYI the other pki-healthcheck issue (i.e. not the password prompt) is being addressed in bug #2027470.
Comment 30 errata-xmlrpc 2022-05-10 13:51:03 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: pki-core:10.6 security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:1851
Note You need to log in before you can comment on or make changes to this bug.