Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
The fix has been merged in the upstream and will be part of the next release. However! Customer will have to remove manually the answerfiles to ensure they are affected by a related issue which we cannot fix in the upcoming release:
# rm -f /var/log/leapp/answerfile*
The known issue will be documented in the main upgrade article. After the removal of the affected answerfiles and update to new packages, the issue will not be triggered anymore.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (leapp, leapp-repository, and cockpit-leapp bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2021:4603
Description of problem: When the RHEL7 system is configured to use sssd as authselect method, rebooting the system to perform the real upgrade fails due to authselectapply actor crashing: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Oct 14 07:37:15 localhost upgrade[628]: Process Process-190: Oct 14 07:37:15 localhost upgrade[628]: Traceback (most recent call last): Oct 14 07:37:15 localhost upgrade[628]: File "/usr/lib64/python3.6/multiprocessing/process.py", line 258, in _bootstrap Oct 14 07:37:15 localhost upgrade[628]: self.run() Oct 14 07:37:15 localhost upgrade[628]: File "/usr/lib64/python3.6/multiprocessing/process.py", line 93, in run Oct 14 07:37:15 localhost upgrade[628]: self._target(*self._args, **self._kwargs) Oct 14 07:37:15 localhost upgrade[628]: File "/root/tmp_leapp_py3/leapp/repository/actor_definition.py", line 72, in _do_run Oct 14 07:37:15 localhost upgrade[628]: actor_instance.run(*args, **kwargs) Oct 14 07:37:15 localhost upgrade[628]: File "/root/tmp_leapp_py3/leapp/actors/__init__.py", line 335, in run Oct 14 07:37:15 localhost upgrade[628]: self.process(*args) Oct 14 07:37:15 localhost upgrade[628]: File "/etc/leapp/repos.d/system_upgrade/el7toel8/actors/authselectapply/actor.py", line 31, in process Oct 14 07:37:15 localhost upgrade[628]: decision = next(self.consume(AuthselectDecision)) Oct 14 07:37:15 localhost upgrade[628]: StopIteration Oct 14 07:37:15 localhost upgrade[628]: ================================================================================================= Oct 14 07:37:15 localhost upgrade[628]: Actor authselect_apply unexpectedly terminated with exit code: 1 - Please check the above details Oct 14 07:37:15 localhost upgrade[628]: ================================================================================================= -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- The reason for this is a badly generated Answer file (/var/log/leapp/answerfile) which contains an invalid line, not in "Key = Value" format: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- [authselect_check] # Title: None # Reason: Confirmation # ========================== authselect_check.confirm ========================= # Label: Configure PAM and nsswitch.conf with the following authselect call? authselect select sssd with-fingerprint --force # Description: If yes, suggested authselect profile will be applied on your system to generate PAM and nsswitch.conf configuration. If no, current configuration will be kept intact. # Type: bool # Default: True # Available choices: True/False # Unanswered question. Uncomment the following line with your answer # confirm = True -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Digging into the code, it appears that the authselect_check actor creates a multi-line label: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 81 def get_confirmation(self, model, command): 82 dialog = self.dialogs[0] 83 84 dialog.components[0].label += "\n{}\n".format(command) 85 86 return self.get_answers(dialog).get('confirm') -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- And such multi-line properties are NOT supported by current leap "answerstore" code: leapp-0.12.1/leapp/messaging/answerstore.py: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 165 f.writelines([ 166 '# {}\n'.format(' {}.{} '.format(dialog.scope, component.key).center(77, '=')), 167 '# {:<20}{}\n'.format('Label:', component.label), 168 '# {:<20}{}\n'.format('Description:', component.description), 169 '# {:<20}{}\n'.format('Type:', component.value_type.__name__), 170 '# {:<20}{}\n'.format('Default:', default), 171 choices, 172 answer_entry, 173 '\n' 174 ]) -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Here above, on line 167, the following block will be generated: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # Label: Configure PAM and nsswitch.conf with the following authselect call? authselect select sssd with-fingerprint --force -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Whereas the proper code should generate something as shown below: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # Label: Configure PAM and nsswitch.conf with the following authselect call? # authselect select sssd with-fingerprint --force -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- or ideally something properly aligned: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # Label: Configure PAM and nsswitch.conf with the following authselect call? # authselect select sssd with-fingerprint --force -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Version-Release number of selected component (if applicable): leapp-0.12.1-1.el7_9.noarch How reproducible: Always Steps to Reproduce: 1. Modify /etc/sysconfig/authconfig to use SSSD -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # diff -u /etc/sysconfig/authconfig.orig /etc/sysconfig/authconfig --- /etc/sysconfig/authconfig.orig 2021-10-14 08:49:42.404000000 +0200 +++ /etc/sysconfig/authconfig 2021-10-14 11:36:08.709000000 +0200 @@ -1,6 +1,6 @@ CACHECREDENTIALS=yes FAILLOCKARGS="deny=4 unlock_time=1200" -FORCELEGACY=no +FORCELEGACY=yes FORCESMARTCARD=no IPADOMAINJOINED=no IPAV2NONTP=no @@ -23,7 +23,7 @@ USESHADOW=yes USESMARTCARD=no USESSSD=yes -USESSSDAUTH=no +USESSSDAUTH=yes USESYSNETAUTH=no USEWINBIND=no USEWINBINDAUTH=no # diff -u /etc/pam.d/system-auth.orig /etc/pam.d/system-auth --- /etc/pam.d/system-auth.orig 2021-10-14 08:50:17.816000000 +0200 +++ /etc/pam.d/system-auth 2021-10-14 11:38:34.556000000 +0200 @@ -5,15 +5,18 @@ auth required pam_faildelay.so delay=2000000 auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success +auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet +account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok +password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke @@ -21,3 +24,4 @@ -session optional pam_systemd.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so +session optional pam_sss.so -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 2. Execute "leapp preupgrade" 3. Check /var/log/leapp/answerfile content Actual results: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- [...] [authselect_check] # Title: None # Reason: Confirmation # ========================== authselect_check.confirm ========================= # Label: Configure PAM and nsswitch.conf with the following authselect call? authselect select sssd with-fingerprint --force # Description: If yes, suggested authselect profile will be applied on your system to generate PAM and nsswitch.conf configuration. If no, current configuration will be kept intact. [...] -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Expected results: Comments everywhere. Additional info: For robustness, all properties should be multi-line compliants, not only "label". Unit tests need to be added accordingly.