RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2100251 - crypto_policies - rhel 8.7 default policy is FUTURE not DEFAULT
Summary: crypto_policies - rhel 8.7 default policy is FUTURE not DEFAULT
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: rhel-system-roles
Version: 9.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 9.1
Assignee: Rich Megginson
QA Contact: Jakub Haruda
URL:
Whiteboard: role:crypto_policies
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-06-22 20:52 UTC by Rich Megginson
Modified: 2022-11-15 11:25 UTC (History)
3 users (show)

Fixed In Version: rhel-system-roles-1.19.3-1.el9
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-11-15 10:23:47 UTC
Type: ---
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github linux-system-roles crypto_policies pull 42 0 None Merged Add cleanup to some tests to facilitate 'shared' test runs 2022-06-24 18:15:35 UTC
Red Hat Issue Tracker RHELPLAN-126027 0 None None None 2022-06-22 20:59:17 UTC
Red Hat Product Errata RHEA-2022:8117 0 None None None 2022-11-15 10:24:14 UTC

Description Rich Megginson 2022-06-22 20:52:26 UTC
Running the role against a rhel8.7 host - tests_default.yml fails because it expects the policy to be DEFAULT but it is FUTURE

Comment 1 Rich Megginson 2022-06-22 21:07:00 UTC
Here is the error:

TASK [linux-system-roles.crypto_policies : Find out what is the currently active policy] ***
task path: /home/rmeggins/linux-system-roles/crypto_policies/tests/roles/linux-system-roles.crypto_policies/tasks/gather_facts.yml:3
Wednesday 22 June 2022  14:47:15 -0600 (0:00:00.027)       0:00:04.041 ********
ok: [/home/rmeggins/.cache/linux-system-roles/rhel-8-y.qcow2.snap] => {
    "changed": false,
    "cmd": [
        "update-crypto-policies",
        "--show"
    ],
    "delta": "0:00:00.067432",
    "end": "2022-06-22 16:47:15.658127",
    "rc": 0,
    "start": "2022-06-22 16:47:15.590695"
}

STDOUT:

FUTURE

...

TASK [linux-system-roles.crypto_policies : Set current policy fact] ************
task path: /home/rmeggins/linux-system-roles/crypto_policies/tests/roles/linux-system-roles.crypto_policies/tasks/gather_facts.yml:9
Wednesday 22 June 2022  14:47:15 -0600 (0:00:00.460)       0:00:04.501 ********
ok: [/home/rmeggins/.cache/linux-system-roles/rhel-8-y.qcow2.snap] => {
    "ansible_facts": {
        "crypto_policies_active": "FUTURE"
    },
    "changed": false
}
META: role_complete for /home/rmeggins/.cache/linux-system-roles/rhel-8-y.qcow2.snap

...


TASK [Check the current policy is DEFAULT and common variables] ****************
task path: /home/rmeggins/linux-system-roles/crypto_policies/tests/tests_default.yml:13
Wednesday 22 June 2022  14:47:16 -0600 (0:00:00.009)       0:00:04.556 ********
fatal: [/home/rmeggins/.cache/linux-system-roles/rhel-8-y.qcow2.snap]: FAILED! => {
    "assertion": "crypto_policies_active == 'DEFAULT'",
    "changed": false,
    "evaluated_to": false
}

MSG:

Assertion failed

Comment 2 Jakub Jelen 2022-06-23 10:08:26 UTC
Not sure how it happened that your crypto policy is future. Either some previous test that failed to clean up left it in this state or something weird is going on there.

In any case, Alex took the crypto policies role so I reassigned the bug.

Comment 3 Rich Megginson 2022-06-23 14:27:31 UTC
(In reply to Jakub Jelen from comment #2)
> Not sure how it happened that your crypto policy is future. Either some
> previous test that failed to clean up left it in this state or something
> weird is going on there.

Yes, that's it - the test does not reset the state of the system.  We recently changed our testing to use a single VM for each set of tests, rather than for each test playbook.  This means each test needs to reset the system so that the next test can complete.  Something like this:

tests_something.yml

block:
  - include_role with given vars

  - verify settings were applied correctly
always:
  - reset system to default settings
    tags:
      - tests::cleanup

We tag the cleanup/reset tasks so that we can skip them if we are using the VM per-test
 
> In any case, Alex took the crypto policies role so I reassigned the bug.

Ok.  Alex, I think a couple of the crypto policies tests need to be changed - not all of them - tests_reboot.yml and a couple of other ones.

Comment 4 Alexander Sosedkin 2022-06-24 10:11:19 UTC
That complicates matters around quite a lot around crypto_policies_reboot_required

I've tried to follow your guidance in https://github.com/linux-system-roles/crypto_policies/pull/42

Comment 12 errata-xmlrpc 2022-11-15 10:23:47 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (rhel-system-roles bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2022:8117


Note You need to log in before you can comment on or make changes to this bug.