Fedora Account System
Red Hat Associate
Red Hat Customer
During a dnf distro-sync upgrade (Fedora 41 → 44), the certmonger package update hangs indefinitely in its %post scriptlet: if test $1 -gt 1 ; then /usr/bin/getcert remove-ca -c certmaster 2>&1 || : fi This invokes: /usr/bin/certmonger -n -L -c /usr/bin/getcert remove-ca -c certmaster This process blocks forever in state S on fcntl_setlk, waiting for a lock on /var/lib/certmonger/lock. Root cause: The running certmonger daemon (/usr/sbin/certmonger -S -p /run/certmonger.pid -n -d2, started long before the upgrade) already holds an exclusive POSIX lock on /var/lib/certmonger/lock. The %post scriptlet's getcert -L (local/offline mode) invocation tries to take the same exclusive lock on the same file and deadlocks, since the running daemon never releases it. /proc/locks confirms the deadlock: 13: POSIX ADVISORY WRITE <daemon_pid> ... /var/lib/certmonger/lock 13: -> POSIX ADVISORY WRITE <scriptlet_pid> ... (waiting) This hangs the entire dnf transaction (and any wrapper, e.g. make upgrade), requiring manual intervention. Reproducible: Always Steps to Reproduce: Have certmonger daemon running (systemctl status certmonger active). Run dnf upgrade certmonger (or a full distro-sync that includes a certmonger update). Observe the transaction hangs on the %post scriptlet. Expected Results: The %post scriptlet should not deadlock against a running daemon instance — either by talking to the daemon over D-Bus instead of using -n -L (local/offline lock-based mode), or by using a non-blocking lock attempt with a timeout/fallback. Additional Information: certmonger-0.79.21-1.fc42.x86_64 certmonger-0.79.21-4.fc44.x86_64
Where are you seeing a certmonger -L invocation? This post-script removal of certmaster was added 6 years ago. It is surprising to see issues now. A workaround would be to disable running scripts during the update of certmonger, something like dnf --setopt=noscripts update certmonger.
No idea why it was never encountered before, but here s the scriplet thats running cat /var/tmp/rpm-tmp.tED3hO if test $1 -eq 1 ; then /usr/bin/dbus-send --system --type=method_call --dest=org.freedesktop.DBus / org.freedesktop.DBus.ReloadConfig 2>&1 || : fi # remove any existing certmaster CA configuration if test $1 -gt 1 ; then /usr/bin/getcert remove-ca -c certmaster 2>&1 || : fi if test $1 -eq 1 ; then /bin/systemctl daemon-reload >/dev/null 2>&1 || : fi
(In reply to pascal.tempier from comment #3) > No idea why it was never encountered before, but here s the scriplet thats > running > ... > # remove any existing certmaster CA configuration > if test $1 -gt 1 ; then > /usr/bin/getcert remove-ca -c certmaster 2>&1 || : > fi Right, so the getcert remove-ca should be using dbus to make the request, not invoking the certmonger daemon directly. Hence my confusion.
... any news ?
Fix upstream there : https://codeberg.org/freeipa/certmonger/issues/312