Bug 676330 - init script cannot start service
Summary: init script cannot start service
Alias: None
Product: Fedora
Classification: Fedora
Component: dogtag-pki
Version: 19
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Matthew Harmsen
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2011-02-09 14:53 UTC by Rob Crittenden
Modified: 2015-02-18 11:06 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2015-02-18 11:06:34 UTC
Type: ---

Attachments (Terms of Use)

Description Rob Crittenden 2011-02-09 14:53:40 UTC
Description of problem:

This is likely related to the usage of systemd in rawhide.

[root@rawhide rcrit]# /sbin/service pki-cad start
Starting pki-cad (via systemctl):  Job failed. See system logs and 'systemctl status' for details.
[root@rawhide rcrit]# echo $?
[root@rawhide rcrit]# /sbin/service pki-cad restart
Restarting pki-cad (via systemctl):  Job failed. See system logs and 'systemctl status' for details.
[root@rawhide rcrit]# echo $?
[root@rawhide rcrit]# /sbin/service pki-cad stop
Stopping pki-cad (via systemctl):                          [  OK  ]
[root@rawhide rcrit]# echo $?

Version-Release number of selected component (if applicable):

rpm -qsystemd-17-3.fc15.x86_64

Comment 1 Matthew Harmsen 2011-02-12 00:58:11 UTC
This problem is almost certainly related to specific changes made to Fedora 15 in the pki-core.spec file to address the concerns of "Bugzilla Bug #656661 - Please Update Spec File to use %ghost on files in /var/run and /var/lock":

%package -n       pki-ca
%if 0%{?fedora} >= 15
# Details:
#     * https://fedoraproject.org/wiki/Features/var-run-tmpfs
#     * https://fedoraproject.org/wiki/Tmpfiles.d_packaging_draft
Requires:         initscripts


%if 0%{?fedora} >= 15
# Details:
#     * https://fedoraproject.org/wiki/Features/var-run-tmpfs
#     * https://fedoraproject.org/wiki/Tmpfiles.d_packaging_draft
%{__mkdir_p} %{buildroot}%{_sysconfdir}/tmpfiles.d
# generate 'pki-ca.conf' under the 'tmpfiles.d' directory
echo "D /var/lock/pki 0755 root root -"    >  %{buildroot}%{_sysconfdir}/tmpfiles.d/pki-ca.conf
echo "D /var/lock/pki/ca 0755 root root -" >> %{buildroot}%{_sysconfdir}/tmpfiles.d/pki-ca.conf
echo "D /var/run/pki 0755 root root -"     >> %{buildroot}%{_sysconfdir}/tmpfiles.d/pki-ca.conf
echo "D /var/run/pki/ca 0755 root root -"  >> %{buildroot}%{_sysconfdir}/tmpfiles.d/pki-ca.conf


%files -n pki-setup
%if 0%{?rhel} || 0%{?fedora} < 15
%dir %{_localstatedir}/lock/pki
%dir %{_localstatedir}/run/pki


%files -n pki-ca
%dir %{_localstatedir}/lock/pki/ca
%dir %{_localstatedir}/run/pki/ca
%if 0%{?fedora} >= 15
# Details:
#     * https://fedoraproject.org/wiki/Features/var-run-tmpfs
#     * https://fedoraproject.org/wiki/Tmpfiles.d_packaging_draft
%config(noreplace) %{_sysconfdir}/tmpfiles.d/pki-ca.conf

The details of this change are explained in the two referenced URLs and Bugzilla Bug #656661.  Unfortunately, for the past week, I have been unable to obtain a working Fedora 15 machine, and thus am blocked from debugging whether the issue is a problem with my implementation or a problem with the new 'tmpfiles.d' mechanism, or a problem with the new 'systemd' mechanism.

Comment 2 Matthew Harmsen 2011-02-16 04:32:10 UTC
We were able to fix standalone 'tomcat6' in our VM by performing the following changes:

# cd /etc/sysconfig
# diff tomcat6 tomcat6.orig
< CATALINA_BASE="/usr/share/tomcat6"
< CATALINA_HOME="/usr/share/tomcat6"
> #CATALINA_BASE="/usr/share/tomcat6"
> #CATALINA_HOME="/usr/share/tomcat6"
< TOMCAT_USER="tomcat"
> #TOMCAT_USER="tomcat"
< CATALINA_PID="/var/run/tomcat6.pid"
> #CATALINA_PID="/var/run/tomcat6.pid"

# chmod 775 /var/log/tomcat6

# chmod 775 /etc/tomcat6

Applying similar logic to address the issue in 'pki-cad',
we discovered that there was a change in '/etc/init.d/tomcat6'
between Fedora 14 and Fedora 15 -- it now makes use of the
CATALINA_HOME variable (that we were previously able to leave
undefined).  This was discovered by observing the following:

(1) /var/log/pki-ca/catalina.out:

Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/catalina/startup/Bootstrap
Caused by: java.lang.ClassNotFoundException: org.apache.catalina.startup.Bootstrap
	at java.net.URLClassLoader$1.run(URLClassLoader.java:217)
	at java.security.AccessController.doPrivileged(Native Method)
	at java.net.URLClassLoader.findClass(URLClassLoader.java:205)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:321)
	at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:294)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:266)
Could not find the main class: org.apache.catalina.startup.Bootstrap. Program will exit.

To address this issue, we set CATALINA_HOME=/var/lib/pki-ca in both /etc/sysconfig/pki-ca and /var/lib/pki-ca/conf/tomcat6.conf, and looped on 'ps -ef | grep java' to discover the following:

/usr/lib/jvm/java/bin/java -classpath :/var/lib/pki-ca/bin/bootstrap.jar:/var/lib/pki-ca/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/var/lib/pki-ca -Dcatalina.home=/var/lib/pki-ca -Djava.endorsed.dirs= -Djava.io.tmpdir= -Djava.util.logging.config.file=/var/lib/pki-ca/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start

NOTE:  The classpath is incorrect for bin/bootstrap.jar and bin/tomcat-juli.jar
       since they need to be preceded by /usr/share/tomcat6.

Unfortunately, simply changing CATALINA_HOME in both places to "/usr/share/tomcat6" did not work.

Additionally, leaving the CATALINA_HOME defined as /var/lib/pki-ca, we tried placing a symlink /var/lib/pki-ca/bin --> /usr/share/tomcat6/bin, but this did not work either.

Comment 3 John Dennis 2011-02-17 00:23:52 UTC
I understand what is going on, see the diff below to understand how they modified the initialization, here is issue in a nutshell

The expected behaviour is for the tomcat6 supplied config file to be read first, this establishes defaults for tomcat6. Then the instance config file is read which can selectively override the defaults. They changed the order, now the instance specific config is read first followed by the default tomcat6 config file which has the potential to undo the instance specific configuration. But what's worse is that the reading of the system supplied tomcat6 config file only occurs if the instance config file sets CATALINA_HOME, which we don't (because it's a system supplied value that we shouldn't be mucking with, e.g. it's part of the tomcat6 packaging).

If CATALINA_HOME is not set multiple things will blow up (as you've seen). Also because our instance config file does not set values normally set by the tomcat6 config there may be potentially other problems due to unset values.

If we set CATALINA_HOME then the tomcat6 supplied config file will be read *after* our per instance config and undo our settings.

IMHO I think they completely broke the initialization. I think perhaps they may have wanted to support using a different CATALINA_HOME set by the per instance config. If that's the case I don't think they understood the consequences. You would have to completely copy the contents of CATALINA_HOME and change it's conf/tomcat6.conf file so it doesn't undo the per instance settings. But wait, the entire point of partitioning CATALINA_HOME and CATALINA_BASE is exactly to allow per instance configuration while retaining the system supplied contents in CATALINA_HOME, so it seems to me this change is very broken. CATALINA_HOME is supposed to be an immutable property of the tomcat6 package (why? because it is essentially the run-time contents of the tomcat6 package)

But perhaps I'm missing something or not privy to the reasoning behind the change. I want to have a conversation with David Knox who made the change to understand what he thought he was trying to accomplish, the wording in the changelog is quite vague.

FWIW, I don't see this as "our" problem with something we need to adjust in our usage of tomcat6, at the moment it seems to me it's the tomcat6 package that needs fixing.  

git diff HEAD~5 tomcat6-6.0.init 
diff --git a/tomcat6-6.0.init b/tomcat6-6.0.init
index 4123f1c..43f53a4 100644
--- a/tomcat6-6.0.init
+++ b/tomcat6-6.0.init
@@ -43,17 +43,17 @@ else
     SU="/bin/su -s /bin/sh"
-# Get the tomcat config (use this for environment specific settings)
-if [ -r "$TOMCAT_CFG" ]; then
-    . $TOMCAT_CFG
 # Get instance specific config file
 if [ -r "/etc/sysconfig/${NAME}" ]; then
     . /etc/sysconfig/${NAME}
+# Get the tomcat config (use this for environment specific settings)
+if [ -r "$TOMCAT_CFG" ]; then
+    . $TOMCAT_CFG
 # Define which connector port to use
@@ -67,7 +67,7 @@ TOMCAT_PROG="${NAME}"
 # Define the tomcat log file
tomcat6 (f15)$

Comment 4 Rob Crittenden 2011-02-17 14:16:49 UTC
Does this suggest that if we pull the tomcat6 init script from F-14 it would work?

Comment 5 John Dennis 2011-02-17 14:40:57 UTC
re comment #4: 

I would think so, but I know better than to make claims for things I have not tested yet :-)

Comment 6 John Dennis 2011-02-17 17:07:28 UTC
I just finished communicating with David Knox and it seems he applied the patch per someone else's suggestion but upon further review after I pointed out the issues he agrees it was a mistake and is in the process of backing out the changes. Apparently it was also committed to f14.

Once I see the fix hit the f15 koji I'll download and test.

Comment 7 John Dennis 2011-03-14 18:52:34 UTC
I think we're O.K. now, this was fixed in tomcat6-6.0.30-3 built on 2/28, we're currently at tomcat6-6.0.30-5. There is no Bohdi push required because f15 has not been released. This change does not affect f14.

Comment 8 Fedora Admin XMLRPC Client 2012-03-06 23:09:55 UTC
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

Comment 9 Fedora Admin XMLRPC Client 2012-03-06 23:23:44 UTC
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

Comment 10 Fedora End Of Life 2013-04-03 20:28:12 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle.
Changing version to '19'.

(As we did not run this process for some time, it could affect also pre-Fedora 19 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.)

More information and reason for this action is here:

Comment 11 Fedora End Of Life 2015-01-09 22:29:00 UTC
This message is a notice that Fedora 19 is now at end of life. Fedora 
has stopped maintaining and issuing updates for Fedora 19. It is 
Fedora's policy to close all bug reports from releases that are no 
longer maintained. Approximately 4 (four) weeks from now this bug will
be closed as EOL if it remains open with a Fedora 'version' of '19'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 19 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 12 Fedora End Of Life 2015-02-18 11:06:34 UTC
Fedora 19 changed to end-of-life (EOL) status on 2015-01-06. Fedora 19 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this

Thank you for reporting this bug and we are sorry it could not be fixed.

Note You need to log in before you can comment on or make changes to this bug.