freeipa

#5339 certmonger logs to syslog Permission denied by ipa-server-guard
Closed: Invalid Opened by canepan.

Closed: Invalid
Reopen Issue

Every 6 hours I find in syslog:

 ipa-server-guard: Traceback (most recent call last):
  File "/usr/libexec/certmonger/ipa-server-guard", line 51, in <module>
    sys.exit(main())
  File "/usr/libexec/certmonger/ipa-server-guard", line 41, in main
    env=os.environ)
  File "/usr/lib/python2.7/site-packages/ipapython/ipautil.py", line 321, in run
    preexec_fn=preexec_fn)
  File "/usr/lib64/python2.7/subprocess.py", line 711, in __init__
    errread, errwrite)
  File "/usr/lib64/python2.7/subprocess.py", line 1308, in _execute_child
    raise child_exception
OSError: [Errno 13] Permission denied

The problems seems to be that ipa-server-guard tries to execute "/", which is a directory

This looks like a SELinux issue.

Does {{{# ausearch -m avc}}} show anything relevant?

Does running {{{# restorecon /var/run/ipa}}} fix the problem?

SELinux is in permissive mode, and the only thong that it seems it would block is Kerberos log access (since I use a custom rotation script)

Canepan we need more information. From which information do you conclude that the issues is that "ipa-server-guard tries to execute "/", which is a directory "?

Note: ipa-server-guard executes a command which it receives as a parameter.

I used strace to launch certmonger, and I found:

# grep 27399.*execve certmonger.trace
27399 execve("/", ["/"], [/* 8 vars */] <unfinished ...>
27399 <... execve resumed> )            = -1 EACCES (Permission denied)

Could you please post output of:

# getcert list-cas

?

closing because of insufficient data

Metadata Update from @canepan:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE
Metadata
None
None
None
Normal
defect
IPA
0
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.