freeipa

#9913 Upgrade from RHEL 9.4 to 9.6+ breaks ipa-dnskeysyncd
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

This is a clone of RHEL-137585 ipa-server-upgrade succeeds but ipactl restart fails due to ipa-dnskeysyncd service failure caused by SELinux AVC denial on RHEL 9.8

Steps to Reproduce

  1. Install ipa on RHEL 9.4
  2. Update to 9.6

Actual behavior

The upgrade reports an issue with ipa-server scriptlet

  Running scriptlet: ipa-server-4.13.0-1.el9.x86_64                     666/666 
Job for ipa.service failed because the control process exited with error code.
See "systemctl status ipa.service" and "journalctl -xeu ipa.service" for details.

The journal shows:

Jan 05 11:59:55 master.testrealm.test systemd[1]: ipa-dnskeysyncd.service: Scheduled restart job, restart counter is at 4.
Jan 05 11:59:55 master.testrealm.test systemd[1]: Stopped IPA key daemon.
Jan 05 11:59:55 master.testrealm.test systemd[1]: ipa-dnskeysyncd.service: Consumed 3.588s CPU time.
Jan 05 11:59:55 master.testrealm.test systemd[1]: Starting IPA key daemon...
Jan 05 11:59:55 master.testrealm.test systemd-tmpfiles[57264]: <stdin>:1: Path '2770' not absolute.
Jan 05 11:59:55 master.testrealm.test systemd-tmpfiles[57264]: <stdin>:2: Path '-' not absolute.
Jan 05 11:59:55 master.testrealm.test systemd-tmpfiles[57264]: <stdin>:3: Path '-' not absolute.
Jan 05 11:59:55 master.testrealm.test systemd-tmpfiles[57264]: <stdin>:4: Path '-' not absolute.
Jan 05 11:59:55 master.testrealm.test systemd[1]: ipa-dnskeysyncd.service: Control process exited, code=exited, status=65/DATAERR
Jan 05 11:59:55 master.testrealm.test systemd[1]: ipa-dnskeysyncd.service: Failed with result 'exit-code'.
Jan 05 11:59:55 master.testrealm.test systemd[1]: Failed to start IPA key daemon.

Version: ipa-server-4.13.0-1.el9.x86_64.rpm

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-137585

The systemd unit file for ipa-dnskeysyncd contains env variables that are not defined (DNSSEC_TOKENS_DIR and DNSSEC_SOFTHSM_PIN):

# cat /usr/lib/systemd/system/ipa-dnskeysyncd.service
[Unit]
Description=IPA key daemon[Service]
Environment=LC_ALL=C.UTF-8
EnvironmentFile=/etc/sysconfig/ipa-dnskeysyncd
ExecStartPre=/bin/sh -c '/bin/sed -e "s,@DNSSEC_TOKENS_DIR@,${DNSSEC_TOKENS_DIR},g;s,@DNSSEC_SOFTHSM_PIN@,${DNSSEC_SOFTHSM_PIN},g" /usr/share/ipa/ipa-dnssec.conf | /usr/bin/systemd-tmpfiles --create -'
ExecStart=/usr/libexec/ipa/ipa-dnskeysyncd
User=ods
Group=named
SupplementaryGroups=ods
PrivateTmp=yes
Restart=on-failure
RestartSec=60s[Install]
WantedBy=multi-user.target

They should have been set in /etc/sysconfig/ipa-dnskeysyncd but the current content is:

# cat /etc/sysconfig/ipa-dnskeysyncd
SOFTHSM2_CONF=/etc/ipa/dnssec/softhsm2.conf
OPENSSL_CONF=/etc/ipa/dnssec/openssl.cnf

Because they are not set, the ExecStartPre command passes a wrong content to systemd-tmpfiles:

# /bin/sed -e "s,@DNSSEC_TOKENS_DIR@,${DNSSEC_TOKENS_DIR},g;s,@DNSSEC_SOFTHSM_PIN@,${DNSSEC_SOFTHSM_PIN},g" /usr/share/ipa/ipa-dnssec.conf 
d        2770    ods    named
A+        -    -    -    -    group:named:rw,user:ods:rw
Z        -    -    -    -    -
z        -    ods    named    -    -

instead of 

# export DNSSEC_TOKENS_DIR=/var/lib/ipa/dnssec/tokens;export DNSSEC_SOFTHSM_PIN=/var/lib/ipa/dnssec/softhsm_pin; /bin/sed -e "s,@DNSSEC_TOKENS_DIR@,${DNSSEC_TOKENS_DIR},g;s,@DNSSEC_SOFTHSM_PIN@,${DNSSEC_SOFTHSM_PIN},g" /usr/share/ipa/ipa-dnssec.conf
d    /var/lib/ipa/dnssec/tokens    2770    ods    named
A+    /var/lib/ipa/dnssec/tokens    -    -    -    -    group:named:rw,user:ods:rw
Z    /var/lib/ipa/dnssec/tokens    -    -    -    -    -
z    /var/lib/ipa/dnssec/softhsm_pin    -    ods    named    -    -

The upgrade must update the content of /etc/sysconfig/ipa-dnskeysyncd and add the following 2 lines:

DNSSEC_TOKENS_DIR=/var/lib/ipa/dnssec/tokens
DNSSEC_SOFTHSM_PIN=/var/lib/ipa/dnssec/softhsm_pin

There is some upgrade code but it doesn't get called on RHEL 9:
https://github.com/freeipa/freeipa/blob/ba89a6b29c6c0cde8c530aac4cad2fc816469da9/ipaserver/install/server/upgrade.py#L533-L553

The method dnskeysyncd.setup_ipa_dnskeysyncd_sysconfig() is the one that should update the content of /etc/sysconfig/ipa-dnskeysyncd. The code doesn't reach that point because both constants.NAMED_OPENSSL_ENGINE and constants.NAMED_OPENSSL_PROVIDER are None.

On RHEL9, the code should use OPENSSL_ENGINE:
https://github.com/freeipa/freeipa/blob/ba89a6b29c6c0cde8c530aac4cad2fc816469da9/ipaplatform/rhel/constants.py#L21

HAS_PKCS11_OPENSSL_ENGINE = osinfo.version_number == (9,)

but osinfo.version_number is (9,6), not (9,)

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8084

master:

  • c896e5e1dffe82a327f5d9928bf0c1e60cab61ea Upgrade: use openssl_engine on rhel9

ipa-4-13:

  • 6ddd9d978ac1d70acf688667515f916ee4373c42 Upgrade: use openssl_engine on rhel9

ipa-4-12:

  • aa60660007ae52320590d8bb31c29e0eec871b4b Upgrade: use openssl_engine on rhel9

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/8084
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.