freeipa

#9810 Nightly test failure in test_integration/test_fips.py - sed couldn't open temporary file
Closed: fixed by frenaud. Opened by mpolovka.

Closed: fixed
Reopen Issue

The nightly test suit test_fips.py is failing in master:nightly-latest-fips pipeline with a failure

    @classmethod
    def install(cls, mh):
        check_version(cls.replicas[0])
        super(TestInstallFIPS, cls).install(mh)
        # sanity check
        for host in cls.get_all_hosts():
            assert host.is_fips_mode
            assert fips.is_fips_enabled(host)
        # patch named-pkcs11 crypto policy
        # see RHBZ#1772111
        for host in [cls.master] + cls.replicas:
>           host.run_command(
                [
                    "sed",
                    "-i",
                    "-E",
                    "s/RSAMD5;//g",
                    "/etc/crypto-policies/back-ends/bind.config",
                ]
            )

E           subprocess.CalledProcessError: Command '['sed', '-i', '-E', 's/RSAMD5;//g', '/etc/crypto-policies/back-ends/bind.config']' returned non-zero exit status 4.

---------------------------- Captured stderr setup -----------------------------
ipa: ERROR: stderr: sed: couldn't open temporary file /etc/crypto-policies/back-ends/sed8YgtzZ: Read-only file system

report
run link

Hi @mpolovka

  1. the test test_fips.py is faking FIPS mode for userspace processes, and in the pipeline where it failed the system is already in FIPS mode (the real FIPS mode, configured with grubby --update-kernel=ALL --args="fips=1...
    IMO you can remove test_fips.py from the fips pipeline as it doesn't make sense.

  2. This portion is code was added as a workaround for RHBZ#1772111 that has been fixed a long time ago in fedora 30. It's probably safe to remove it.
Edited by frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7851
- Issue assigned to mpolovka

master:

  • e8378a0d779be56cea08d0e57ede2b69cb17c5f1 ipatests: test_fips: Remove obsolete patch

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-12:

  • 232169cc00e0d66bef1cc27997e45944d4d3cd2c ipatests: simulate FIPS mode and install replica
  • 599e208225d9a878af28e069d480dc4ee9d9bdea ipatests: test_fips: Remove obsolete patch
Metadata

fips test-failure tests

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.