freeipa

#9831 hsm validation fails on systems with private tmp
Closed: fixed by frenaud. Opened by slev.

Closed: fixed
Reopen Issue

HSM validator prepare temporary directory and files as privileged user and then run some checks as pkiuser. In case of private tmp this path is not accessible and installation fails:

DEBUG Starting external process
DEBUG args=['/usr/bin/modutil', '-dbdir', 'sql:/tmp/.private/root/tmp_knpockc', '-nocertdb', '-add', 'test', '-libfile', '/usr/lib64/pkcs11/libsofthsm2.so', '-force']
DEBUG runas=pkiuser (UID 985, GID 967)
DEBUG supplementary_group=pkiuser (GID 967)
DEBUG Process finished, return code=22
DEBUG stdout=
DEBUG stderr=ERROR: Failed to add module "test". Probable cause : "A PKCS #11 module returned CKR_GENERAL_ERROR, indicating that an unrecoverable error has occurred.".
DEBUG Starting external process
DEBUG args=['/usr/bin/modutil', '-dbdir', 'sql:/tmp/.private/root/tmp_knpockc', '-list', '-force']
DEBUG runas=pkiuser (UID 985, GID 967)
DEBUG supplementary_group=pkiuser (GID 967)
DEBUG Process finished, return code=46
DEBUG stdout=
DEBUG stderr=modutil: function failed: SEC_ERROR_BAD_DATABASE: security library: bad database.

Metadata Update from @slev:
- Issue assigned to slev

master:

  • 7e436ff6fe3c78f605cd63e98bd560cfefb5a293 install: make use of shared temp directory for hsm validation

ipa-4-12:

  • 7887b0211cdcd6fbd9a3d86882fabd26e50bcadd install: make use of shared temp directory for hsm validation

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.