| Newsgroups |
gmane.comp.sysutils.cfengine.general |
| Message-ID |
<[email protected]> |
Apologies for the delay. At last, I've got our local non-FIPS
RHEL9.OS-deployment baseline to an equivalent level to the FIPS-based one I
had been previously had to use.
Success! The bootstrap no longer segfaults, but runs to completion. Then
"update.cf" and a couple of runs of the agent policy ("promises.cf") also
run satisfactorily. (A few local policy issues, but that's OK; it's our
problem, and to be expected with a new OS release.)
But there still remain two issues that I believe Northern.Tech should
regard as bugs:
- the segfault-failure in FIPS mode really shouldn't happen
- I wasn't able to use 3.18.5; rather I had to use an earlier 3.18.4
overnight build
The latter is because it required a very recent "selinux-policy". We
discussed this principle earlier in the thread; see above. The
distributed application RPM should be conservative in what pre-reqs it
needs. Try to ensure your build/distribution are specifically down-level
(e.g. six months or even more) from RH "bleeding edge". Customers need
stable OS platforms, even if the applications on it are a little newer, so
those applications should be distributed with those stable (older)
platforms in mind.
Can someone open the bug reports? Or do you want me to do so?
-- David Lee
-- Diamond Light Source
On Wednesday, 14 June 2023 at 15:20:51 UTC+1 [email protected]
wrote:
> You mention FIPS. Yes, this trial RH9 installation is using FIPS.
> Nevertheless with RH8 (both with and without FIPS) we have been OK.
>
> I'll try it without FIPS soon.
>
> So it sounds as though CFE has some sort of RH9+FIPS bug (absent from
> RH8+FIPS) causing a segfault.
>
> Is there a ticket for this bug?
>
> -- David Lee
>
>
> On Tuesday, 30 May 2023 at 04:50:44 UTC+1 [email protected] wrote:
>
>> On Thu, 2023-05-25 at 08:15 -0700, [email protected] wrote:
>> > Any progress on this yet? It is still coredumping.
>> >
>> > At last, I've been able to build CFE from source on RHEL9. ("git
>> > pull" yesterday, so decently up-to-date.) On "./configure" I used
>> > "--enable-debug-yes" to try to get more information from gdb, and did
>> > a "make install".
>> >
>> > Running under gdb gives some information additional to what I got
>> > above.
>> >
>> > (gdb) run -KI --bootstrap=cph-mpf
>> > ...
>> > (gdb) bt
>> > #0 0x0000000000000000 in ?? ()
>> > #1 0x00007ffff7eb3785 in PromiseRuntimeHash (pp=0x564800,
>> > salt=0x7fffffffc800 "method_Check Keys_", digest=0x7fffffff8f40
>> > "",
>> > type=HASH_METHOD_MD5) at locks.c:675
>> Oh! If your RHEL 9 machine runs OpenSSL 3, MD5 may not be supported at
>> all. Or, by any chance, is your machine running in FIPS mode?
>>
>> CFEngine Enterprise uses SHA256 instead.
>>
>> --
>> Vratislav
>>
>>
--
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/c9f8f33e-c8fd-48e5-a777-5dad9e7c60b6n%40googlegroups.com.