Re: RHEL9?

"[email protected]" <[email protected]> Fri, 7 Jul 2023 02:17:37 -0700 (PDT)
Newsgroups gmane.comp.sysutils.cfengine.general
Message-ID <[email protected]>
Apologies for the delay.  At last, I've got our local non-FIPS 
RHEL9.OS-deployment baseline to an equivalent level to the FIPS-based one I 
had been previously had to use.

Success!  The bootstrap no longer segfaults, but runs to completion. Then 
"update.cf" and a couple of runs of the agent policy ("promises.cf") also 
run satisfactorily.  (A few local policy issues, but that's OK; it's our 
problem, and to be expected with a new OS release.)

But there still remain two issues that I believe Northern.Tech should 
regard as bugs:

   - the segfault-failure in FIPS mode really shouldn't happen
   - I wasn't able to use 3.18.5; rather I had to use an earlier 3.18.4 
   overnight build

The latter is because it required a very recent "selinux-policy".  We 
discussed this principle earlier in the thread; see above.   The 
distributed application RPM should be conservative in what pre-reqs it 
needs.  Try to ensure your build/distribution are specifically down-level 
(e.g. six months or even more) from RH "bleeding edge".  Customers need 
stable OS platforms, even if the applications on it are a little newer, so 
those applications should be distributed with those stable (older) 
platforms in mind.

Can someone open the bug reports?  Or do you want me to do so?

-- David Lee
-- Diamond Light Source


On Wednesday, 14 June 2023 at 15:20:51 UTC+1 [email protected] 
wrote:

> You mention FIPS.  Yes, this trial RH9 installation is using FIPS.  
> Nevertheless with RH8 (both with and without FIPS) we have been OK.
>
> I'll try it without FIPS soon.
>
> So it sounds as though CFE has some sort of RH9+FIPS bug (absent from 
> RH8+FIPS) causing a segfault.
>
> Is there a ticket for this bug?
>
> -- David Lee
>
>
> On Tuesday, 30 May 2023 at 04:50:44 UTC+1 [email protected] wrote:
>
>> On Thu, 2023-05-25 at 08:15 -0700, [email protected] wrote: 
>> > Any progress on this yet?  It is still coredumping. 
>> > 
>> > At last, I've been able to build CFE from source on RHEL9.   ("git 
>> > pull" yesterday, so decently up-to-date.)   On "./configure" I used 
>> > "--enable-debug-yes" to try to get more information from gdb, and did 
>> > a "make install". 
>> > 
>> > Running under gdb gives some information additional to what I got 
>> > above. 
>> > 
>> > (gdb) run -KI --bootstrap=cph-mpf 
>> > ... 
>> > (gdb) bt 
>> > #0  0x0000000000000000 in ?? () 
>> > #1  0x00007ffff7eb3785 in PromiseRuntimeHash (pp=0x564800, 
>> >     salt=0x7fffffffc800 "method_Check Keys_", digest=0x7fffffff8f40 
>> > "", 
>> >     type=HASH_METHOD_MD5) at locks.c:675 
>> Oh! If your RHEL 9 machine runs OpenSSL 3, MD5 may not be supported at 
>> all. Or, by any chance, is your machine running in FIPS mode? 
>>
>> CFEngine Enterprise uses SHA256 instead. 
>>
>> -- 
>> Vratislav 
>>
>>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/c9f8f33e-c8fd-48e5-a777-5dad9e7c60b6n%40googlegroups.com.