Re: RHEL9?

"'Vratislav Podzimek' via help-cfengine" <[email protected]> Wed, 12 Jul 2023 10:52:32 +0200
Newsgroups	gmane.comp.sysutils.cfengine.general
Message-ID	<[email protected]>
On Fri, 2023-07-07 at 02:17 -0700, [email protected] wrote:
> Apologies for the delay.  At last, I've got our local non-FIPS RHEL9.OS-deployment baseline to an
> equivalent level to the FIPS-based one I had been previously had to use.
No need to apologize, thanks for the useful feedback/info!

> Success!  The bootstrap no longer segfaults, but runs to completion. Then "update.cf" and a couple
> of runs of the agent policy ("promises.cf") also run satisfactorily.  (A few local policy issues,
> but that's OK; it's our problem, and to be expected with a new OS release.)
> 
> But there still remain two issues that I believe Northern.Tech should regard as bugs:
>  * the segfault-failure in FIPS mode really shouldn't happen
Yes, it should be handled in a nicer way with a CRITICAL error saying what's going on. I've just
created a ticket [1] for this.


>  * I wasn't able to use 3.18.5; rather I had to use an earlier 3.18.4 overnight build
> The latter is because it required a very recent "selinux-policy".  We discussed this principle
> earlier in the thread; see above.   The distributed application RPM should be conservative in what
> pre-reqs it needs.  Try to ensure your build/distribution are specifically down-level (e.g. six
> months or even more) from RH "bleeding edge".  Customers need stable OS platforms, even if the
> applications on it are a little newer, so those applications should be distributed with those
> stable (older) platforms in mind.
This is actually quite tricky. We have seen in the past that things didn't work with our SELinux
policy built on systems with an older version of selinux-policy when a newer version was installed.
In other cases we have seen our policy built with new version of selinux-policy not working on
systems that had older version of it. And while we can hardly ask people to downgrade selinux-policy
and re-introducing CVEs that were fixed in the newer version if they want to use CFEngine requiring
an update of the package is less problematic.

To me, this is really a problem of how selinux-policy is packaged and how compatibility, both
forward and backwards, is handled there. But that's a Red Hat's/IBM's problem not ours. We could
probably provide CFEngine packages with all CFEngine processes being unconfined and thus not
affected by SELinux, but that's also non-trivial and completely beats the purpose of using SELinux
on the particular machines.

[1] https://northerntech.atlassian.net/browse/CFE-4226

--
Vratislav

> 
> 
> 
> On Wednesday, 14 June 2023 at 15:20:51 UTC+1 [email protected] wrote:
> > You mention FIPS.  Yes, this trial RH9 installation is using FIPS.  Nevertheless with RH8 (both
> > with and without FIPS) we have been OK.
> > 
> > I'll try it without FIPS soon.
> > 
> > So it sounds as though CFE has some sort of RH9+FIPS bug (absent from RH8+FIPS) causing a
> > segfault.
> > 
> > Is there a ticket for this bug?
> > 
> > -- David Lee
> > 
> > 
> > On Tuesday, 30 May 2023 at 04:50:44 UTC+1 [email protected] wrote:
> > > On Thu, 2023-05-25 at 08:15 -0700, [email protected] wrote:
> > > > Any progress on this yet?  It is still coredumping.
> > > > 
> > > > At last, I've been able to build CFE from source on RHEL9.   ("git
> > > > pull" yesterday, so decently up-to-date.)   On "./configure" I used
> > > > "--enable-debug-yes" to try to get more information from gdb, and did
> > > > a "make install".
> > > > 
> > > > Running under gdb gives some information additional to what I got
> > > > above.
> > > > 
> > > > (gdb) run -KI --bootstrap=cph-mpf
> > > > ...
> > > > (gdb) bt
> > > > #0  0x0000000000000000 in ?? ()
> > > > #1  0x00007ffff7eb3785 in PromiseRuntimeHash (pp=0x564800, 
> > > >     salt=0x7fffffffc800 "method_Check Keys_", digest=0x7fffffff8f40
> > > > "", 
> > > >     type=HASH_METHOD_MD5) at locks.c:675
> > > Oh! If your RHEL 9 machine runs OpenSSL 3, MD5 may not be supported at
> > > all. Or, by any chance, is your machine running in FIPS mode?
> > > 
> > > CFEngine Enterprise uses SHA256 instead.
> > > 
> > > --
> > > Vratislav
> > > 
> -- 
> You received this message because you are subscribed to the Google Groups "help-cfengine" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to help-
> [email protected].
> To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/c9f8f33e-
> c8fd-48e5-a777-5dad9e7c60b6n%40googlegroups.com.

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/d2ee84ae58026cbe64f7ee52d35d4e395acce0e3.camel%40northern.tech.
signature.asc (application/pgp-signature, 833 B)