| Newsgroups |
gmane.comp.sysutils.cfengine.general |
| Message-ID |
<[email protected]> |
Vratislav ,
Many thanks.
- segfault: Thanks for regarding this is a bug and opening a ticket.
Can you make me a "watcher" (or equivalent) there, so I get notified of
progress?
- "selinux-policy" etc. OK, fair enough. I had just never seen this
before. On reflection, this particular development exercise is on more
than the usual number of "bleeding edges". I've managed to make it work
by ensuring that my test Satellite channel is also suitable "bleeding edge"
which naturally provides an appropriate version of that RPM. Things will
probably settle down, and at least we are aware of it.
All the best.
-- David Lee
On Wednesday, 12 July 2023 at 09:52:38 UTC+1 [email protected]
wrote:
> On Fri, 2023-07-07 at 02:17 -0700, [email protected] wrote:
> > Apologies for the delay. At last, I've got our local non-FIPS
> RHEL9.OS-deployment baseline to an
> > equivalent level to the FIPS-based one I had been previously had to use.
> No need to apologize, thanks for the useful feedback/info!
>
> > Success! The bootstrap no longer segfaults, but runs to completion.
> Then "update.cf" and a couple
> > of runs of the agent policy ("promises.cf") also run satisfactorily.
> (A few local policy issues,
> > but that's OK; it's our problem, and to be expected with a new OS
> release.)
> >
> > But there still remain two issues that I believe Northern.Tech should
> regard as bugs:
> > * the segfault-failure in FIPS mode really shouldn't happen
> Yes, it should be handled in a nicer way with a CRITICAL error saying
> what's going on. I've just
> created a ticket [1] for this.
>
>
> > * I wasn't able to use 3.18.5; rather I had to use an earlier 3.18.4
> overnight build
> > The latter is because it required a very recent "selinux-policy". We
> discussed this principle
> > earlier in the thread; see above. The distributed application RPM
> should be conservative in what
> > pre-reqs it needs. Try to ensure your build/distribution are
> specifically down-level (e.g. six
> > months or even more) from RH "bleeding edge". Customers need stable OS
> platforms, even if the
> > applications on it are a little newer, so those applications should be
> distributed with those
> > stable (older) platforms in mind.
> This is actually quite tricky. We have seen in the past that things didn't
> work with our SELinux
> policy built on systems with an older version of selinux-policy when a
> newer version was installed.
> In other cases we have seen our policy built with new version of
> selinux-policy not working on
> systems that had older version of it. And while we can hardly ask people
> to downgrade selinux-policy
> and re-introducing CVEs that were fixed in the newer version if they want
> to use CFEngine requiring
> an update of the package is less problematic.
>
> To me, this is really a problem of how selinux-policy is packaged and how
> compatibility, both
> forward and backwards, is handled there. But that's a Red Hat's/IBM's
> problem not ours. We could
> probably provide CFEngine packages with all CFEngine processes being
> unconfined and thus not
> affected by SELinux, but that's also non-trivial and completely beats the
> purpose of using SELinux
> on the particular machines.
>
> [1] https://northerntech.atlassian.net/browse/CFE-4226
>
> --
> Vratislav
>
> >
> >
> >
> > On Wednesday, 14 June 2023 at 15:20:51 UTC+1 [email protected]
> wrote:
> > > You mention FIPS. Yes, this trial RH9 installation is using FIPS.
> Nevertheless with RH8 (both
> > > with and without FIPS) we have been OK.
> > >
> > > I'll try it without FIPS soon.
> > >
> > > So it sounds as though CFE has some sort of RH9+FIPS bug (absent from
> RH8+FIPS) causing a
> > > segfault.
> > >
> > > Is there a ticket for this bug?
> > >
> > > -- David Lee
> > >
> > >
> > > On Tuesday, 30 May 2023 at 04:50:44 UTC+1 [email protected]
> wrote:
> > > > On Thu, 2023-05-25 at 08:15 -0700, [email protected] wrote:
> > > > > Any progress on this yet? It is still coredumping.
> > > > >
> > > > > At last, I've been able to build CFE from source on RHEL9. ("git
> > > > > pull" yesterday, so decently up-to-date.) On "./configure" I used
> > > > > "--enable-debug-yes" to try to get more information from gdb, and
> did
> > > > > a "make install".
> > > > >
> > > > > Running under gdb gives some information additional to what I got
> > > > > above.
> > > > >
> > > > > (gdb) run -KI --bootstrap=cph-mpf
> > > > > ...
> > > > > (gdb) bt
> > > > > #0 0x0000000000000000 in ?? ()
> > > > > #1 0x00007ffff7eb3785 in PromiseRuntimeHash (pp=0x564800,
> > > > > salt=0x7fffffffc800 "method_Check Keys_", digest=0x7fffffff8f40
> > > > > "",
> > > > > type=HASH_METHOD_MD5) at locks.c:675
> > > > Oh! If your RHEL 9 machine runs OpenSSL 3, MD5 may not be supported
> at
> > > > all. Or, by any chance, is your machine running in FIPS mode?
> > > >
> > > > CFEngine Enterprise uses SHA256 instead.
> > > >
> > > > --
> > > > Vratislav
> > > >
> > --
> > You received this message because you are subscribed to the Google
> Groups "help-cfengine" group.
> > To unsubscribe from this group and stop receiving emails from it, send
> an email to help-
> > [email protected].
> > To view this discussion on the web visit
> https://groups.google.com/d/msgid/help-cfengine/c9f8f33e-
> > c8fd-48e5-a777-5dad9e7c60b6n%40googlegroups.com.
>
>
--
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/d6b8b4ab-b4e4-4aa8-9e74-4c6e4362aaa1n%40googlegroups.com.