Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 2056927 - Require authselect for use in scriptlets
Summary: Require authselect for use in scriptlets
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: nss-mdns
Version: 36
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Adam Goode
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: AcceptedBlocker
Depends On:
Blocks: F36FinalBlocker
TreeView+ depends on / blocked
 
Reported: 2022-02-22 11:23 UTC by Pavel Březina
Modified: 2022-03-30 14:03 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-03-30 14:03:41 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Pavel Březina 2022-02-22 11:23:57 UTC
nss-mdns calls authselect in scriptlet, but does not have corresponding Requires. If nss-mdns is installed before the authselect package, it does not correctly auto-enable itself.

Pull requests:
https://src.fedoraproject.org/rpms/nss-mdns/pull-request/7
https://src.fedoraproject.org/rpms/nss-mdns/pull-request/8

Comment 1 Fedora Blocker Bugs Application 2022-02-22 17:59:04 UTC
Proposed as a Blocker for 36-final by Fedora user chrismurphy using the blocker tracking app because:

 mDNS needs to work for IPP Everywhere printing to discover and setup printers
https://fedoraproject.org/wiki/Fedora_35_Final_Release_Criteria#Printing

Comment 2 Pavel Březina 2022-02-24 15:28:05 UTC
The PRs were merged, but it wasn't yet build.

Comment 3 Geoffrey Marr 2022-02-28 21:11:24 UTC
Discussed during the 2022-02-28 blocker review meeting: [0]

The decision to classify this bug as an "AcceptedBlocker (Final)" was made as it violates the following criterion:

"Printing must work in release-blocking desktops on at least one printer using...The generic IPP driver"

[0] https://meetbot.fedoraproject.org/fedora-blocker-review/2022-02-28/f36-blocker-review.2022-02-28-17.00.txt

Comment 4 Pavel Březina 2022-03-01 11:04:51 UTC
Hi Adam, can you please rebuild nss-mdns package in F36 and rawhide? Thank you.

Comment 5 Adam Goode 2022-03-01 17:39:42 UTC
Yes I will do this tonight.

Comment 7 Fedora Update System 2022-03-02 15:25:36 UTC
FEDORA-2022-09f077aa3a has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-09f077aa3a

Comment 8 Fedora Update System 2022-03-02 19:43:42 UTC
FEDORA-2022-09f077aa3a has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-09f077aa3a`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-09f077aa3a

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Villy Kruse 2022-03-11 08:57:38 UTC
After upgrading from f35 to f36, the nss-mdns module was not enabled in /etc/nsswitch.

It is difficult to tell why that is as long as the autselect calls in the post transaction script is redirecting stdout and stderr to /dev/null.

In theory, when running the post transaction script, the authselect package should already be fully installed and functional, even when the post transaction for authselect-libs is run after the post transaction for nss-mdns.

Comment 10 Fedora Update System 2022-03-26 15:07:05 UTC
FEDORA-2022-09f077aa3a has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 11 Adam Williamson 2022-03-28 17:40:42 UTC
Can anyone confirm whether the update did the trick here? Is the bug fixed?

Comment 12 Kamil Páral 2022-03-29 13:00:57 UTC
It is both fixed and broken.

It is fixed for F36 images which I installed in the past and then I upgraded to nss-mdns-0.15.1-5.fc36. It is also working for F35 upgrades:

[kparal@f35 ~]$ grep hosts /etc/nsswitch.conf
hosts:      files myhostname mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns

However, it is broken for F36 Workstation Live images, which were created with nss-mdns-0.15.1-5.fc36 already included [1]!

[kparal@f36 ~]$ grep hosts /etc/nsswitch.conf 
hosts:      files myhostname resolve [!UNAVAIL=return] dns

Reinstalling the same package fixes the problem:

[kparal@f36 ~]$ sudo dnf reinstall nss-mdns
...
Reinstalled:
  nss-mdns-0.15.1-5.fc36.x86_64                                                                                               

Complete!
[kparal@f36 ~]$ grep hosts /etc/nsswitch.conf 
hosts:      files myhostname mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns


So, we need to figure out why Live composes are still broken.


[1] https://kojipkgs.fedoraproject.org/compose/branched/Fedora-36-20220328.n.0/compose/Workstation/x86_64/iso/Fedora-Workstation-Live-x86_64-36-20220328.n.0.iso

Comment 13 Pavel Březina 2022-03-29 13:14:28 UTC
authselect works now correctly, nss-mdns now requires it so it first installs authselect, then calls authselect enable-feature which is correct.

I don't see nss-mdns being installed in the logs:
https://kojipkgs.fedoraproject.org/compose/branched/Fedora-36-20220328.n.0/logs/x86_64/buildinstall-Everything-logs/dnf.log

However, I don't know if this is correct log file or how to debug it further. This needs to be reported to whomever is responsible for the compose.

Comment 14 Kamil Páral 2022-03-29 13:35:07 UTC
I think the logs for Fedora-Workstation-Live-x86_64-36-20220328.n.0 are here:
https://koji.fedoraproject.org/koji/taskinfo?taskID=84830915

Comment 15 Pavel Březina 2022-03-29 14:31:54 UTC
I don't know precisely how live media compose works, there might be two places that comes to my mind:
- kickstart allows you to call authselect and it is called from livecd-tools https://src.fedoraproject.org/rpms/livecd-tools/blob/rawhide/f/0001-switch-from-authconfig-to-authselect.patch
- anaconda calls authselect on installation

Perhaps one or the other is involved here?

Comment 16 Adam Williamson 2022-03-29 16:03:32 UTC
I think it's more likely the latter. The former patch is about handling authconfig/select directives in kickstart files. The actual kickstarts we use for live image builds are here:

https://pagure.io/fedora-kickstarts

AFAICS, none of them have such lines, so I don't think that's relevant here. But yes, anaconda does have internal code for doing authselect stuff, and we log that it happens:

10:23:24,214 INF installation: Task started: Authselect configuration (15/37)
10:23:24,218 INF progress: Authselect configuration
10:23:24,218 DBG installation: Task completed: Authselect configuration (15/37) (0.0 s)

unfortunately, anaconda doesn't log what *happens* in any detail. This also wouldn't necessarily differ between creation of live images and regular installs, so it might be interesting to check how things are after an Everything or Server netinst/dvd install too.

Comment 17 Adam Williamson 2022-03-29 17:30:56 UTC
Hm. Poking into this more, it looks like we're always going to log that task, but it doesn't necessarily do anything. By the looks of program.log, in this case, it didn't - it did not call authselect.

Comment 18 Adam Williamson 2022-03-29 23:27:37 UTC
OK, so this breaks during live install, not live image generation. The live image itself has a correct hosts line, but a system installed from the live image does not.

From a quick look, I suspect the culprit is fingerprint authentication enablement:

journal.log:Mar 29 19:18:50 localhost-live org.fedoraproject.Anaconda.Modules.Security[2479]: DEBUG:anaconda.modules.security.installation:Enabling fingerprint authentication.
journal.log:Mar 29 19:18:50 localhost-live org.fedoraproject.Anaconda.Modules.Security[2479]: DEBUG:anaconda.modules.security.installation:Configuring authentication: /usr/bin/authselect ['select', 'sssd', 'with-fingerprint', 'with-silent-lastlog', '--force']
journal.log:Mar 29 19:18:50 localhost-live org.fedoraproject.Anaconda.Modules.Security[2479]: INFO:program:Running in chroot '/mnt/sysroot'... /usr/bin/authselect select sssd with-fingerprint with-silent-lastlog --force
journal.log:Mar 29 19:18:51 localhost-live org.fedoraproject.Anaconda.Modules.Security[2479]: INFO:program:Backup stored at /var/lib/authselect/backups/2022-03-29-23-18-50.dyBru6

And indeed:

[root@localhost-live tmp]# grep hosts /mnt/sysroot/var/lib/authselect/backups/2022-03-29-23-18-50.dyBru6/nsswitch.conf 
hosts:      files myhostname mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns

so, the fingerprint auth enablement code in anaconda:

https://github.com/rhinstaller/anaconda/blob/master/pyanaconda/modules/security/installation.py#L415-L421

seems like it doesn't just enable a feature (like we do for nss_mdns), it rewrites the whole config. Maybe we should change it to do `authselect enable-feature with-fingerprint`?

Comment 19 Pavel Březina 2022-03-30 08:16:38 UTC
Sounds good to me. Authselect installation now calls 'authselect select sssd with-silent-last-log --force' therefore Anaconda does not have to call it anymore and it can just enable fingerprint with enable-feature.

Comment 20 Vendula Poncova 2022-03-30 11:51:11 UTC
The suggested change in Anaconda is implemented in the following pull request: https://github.com/rhinstaller/anaconda/pull/3991

Comment 21 Kamil Páral 2022-03-30 14:03:41 UTC
I see that Adam already reported bug 2069899 regarding anaconda, so I'm going to close this one.


Note You need to log in before you can comment on or make changes to this bug.