Update CA bundle path in krb5 config (el9to10) #1340

jrisc · 2025-02-07T11:38:51Z

In RHEL10, the historical /etc/ssl/certs/ca-certificates.crt CA bundle file was replaced by /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem. The CA bundle file might be used as pkinit_anchors in MIT krb5 configuration files.

The krb5conf actors search for occurrences of the old CA bundle path, and replace them with the new one.

jira: RHEL-65265

github-actions · 2025-02-07T11:39:02Z

Thank you for contributing to the Leapp project!

Please note that every PR needs to comply with the Leapp Guidelines and must pass all tests in order to be mergeable.
If you want to request a review or rebuild a package in copr, you can use following commands as a comment:

review please @oamg/developers to notify leapp developers of the review request
/packit copr-build to submit a public copr build using packit

Packit will automatically schedule regression tests for this PR's build and latest upstream leapp build.
However, here are additional useful commands for packit:

/packit test to re-run manually the default tests
/packit retest-failed to re-run failed tests manually
/packit test oamg/leapp#42 to run tests with leapp builds for the leapp PR#42 (default is latest upstream - main - build)

Note that first time contributors cannot run tests automatically - they need to be started by a reviewer.

It is possible to schedule specific on-demand tests as well. Currently 2 test sets are supported, beaker-minimal and kernel-rt, both can be used to be run on all upgrade paths or just a couple of specific ones.
To launch on-demand tests with packit:

/packit test --labels kernel-rt to schedule kernel-rt tests set for all upgrade paths
/packit test --labels beaker-minimal-8.10to9.4,kernel-rt-8.10to9.4 to schedule kernel-rt and beaker-minimal test sets for 8.10->9.4 upgrade path

See other labels for particular jobs defined in the .packit.yaml file.

Please open ticket in case you experience technical problem with the CI. (RH internal only)

Note: In case there are problems with tests not being triggered automatically on new PR/commit or pending for a long time, please contact leapp-infra.

pirat89 · 2025-02-10T13:59:23Z

@jrisc Hi \o thank you for the contribution. I am aware that for first contributors tests are not performed automatically and it could you to wait for our approval always. You can execute tests locally in container using Makefile from the main dir:

TEST_CONTAINER=rhel9 make test_container

see make help for more prepared stuff. Note that I realized that rhel9 container is not documented in the help page, but it's working otherwise.

pirat89

The code looks good in general. I found just one thing which is weird to me and based on the outcome of the discussion there could be another things to change or not.

repos/system_upgrade/el9toel10/actors/krb5conf/convertkrb5conf/actor.py

repos/system_upgrade/el9toel10/actors/krb5conf/convertkrb5conf/libraries/convertpamuserdb.py

pirat89 · 2025-02-12T12:57:16Z

repos/system_upgrade/el9toel10/actors/krb5conf/convertkrb5conf/libraries/convertpamuserdb.py

+    with open(conf_file) as f:
+        text = f.read().replace('/etc/ssl/certs/ca-certificates.crt',
+                                '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem')
+    with open(conf_file, 'w') as f:
+        f.write(text)


if we are sure that all files wil be always present and rw operation will allowed, it's ok. otherwise we should cover it by try-except:

try: ... except IOError as e: # log error return # give it a chance to fix other files still

Since the file list is supposed to be collected just before by the scankrb5conf actor, I think we can expect the files to still be there at this point.

I just realize that I forgot to rename this source file though... 😅

I renamed the file in 724f6be.

Is Leapp running as root? If that's the case, I don't expect it to face any file permissions problems. However, if it is not and one of the krb5 config file in /etc/krb5.conf.d/ is not publicly readable (which makes no sense, but is technically possible), it will probably cause the scankrb5conf actor to fail. Do you think I should just log a warning and skip the erroneous file in this case?

you are right. yes, it is running as root always and as we could read it before, we should be able to read it later as well - DAC is ignored by root, selinux will be always in disabled or permissive mode, and I do not expect someone would set an ACL on these files (like making them immutable). So only thing here would be if a file is removed or moved/renamed during the RPM transaction.

repos/system_upgrade/el9toel10/actors/krb5conf/convertkrb5conf/libraries/convertkrb5conf.py

jrisc · 2025-02-13T12:38:27Z

@pirat89 It seems that failing tests are cause by the absence of RPM database. Is there a way to handle this case, or it just cannot be tested?

In RHEL10, the historical /etc/ssl/certs/ca-certificates.crt CA bundle file was replaced by /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem. The CA bundle file might be used as "pkinit_anchors" in MIT krb5 configuration files. The krb5conf actors search for occurrences of the old CA bundle path, and replace them with the new one. jira: RHEL-65265 Co-authored-by: Petr Stodůlka <[email protected]>

MichalHe

The solution looks code-wise very good, thank you. I left some minor comments intended to ease with maintenance of the code.

MichalHe · 2025-07-24T07:44:41Z

repos/system_upgrade/el9toel10/actors/krb5conf/checkkrb5conf/libraries/checkkrb5conf.py

+    if msg.unmanaged_files:
+        reporting.create_report([
+            reporting.Title('Unmanaged MIT krb5 configuration file(s) will be '
+                            'updated to point the new X.509 CA bundle file'),


Suggested change

'updated to point the new X.509 CA bundle file'),

'updated to point to the new X.509 CA bundle file'),

MichalHe · 2025-07-24T07:55:32Z

repos/system_upgrade/el9toel10/actors/krb5conf/checkkrb5conf/libraries/checkkrb5conf.py

+                'file was modified. The following unmanaged MIT krb5 '
+                'configuration files have to be updated to point to the new '
+                'bundle file:'
+                '{sep}{files}'.format(sep=FMT_LIST_SEPARATOR, files=FMT_LIST_SEPARATOR.join(msg.unmanaged_files))),


Could you please add a function that takes a list of entries (e.g. unmanaged files) and outputs the list formatted in human readable form? I see that the same pattern is used in both created reports. The function could improve readability as I had to think a bit about what the output would look like.

MichalHe · 2025-07-24T07:58:02Z

repos/system_upgrade/el9toel10/actors/krb5conf/convertkrb5conf/actor.py

+
+class ConvertKrb5conf(Actor):
+    """
+    Update krb5 configuration file


Could you please add more details what is the nature of the update?

repos/system_upgrade/el9toel10/actors/krb5conf/convertkrb5conf/libraries/convertkrb5conf.py

MichalHe · 2025-07-24T08:18:17Z

repos/system_upgrade/el9toel10/actors/krb5conf/scankrb5conf/libraries/scankrb5conf.py

+
+def fetch_outdated_krb5_conf_files(conf_paths, ca_bundle_path='/etc/ssl/certs/ca-certificates.crt'):
+    krb5_conf_files = set()
+    odtd_rpm_conf = set()


Out of curiosity, what does odtd means?

MichalHe · 2025-07-24T08:21:53Z

repos/system_upgrade/el9toel10/actors/krb5conf/scankrb5conf/libraries/scankrb5conf.py

+                else:
+                    try:
+                        rpm_nvr = run(['/usr/bin/rpm', '-qf', file_path], split=True)['stdout']
+                        # We do not potential files provided by Red Hat RPMs


The comment is a bit malformed. Maybe something like this?

Suggested change

# We do not potential files provided by Red Hat RPMs

# We only want to handle files signed by the distribution, because we have no guarantees about third party packages

pirat89 · 2025-08-13T08:21:04Z

@jrisc @MichalHe let's move this to the plan for the next release (9.8 -> 10.2 is anyway the milestone where upgrades 9 -> 10 is becoming more interesting). @jrisc in the meanwhile, rebase please the branch against the up-to-date upstream so it resolves problems with tests.

pirat89 added this to the 8.10/9.6 milestone Feb 10, 2025

jrisc force-pushed the el9_10_krb5 branch 2 times, most recently from 6512868 to b3f4974 Compare February 10, 2025 11:57

jrisc changed the title ~~[WIP] Update CA bundle path in krb5 config (el9to10)~~ Update CA bundle path in krb5 config (el9to10) Feb 10, 2025

pirat89 added enhancement New feature or request report Any reports have been added / removed / changed in the PR labels Feb 10, 2025

pirat89 reviewed Feb 10, 2025

View reviewed changes

repos/system_upgrade/el9toel10/actors/krb5conf/convertkrb5conf/actor.py Outdated Show resolved Hide resolved

jrisc force-pushed the el9_10_krb5 branch from b3f4974 to 3f4d5b6 Compare February 11, 2025 17:30

pirat89 self-assigned this Feb 12, 2025

pirat89 reviewed Feb 12, 2025

View reviewed changes

repos/system_upgrade/el9toel10/actors/krb5conf/convertkrb5conf/libraries/convertpamuserdb.py Outdated Show resolved Hide resolved

pirat89 reviewed Feb 12, 2025

View reviewed changes

jrisc force-pushed the el9_10_krb5 branch from 86c50e4 to 724f6be Compare February 12, 2025 13:21

pirat89 reviewed Feb 12, 2025

View reviewed changes

repos/system_upgrade/el9toel10/actors/krb5conf/convertkrb5conf/libraries/convertkrb5conf.py Outdated Show resolved Hide resolved

jrisc and others added 9 commits February 13, 2025 13:46

Rename krb5conf model

f88cf98

Differentiate unmanaged and RPM-provided krb5 conf files

c65b299

Force update of main krb5.conf file if necessary

2d08990

Add specific report entry for RPM-managed krb5 config files

5433d9b

Typo

aded170

Backup krb5 config file before modification

0870e8f

Update test

78dedfd

Fix various bugs

13a292d

jrisc force-pushed the el9_10_krb5 branch from 8c4aa92 to 13a292d Compare February 13, 2025 12:46

pirat89 modified the milestones: 8.10/9.6, 8.10/9.7 Feb 13, 2025

MichalHe requested changes Jul 24, 2025

View reviewed changes

pirat89 modified the milestones: 8.10/9.7, 8.10/9.8 Aug 13, 2025

	'updated to point the new X.509 CA bundle file'),
	'updated to point to the new X.509 CA bundle file'),

	# We do not potential files provided by Red Hat RPMs
	# We only want to handle files signed by the distribution, because we have no guarantees about third party packages

Update CA bundle path in krb5 config (el9to10) #1340

Are you sure you want to change the base?

Update CA bundle path in krb5 config (el9to10) #1340

Uh oh!

Conversation

jrisc commented Feb 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 7, 2025

Thank you for contributing to the Leapp project!

Uh oh!

pirat89 commented Feb 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pirat89 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

pirat89 Feb 12, 2025

Choose a reason for hiding this comment

Uh oh!

jrisc Feb 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jrisc Feb 12, 2025

Choose a reason for hiding this comment

Uh oh!

jrisc Feb 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pirat89 Feb 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jrisc commented Feb 13, 2025

Uh oh!

MichalHe left a comment

Choose a reason for hiding this comment

Uh oh!

MichalHe Jul 24, 2025

Choose a reason for hiding this comment

Uh oh!

MichalHe Jul 24, 2025

Choose a reason for hiding this comment

Uh oh!

MichalHe Jul 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

MichalHe Jul 24, 2025

Choose a reason for hiding this comment

Uh oh!

MichalHe Jul 24, 2025

Choose a reason for hiding this comment

Uh oh!

pirat89 commented Aug 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jrisc commented Feb 7, 2025 •

edited

Loading

pirat89 commented Feb 10, 2025 •

edited

Loading

jrisc Feb 12, 2025 •

edited

Loading

jrisc Feb 12, 2025 •

edited

Loading

pirat89 Feb 12, 2025 •

edited

Loading