Hi guys
When I sign a zone I get lots of: ... File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/26365760-a70d-19be-2db1-a80adc796477.object
File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object
File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object
zone private.road/IN (signed): sending notifies (serial 1642004083) client @0x7f8f7c1948b8 10.3.1.99#39887: received notify for zone 'private.road'
Are those a reason to worry & investigate? If not then what do they translate to?
many thanks, L
lejeczek via FreeIPA-users wrote:
Hi guys
When I sign a zone I get lots of: ... File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/26365760-a70d-19be-2db1-a80adc796477.object
File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object
File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object
zone private.road/IN (signed): sending notifies (serial 1642004083) client @0x7f8f7c1948b8 10.3.1.99#39887: received notify for zone 'private.road'
Are those a reason to worry & investigate? If not then what do they translate to?
I'd start by checking for SELinux AVCs and FS permissions.
I seem to recall that another user has reported a race condition related to softhsm2.
rob
On 12/01/2022 18:31, Rob Crittenden wrote:
lejeczek via FreeIPA-users wrote:
Hi guys
When I sign a zone I get lots of: ... File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/26365760-a70d-19be-2db1-a80adc796477.object
File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object
File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object
zone private.road/IN (signed): sending notifies (serial 1642004083) client @0x7f8f7c1948b8 10.3.1.99#39887: received notify for zone 'private.road'
Are those a reason to worry & investigate? If not then what do they translate to?
I'd start by checking for SELinux AVCs and FS permissions.
I seem to recall that another user has reported a race condition related to softhsm2.
rob
folder and its content: drwxrws---. 2 ods named 12288 Jan 12 16:14 /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/
fcontext labels are as policies dictate, no SELinux issues unless some things are denied silently. This is on Centos 9 - should I make it a BZ? thanks, L.
have a bit of an update, in my case IPA is in rootfull containers and... I have: /devs/ROOTFUL.containers(/.*)? all files system_u:object_r:container_file_t:s0 and container I run with: -> $ export _PATH=/devs/ROOTFUL.containers/${_NAME} -> $ podman run -ti --tz=local --cap-add=CAP_SYS_TIME .... --volume=${_PATH}/root:/root --volume=${_PATH}/data:/data:z If I do: -> $ setenforce 0 and: -> $ ipactl restart then "..File.cpp(94): Could not open the file (Permission denied):" are gone, which otherwise, logs are full of. but before I attempt to troubleshoot I wanted to ask - perhaps we/somebody know already what is correct fcontext &| way to run IPA container so these errors do no occur? I'm on centos 9 with 4.12.2
many thanks, L.
seems that labels must be: unconfined_u:object_r:container_file_t:s0 for such IPA container, to be free of such errors
On Wed, Dec 17, 2025 at 10:36 AM lejeczek via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
have a bit of an update, in my case IPA is in rootfull containers and... I have: /devs/ROOTFUL.containers(/.*)? all files
system_u:object_r:container_file_t:s0
and container I run with: -> $ export _PATH=/devs/ROOTFUL.containers/${_NAME} -> $ podman run -ti --tz=local --cap-add=CAP_SYS_TIME ....
--volume=${_PATH}/root:/root --volume=${_PATH}/data:/data:z
If I do: -> $ setenforce 0 and: -> $ ipactl restart then "..File.cpp(94): Could not open the file (Permission denied):" are
gone, which otherwise, logs are full of.
but before I attempt to troubleshoot I wanted to ask - perhaps
we/somebody know already what is correct fcontext &| way to run IPA container so these errors do no occur?
I'm on centos 9 with 4.12.2
I'd suggest you take a look at the freeipa-container project:
https://github.com/freeipa/freeipa-container
Some workarounds are required for IPA to work in a container.
Also running IPA in a container is not supported, so opening an issue may not help.
Rafael
many thanks, L.
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
-- Rafael Guterres Jeffman Senior Software Engineer FreeIPA - Red Hat
freeipa-users@lists.fedorahosted.org