Upgrade to kernel-0:5.14.0-611.49.2.el9_7.x86_64 fails

Support
1

I am getting this error during install of kernel-5.14.0-611.49.2.el9_7.x86_64 :

Running scriptlet: kernel-core-5.14.0-611.49.2.el9_7.x86_64
Error on line 10 of configuration file
4027A3C31B7F0000:error:07000068:configuration file routines:str_copy:variable has no value:crypto/conf/conf_def.c:759:line 10
dracut: ‘/usr/lib/dracut/ossl-files --config’ does not return a path!!
warning: %posttrans(kernel-core-5.14.0-611.49.2.el9_7.x86_64) scriptlet failed, exit status 1

When I try to boot to that kernel it fails.

I have looked at /etc/ssl/openssl.cnf and compared it with openssl.cnf.leappsave and the only difference seems to be openssl now uses an $ENV reference for a lot of its parameters whereas the old one had them hardcoded. However, this error has only occurred in the latest update; updating to kernel-5.14.0-611.42.1.el9_7.x86_64 and previous all worked fine.

I have done a:

dnf remove $(dnf repoquery --installed --installonly --latest=1)

to roll back.

2

hello

This does not look like a kernel problem itself.

The failure happens while the kernel-core posttrans script runs dracut, and dracut calls /usr/lib/dracut/ossl-files --config. The OpenSSL error suggests that the OpenSSL configuration actually read by dracut contains an unresolved variable, or that a different configuration file is being used via OPENSSL_CONF.

Please check:

echo “$OPENSSL_CONF”
ls -l /etc/ssl/openssl.cnf /etc/pki/tls/openssl.cnf
grep -R ‘$ENV::’ /etc/ssl /etc/pki/tls /etc/crypto-policies 2>/dev/null
/usr/lib/dracut/ossl-files --config

On a normal system, /usr/lib/dracut/ossl-files --config should return /etc/pki/tls/openssl.cnf.

thank you

3

Thanks for your suggestions. This is what my system returns:

# echo “$OPENSSL_CONF”

# ls -l /etc/ssl/openssl.cnf /etc/pki/tls/openssl.cnf

-rw-r–r-- 1 root root 5163 Apr 7 11:34 /etc/pki/tls/openssl.cnf

lrwxrwxrwx 1 root root 24 Nov 19 21:11 /etc/ssl/openssl.cnf → /etc/pki/tls/openssl.cnf

# grep -R ‘$ENV::’ /etc/ssl /etc/pki/tls /etc/crypto-policies 2>/dev/null

# /usr/lib/dracut/ossl-files --config

Error on line 10 of configuration file

40973DB97D7F0000:error:07000068:configuration file routines:str_copy:variable has no value:crypto/conf/conf_def.c:759:line 10

If I do:

# less /etc/pki/tls/openssl.cnf

line 10 refers to this:

dir = $ENV::EASYRSA_PKI # Where everything is kept

It appears that none of the $ENV variables are set on my system.

I also presume there is a script somewhere that will set these variables?

It is suggested that I use ssxenv.sh, but I can’t find it on my system and it appears to belong to ssx (IBM) which is not part of my openssl setup :

# locate ssxenv

#

I also presume that these environment variables should be listed in /etc/environment which is empty on my system:

# ls -l /etc/environment

-rw-r–r-- 1 root root 0 05:29 4-Apr-2024 /etc/environment

NB The openssl.cnf.leappsave file (i.e. prior to upgrading to alma8 and then to alma9) does not use any openssl environment variables.

Here are the openssl packages I have on my system.

# dnf info ‘openssl*’

Installed Packages

Name : openssl

Version : 3.5.1

Release : 7.el9_7

Architecture : x86_64

…

Name : openssl-devel

Version : 3.5.1

Release : 7.el9_7

Architecture : x86_64

…

Name : openssl-fips-provider

Version : 3.5.1

Release : 7.el9_7

Architecture : x86_64

…

Name : openssl-libs

Version : 3.5.1

Release : 7.el9_7

Architecture : x86_64

…

Name : openssl-pkcs11

Version : 0.4.11

Release : 9.el9

Architecture : x86_64

…

Available Packages

Name : openssl-perl

Version : 3.5.1

Release : 7.el9_7

Architecture : x86_64

Any suggestions about what I should do next?

4

Hello,

This looks like the system OpenSSL config was replaced or modified with an EasyRSA-style config.

The line:

dir = $ENV::EASYRSA_PKI

should not normally be in the global OpenSSL config used by dracut.

I would first check and restore the default OpenSSL config:

rpm -qf /etc/pki/tls/openssl.cnf
rpm -V $(rpm -qf /etc/pki/tls/openssl.cnf)
ls -l /etc/pki/tls/openssl.cnf*

If openssl.cnf.leappsave is the previous working config, compare it and restore it carefully:

diff -u /etc/pki/tls/openssl.cnf.leappsave /etc/pki/tls/openssl.cnf

After restoring the config, test again:

/usr/lib/dracut/ossl-files --config
dracut -f

Thanks