From 2f902efd0e47eb2461429ce658f89d2a11f0891e Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Thu, 27 Jun 2024 15:42:47 +0200 Subject: [PATCH] ipa-ods-enforcer: stop must also stop the socket ipa-ods-enforcer is a socket-activated service. In order to fully stop the service, IPA needs to call systemctl stop ipa-ods-enforcer.service ipa-ods-enforcer.socket otherwise the socket remains active (listening) and can restart the service. A consequence of the issue is the backup / uninstall / restore scenario that is failing to sign the zones. The uninstaller removes the socket /run/opendnssec/engine.sock but leaves the ipa-ods-enforcer.socket active. A subsequent restore or install will not re-create the socket. Fixes: https://pagure.io/freeipa/issue/9613 Signed-off-by: Florence Blanc-Renaud Reviewed-By: Rob Crittenden --- ipaplatform/base/services.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ipaplatform/base/services.py b/ipaplatform/base/services.py index 466390332..275422e30 100644 --- a/ipaplatform/base/services.py +++ b/ipaplatform/base/services.py @@ -290,6 +290,10 @@ class SystemdService(PlatformService): # https://bugzilla.redhat.com/show_bug.cgi?id=973331#c11 if instance == "ipa-otpd.socket": args.append("--ignore-dependencies") + # ipa-ods-exporter is socket-activated, both the service and the + # socket have to be stopped + if instance == "ipa-ods-exporter.service": + args.append("ipa-ods-exporter.socket") ipautil.run(args, skip_output=not capture_output)