From 8cbeb62e6b4f492047719d7c6e0cfa69c15ceaa4 Mon Sep 17 00:00:00 2001

From: Matthew Harmsen <mharmsen@redhat.com>

Date: Fri, 8 Dec 2017 17:17:34 -0700

Subject: [PATCH 1/6] Fix nuxwdog to work on all platforms

- dogtagpki Pagure Issue #2874 - nuxwdog won't start on Fedora

Change-Id: I5ff65c75087aeb939cb58ee7cf888bbbacb57ad5

(cherry picked from commit 19f04606cb58f7dc6e2872e39f62d3dad427ae22)

---

 base/server/sbin/pki-server-nuxwdog | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/base/server/sbin/pki-server-nuxwdog b/base/server/sbin/pki-server-nuxwdog

index ead925303..cb8993821 100755

--- a/base/server/sbin/pki-server-nuxwdog

+++ b/base/server/sbin/pki-server-nuxwdog

@@ -41,8 +41,8 @@ nux_fname="${CATALINA_BASE}/conf/nuxwdog.conf"

 touch ${nux_fname}

 chown pkiuser: ${nux_fname}

-echo "ExeFile ${JAVACMD}" > $nux_fname

-echo "ExeArgs ${JAVACMD} ${FLAGS} -classpath ${CLASSPATH} ${OPTIONS} ${MAIN_CLASS} start" >> $nux_fname

+echo "ExeFile ${JAVA_HOME}/bin/java" > $nux_fname

+echo "ExeArgs ${JAVA_HOME}/bin/java ${JAVACMD_OPTS} ${FLAGS} -classpath ${CLASSPATH} ${OPTIONS} ${MAIN_CLASS} start" >> $nux_fname

 echo "TmpDir ${CATALINA_BASE}/logs/pids" >> $nux_fname

 echo "ChildSecurity 1" >> $nux_fname

 echo "ExeOut ${CATALINA_BASE}/logs/catalina.out" >> $nux_fname

-- 

2.14.3

From e688a788f6cb9fd6e488ea5475c50c21583b9c87 Mon Sep 17 00:00:00 2001

From: Ade Lee <alee@redhat.com>

Date: Tue, 2 Jan 2018 13:38:40 -0500

Subject: [PATCH 2/6] Modified systemd invocations in pkispawn to handle

 nuxwdog

The systemd invocations in pkispawn/pkidestroy did not account for

nuxwdog enabled instances.  This patch allows pkispawn/pkidestroy to

use the right service name if the nuxwdog service unit files exist.

Also modified instance_layout deployment script to delete the right

systemd link.

Change-Id: I25eac0555aad022784d7728913ae4a335eab3463

(cherry picked from commit c7c907c07599ef1d9b52638c25153f7bd82de999)

---

 .../python/pki/server/deployment/pkihelper.py      | 55 ++++++++++------------

 .../deployment/scriptlets/instance_layout.py       |  5 +-

 2 files changed, 28 insertions(+), 32 deletions(-)

diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py

index 9bb0dfc0e..2cc36f4a2 100644

--- a/base/server/python/pki/server/deployment/pkihelper.py

+++ b/base/server/python/pki/server/deployment/pkihelper.py

@@ -3495,17 +3495,28 @@ class Systemd(object):

         Args:

           deployer (dictionary):  PKI Deployment name/value parameters

-

-        Attributes:

-

-        Returns:

-

-        Raises:

-

-        Examples:

-

         """

         self.mdict = deployer.mdict

+        instance_name = deployer.mdict['pki_instance_name']

+

+        unit_file = 'pki-tomcatd@%s.service' % instance_name

+        systemd_link = os.path.join(

+            '/etc/systemd/system/pki-tomcatd.target.wants',

+            unit_file)

+

+        nuxwdog_unit_file = 'pki-tomcatd-nuxwdog@%s.service' % instance_name

+        nuxwdog_systemd_link = os.path.join(

+            '/etc/systemd/system/pki-tomcatd-nuxwdog.target.wants',

+            nuxwdog_unit_file)

+

+        if os.path.exists(nuxwdog_systemd_link):

+            self.is_nuxwdog_enabled = True

+            self.service_name = nuxwdog_unit_file

+            self.systemd_link = nuxwdog_systemd_link

+        else:

+            self.is_nuxwdog_enabled = False

+            self.service_name = unit_file

+            self.systemd_link = systemd_link

     def daemon_reload(self, critical_failure=True):

         """PKI Deployment execution management lifecycle function.

@@ -3579,7 +3590,7 @@ class Systemd(object):

                 command = ["rm", "/etc/rc3.d/*" +

                            self.mdict['pki_instance_name']]

             else:

-                command = ["systemctl", "disable", "pki-tomcatd.target"]

+                command = ["systemctl", "disable", self.service_name]

             # Display this "systemd" execution managment command

             config.pki_log.info(

@@ -3629,7 +3640,7 @@ class Systemd(object):

                 command = ["ln", "-s", "/etc/init.d/pki-tomcatd",

                            "/etc/rc3.d/S89" + self.mdict['pki_instance_name']]

             else:

-                command = ["systemctl", "enable", "pki-tomcatd.target"]

+                command = ["systemctl", "enable", self.service_name]

             # Display this "systemd" execution managment command

             config.pki_log.info(

@@ -3673,20 +3684,15 @@ class Systemd(object):

         """

         try:

-            service = None

             # Execute the "systemd daemon-reload" management lifecycle command

             if reload_daemon:

                 self.daemon_reload(critical_failure)

-            # Compose this "systemd" execution management command

-            service = "pki-tomcatd" + "@" +\

-                      self.mdict['pki_instance_name'] + "." +\

-                      "service"

             if pki.system.SYSTEM_TYPE == "debian":

                 command = ["/etc/init.d/pki-tomcatd", "start",

                            self.mdict['pki_instance_name']]

             else:

-                command = ["systemctl", "start", service]

+                command = ["systemctl", "start", self.service_name]

             # Display this "systemd" execution managment command

             config.pki_log.info(

@@ -3726,17 +3732,11 @@ class Systemd(object):

         """

         try:

-            service = None

-            # Compose this "systemd" execution management command

-            service = "pki-tomcatd" + "@" +\

-                      self.mdict['pki_instance_name'] + "." +\

-                      "service"

-

             if pki.system.SYSTEM_TYPE == "debian":

                 command = ["/etc/init.d/pki-tomcatd", "stop",

                            self.mdict['pki_instance_name']]

             else:

-                command = ["systemctl", "stop", service]

+                command = ["systemctl", "stop", self.service_name]

             # Display this "systemd" execution managment command

             config.pki_log.info(

@@ -3777,21 +3777,16 @@ class Systemd(object):

         """

         try:

-            service = None

             # Compose this "systemd" execution management command

             # Execute the "systemd daemon-reload" management lifecycle command

             if reload_daemon:

                 self.daemon_reload(critical_failure)

-            service = "pki-tomcatd" + "@" +\

-                      self.mdict['pki_instance_name'] + "." +\

-                      "service"

-

             if pki.system.SYSTEM_TYPE == "debian":

                 command = ["/etc/init.d/pki-tomcatd", "restart",

                            self.mdict['pki_instance_name']]

             else:

-                command = ["systemctl", "restart", service]

+                command = ["systemctl", "restart", self.service_name]

             # Display this "systemd" execution managment command

             config.pki_log.info(

diff --git a/base/server/python/pki/server/deployment/scriptlets/instance_layout.py b/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

index a9a2840c7..b225d653b 100644

--- a/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

+++ b/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

@@ -58,7 +58,8 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

             # Link /etc/pki/<instance>/logging.properties

             # to /usr/share/pki/server/conf/logging.properties.

             deployer.symlink.create(

-                os.path.join(deployer.mdict['pki_source_server_path'], "logging.properties"),

+                os.path.join(deployer.mdict['pki_source_server_path'],

+                             "logging.properties"),

                 os.path.join(deployer.mdict['pki_instance_configuration_path'],

                              "logging.properties"))

@@ -173,7 +174,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

         if len(deployer.instance.tomcat_instance_subsystems()) == 0:

             # remove Tomcat instance systemd service link

-            deployer.symlink.delete(deployer.mdict['pki_systemd_service_link'])

+            deployer.symlink.delete(deployer.systemd.systemd_link)

             # remove Tomcat instance base

             deployer.directory.delete(deployer.mdict['pki_instance_path'])

-- 

2.14.3

From 98851261dd164bc586c78d0b96df712918c336e8 Mon Sep 17 00:00:00 2001

From: Ade Lee <alee@redhat.com>

Date: Tue, 2 Jan 2018 14:52:32 -0500

Subject: [PATCH 3/6] Allow prompting for token passwords if not present

Change-Id: Ifa2e60424d713ebe15bf9aa92f1d5b7691b7e0ff

(cherry picked from commit 6716b82ecc38b23de81c8f0fe18863e1df4bfddb)

---

 .../python/pki/server/deployment/__init__.py       |  4 +++-

 .../python/pki/server/deployment/pkihelper.py      | 27 ++++++++--------------

 base/server/sbin/pkidestroy                        |  2 +-

 base/server/sbin/pkispawn                          |  2 +-

 4 files changed, 15 insertions(+), 20 deletions(-)

diff --git a/base/server/python/pki/server/deployment/__init__.py b/base/server/python/pki/server/deployment/__init__.py

index 709fe7014..f9b05dd42 100644

--- a/base/server/python/pki/server/deployment/__init__.py

+++ b/base/server/python/pki/server/deployment/__init__.py

@@ -66,6 +66,7 @@ class PKIDeployer:

         self.systemd = None

         self.tps_connector = None

         self.config_client = None

+        self.parser = None

         # Set installation time

         ticks = time.time()

@@ -88,7 +89,7 @@ class PKIDeployer:

         if not len(self.dns_domainname):

             self.dns_domainname = self.hostname

-    def init(self):

+    def init(self, parser):

         # Utility objects

         self.identity = util.Identity(self)

@@ -111,6 +112,7 @@ class PKIDeployer:

         self.systemd = util.Systemd(self)

         self.tps_connector = util.TPSConnector(self)

         self.config_client = util.ConfigClient(self)

+        self.parser = parser

     def flatten_master_dict(self):

diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py

index 2cc36f4a2..8049e61fc 100644

--- a/base/server/python/pki/server/deployment/pkihelper.py

+++ b/base/server/python/pki/server/deployment/pkihelper.py

@@ -2057,6 +2057,7 @@ class Password:

     def __init__(self, deployer):

         self.mdict = deployer.mdict

+        self.deployer = deployer

     def create_password_conf(self, path, pin, pin_sans_token=False,

                              overwrite_flag=False, critical_failure=True):

@@ -2146,7 +2147,7 @@ class Password:

                 raise

         return

-    def get_password(self, path, token_name, critical_failure=True):

+    def get_password(self, path, token_name):

         token_pwd = None

         if os.path.exists(path) and os.path.isfile(path) and\

            os.access(path, os.R_OK):

@@ -2159,16 +2160,11 @@ class Password:

                 token_pwd = tokens[token_name]

         if token_pwd is None or token_pwd == '':

-            # TODO prompt for this password

-            config.pki_log.error(log.PKIHELPER_PASSWORD_NOT_FOUND_1,

-                                 token_name,

-                                 extra=config.PKI_INDENTATION_LEVEL_2)

-            if critical_failure:

-                raise Exception(

-                    log.PKIHELPER_PASSWORD_NOT_FOUND_1 %

-                    token_name)

-            else:

-                return

+            self.deployer.parser.read_password(

+                'Password for token {}'.format(token_name),

+                self.deployer.subsystem_name,

+                'token_pwd')

+            token_pwd = self.mdict['token_pwd']

         return token_pwd

@@ -2998,8 +2994,7 @@ class KRAConnector:

             token_pwd = self.password.get_password(

                 self.mdict['pki_shared_password_conf'],

-                token_name,

-                critical_failure)

+                token_name)

             if token_pwd is None or token_pwd == '':

                 config.pki_log.warning(

@@ -3203,8 +3198,7 @@ class TPSConnector:

             token_pwd = self.password.get_password(

                 self.mdict['pki_shared_password_conf'],

-                token_name,

-                critical_failure)

+                token_name)

             if token_pwd is None or token_pwd == '':

                 config.pki_log.warning(

@@ -3441,8 +3435,7 @@ class SecurityDomain:

         token_pwd = self.password.get_password(

             self.mdict['pki_shared_password_conf'],

-            token_name,

-            critical_failure)

+            token_name)

         if token_pwd is None or token_pwd == '':

             config.pki_log.warning(

diff --git a/base/server/sbin/pkidestroy b/base/server/sbin/pkidestroy

index 4a0c6a0b8..58d49698a 100755

--- a/base/server/sbin/pkidestroy

+++ b/base/server/sbin/pkidestroy

@@ -227,7 +227,7 @@ def main(argv):

     # Process the various "scriptlets" to remove the specified PKI subsystem.

     pki_subsystem_scriptlets = parser.mdict['destroy_scriplets'].split()

-    deployer.init()

+    deployer.init(parser)

     try:

         for scriptlet_name in pki_subsystem_scriptlets:

diff --git a/base/server/sbin/pkispawn b/base/server/sbin/pkispawn

index 1aa7079e8..6d387b2d8 100755

--- a/base/server/sbin/pkispawn

+++ b/base/server/sbin/pkispawn

@@ -519,7 +519,7 @@ def main(argv):

     # Process the various "scriptlets" to create the specified PKI subsystem.

     pki_subsystem_scriptlets = parser.mdict['spawn_scriplets'].split()

-    deployer.init()

+    deployer.init(parser)

     try:

         for scriptlet_name in pki_subsystem_scriptlets:

-- 

2.14.3

From 25439301773d2bf80a7eb871c8e1161bdbdb0315 Mon Sep 17 00:00:00 2001

From: Ade Lee <alee@redhat.com>

Date: Wed, 17 Jan 2018 18:31:19 -0500

Subject: [PATCH 4/6] Allow instances to be created with custom users

Some folks want to run instances under a different user and

group (ie. not pkiuser).  They may even want a different user for

each instance.  The way to do this in systemd is to create systemd

override files for the specific instance.

The deployment scriptlets have been updated to create (and delete)

these override files.

Change-Id: Icb0b6d15c6c8542dbbd565987d5fb3f1bddf6037

(cherry picked from commit afe0a2525cace41a1bef2ff7fe0f8f53aa5990e5)

---

 .../python/pki/server/deployment/pkihelper.py      | 55 ++++++++++++++++++++++

 .../deployment/scriptlets/instance_layout.py       | 18 +++++++

 2 files changed, 73 insertions(+)

diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py

index 8049e61fc..2b18f003c 100644

--- a/base/server/python/pki/server/deployment/pkihelper.py

+++ b/base/server/python/pki/server/deployment/pkihelper.py

@@ -21,6 +21,12 @@

 # System Imports

 from __future__ import absolute_import

 from __future__ import print_function

+

+try:

+    import configparser

+except ImportError:

+    import ConfigParser as configparser

+

 import errno

 import sys

 import os

@@ -3490,26 +3496,75 @@ class Systemd(object):

           deployer (dictionary):  PKI Deployment name/value parameters

         """

         self.mdict = deployer.mdict

+        self.deployer = deployer

         instance_name = deployer.mdict['pki_instance_name']

         unit_file = 'pki-tomcatd@%s.service' % instance_name

         systemd_link = os.path.join(

             '/etc/systemd/system/pki-tomcatd.target.wants',

             unit_file)

+        override_dir = '/etc/systemd/system/pki-tomcatd@{}.service.d'.format(

+            instance_name)

+        self.base_override_dir = override_dir

         nuxwdog_unit_file = 'pki-tomcatd-nuxwdog@%s.service' % instance_name

         nuxwdog_systemd_link = os.path.join(

             '/etc/systemd/system/pki-tomcatd-nuxwdog.target.wants',

             nuxwdog_unit_file)

+        nuxwdog_override_dir = (

+            '/etc/systemd/system/pki-tomcatd-nuxwdog@{}.service.d'.format(

+                instance_name))

+        self.nuxwdog_override_dir = nuxwdog_override_dir

+

+        # self.overrides will be a hash of ConfigParsers indexed by filename

+        # once the overrides have been constructed, the caller should call

+        # write_overrides()

+        self.overrides = {}

         if os.path.exists(nuxwdog_systemd_link):

             self.is_nuxwdog_enabled = True

             self.service_name = nuxwdog_unit_file

             self.systemd_link = nuxwdog_systemd_link

+            self.override_dir = nuxwdog_override_dir

         else:

             self.is_nuxwdog_enabled = False

             self.service_name = unit_file

             self.systemd_link = systemd_link

+            self.override_dir = override_dir

+

+    def create_override_directory(self):

+        self.deployer.directory.create(self.override_dir, uid=0, gid=0)

+

+    def create_override_file(self, fname):

+        self.create_override_directory()

+        self.deployer.file.create(

+            os.path.join(self.override_dir, fname),

+            uid=0, gid=0

+        )

+

+    def set_override(self, section, param, value, fname='local.conf'):

+        if fname not in self.overrides:

+            parser = configparser.ConfigParser()

+            parser.optionxform = str

+            override_file = os.path.join(self.override_dir, fname)

+            if os.path.exists(override_file):

+                parser.read(override_file)

+            self.overrides[fname] = parser

+        else:

+            parser = self.overrides[fname]

+

+        if not parser.has_section(section):

+            parser.add_section(section)

+

+        parser[section][param] = value

+

+    def write_overrides(self):

+        for fname, parser in self.overrides.items():

+            override_file = os.path.join(self.override_dir, fname)

+            if not os.path.exists(override_file):

+                self.create_override_file(override_file)

+            with open(override_file, 'w') as fp:

+                parser.write(fp, space_around_delimiters=False)

     def daemon_reload(self, critical_failure=True):

         """PKI Deployment execution management lifecycle function.

diff --git a/base/server/python/pki/server/deployment/scriptlets/instance_layout.py b/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

index b225d653b..bb9919f34 100644

--- a/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

+++ b/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

@@ -144,10 +144,21 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

             deployer.symlink.create(

                 deployer.mdict['pki_tomcat_bin_path'],

                 deployer.mdict['pki_tomcat_bin_link'])

+

+            # create systemd links

             deployer.symlink.create(

                 deployer.mdict['pki_tomcat_systemd'],

                 deployer.mdict['pki_instance_systemd_link'],

                 uid=0, gid=0)

+            user = deployer.mdict['pki_user']

+            group = deployer.mdict['pki_group']

+            if user != 'pkiuser' or group != 'pkiuser':

+                deployer.systemd.set_override(

+                    'Service', 'User', user, 'user.conf')

+                deployer.systemd.set_override(

+                    'Service', 'Group', group, 'user.conf')

+            deployer.systemd.write_overrides()

+            deployer.systemd.daemon_reload()

             # establish shared NSS security databases for this instance

             deployer.directory.create(deployer.mdict['pki_database_path'])

@@ -176,6 +187,13 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

             # remove Tomcat instance systemd service link

             deployer.symlink.delete(deployer.systemd.systemd_link)

+            # delete systemd override directories

+            if deployer.directory.exists(deployer.systemd.base_override_dir):

+                deployer.directory.delete(deployer.systemd.base_override_dir)

+            if deployer.directory.exists(deployer.systemd.nuxwdog_override_dir):

+                deployer.directory.delete(deployer.systemd.nuxwdog_override_dir)

+            deployer.systemd.daemon_reload()

+

             # remove Tomcat instance base

             deployer.directory.delete(deployer.mdict['pki_instance_path'])

             # remove Tomcat instance logs

-- 

2.14.3

From dc0af568a913d06ced134e6685b5dec1bafb5153 Mon Sep 17 00:00:00 2001

From: Ade Lee <alee@redhat.com>

Date: Tue, 16 Jan 2018 15:10:15 -0500

Subject: [PATCH 5/6] Make sure tomcat is running as pki user with nuxwdog

The nuxwdog process needs to run as a privileged user to be able

to retrieve the passwords from the systemd tty agent in systemctl.

Therefore, the nuxwdog unit file should NOT specify the PKI user

there.

However, we have added an option to nuxwdog to specify the user

in the nuxwdog config file, so that the process that nuxwdog spawns

(ie. tomcat) will run as the specified user.

The code changes in this patch ensure that when the nuxwdog conf

file is created, the user is set correctly as the value of the

variable TOMCAT_USER.

Change-Id: I0b4f8caedb048aaedf6a8a8f72b24fab39ad7bbf

(cherry picked from commit 96e99209b278b5ba380a61486a5b6ce6a87326a0)

---

 base/server/sbin/pki-server-nuxwdog | 3 ++-

 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/base/server/sbin/pki-server-nuxwdog b/base/server/sbin/pki-server-nuxwdog

index cb8993821..ffdbc3394 100755

--- a/base/server/sbin/pki-server-nuxwdog

+++ b/base/server/sbin/pki-server-nuxwdog

@@ -39,7 +39,7 @@ set_javacmd

 # create the nuxwdog config file

 nux_fname="${CATALINA_BASE}/conf/nuxwdog.conf"

 touch ${nux_fname}

-chown pkiuser: ${nux_fname}

+chown ${TOMCAT_USER}: ${nux_fname}

 echo "ExeFile ${JAVA_HOME}/bin/java" > $nux_fname

 echo "ExeArgs ${JAVA_HOME}/bin/java ${JAVACMD_OPTS} ${FLAGS} -classpath ${CLASSPATH} ${OPTIONS} ${MAIN_CLASS} start" >> $nux_fname

@@ -50,4 +50,5 @@ echo "ExeErr ${CATALINA_BASE}/logs/catalina.out" >> $nux_fname

 echo "ExeBackground 1" >> $nux_fname

 echo "PidFile $NUXWDOG_PID" >> $nux_fname

 echo "ChildPidFile $CATALINA_PID" >> $nux_fname

+echo "User ${TOMCAT_USER}" >> $nux_fname

-- 

2.14.3

From 73faa356531a529e13e55800861598bb6cc8ab6a Mon Sep 17 00:00:00 2001

From: Ade Lee <alee@redhat.com>

Date: Thu, 1 Feb 2018 13:02:03 -0500

Subject: [PATCH 6/6] More fixes for non-standard users

Needed to fix some python code that was added that works only on Python 3.

The top level directories for the registry should be owned by

root and be world readable/executable so that different users

can read the registry.

Change-Id: Ic0ce188cb678ff66e1a7370451f8df2285fc1282

cherry-pick from 79e8a8e99a3c9c6d16b63bb5d4b2b18a4b828b11

(cherry picked from commit e37ddfbc8b54e17dbe081221f6c849732a30ebe2)

---

 base/common/CMakeLists.txt                                 | 12 ++++++++++++

 base/server/python/pki/server/deployment/pkihelper.py      |  8 ++------

 .../server/deployment/scriptlets/infrastructure_layout.py  | 14 ++++++++++----

 .../pki/server/deployment/scriptlets/instance_layout.py    |  5 +++--

 4 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/base/common/CMakeLists.txt b/base/common/CMakeLists.txt

index d7856e1aa..3e8659da6 100644

--- a/base/common/CMakeLists.txt

+++ b/base/common/CMakeLists.txt

@@ -133,6 +133,18 @@ install(

         ${SYSTEMD_ETC_INSTALL_DIR}/pki-tomcatd-nuxwdog.target.wants

 )

+install(

+    DIRECTORY

+    DESTINATION

+        /etc/sysconfig/pki

+)

+

+install(

+    DIRECTORY

+    DESTINATION

+        /etc/sysconfig/pki/tomcat

+)

+

 install(

     DIRECTORY

         man/

diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py

index 2b18f003c..2e92b5956 100644

--- a/base/server/python/pki/server/deployment/pkihelper.py

+++ b/base/server/python/pki/server/deployment/pkihelper.py

@@ -1024,8 +1024,6 @@ class Instance:

             raise

     def get_instance_status(self, secure_connection=True):

-        pki_protocol = None

-        pki_port = None

         if secure_connection:

             pki_protocol = "https"

             pki_port = self.mdict['pki_https_port']

@@ -2931,7 +2929,6 @@ class ServerCertNickConf:

             try:

                 # overwrite value inside 'serverCertNick.conf'

                 with open(self.servercertnick_conf, "w") as fd:

-                    ssl_server_nickname = None

                     if self.step_two:

                         # use final HSM name

                         ssl_server_nickname = (self.token_name + ":" +

@@ -3556,7 +3553,7 @@ class Systemd(object):

         if not parser.has_section(section):

             parser.add_section(section)

-        parser[section][param] = value

+        parser.set(section, param, value)

     def write_overrides(self):

         for fname, parser in self.overrides.items():

@@ -3564,7 +3561,7 @@ class Systemd(object):

             if not os.path.exists(override_file):

                 self.create_override_file(override_file)

             with open(override_file, 'w') as fp:

-                parser.write(fp, space_around_delimiters=False)

+                parser.write(fp)

     def daemon_reload(self, critical_failure=True):

         """PKI Deployment execution management lifecycle function.

@@ -4142,7 +4139,6 @@ class ConfigClient:

             os.path.dirname(self.mdict['pki_external_admin_csr_path']))

         with open(self.mdict['pki_external_admin_csr_path'], "w") as f:

             f.write("-----BEGIN CERTIFICATE REQUEST-----\n")

-        admin_certreq = None

         with open(os.path.join(

                   self.mdict['pki_client_database_dir'],

                   "admin_pkcs10.bin.asc"), "r") as f:

diff --git a/base/server/python/pki/server/deployment/scriptlets/infrastructure_layout.py b/base/server/python/pki/server/deployment/scriptlets/infrastructure_layout.py

index b105378f8..7322ac392 100644

--- a/base/server/python/pki/server/deployment/scriptlets/infrastructure_layout.py

+++ b/base/server/python/pki/server/deployment/scriptlets/infrastructure_layout.py

@@ -53,9 +53,14 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

         # registry directories for storage of a copy of the original

         # deployment configuration file used to spawn this instance,

         # and save a copy of this file

-        deployer.directory.create(deployer.mdict['pki_registry_path'])

-        deployer.directory.create(

-            deployer.mdict['pki_instance_type_registry_path'])

+        #

+        # Unless a prefix is used, the top level directories should exist

+        # and be owned by the rpm

+        if deployer.mdict['pki_root_prefix'] != "":

+            deployer.directory.create(deployer.mdict['pki_registry_path'])

+            deployer.directory.create(

+                deployer.mdict['pki_instance_type_registry_path'])

+

         deployer.directory.create(deployer.mdict['pki_instance_registry_path'])

         deployer.directory.create(

             deployer.mdict['pki_subsystem_registry_path'])

@@ -123,4 +128,5 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

                 deployer.directory.delete(

                     deployer.mdict['pki_configuration_path'])

             # remove top-level infrastructure registry

-            deployer.directory.delete(deployer.mdict['pki_registry_path'])

+            if deployer.mdict['pki_root_prefix'] != "":

+                deployer.directory.delete(deployer.mdict['pki_registry_path'])

diff --git a/base/server/python/pki/server/deployment/scriptlets/instance_layout.py b/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

index bb9919f34..b24e9b728 100644

--- a/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

+++ b/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

@@ -211,8 +211,9 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

                 deployer.mdict['pki_instance_registry_path'])

             # remove Tomcat PKI registry (if empty)

             if deployer.instance.tomcat_instances() == 0:

-                deployer.directory.delete(

-                    deployer.mdict['pki_instance_type_registry_path'])

+                if deployer.mdict['pki_root_prefix'] != "":

+                    deployer.directory.delete(

+                        deployer.mdict['pki_instance_type_registry_path'])

 # Callback only when the /usr/share/pki/server/conf directory

-- 

2.14.3