Skip lock and fork in ipa-server-guard on unsupported ops

On startup certmonger performs a number of options on the
configured CA (IPA, not to be confused with the real dogtag CA)
and the tracking requests.

Break early for operations that are not supported by ipa-submit.
This will save both a fork and a lock call.

https://bugzilla.redhat.com/show_bug.cgi?id=1656519

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>

install/certmonger/ipa-server-guard.in

@@ -35,11 +35,24 @@ import six
 from ipapython import ipautil
 from ipaserver.install import certs
 
+# Return codes. Names of the constants are taken from
+# https://git.fedorahosted.org/cgit/certmonger.git/tree/src/submit-e.h
+OPERATION_NOT_SUPPORTED_BY_HELPER = 6
+
 
 def main():
     if len(sys.argv) < 2:
         raise RuntimeError("Not enough arguments")
 
+    # Avoid the lock if the operation is unsupported by ipa-submit
+    operation = os.environ.get('CERTMONGER_OPERATION')
+    if operation not in ('IDENTIFY',
+                         'FETCH-ROOTS',
+                         'GET-NEW-REQUEST-REQUIREMENTS',
+                         'SUBMIT',
+                         'POLL'):
+        return OPERATION_NOT_SUPPORTED_BY_HELPER
+
     with certs.renewal_lock:
         result = ipautil.run(sys.argv[1:], raiseonerr=False, env=os.environ)
         if six.PY2: