Fix CA-less to CA-full upgrade

CertDB would have always created a directory on initialization. This
behavior changes here by replacing the truncate argument with create
which will only create the database when really required.

https://pagure.io/freeipa/issue/6853

Reviewed-By: Tomas Krizek <tkrizek@redhat.com>

ipaserver/install/ca.py

@@ -183,6 +183,8 @@ def install_check(standalone, replica_config, options):
             realm_name, nssdir=dirname, subject_base=options._subject_base)
 
         for db in (cadb, dsdb):
+            if not db.exists():
+                continue
             for nickname, _trust_flags in db.list_certs():
                 if nickname == certdb.get_ca_nickname(realm_name):
                     raise ScriptError(

ipaserver/install/certs.py

@@ -99,7 +99,7 @@ class CertDB(object):
     # TODO: Remove all selfsign code
     def __init__(self, realm, nssdir, fstore=None,
                  host_name=None, subject_base=None, ca_subject=None,
-                 user=None, group=None, mode=None, truncate=False):
+                 user=None, group=None, mode=None, create=False):
         self.nssdb = NSSDatabase(nssdir)
 
         self.secdir = nssdir
@@ -132,15 +132,16 @@ class CertDB(object):
         self.uid = 0
         self.gid = 0
 
-        if not truncate and os.path.exists(self.secdir):
-            # We are going to set the owner of all of the cert
-            # files to the owner of the containing directory
-            # instead of that of the process. This works when
-            # this is called by root for a daemon that runs as
-            # a normal user
-            mode = os.stat(self.secdir)
-            self.uid = mode[stat.ST_UID]
-            self.gid = mode[stat.ST_GID]
+        if not create:
+            if os.path.isdir(self.secdir):
+                # We are going to set the owner of all of the cert
+                # files to the owner of the containing directory
+                # instead of that of the process. This works when
+                # this is called by root for a daemon that runs as
+                # a normal user
+                mode = os.stat(self.secdir)
+                self.uid = mode[stat.ST_UID]
+                self.gid = mode[stat.ST_GID]
         else:
             if user is not None:
                 pu = pwd.getpwnam(user)
@@ -162,6 +163,23 @@ class CertDB(object):
     def passwd_fname(self):
         return self.nssdb.pwd_file
 
+    def exists(self):
+        """
+        Checks whether all NSS database files + our pwd_file exist
+        """
+        db_files = (
+            self.secdir,
+            self.certdb_fname,
+            self.keydb_fname,
+            self.secmod_fname,
+            self.nssdb.pwd_file,
+        )
+
+        for f in db_files:
+            if not os.path.exists(f):
+                return False
+        return True
+
     def __del__(self):
         if self.reqdir is not None:
             shutil.rmtree(self.reqdir, ignore_errors=True)

ipaserver/install/httpinstance.py

@@ -366,7 +366,7 @@ class HTTPInstance(service.Service):
         db = certs.CertDB(self.realm, nssdir=paths.HTTPD_ALIAS_DIR,
                           subject_base=self.subject_base, user="root",
                           group=constants.HTTPD_GROUP,
-                          truncate=True)
+                          create=True)
         self.disable_system_trust()
         self.create_password_conf()
         if self.pkcs12_info: