CentOS error “Failed to initialize NSS library” occurs when we erase a package.

As part of our Server Management Services, we assist our customers with several CentOS queries.

Today, let us see how our engineers fix this error for our customers.

CentOS error “Failed to initialize NSS library”

Generally, when we erase a package, it can impact this error.

The error is an output of executing a yum command. For example, here is the output after performing the ‘yum’ command:

[root@localhost dracut.conf.d]# yum clean all
error: Failed to initialize NSS library
There was a problem importing one of the Python modules
required to run yum. The error leading to this problem was:

cannot import name ts

Please install a package which provides this module, or
verify that the module is installed correctly.

It's possible that the above module doesn't match the
current version of Python, which is:
2.7.5 (default, Jul 13 2018, 13:06:57) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]

If you cannot solve this problem yourself, please go to 
the yum faq at:
http://yum.baseurl.org/wiki/Faq

[root@localhost dracut.conf.d]#

Basically, almost all commands using ‘yum’ with any type of parameter will present the above error.

Since the ‘yum’ utility is broken, we cannot reinstall the package. So, in order to solve, the only method is to copy the related files manually.

Here, the operating system is CentOS. The related files of the two packages’ are the ‘libgomp and the ‘nss-softokn-freebl.

The related file of the first package is libfreebl3.so. It exists in the /usr/lib64 folder. The second package is the package with the name nss-softokn-freebl.

We can try to recover it manually by copying all the files related to the package.

To find the related files, we use the rpm package search page.

Under the ‘Files’ section on the page, it lists all of the related files:

/etc/prelink.conf.d
/etc/prelink.conf.d/nss-softokn-prelink.conf
/usr/lib/dracut/dracut.conf.d/50-nss-softokn.conf
/usr/lib/dracut/modules.d/05nss-softokn
/usr/lib/dracut/modules.d/05nss-softokn/module-setup.sh
/usr/lib64/libfreebl3.chk
/usr/lib64/libfreebl3.so
/usr/lib64/libfreeblpriv3.chk
/usr/lib64/libfreeblpriv3.so

In addition, it shows the affected files for installing the nss-softokn-freebl package:

/etc/prelink.conf.d/nss-softokn-prelink.conf
/usr/lib/dracut/dracut.conf.d/50-nss-softokn.conf
/usr/lib/dracut/modules.d/05nss-softokn/module-setup.sh
/usr/lib64/libfreebl3.chk
/usr/lib64/libfreebl3.so
/usr/lib64/libfreeblpriv3.chk
/usr/lib64/libfreeblpriv3.so

Here, a list of the related files with nss-softokn-freebl package exists.

Copy all of the necessary files into the correct location with the same operating system or environment.

• Execute the solution

Moving ahead, our Support Techs suggest steps to achieve it in a systematic order.

a) Copy the first file, the nss-softokn-prelink.conf file

Before we copy the first file, we need to check the condition in the target or the problematic server location:

[root@target lib]# cd /etc/prelink.conf.d/
[root@target prelink.conf.d]# ls
fipscheck.conf grub2.conf
[root@target prelink.conf.d]#

Since it is not present, we copy the first file, nss-softokn-prelink.conf from the source server to the problematic or the target server location:

[root@source prelink.conf.d]# scp nss-softokn-prelink.conf user@xxx.xxx.xxx.xxx:/home/user
user@xxx.xxx.xxx.xxx's password: 
nss-softokn-prelink.conf 100% xxxxx xxxx/s 00:00 
[root@source prelink.conf.d]$

Once done, we can see the condition, as follows:

[root@target prelink.conf.d]# mv /home/user/nss-softokn-prelink.conf . 
[root@target prelink.conf.d]# ls -al
total 24
drwxr-xr-x. 2 root root 78 Feb 4 09:33 .
drwxr-xr-x. 76 root root 8192 Feb 4 07:50 ..
-rw-r--r--. 1 root root 57 Aug 2 2017 fipscheck.conf
-rw-r--r--. 1 root root 220 Oct 21 2017 grub2.conf
-rw-r--r--. 1 root root 184 Feb 4 09:30 nss-softokn-prelink.conf
[root@target prelink.conf.d]#

At last, from the output, we can see that the file exists.

b) Copy the second file, the 50-nss-softokn.conf file

Similarly, first, we check the condition in the target or the problematic server location:

[root@target dracut]# cd dracut.conf.d/
[root@target dracut.conf.d]# ls
01-dist.conf 01-microcode.conf 02-rescue.conf 76-phys-port-name.conf
[root@target dracut.conf.d]#

From the output, we can see that there is no such file. Hence we copy the second file:

[root@source dracut.conf.d]# scp 50-nss-softokn.conf user@xxx.xxx.xxx.xxx:/home/user
user@xxx.xxx.xxx.xxx's password: 
50-nss-softokn.conf 100% xxxxx xxxx/s 00:00 
root@source dracut.conf.d]#

Once done, make sure to check the condition of the problematic or the target server location:

[root@target prelink.conf.d]# mv /home/user/50-nss-softokn.conf . 
[root@target dracut.conf.d]# ls -al
total 20
drwxr-xr-x. 2 root root 130 Feb 4 09:37 .
drwxr-xr-x. 4 root root 236 Jul 16 2018 ..
-rw-r--r--. 1 root root 524 Apr 11 2018 01-dist.conf
-rw-r--r--. 1 root root 22 May 24 2018 01-microcode.conf
-rw-r--r--. 1 root root 26 Apr 11 2018 02-rescue.conf
-rw-r--r--. 1 root root 65 Feb 4 09:36 50-nss-softokn.conf
-rw-r--r--. 1 root root 117 Apr 11 2018 76-phys-port-name.conf
[root@target dracut.conf.d]#

Finally, the file exists.

c) Copy the third file, the module-setup.sh file

Initially, we check the availability of the third file. For that, we check the condition in the target or the problematic server location:

[root@target prelink.conf.d]# cd /usr/lib/dracut/
[root@target dracut]# ls
dracut.conf.d dracut-functions dracut-functions.sh dracut-initramfs-restore dracut-init.sh dracut-install dracut-logger.sh dracut-version.sh modules.d skipcpio
[root@target dracut]# cd modules.d/
[root@target modules.d]# ls -al
total 16
drwxr-xr-x. 64 root root 4096 Feb 4 07:50 .
drwxr-xr-x. 4 root root 236 Jul 16 2018 ..
drwxr-xr-x. 2 root root 29 Jul 16 2018 00bash
drwxr-xr-x. 2 root root 29 Jul 16 2018 00systemd-bootchart
drwxr-xr-x. 2 root root 57 Jul 16 2018 03modsign
drwxr-xr-x. 2 root root 29 Jul 16 2018 03rescue
drwxr-xr-x. 2 root root 72 Jul 16 2018 04watchdog
drwxr-xr-x. 2 root root 29 Jul 16 2018 05busybox
drwxr-xr-x. 2 root root 111 Jul 16 2018 10i18n
drwxr-xr-x. 2 root root 72 Jul 16 2018 30convertfs
....
drwxr-xr-x. 2 root root 227 Jul 16 2018 99kdumpbase
drwxr-xr-x. 2 root root 48 Jul 16 2018 99shutdown
drwxr-xr-x. 2 root root 48 Jul 16 2018 99uefi-lib
[root@target modules.d]#

Prior to copying the third file, we create the folder to place the module-setup.sh file in the target or the problematic server location:

[root@source modules.d]# mkdir 05nss-softokn
[root@source modules.d]# chmod -Rv 755 05nss-softokn/
mode of ‘05nss-softokn/’ retained as 0755 (rwxr-xr-x)
[root@source modules.d]# cd 05nss-softokn/
[root@source 05nss-softokn]# ls -al
total 4
drwxr-xr-x. 2 root root 6 Feb 4 09:34 .
drwxr-xr-x. 65 root root 4096 Feb 4 09:34 ..
[root@source 05nss-softokn]#

After that, we proceed to copy the third file:

[root@source 05nss-softokn]# scp 05nss-softokn/module-setup.sh user@xxx.xxx.xxx.xxx:/home/user
user@xxx.xxx.xxx.xxx's password: 
module-setup.sh 100% xxxxx xxxx/s 00:00 
[root@source 05nss-softokn]#

Later, we need to check the problematic server after we copy the third file for the availability of the file:

[root@target 05nss-softokn]# ls
[root@target 05nss-softokn]# mv /home/user/module-setup.sh . 
[root@target 05nss-softokn]# ls -al
total 8
drwxr-xr-x. 2 root root 29 Feb 4 09:35 .
drwxr-xr-x. 65 root root 4096 Feb 4 09:34 ..
-rw-r--r--. 1 root root 293 Feb 4 09:34 module-setup.sh
[root@target 05nss-softokn]#

d) Copy the rest of the files

As we saw in the steps above, we check the condition before we copy all those files:

[root@target lib64]# ls -al
total 62072
dr-xr-xr-x. 40 root root 20480 Feb 4 09:40 .
drwxr-xr-x. 15 root root 188 Jul 30 2018 ..
drwxr-xr-x. 2 root root 6 Jun 10 2014 apr-util-1
drwxr-xr-x. 2 root root 28 Jul 16 2018 audit
...
-r-xr-xr-x. 1 root root 356120 Apr 11 2018 libdevmapper.so.1.02
...
-rwxr-xr-x. 1 root root 72192 Sep 7 2017 libformw.so.5.9
...
-rwxr-xr-x. 1 root root 535064 Aug 2 2017 libgcrypt.so.11.8.2
...
-rwxr-xr-x. 1 root root 339104 Apr 11 2018 libgobject-2.0.so.0.5400.2
...
drwxr-xr-x. 2 root root 4096 Jul 16 2018 xtables
[root@target lib64]#

Here, there are no related files with the nss-softokn-freebl package. So, we copy all of those files:

[root@localhost dracut.conf.d]# cd /usr/lib64/
[root@localhost lib64]# scp libfreebl3.so libfreebl3.chk libfreeblpriv3.so libfreeblpriv3.chk 
user@xxx.xxx.xxx.xxx's password: 
libfreebl3.so 100% xxxxx xxxx/s 00:00 
libfreebl3.chk 100% xxxxx xxxx/s 00:00 
libfreeblpriv3.so 100% xxxxx xxxx/s 00:00 
libfreeblpriv3.chk 100% xxxxx xxxx/s 00:00 
[root@localhost lib64]#

Finally, we need to make sure that the content in the target or the problematic server has the libfreebl3.chk, libfreebl3.so, libfreeblpriv3.chk and libfreeblpriv3.so files:

[root@localhost lib64]# ls -al
total 62072
dr-xr-xr-x. 40 root root 20480 Feb 4 09:40 .
drwxr-xr-x. 15 root root 188 Jul 30 2018 ..
drwxr-xr-x. 2 root root 6 Jun 10 2014 apr-util-1
drwxr-xr-x. 2 root root 28 Jul 16 2018 audit
...
-rwxr-xr-x. 1 root root 72192 Sep 7 2017 libformw.so.5.9
-rw-r--r--. 1 root root 899 Feb 4 09:39 libfreebl3.chk
-rwxr-xr-x. 1 root root 11448 Feb 4 09:04 libfreebl3.so
-rw-r--r--. 1 root root 899 Feb 4 09:39 libfreeblpriv3.chk
-rw-r--r--. 1 root root 551840 Feb 4 09:39 libfreeblpriv3.so
...
drwxr-xr-x. 2 root root 4096 Jul 16 2018 xtables
[root@localhost lib64]#

• Finish the resolution

Finally, we execute the ‘yum’ command again.

Once we copy all the related files, the output will be like the following:

[root@localhost lib64]# yum update
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: xxxxxxx.xxxxx.xxx.xx
* epel: xxxxxxx.xxx.xxx.xx
* extras: xxxxxxx.xxxx.xxx.xx
* ius: xxx.xxxxxxx.xx
* updates: xxxxxxx.xxxx.xx.xx
Resolving Dependencies
--> Running transaction check
---> Package NetworkManager.x86_64 1:1.10.2-16.el7_5 will be updated
---> Package NetworkManager.x86_64 1:1.12.0-8.el7_6 will be an update
--> Processing Dependency: glib2 >= 2.56.1 for package: 
...
---> Package bind-license.noarch 32:9.9.4-61.el7 will be updated
---> Package bind-license.noarch 32:9.9.4-73.el7_6 will be an update
---> Package cronie.x86_64 0:1.4.11-19.el7 will be updated
---> Package cronie.x86_64 0:1.4.11-20.el7_6 will be an update
---> Package cronie-anacron.x86_64 0:1.4.11-19.el7 will be updated
...
---> Package python2-psutil.x86_64 0:2.2.1-4.el7 will be installed
---> Package selinux-policy.noarch 0:3.13.1-229.el7_6.9 will be an update
--> Processing Dependency: libsemanage >= 2.5-13 for package: selinux-policy-3.13.1-229.el7_6.9.noarch
---> Package systemd.x86_64 0:219-62.el7_6.3 will be an update
--> Processing Dependency: libcryptsetup.so.12(CRYPTSETUP_2.0)(64bit) for package: systemd-219-62.el7_6.3.x86_64
--> Processing Dependency: libcryptsetup.so.12()(64bit) for package: systemd-219-62.el7_6.3.x86_64
--> Finished Dependency Resolution
...
Error: Package: kernel-3.10.0-957.5.1.el7.x86_64 (updates)
Requires: linux-firmware >= 20180911-68
Installed: linux-firmware-20180220-62.2.git6d51311.el7_5.noarch (@updates)
linux-firmware = 20180220-62.2.git6d51311.el7_5
Available: linux-firmware-20180220-62.git6d51311.el7.noarch (base)
linux-firmware = 20180220-62.git6d51311.el7
Error: Package: systemd-219-62.el7_6.3.x86_64 (updates)
Requires: libcryptsetup.so.12()(64bit)
Error: Package: systemd-219-62.el7_6.3.x86_64 (updates)
Requires: libcryptsetup.so.12(CRYPTSETUP_2.0)(64bit)
You could try using --skip-broken to work around the problem
** Found 8 pre-existing rpmdb problem(s), 'yum check' output follows:
gettext-0.19.8.1-2.el7.x86_64 has missing requires of libgomp.so.1()(64bit)
gettext-0.19.8.1-2.el7.x86_64 has missing requires of libgomp.so.1(GOMP_1.0)(64bit)
gettext-libs-0.19.8.1-2.el7.x86_64 has missing requires of libgomp.so.1()(64bit)
glibc-2.17-222.el7.x86_64 has missing requires of libfreebl3.so()(64bit)
glibc-2.17-222.el7.x86_64 has missing requires of libfreebl3.so(NSSRAWHASH_3.12.3)(64bit)
nss-softokn-3.36.0-5.el7_5.x86_64 has missing requires of nss-softokn-freebl(x86-64) >= ('0', '3.36.0', '5.el7_5')
p11-kit-trust-0.23.5-3.el7.x86_64 has missing requires of libfreebl3.so()(64bit)
p11-kit-trust-0.23.5-3.el7.x86_64 has missing requires of libfreebl3.so(NSSRAWHASH_3.12.3)(64bit)
[root@localhost lib64]#

To inspect further into the problem, we execute the ‘yum check’:

[root@localhost lib64]# yum check
Loaded plugins: fastestmirror
gettext-0.19.8.1-2.el7.x86_64 has missing requires of libgomp.so.1()(64bit)
gettext-0.19.8.1-2.el7.x86_64 has missing requires of libgomp.so.1(GOMP_1.0)(64bit)
gettext-libs-0.19.8.1-2.el7.x86_64 has missing requires of libgomp.so.1()(64bit)
glibc-2.17-222.el7.x86_64 has missing requires of libfreebl3.so()(64bit)
glibc-2.17-222.el7.x86_64 has missing requires of libfreebl3.so(NSSRAWHASH_3.12.3)(64bit)
nss-softokn-3.36.0-5.el7_5.x86_64 has missing requires of nss-softokn-freebl(x86-64) >= ('0', '3.36.0', '5.el7_5')
p11-kit-trust-0.23.5-3.el7.x86_64 has missing requires of libfreebl3.so()(64bit)
p11-kit-trust-0.23.5-3.el7.x86_64 has missing requires of libfreebl3.so(NSSRAWHASH_3.12.3)(64bit)
Error: check all
[root@localhost lib64]#

Apparently, according to the output, there is a missing file related to the libgomp package. Its filename is libgomp.so.1.

To fix this easily, we just copy it manually again:

[root@source lib64]# scp libgomp.so.1 user@xxx.xxx.xxx.xxx:/home/user
user@xxx.xxx.xxx.xxx's password: 
libgomp.so.1 100% xxxxx xxxx/s 00:00 
[root@source lib64]#

Later, we properly copy and modify the file permission in the target or problematic server:

[root@target lib64]# mv /home/user/libgomp.so.1 . 
[root@target lib64]# chmod +x libgomp.so.1 
[root@target lib64]#

[Stuck in between? We are here to help you out]

Conclusion

In short, we saw how our Support Techs go ahead and fix the CentOS error.