Re: problem with nss_ldap

On Fri, Mar 06, 2009 at 05:00:49PM -0500, tmclaugh_at_sdf.lonestar.org wrote:
> > On Fri, Mar 06, 2009 at 09:39:31PM +0100, Hartmut Brandt wrote:
> >>
> >> Hi Tom,
> >>
> >> On Sat, 28 Feb 2009, Tom McLaughlin wrote:
> >>
> >> TM>Tom McLaughlin wrote:
> >> TM>> Harti Brandt wrote:
> >> TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt_at_dlr.de wrote:
> >> TM>
> >> TM>> > > Both create entries in /var/log/messages like:
> >> TM>> > >
> >> TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error:
> >> Miscellaneous
> >> TM>> > > failure (see
> >> TM>> > >
> >> text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
> >> TM>Z
> >> TM>> Z
> >> TM>> >  ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
> >> TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ
> >> TM>> > >
> >> TM>> > > I've tried to figure out in which of the dozens of layered
> >> libraries
> >> TM>> > > (gss, sasl, ssl, ......) this error is generated but did not
> >> find
> >> TM>> > > anything.
> >> TM>> > >
> >> TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in
> >> sshd_config
> >> TM>> > > (as I said, this worked before).
> >> TM>> > So to answer my own mail: I made a link from the kerberos ticket
> >> file
> >> TM>> > which contains the host ticket (and is specified in
> >> nss_ldap.conf) to
> >> TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary,
> >> though.
> >> TM>>
> >> TM>> There may be an issue with the env method used in nss_ldap to
> >> change the
> >> TM>> credentials cache.  My mind is fuzzy but I do recall a similar
> >> issue but
> >> TM>> don't remember the exact cause or case.  nss_ldap has a second
> >> configurable
> >> TM>> ccname method which when I submitted the original patch I intended
> >> to
> >> TM>> switch to once we had a newer heimdal.  Once I get nss_ldap working
> >> on my
> >> TM>> box I intend to submit another patch.
> >> TM>>
> >> TM>> tom
> >> TM>
> >> TM>Hi Harti (CC maintainer),
> >> TM>
> >> TM>Can you try the attached patch for nss_ldap?  This should cause the
> >> host
> >> TM>ticket to work correctly on -CURRENT.  It's "my box approved".
> >>
> >> Does not work. I rebuilt my system with today's sources to be sure,
> >> removed my patches to the two library makefiles and rebuilt nss_ldap
> >> with
> >> your patch. I get:
> >>
> >> # ls -l
> >> dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol
> >> "GSS_C_NT_HOSTBASED_SERVICE"
> >> /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined symbol
> >> "gss_oid_equal"
> >>
> >> Basically on everything I enter. Luckily vi still works :-)
> >>
> >> I saw that the configuration script claims not to find
> >> gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is because the
> >> test program for -lgssapi_krb5 links only to gssapi_krb5 but not to
> >> gssapi
> >> and so gets a lot of errors. I fixed this by adding gssapi, but the
> >> final
> >> result was the same.
> >
> > It seems that this is because libgssapi_krb5, libgssapi_spnego
> > and several other heimdal shared libraries are not linked against
> > libgssapi.
> >
> >
> 
> As I understand it libgssapi_krb5 and libgssapi_spnego are not supposed to
> be linked against libgssapi.  They're supposed to be just plugins.

These objects reference symbols from libgssapi. The libgssapi or nss_ldap
are dlopened without RTLD_GLOBAL flag, and libgssapi-provided symbols
are not available. As I understand, nss module must be not loaded with
RTLD_GLOBAL.

Our binutils in base are old. Newer ld has a switch --no-allow-shlib-undefined
that fails the link if shared library has undefined references. I find
it useful to catch and fix this kind of errors.