Date: Thu, 9 Apr 2009 00:28:12 GMT From: Benjamin Lee <ben@b1c1l1.com> To: freebsd-gnats-submit@FreeBSD.org Subject: ports/133501: pthread_atfork breaks nss_ldap on RELENG_7 Message-ID: <200904090028.n390SCx1017874@www.freebsd.org> Resent-Message-ID: <200904090030.n390U741022188@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 133501
>Category: ports
>Synopsis: pthread_atfork breaks nss_ldap on RELENG_7
>Confidential: no
>Severity: critical
>Priority: high
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Thu Apr 09 00:30:06 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator: Benjamin Lee
>Release: 7.1-RELEASE-p4
>Organization:
>Environment:
FreeBSD *** 7.1-RELEASE-p4 FreeBSD 7.1-RELEASE-p4 #0: Sun Mar 22 12:35:36 UTC 2009 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386
>Description:
pthread_atfork breaks nss_ldap on machines running RELENG_7. I have verified this on several machines running 7.0-RELEASE and 7.1-RELEASE. I have been unable to reproduce the issue on older versions (e.g. 6.3-RELEASE, 6.2-RELEASE). Therefore I suspect that the defect is related to the change from libkse to libthr.
When logging into an affected machine using SSH and challenge-response authentication, several nss_ldap calls fail and cause a variety of problems. One of these problems is that the call to initgroups(3) fails (the only group in `groups` output is the user's gid).
The following messages are logged to /var/log/auth.log:
Apr 8 17:22:51 *** sshd[14259]: Accepted keyboard-interactive/pam for blee from *** port 63880 ssh2
Apr 8 17:22:51 *** sshd[14262]: nss_ldap: could not get LDAP result - Can't contact LDAP server
Apr 8 17:22:51 *** sshd[14262]: nss_ldap: could not get LDAP result - Can't contact LDAP server
The problem does *NOT* occur when using public key authentication (i.e. SSH keys).
>How-To-Repeat:
Login to a machine running RELENG_7 and nss_ldap using SSH and challenge-response authentication.
>Fix:
Workaround:
Update the configure.in patch to disable pthread_atfork support by applying attached the diff against files/patch-configure.in.
Patch attached with submission follows:
--- patch-configure.in.orig 2008-12-10 08:11:25.000000000 -0800
+++ patch-configure.in 2009-04-08 17:13:10.000000000 -0700
@@ -24,3 +24,11 @@
AC_CHECK_HEADERS(irs.h) ;;
esac
AC_CHECK_HEADERS(thread.h)
+@@ -227,7 +230,6 @@
+ AC_CHECK_FUNCS(gethostbyname)
+ AC_CHECK_FUNCS(nsdispatch)
+ AC_CHECK_LIB(pthread_nonshared, main)
+-AC_CHECK_FUNCS(pthread_atfork)
+ AC_CHECK_FUNCS(pthread_once)
+ AC_CHECK_FUNCS(ether_aton)
+ AC_CHECK_FUNCS(ether_ntoa)
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200904090028.n390SCx1017874>