rpms
/
glibc
7
0
Fork 1
Code Issues Pull Requests Releases Activity
glibc/SOURCES/glibc-rh1932770.patch

178 lines
6.0 KiB
Diff
Raw Permalink Blame History

This is a custom downstream RHEL 8 patch which rebuilds three
GLIBC_PRIVATE interfaces locally for use by libnss_files.so.2
and libnss_compat.so.2.
The shared objects needs the following 3 functions:
__nss_readline
__nss_parse_line_result
__nss_files_fopen (only requirement for libnss_compat.so.2)
They are implemented in:
nss/nss_parse_line_result.c
nss/nss_readline.c
nss/nss_files_fopen.c
We create wrappers for those functions, recompile, and link directly
into the shared objects:
nss/nss_parse_line_result_int.c
nss/nss_readline_int.c
nss/nss_files_fopen_int.c
After building the new shared objects there are no longer any undefined
global function references to __nss_readline@GLIBC_PRIVATE,
__nss_parse_line_result@GLIBC_PRIVATE or
__nss_files_fopen@GLIBC_PRIVATE.
Instead we see local function definitions in the shared object e.g.
Symbol table '.symtab' contains 628 entries:
...
486: 0000000000008ce0 92 FUNC LOCAL DEFAULT 15 __nss_parse_line_result
...
494: 0000000000008b70 72 FUNC LOCAL DEFAULT 15 __nss_readline_seek
...
497: 0000000000008bc0 279 FUNC LOCAL DEFAULT 15 __nss_readline
...
510: 0000000000008ce0 82 FUNC LOCAL DEFAULT 15 __nss_files_fopen
The remaining GLIBC_PRIVATE references in the shared objects are all
pre-existing and do not impact upgrade scenarios.
For reference the existing and present GLIBC_PRIVATE interfaces are:
__libc_alloc_buffer_alloc_array@@GLIBC_PRIVATE
__libc_alloc_buffer_copy_string@@GLIBC_PRIVATE
__libc_alloc_buffer_create_failure@@GLIBC_PRIVATE
__libc_dynarray_emplace_enlarge@@GLIBC_PRIVATE
__libc_scratch_buffer_grow@@GLIBC_PRIVATE
__resp@@GLIBC_PRIVATE
_nss_files_parse_grent@@GLIBC_PRIVATE
_nss_files_parse_pwent@@GLIBC_PRIVATE
_nss_files_parse_sgent@@GLIBC_PRIVATE
_nss_files_parse_spent@@GLIBC_PRIVATE
errno@@GLIBC_PRIVATE
__nss_database_lookup2@GLIBC_PRIVATE
__nss_lookup_function@GLIBC_PRIVATE
Each was checked for existence in libc.so.6.
A small reproducer was used in testing this patch, included here:
cat >> tst-rhbz1927040.c <<EOF
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <errno.h>
#include <pwd.h>
#include <string.h>
int
main (void)
{
struct passwd *res;
/* Only lookup via files. */
printf ("INFO: Upgrade glibc, then press ENTER to see if libnss_files.so.2 loads.");
getchar ();
/* Try to get one entry. */
printf ("INFO: Looking up first password entry.\n");
setpwent ();
errno = 0;
res = getpwent ();
if (res == NULL && errno != 0)
{
printf ("FAIL: Could not get entry (%s).\n", strerror(errno));
exit (1);
}
printf ("INFO: First entry passwd.pw_name = \"%s\"\n", res->pw_name);
printf ("PASS: Call to getpwent succeeded.\n");
endpwent ();
exit (0);
}
EOF
Testing RHEL upgrade
from: glibc-2.28-127.el8_3.2
to: glibc-2.28-148.el8
./tst-rhbz1927040
INFO: Upgrade glibc, then press ENTER to see if libnss_files.so.2 loads.
INFO: Looking up first password entry.
INFO: Result was NULL.
PASS: Call to getpwent succeeded.
With LD_DEBUG=all you can observe:
22697: /lib64/libnss_files.so.2: error: symbol lookup error: undefined symbol: __nss_files_fopen, version GLIBC_PRIVATE (fatal)
Which is the indication that the upgrade caused the transient IdM lookup failure.
Running again succeeds:
INFO: Upgrade glibc, then press ENTER to see if libnss_files.so.2 loads.
INFO: Looking up first password entry.
INFO: First entry passwd.pw_name = "root"
PASS: Call to getpwent succeeded.
diff --git a/nss/Makefile b/nss/Makefile
index 7359da38feb65618..d5c28a6b5ed3661c 100644
--- a/nss/Makefile
+++ b/nss/Makefile
@@ -92,9 +92,19 @@ extra-libs-others = $(extra-libs)
subdir-dirs = $(services:%=nss_%)
vpath %.c $(subdir-dirs) ../locale/programs ../intl
-
+# In RHEL we add nss_readline, nss_parse_line_result, and
+# nss_files_fopen to the libnss_files-routines in order to avoid the
+# case where a long running process (having never used NSS) attemps to
+# load an NSS module for the first time and that NSS module needs a
+# newer GLIBC_PRIVATE interface. In effect we must make the NSS modules
+# self-sufficient and not rely on a GLIBC_PRIVATE interface.
+# See: https://bugzilla.redhat.com/show_bug.cgi?id=1927040
+# Note: We must recompile the objects to get the correct global symbol
+# references, which is why we have the *_int.c wrappers.
libnss_files-routines := $(addprefix files-,$(databases)) \
- files-initgroups files-init
+ files-initgroups files-init \
+ nss_readline_int nss_parse_line_result_int \
+ nss_files_fopen_int
libnss_db-dbs := $(addprefix db-,\
$(filter-out hosts network key alias,\
@@ -104,8 +114,10 @@ libnss_db-routines := $(libnss_db-dbs) db-open db-init hash-string
generated += $(filter-out db-alias.c db-netgrp.c, \
$(addsuffix .c,$(libnss_db-dbs)))
+# See note above regarding nss_files_fopen.
libnss_compat-routines := $(addprefix compat-,grp pwd spwd initgroups) \
- nisdomain
+ nisdomain \
+ nss_files_fopen_int
install-others += $(inst_vardbdir)/Makefile
diff --git a/nss/nss_files_fopen_int.c b/nss/nss_files_fopen_int.c
new file mode 100644
index 0000000000000000..fa518084fd609b52
--- /dev/null
+++ b/nss/nss_files_fopen_int.c
@@ -0,0 +1,3 @@
+/* Include a local internal copy of __nss_files_fopen to make the NSS
+ module self-contained. */
+#include <nss_files_fopen.c>
diff --git a/nss/nss_parse_line_result_int.c b/nss/nss_parse_line_result_int.c
new file mode 100644
index 0000000000000000..bc0ee7a251743c9a
--- /dev/null
+++ b/nss/nss_parse_line_result_int.c
@@ -0,0 +1,3 @@
+/* Include a local internal copy of __nss_parse_line_result to make the
+ NSS module self-contained. */
+#include <nss_parse_line_result.c>
diff --git a/nss/nss_readline_int.c b/nss/nss_readline_int.c
new file mode 100644
index 0000000000000000..0e7bd259733673c9
--- /dev/null
+++ b/nss/nss_readline_int.c
@@ -0,0 +1,3 @@
+/* Include a local internal copy of __nss_readline and
+ __nss_readline_seek to make the NSS module self-contained. */
+#include <nss_readline.c>
Reference in New Issue View Git Blame Copy Permalink