Bug 1400425

Summary: nss_sss should not link against libpthread
Product: Red Hat Enterprise Linux 7 Reporter: Deepak Das <ddas>
Component: sssdAssignee: SSSD Maintainers <sssd-maint>
Status: CLOSED ERRATA QA Contact: Niranjan Mallapadi Raghavender <mniranja>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 7.3CC: d.perry, grajaiya, jhrozek, lslebodn, mkosek, mzidek, pbrezina, sssd-qe
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: sssd-1.15.0-2.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-01 09:02:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Deepak Das 2016-12-01 08:23:04 UTC
/usr/lib64/libnss_sss.so.2 in sssd-1.14.0-43.el7.x86_64 is linked against libpthread.  This causes problems when static binaries attempt to use NSS-based functions:

  https://sourceware.org/bugzilla/show_bug.cgi?id=20500

It also increases the risk for symbol collisions with the application binary.

What libpthread functionality do you *really* need which is not in libc.so.6?

Comment 2 Jakub Hrozek 2016-12-01 12:39:44 UTC
Upstream ticket:
https://fedorahosted.org/sssd/ticket/3156

Comment 3 Jakub Hrozek 2016-12-01 12:41:01 UTC
master: d2f93542650c2f9613043acfa8e2f368972a70cd

Comment 4 Jakub Hrozek 2016-12-01 12:45:34 UTC
To reproduce, compile a program that resolves a user from SSSD, for example:
----------
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <sys/types.h>
#include <pwd.h>

int
main()
{
        struct passwd *p;

        if((p = getpwnam("admin")) != NULL)
                printf("%s\n", p->pw_name);
}
----------

compile the program with -static and then try to run it. With the NSS module that still links against -lphread, the program might crash when loading the lpthread library. Since the library wouldn't be linked with nss_sss at all if the patch is present, no such error should be present with the fixed packages.

An important part of testing is regression testing, especially multi-threaded programs.

Comment 5 Lukas Slebodnik 2016-12-01 12:52:13 UTC
(In reply to Jakub Hrozek from comment #4)
> To reproduce, compile a program that resolves a user from SSSD, for example:
> ----------
> #include <unistd.h>
> #include <stdlib.h>
> #include <stdio.h>
> #include <sys/types.h>
> #include <pwd.h>
> 
> int
> main()
> {
>         struct passwd *p;
> 
>         if((p = getpwnam("admin")) != NULL)
>                 printf("%s\n", p->pw_name);
> }
> ----------
> 
> compile the program with -static and then try to run it. With the NSS module
> that still links against -lphread, the program might crash when loading the
> lpthread library. Since the library wouldn't be linked with nss_sss at all
> if the patch is present, no such error should be present with the fixed
> packages.
> 
> An important part of testing is regression testing, especially
> multi-threaded programs.

IMHO, there is a much simpler test:
ldd /lib64/libnss_sss.so.2 | grep libpthread.so

Comment 7 Niranjan Mallapadi Raghavender 2017-05-26 06:35:05 UTC
Versions
=========
[root@idm1 yum.repos.d]# rpm -q sssd
sssd-1.15.2-29.el7.x86_64

verify libnss_sss.so is linked with libthread. 

[root@idm1 yum.repos.d]# ldd /lib64/libnss_sss.so.2 | grep libpthread.so

[root@idm1 yum.repos.d]# ldd /lib64/libnss_sss.so.2
        linux-vdso.so.1 =>  (0x00007ffd20d49000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007f77250f6000)
        libc.so.6 => /lib64/libc.so.6 (0x00007f7724d33000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f7725511000)

Comment 8 errata-xmlrpc 2017-08-01 09:02:33 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:2294