Bug 703567

Summary: edquota defines global symbols with names that nsswitch modules might be using
Product: [Fedora] Fedora Reporter: Nalin Dahyabhai <nalin>
Component: quotaAssignee: Petr Pisar <ppisar>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: ovasik, ppisar
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
URL: https://sourceforge.net/tracker/?func=detail&aid=3300978&group_id=18136&atid=118136
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 704216 (view as bug list) Environment:
Last Closed: 2011-05-25 07:26:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 704219    
Bug Blocks:    
Attachments:
Description Flags
Fix none

Description Nalin Dahyabhai 2011-05-10 17:22:33 UTC 
Description of problem:
On a system with nss_db configured in /etc/nsswitch.conf, queries that go through libnss_db cause edquota to crash because the module expects to be calling libc's dirname() function, but ends up attempting to call the global variable named "dirname" that edquota defines (confirmed by running edquota with "$LD_DEBUG=bindings"). 

Version-Release number of selected component (if applicable):
quota-4.00-0.14.pre1.fc16.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Install nss_db
2. make -C /var/db
3. Add "db" to the beginning of the "passwd", "group", and "shadow" lists in /etc/nsswitch.conf.
4. Run "edquota -f $fs -u $user" for a given mountpoint and user.
  
Actual results:
Segfault.

Expected results:
Text editor opens, as you'd expect.

Additional info:
Renaming "dirname" or making it static both prevent this from happening.  I'm open to changes to how we build nss_db to prevent this there, but it won't help other nsswitch modules which might also be calling this dirname().
Comment 1 Petr Pisar 2011-05-12 08:42:45 UTC 
This is nasty bug. Actually it means any program that does (indirectly) dlopen() can clash with any exported symbols. Especially if the dlopen()ed object can be linked against any obscure library.

Clean solution is to not export any global variables/functions from main program and the ones that must be exported (e.g. due to communication between object program and it's own direct plug-in) must be prefixed uniquely. This like in the old days everything was linked statically.

I will audit quota tools code for that. Meanwhile use nscd to separate address space and to avoid segfault.
Comment 2 Petr Pisar 2011-05-12 12:12:55 UTC 
All Fedoras affected.
Comment 3 Petr Pisar 2011-05-12 12:15:32 UTC 
Created attachment 498523 [details]
Fix

Minimal fix. More comprehensive patch proposed to upstream.
Comment 4 Petr Pisar 2011-05-12 12:54:26 UTC 
Fix commited as quota-4.00-0.15.pre1.fc16 for F16, but it has not been built because glibc stopped to deliver RPC. quota tools must be ported to standalone tirpc.
Comment 5 Fedora Update System 2011-05-12 12:57:08 UTC 
quota-4.00-0.12.pre1.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/quota-4.00-0.12.pre1.fc15
Comment 6 Fedora Update System 2011-05-12 12:57:26 UTC 
quota-3.17-16.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/quota-3.17-16.fc14
Comment 7 Fedora Update System 2011-05-12 12:57:43 UTC 
quota-3.17-13.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/quota-3.17-13.fc13
Comment 8 Petr Pisar 2011-05-12 13:26:14 UTC 
The F16 fix is blocked by bug #704219 (migrate to tirpc) now.
Comment 9 Petr Pisar 2011-05-12 14:09:25 UTC 
(In reply to comment #1)
> This is nasty bug. Actually it means any program that does (indirectly)
> dlopen() can clash with any exported symbols. Especially if the dlopen()ed
> object can be linked against any obscure library.
> 
The real reason why global non-static variable dirname is exported into dynamic symbol table is the code is compiled with -fPIE. Without this option resulting binary does not provide dirname symbol because compiler does not make it dynamic because it's referenced in the original object file only.
Comment 10 seth vidal 2011-05-12 17:32:58 UTC 
this hits rhel6, as well, doesn't it? Do we have a bug open there?
Comment 11 seth vidal 2011-05-12 17:40:40 UTC 
found the rhel6 bug open for it. thanks
Comment 12 Petr Pisar 2011-05-17 10:44:39 UTC 
Fixed in F16 as quota-4.00-0.15.pre1.fc16 compiled against glibc-2.13.90-12.
Comment 13 Fedora Update System 2011-05-19 04:45:11 UTC 
quota-4.00-0.12.pre1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Fedora Update System 2011-05-25 02:31:58 UTC 
quota-3.17-13.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 15 Fedora Update System 2011-05-25 02:54:00 UTC 
quota-3.17-16.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 16 Petr Pisar 2011-05-25 07:26:11 UTC 
All supported Fedoras have been fixed.