Bug 249250 – app-admin/sudo-1.6.9_p17 - sudo segfaults

• Status: RESOLVED WORKSFORME
• Product: Gentoo Linux

[Description Thomas Frank 2008-11-29 12:18:03 UTC]

sudo segfaults when called with any program you like. This happens when run as normal user as well as "root" user

E.g "sudo bash" or "sudo top"

This happens with all versions of app-admin/sudo but version 
app-admin/sudo-1.6.8_p12-r1.

Reproducible: Always

Steps to Reproduce:
1. emerge app-admin/sudo-1.6.9_p17
2. su -
3. sudo top

Actual Results:  
you receive a segmentation fault

Expected Results:  
"top" should run now in context of the super user

Output "emerge --info"

Portage 2.1.6_rc2 (default/linux/amd64/2008.0/desktop, gcc-4.1.2, glibc-2.6.1-r0, 2.6.25.9 x86_64)
=================================================================
System uname: Linux-2.6.25.9-x86_64-Intel-R-_Core-TM-2_Quad_CPU_Q9450_@_2.66GHz-with-glibc2.2.5
Timestamp of tree: Fri, 28 Nov 2008 15:30:01 +0000
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p33
dev-java/java-config: 1.3.7, 2.1.6
dev-lang/python:     2.5.2-r7
dev-python/pycrypto: 2.0.1-r6
dev-util/ccache:     2.4-r7
sys-apps/baselayout: 2.0.0
sys-apps/openrc:     0.3.0-r1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r2
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.1-r1
sys-devel/binutils:  2.18-r3
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.23-r3
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=nocona -ggdb"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/terminfo /etc/udev/rules.d"
CXXFLAGS="-O2 -pipe -march=nocona -ggdb"
DISTDIR="/usr/portage/distfiles"
FEATURES="ccache distlocks parallel-fetch protect-owned sandbox sfperms strict unmerge-orphans userfetch"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
LANG="en_US.UTF-8"
LDFLAGS="-Wl,-O1"
LINGUAS="en de"
MAKEOPTS="-j5"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X Xaw3d a52 aac acl acpi alsa amd64 bash-completion beagle berkdb branding bzip2 cairo cdda cddb cdr cli cracklib crypt cups dbus directfb dri dvd dvdr dvdread encode esd firefox fortran gdbm gif glitz gnome gpm gstreamer gtk hal iconv isdnlog java jpeg libnotify mad midi mmx mmxext mono mp3 mpeg mudflap multilib ncurses nls nptl nptlonly nsplugin ogg opengl openmp pam paste64 pcre pdf perl png ppds pppd python quicktime readline reflection session spell spl sse sse2 ssl ssse3 startup-notification svg sysfs tcpd tiff toolbar truetype unicode usb userlocales vorbis x264 xml xorg xprint xulrunner xv xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en de" USERLAND="GNU" VIDEO_CARDS="nvidia vesa"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY


Output "gdb --args /usr/bin/sudo 'top'"

GNU gdb 6.7.1
Copyright (C) 2007 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu"...
Using host libthread_db library "/lib/libthread_db.so.1".
(gdb) run
Starting program: /usr/bin/sudo top

Program received signal SIGSEGV, Segmentation fault.
0x000000000040b0f0 in sudo_conv (num_msg=1, msg=0x7fff34e9efa8, response=0x7fff34e9efa0, appdata_ptr=<value optimized out>)
    at ./auth/pam.c:269
269	./auth/pam.c: No such file or directory.
	in ./auth/pam.c

Output "gdb backtrace"

#0  0x000000000040b0f0 in sudo_conv (num_msg=1, msg=0x7fff34e9efa8, response=0x7fff34e9efa0, appdata_ptr=<value optimized out>)
    at ./auth/pam.c:269
#1  0x00007f9c2b6ce048 in ?? () from /lib64/security/pam_mount.so
#2  0x00007f9c2b6ce5d3 in pam_sm_open_session () from /lib64/security/pam_mount.so
#3  0x00007f9c2ca7cb5d in ?? () from /lib/libpam.so.0
#4  0x000000000040af7b in pam_prep_user (pw=0x9f16c0) at ./auth/pam.c:225
#5  0x0000000000407b17 in set_perms (perm=0) at set_perms.c:440
#6  0x0000000000409277 in main (argc=<value optimized out>, argv=<value optimized out>, envp=0x7fff34e9f320) at sudo.c:408

[Comment 1 Jeroen Roovers (RETIRED) 2008-11-29 17:19:23 UTC]

Looks like a pam problem...

[Comment 2 Diego Elio Pettenò (RETIRED) 2008-11-29 17:25:51 UTC]

Yeah so it's my problem to deal with for sure.

Can you please build pam_mount with debug symbols and see what happens if you disable it from the chain?

[Comment 3 Thomas Frank 2008-11-30 09:39:14 UTC]

That's the backtrace with CFLAGS -ggdb and FEATURES=nostrip:

(gdb) bt
#0  0x000000000040b0f0 in sudo_conv (num_msg=1, msg=0x7fff14707818, 
    response=0x7fff14707810, appdata_ptr=<value optimized out>)
    at ./auth/pam.c:269
#1  0x00007f0b0af37048 in read_password (pamh=0x1b145a0, 
    prompt=0x1b1fec0 "reenter password for pam_mount:", pass=0x7fff14707860)
    at pam_mount.c:156
#2  0x00007f0b0af375d3 in pam_sm_open_session (pamh=0x1b145a0, 
    flags=<value optimized out>, argc=<value optimized out>, 
    argv=<value optimized out>) at pam_mount.c:490
#3  0x00007f0b0c2e5b5d in ?? () from /lib/libpam.so.0
#4  0x000000000040af7b in pam_prep_user (pw=0x1b116c0) at ./auth/pam.c:225
#5  0x0000000000407b17 in set_perms (perm=0) at set_perms.c:440
#6  0x0000000000409277 in main (argc=<value optimized out>, 
    argv=<value optimized out>, envp=0x7fff14707b90) at sudo.c:408

When taking pam_mount out of the game, sudo works as expected and does not produce a segfault. I'm using pam_mount-0.49.

[Comment 4 Thomas Frank 2009-01-06 11:17:37 UTC]

Hi,

recently upgraded to pam_mount-1.5: I'm still getting the segfault when calling sudo.

[Comment 5 Thomas Frank 2009-03-10 16:27:11 UTC]

I've updated to pam_mount-1.20 in conjunction with sys-libs/pam-1.0.4 today. "sudo" works now as desired. I'd say this bug has been solved and can be closed now.

Thanks a lot!

[Comment 6 Diego Elio Pettenò (RETIRED) 2009-03-11 11:12:02 UTC]

Closing then since it was a bug in pam_mount.