My problem is the same as described in 410421. However, I have that with openssh, cronie and su (sys-apps/shadow). The versions installed are: - net-misc/openssh-8.1_p1-r4 - sys-apps/shadow-4.8-r5 - sys-process/cronie-1.5.5 - sys-libs/pam-1.4.0_p20200829 The error just came up when upgrading from sys-libs/pam-1.3.0-r2 to the current version. This system is a 32bit i386 system. I have a similar setup on amd64 which do not suffer of this bug. Reproducible: Always
Please restart your cron as per the pam postinst message.
I did that. I did restart cron and openssh multiple times and I even tried to rebuild that packages with the same result. Note that even su (from shadow) is affected by that problem, which is a command, not a daemon.
Please share: - emerge --info - emerge -pvO pam pambase - syslog output - confirmation that 'dispatch-conf' returns nothing (as per https://www.gentoo.org/support/news-items/2020-06-23-upgrade-to-sys-libs_pam-1_4_0.html)
emerge --info: Portage 3.0.8 (python 3.7.9-final-0, default/linux/x86/17.0/hardened, gcc-9.3.0, glibc-2.32-r2, 5.4.66-gentoo-x86 i686) ================================================================= System uname: Linux-5.4.66-gentoo-x86-i686-Intel-R-_Pentium-R-_M_processor_1.86GHz-with-gentoo-2.7 KiB Mem: 2065328 total, 860820 free KiB Swap: 1048572 total, 1048572 free Timestamp of repository gentoo: Sat, 31 Oct 2020 11:00:01 +0000 Head commit of repository gentoo: 9444dcb0033689a493c681a8f5ce5660bc143df8 Timestamp of repository haskell: Thu, 29 Oct 2020 22:35:18 +0000 Head commit of repository haskell: 376bea3058c1f9d63ae2357cbe0d12b9f45873fa Head commit of repository ket: 1a8a1c177af97e83508ea5c4d28d13dda048bdd6 sh bash 5.0_p18 ld GNU ld (Gentoo 2.34 p6) 2.34.0 distcc 3.3.3 i686-pc-linux-gnu [disabled] ccache version 3.7.11 [enabled] app-shells/bash: 5.0_p18::gentoo dev-java/java-config: 2.3.1::gentoo dev-lang/perl: 5.30.3-r1::gentoo dev-lang/python: 2.7.18-r4::gentoo, 3.7.9::gentoo, 3.8.5::gentoo dev-util/ccache: 3.7.11::gentoo dev-util/cmake: 3.17.4-r1::gentoo dev-util/pkgconfig: 0.29.2::gentoo sys-apps/baselayout: 2.7::gentoo sys-apps/openrc: 0.42.1::gentoo sys-apps/sandbox: 2.20::gentoo sys-devel/autoconf: 2.69-r5::gentoo sys-devel/automake: 1.16.1-r1::gentoo sys-devel/binutils: 2.34-r2::gentoo sys-devel/gcc: 9.3.0-r1::gentoo sys-devel/gcc-config: 2.3.2::gentoo sys-devel/libtool: 2.4.6-r6::gentoo sys-devel/make: 4.2.1-r4::gentoo sys-kernel/linux-headers: 5.4-r1::gentoo (virtual/os-headers) sys-libs/glibc: 2.32-r2::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 sync-rsync-verify-jobs: 1 sync-rsync-verify-max-age: 24 sync-rsync-extra-opts: sync-rsync-verify-metamanifest: no haskell location: /var/db/repos/haskell sync-type: git sync-uri: https://github.com/gentoo-mirror/haskell.git masters: gentoo ket location: /var/db/repos/ket sync-type: git sync-uri: /home/klaus/devel/ket-overlay masters: gentoo ACCEPT_KEYWORDS="x86" ACCEPT_LICENSE="@FREE" CBUILD="i686-pc-linux-gnu" CFLAGS="-march=pentium-m -O2 -pipe" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/lib/libreoffice/program/sofficerc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-march=pentium-m -O2 -pipe" DISTDIR="/usr/portage/distfiles" ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-O2 -march=i686 -pipe" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs buildsyspkg ccache config-protect-if-modified distlocks ebuild-locks fixlafiles getbinpkg ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch pid-sandbox preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict suidctl unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -march=i686 -pipe" GENTOO_MIRRORS="ftp://ftp.fau.de/gentoo" LANG="de_DE" LC_ALL="C" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j1" PKGDIR="/usr/portage/packages" PORTAGE_BINHOST="ssh://gentoobin@ikki/misc/build/gentoo-i386/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/var/tmp" USE="X acl alsa alsa-plugin bluetooth bzip2 caps crypt hardened iconv ipv6 jpeg libglvnd libtirpc ncurses nls nptl openmp pam pcre pcsc-lite pic pie png readline seccomp split-usr ssl ssp threads udev unicode vdpau x86 xattr xtpax zlib zsh-completion" ABI_X86="32" ADA_TARGET="gnat_2018" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="evdev keyboard mouse wacom" KERNEL="linux" L10N="de de-1901 de-DE" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-2 php7-3 php7-4" POSTGRES_TARGETS="postgres10 postgres11" PYTHON_SINGLE_TARGET="python3_7" PYTHON_TARGETS="python2_7 python3_7" RUBY_TARGETS="ruby25 ruby26" USERLAND="GNU" VIDEO_CARDS="dummy fbdev radeon vesa" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LINGUAS, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS emerge -pvO pam pambase: These are the packages that would be merged, in order: [binary R ] sys-libs/pam-1.4.0_p20200829::gentoo USE="filecaps (pie) (split-usr) -audit -berkdb -debug -nis (-selinux)" 442 KiB [binary R ] sys-auth/pambase-20201028.1::gentoo USE="caps nullok passwdqc sha512 -debug -elogind -gnome-keyring -minimal -mktemp -pam_krb5 -pam_ssh -pwhistory -pwquality -securetty (-selinux) -systemd" 0 KiB Total: 2 packages (2 reinstalls, 2 binaries), Size of downloads: 442 KiB (Note to the binary packages, I have a build host as this host CPU is to weak to build any packages) syslog output (relevant cutout): Nov 1 16:15:01 tha crond[5615]: PAM unable to resolve symbol: pam_sm_close_session Nov 1 16:15:01 tha crond[5614]: PAM unable to resolve symbol: pam_sm_close_session Nov 1 16:15:01 tha crond[5613]: PAM unable to resolve symbol: pam_sm_close_session Nov 1 16:15:01 tha crond[5616]: PAM unable to resolve symbol: pam_sm_open_session Nov 1 16:15:01 tha crond[5612]: PAM unable to resolve symbol: pam_sm_close_session Nov 1 16:15:01 tha crond[5608]: PAM unable to resolve symbol: pam_sm_open_session Nov 1 16:15:01 tha crond[5616]: PAM unable to resolve symbol: pam_sm_close_session Nov 1 16:15:01 tha crond[5607]: PAM unable to resolve symbol: pam_sm_close_session Nov 1 16:15:01 tha crond[5608]: PAM unable to resolve symbol: pam_sm_close_session Nov 1 16:15:33 tha sshd[5706]: PAM unable to resolve symbol: pam_sm_open_session Nov 1 16:15:33 tha sshd[5706]: PAM unable to resolve symbol: pam_sm_close_session About dispatch-conf (I even don't know what it does) gives no output.
It is unlikely relevant, but I am curious. what happens if you recompile cronie and openssh (and then restart them) having newer pam installed?
That was the last I did before filling this bug. I thought that there is some incompatibility but it was not the case. But what I saw in the last day, while sys-libs/glibc-2.32-r2 is masked by keyword (~amd64) on amd64, the package is the installed one on i386. amd64 still uses 2.31-r6. Maybe that is related. Another information (although I do not think, it is related), I use a chroot on a amd64 machine to compile BUT use "setarch linux32 emerge …" to build packages. The compiler flags are made for this machine (CFLAGS="-march=pentium-m -O2 -pipe").
https://bugs.gentoo.org/751946#c0 Move pam_cap.so from "session" to "auth" solves this issue.
I was thinking (hoping) you would be right. But no, the solution you described was not the solution. But it gave me a hint. The solution is completely opposed of your solution. As the pam system-auth was changed by new emerges, I did edit them in a way to have pam_cap in both, auth and session. However, it seems that I cannot use it in session; opposed to the way, pam_cap is used in gentoo system-auth. (also opposed to the description in that bug report) For the completness, I have sys-libs/libcap-2.43 installed (and sys-libs/libcap-ng-0.7.10). The difference between the both mentioned machines was, that on i386, I had "session optional pam_cap.so" AND "auth optional pam_cap.so" and on the amd64 machine I had it only in auth which works fine.
Ah, misread your reply... You are right as my description show. :-)
Fixed in stable.
