Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 181986

Summary: net-dns/bind-{9.3.4-r3,9.4.1-r1} will not start as user named when ldap is set in nsswitch.conf
Product: Gentoo Linux Reporter: Alex Masidlover <amasidlover>
Component: Current packagesAssignee: Konstantin Arkhipov (RETIRED) <voxus>
Status: RESOLVED CANTFIX    
Severity: normal CC: bind+disabled, dertobi123, jsermer
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---

Description Alex Masidlover 2007-06-14 06:17:56 UTC
If I have the following line in nsswitch.conf; 'hosts: files dns ldap' then named will only start as root. Starting with -u named on the command line products a segmentation fault. 
I have managed to work around it by either removing ldap from the nsswitch hosts line or by removing the -u named from the init.d script (not good from a security point of view...)

Reproducible: Always

Steps to Reproduce:
1. Add ldap to the hosts line in nsswitch.conf
2. Try and start bind with /etc/init.d/named start or named -u named

Actual Results:  
Segmentation fault

Expected Results:  
Named to run normally...

Backtrace:
Program received signal SIGSEGV, Segmentation fault.
0xb7a9e6f8 in __res_hostalias () from /lib/libresolv.so.2
(gdb) bt
#0  0xb7a9e6f8 in __res_hostalias () from /lib/libresolv.so.2
#1  0xb79ab44f in _nss_dns_gethostbyname3_r () from /lib/libnss_dns.so.2
#2  0xb79ab567 in _nss_dns_gethostbyname2_r () from /lib/libnss_dns.so.2
#3  0xb7bf7b7e in ?? () from /lib/libc.so.6
#4  0xb7bf86d2 in getaddrinfo () from /lib/libc.so.6
#5  0xb7afa5ca in ldap_connect_to_host () from /usr/lib/libldap-2.3.so.0
#6  0xb7ae68f8 in ldap_int_open_connection () from /usr/lib/libldap-2.3.so.0
#7  0xb7af84d3 in ldap_new_connection () from /usr/lib/libldap-2.3.so.0
#8  0xb7ae67f1 in ldap_open_defconn () from /usr/lib/libldap-2.3.so.0
#9  0xb7af8e5e in ldap_send_initial_request () from /usr/lib/libldap-2.3.so.0
#10 0xb7aedf5f in ldap_sasl_bind () from /usr/lib/libldap-2.3.so.0
#11 0xb7aee8e4 in ldap_simple_bind () from /usr/lib/libldap-2.3.so.0
#12 0xb7b13909 in ?? () from /lib/libnss_ldap.so.2
#13 0x0fefa080 in ?? ()
#14 0x00000000 in ?? () 

Portage/gcc info:
Portage 2.1.2.7 (default-linux/x86/2007.0/desktop, gcc-4.1.2, glibc-2.5-r3, 2.6.19-gentoo-r5 i686)
=================================================================
System uname: 2.6.19-gentoo-r5 i686 Genuine Intel(R) CPU            2140  @ 1.60GHz
Gentoo Base System release 1.12.9
Timestamp of tree: Thu, 07 Jun 2007 12:00:01 +0000
dev-lang/python:     2.4.4-r4
dev-python/pycrypto: 2.0.1-r5
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.61
sys-devel/automake:  1.4_p6, 1.6.3, 1.7.9-r1, 1.9.6-r2, 1.10
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.14
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=i686 -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb /var/bind"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/terminfo"
CXXFLAGS="-O2 -march=i686 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="distlocks metadata-transfer sandbox sfperms strict"
GENTOO_MIRRORS="http://gentoo.virginmedia.com/ ftp://gentoo.virginmedia.com/sites/gentoo http://www.mirrorservice.org/sites/www.ibiblio.org/gentoo/ ftp://ftp.mirrorservice.org/sites/www.ibiblio.org/gentoo/ "
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X acl acpi alsa apache2 arts backendonly berkdb bitmap-fonts cairo cdr cli cracklib crypt cups dbus dri dvb dvd dvdr dvdread eds emboss encode esd evo fam firefox fortran gdbm gif gnome gpm gstreamer hal iconv ipv6 isdnlog ivtv jpeg kde kerberos ldap libg++ mad midi mikmod mp3 mpeg mudflap mysql ncurses nls nptl nptlonly ogg opengl openmp oss pam pcre pdf perl png posix pppd python qt3 qt3support qt4 quicktime readline reflection sdl session spell spl ssl svg tcpd tiff truetype truetype-fonts type1-fonts unicode vorbis win32codecs x86 xml xorg xv zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="i810"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY


These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R   ] net-dns/bind-9.3.4-r3  USE="berkdb ipv6 ldap mysql* ssl -dlz -doc -idn -odbc -postgres -resolvconf (-selinux) -threads" 5,279 kB

Total: 1 package (1 reinstall), Size of downloads: 5,279 kB
 [1] i686-pc-linux-gnu-4.1.1
 [2] i686-pc-linux-gnu-4.1.2 *
Comment 1 Jakub Moc (RETIRED) gentoo-dev 2007-06-14 06:53:42 UTC
Try with 9.4.1-r1 please.
Comment 2 Alex Masidlover 2007-06-14 07:08:40 UTC
Attempted with 9.4.1-r1 and received same result:

noam ~ # named -v
BIND 9.4.1

#0  0xb7ad46f8 in __res_hostalias () from /lib/libresolv.so.2
#1  0xb7ad4ed6 in __libc_res_nsearch () from /lib/libresolv.so.2
#2  0xb79e12aa in _nss_dns_gethostbyname3_r () from /lib/libnss_dns.so.2
#3  0xb79e1567 in _nss_dns_gethostbyname2_r () from /lib/libnss_dns.so.2
#4  0xb7c2db7e in ?? () from /lib/libc.so.6
#5  0xb7c2e6d2 in getaddrinfo () from /lib/libc.so.6
#6  0xb7b305ca in ldap_connect_to_host () from /usr/lib/libldap-2.3.so.0
#7  0xb7b1c8f8 in ldap_int_open_connection () from /usr/lib/libldap-2.3.so.0
#8  0xb7b2e4d3 in ldap_new_connection () from /usr/lib/libldap-2.3.so.0
#9  0xb7b1c7f1 in ldap_open_defconn () from /usr/lib/libldap-2.3.so.0
#10 0xb7b2ee5e in ldap_send_initial_request () from /usr/lib/libldap-2.3.so.0
#11 0xb7b23f5f in ldap_sasl_bind () from /usr/lib/libldap-2.3.so.0
#12 0xb7b248e4 in ldap_simple_bind () from /usr/lib/libldap-2.3.so.0
#13 0xb7b49909 in ?? () from /lib/libnss_ldap.so.2
#14 0x0ff04458 in ?? ()
#15 0x00000000 in ?? ()
Comment 3 Jeremy Sermersheim 2007-07-10 19:14:24 UTC
I have a similar issue.  I have to remove ldap from the group line in /etc/nsswitch.conf:

hyperion ~ # grep ^group /etc/nsswitch.conf
group:       files ldap
hyperion ~ # /etc/init.d/named start
 * Service named starting                                                                                            [ !! ]
 * ERROR:  named failed to start
hyperion ~ # grep ^group /etc/nsswitch.conf
group:       files
hyperion ~ # /etc/init.d/named start
 * Service named starting
 * Service named started
hyperion ~ # ps -ef|grep -i named
named     9285     1  0 14:09 ?        00:00:00 /usr/sbin/named -u named -n 1 -t /chroot/dns


I'm also running 9.4.1-r1

hyperion ~ # equery l net-dns/bind
[ Searching for package 'bind' in 'net-dns' among: ]
 * installed packages
[I--] [ ~] net-dns/bind-9.4.1-r1 (0)
[I--] [ ~] net-dns/bind-tools-9.4.1-r1 (0)
Comment 4 James Lamanna 2007-10-31 21:00:47 UTC
I have this same problem with net-dns/bind-9.4.1_p1.
Bind works fine running from the foreground (-f) but daemonized it fails with ldap in the group line in nsswitch.conf.
Comment 5 James Lamanna 2007-11-06 03:09:35 UTC
Building with 'dlz' as a USE flag seems to workaround this issue.
Comment 6 Tobias Scherbaum (RETIRED) gentoo-dev 2008-05-03 18:40:35 UTC
(In reply to comment #5)
> Building with 'dlz' as a USE flag seems to workaround this issue.
> 

I'm not seeing why this would workaroung this issue, but if it does ... *shrugs*
Anyways, that's nothing we can (easily) check within the ebuild so i close this one as CANTFIX.