Bug 370593 – sys-auth/pam_mount-2.10 fails to mount via mount.crypt with an error of ehd_load: Invalid argument

• Product: Gentoo Linux
• Status: RESOLVED NEEDINFO

[Description Eric Gisse 2011-06-08 04:06:09 UTC]

I use LUKS encrypted LVM's that are opened with pam_mount to store user directories on a server. Historically pam_mount has to be watched when upgrading, but this is a new level of broken.



Reproducible: Always

Steps to Reproduce:
1) pam_mount 2.10 + libhx 3.10.1 
2) mount a LUKS device 
3) fail
Actual Results:  
*with debug enabled in pam_mount

# su USER -
pam_mount(pam_mount.c:553): pam_mount 2.10: entering session stage
reenter password for pam_mount:
pam_mount(misc.c:38): Session open: (ruid/rgid=0/1008, e=0/1008)
pam_mount(mount.c:214): Mount info: globalconf, user=USER <volume fstype="crypt" server="(null)" path="/dev/vg0/home_USER" mountpoint="/home/USER" cipher="(null)" fskeypath="(null)" fskeycipher="(null)" fskeyhash="(null)" options="" /> fstab=0 ssh=0
command: 'mount' '-t' 'crypt' '/dev/vg0/home_USER' '/home/USER' 
pam_mount(misc.c:38): set_myuid<pre>: (ruid/rgid=0/1008, e=0/1008)
pam_mount(misc.c:38): set_myuid<post>: (ruid/rgid=0/1008, e=0/1008)
pam_mount(mount.c:65): Messages from underlying mount program:
pam_mount(mount.c:69): ehd_load: Invalid argument
pam_mount(misc.c:380): 16 1 253:16 / / rw,relatime - ext2 /dev/mapper/root rw,barrier=1,data=ordered
pam_mount(misc.c:380): 12 16 0:3 / /proc rw,nosuid,nodev,noexec,relatime - proc proc rw
pam_mount(misc.c:380): 13 16 0:12 / /lib64/rc/init.d rw,nosuid,nodev,noexec,relatime - tmpfs rc-svcdir rw,size=1024k,mode=755
pam_mount(misc.c:380): 14 16 0:13 / /sys rw,nosuid,nodev,noexec,relatime - sysfs sysfs rw
pam_mount(misc.c:380): 15 14 0:14 / /sys/kernel/security rw,nosuid,nodev,noexec,relatime - securityfs securityfs rw
pam_mount(misc.c:380): 17 16 0:15 / /dev rw,nosuid,relatime - tmpfs udev rw,size=10240k,mode=755
pam_mount(misc.c:380): 18 17 0:8 / /dev/pts rw,nosuid,noexec,relatime - devpts devpts rw,gid=5,mode=620
pam_mount(misc.c:380): 19 17 0:16 / /dev/shm rw,nosuid,nodev,noexec,relatime - tmpfs shm rw
pam_mount(misc.c:380): 20 16 253:10 / /var/cache/squid rw,noatime - ext4 /dev/mapper/vg0-squid_cache rw,barrier=1,data=ordered
pam_mount(misc.c:380): 21 16 0:17 / /tmp rw,nosuid,nodev,noexec,relatime - tmpfs none rw
pam_mount(misc.c:380): 22 12 0:18 / /proc/sys/fs/binfmt_misc rw,nosuid,nodev,noexec,relatime - binfmt_misc binfmt_misc rw
pam_mount(pam_mount.c:521): mount of /dev/vg0/home_USER failed
command: 'pmvarrun' '-u' 'USER' '-o' '1' 
pam_mount(misc.c:38): set_myuid<pre>: (ruid/rgid=0/1008, e=0/1008)
pam_mount(misc.c:38): set_myuid<post>: (ruid/rgid=0/1008, e=0/1008)
pmvarrun(pmvarrun.c:248): parsed count value 0
pam_mount(pam_mount.c:440): pmvarrun says login count is 1
pam_mount(pam_mount.c:645): done opening session (ret=0)

Expected Results:  
# su user -
reenter password for pam_mount:
user@machine:03:51:0:/var/log>

The libhx version is specified because pam_mount depends on it, and the earlier version (I have to use 2.8 now) requires an earlier version of libhx so there may possibly be a relation.

The mount via cryptsetup functions equally well in either version so I assume this is a problem with the pam_mount package.

=========================================

emerge --info:

Portage 2.1.9.47 (hardened/linux/amd64, gcc-4.5.2, glibc-2.13-r2, 2.6.37-hardened-r7 x86_64)
=================================================================
System uname: Linux-2.6.37-hardened-r7-x86_64-AMD_Athlon-tm-_64_X2_Dual_Core_Processor_5600+-with-gentoo-2.0.2
Timestamp of tree: Tue, 07 Jun 2011 14:00:01 +0000
distcc 3.1 x86_64-pc-linux-gnu [disabled]
ccache version 3.1.4 [enabled]
app-shells/bash:          4.2_p8-r1
dev-java/java-config:     2.1.11-r3
dev-lang/python:          2.7.1-r1, 3.1.3-r1
dev-util/ccache:          3.1.4
dev-util/cmake:           2.8.4-r1
sys-apps/baselayout:      2.0.2
sys-apps/openrc:          0.8.2
sys-apps/sandbox:         2.2
sys-devel/autoconf:       2.68
sys-devel/automake:       1.9.6-r2, 1.11.1-r1
sys-devel/binutils:       2.21
sys-devel/gcc:            4.5.2
sys-devel/gcc-config:     1.4.1
sys-devel/libtool:        2.4-r1
sys-devel/make:           3.82
sys-kernel/linux-headers: 2.6.38 (virtual/os-headers)
sys-libs/glibc:           2.13-r2
ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="*"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=k8 -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /etc/pam.d/ /usr/share/gnupg/qualified.txt /usr/share/openvpn/easy-rsa /var/bind"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-march=k8 -O2 -pipe"
DISTDIR="/var/portage/distfiles"
FEATURES="assume-digests binpkg-logs ccache distlocks fixlafiles fixpackages metadata-transfer news parallel-fetch protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch"
FFLAGS=""
GENTOO_MIRRORS="http://distfiles.gentoo.org"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-O1,--as-needed"
LINGUAS="en"
MAKEOPTS="-j4"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/layman/hardened-development /usr/local/portage/layman/sunrise /usr/local/portage/layman/sectools /usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="3dnow 3dnowext amd64 custom-cflags gnutls hardened imap ipv6 maildir mmx mmxext multilib mysql ncurses pam python sse sse2 ssl tcpd threads vhosts xattr xinetd xorg zlib" ALSA_CARDS="hda-intel" APACHE2_MODULES="authz_host dir mime userdir vhost_alias alias rewrite log_config" APACHE2_MPMS="worker" ELIBC="glibc" INPUT_DEVICES="evdev" KERNEL="linux" LINGUAS="en" QEMU_SOFTMMU_TARGETS="x86_64" USERLAND="GNU" VIDEO_CARDS="radeon radeonhd" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

==========================================

/etc/security/pam_mount.conf.xml

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<!--
	See pam_mount.conf(5) for a description.
-->

<pam_mount>

		<!-- debug should come before everything else,
		since this file is still processed in a single pass
		from top-to-bottom -->

<debug enable="1" />

<!-- VOLDEF--> 
<volume user="user" path="/dev/vg0/home_user" mountpoint="/home/user" fstype="crypt" /> 


		<!-- pam_mount parameters: General tunables -->

<!--
<luserconf name=".pam_mount.conf.xml" />
-->

<!-- Note that commenting out mntoptions will give you the defaults.
     You will need to explicitly initialize it with the empty string
     to reset the defaults to nothing. -->
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<!--
<mntoptions deny="suid,dev" />
<mntoptions allow="*" />
<mntoptions deny="*" />
-->
<mntoptions require="nosuid,nodev" />
<logout wait="10000" hup="no" term="no" kill="no" />
<path>/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin</path>

<logout wait="0" hup="0" term="0" kill="0" />


		<!-- pam_mount parameters: Volume-related -->

<mkmountpoint enable="1" remove="true" />


</pam_mount>

[Comment 1 Matt Turner 2011-06-16 18:18:08 UTC]

This worked with older versions?

I see in your log

cipher="(null)" fskeypath="(null)" fskeycipher="(null)" fskeyhash="(null)"

I can't tell what kind of set up you have, but I'd think at least you'd have to specify cipher=.

Probably the best course of action is to email the pam-mount-user mailing list on SourceForge.

[Comment 2 Matt Turner 2011-07-15 18:53:03 UTC]

No response in a month. Marking as NEEDINFO.