Bug 579486 – PAM unable to dlopen(/lib64/security/pam_ecryptfs.so): /usr/lib64/libnssutil3.so: undefined symbol: PR_GetEnvSecure

• Product: Gentoo Linux
• Status: RESOLVED TEST-REQUEST

[Description ncl 2016-04-10 07:45:14 UTC]

After an emerge -avuUDN @world update, I am no longer able to login to my system as anyone other than myself. I an unable to use su, or sudo.

I have used ecryptfs on this system for a while. I have dm-crypt on other systems, but ecryptfs has worked on this one until now. 
All attempts to sudo, su, or login as root fail. I can't even password login as myself, only key authentication works. I get errors such as:

sudo: PAM authentication error: Module is unknown
su: Module is unknown

etc.

I luckily had open a tail -F of /var/log/auth.log for a while, it seems the ecryptfs module has broken after my world upgrade. I am unsure if it is because the upgrade was interrupted by a package fetch failing.
The auth.log entries goes like this:

su[31374]: PAM unable to dlopen(/lib64/security/pam_ecryptfs.so): /usr/lib64/libnssutil3.so: undefined symbol: PR_GetEnvSecure
su[31374]: PAM adding faulty module: /lib64/security/pam_ecryptfs.so
[enters password to su/sudo/etc]
su[31374]: pam_authenticate: Module is unknown
su[31374]: FAILED su for root by ncl


How do I fix this? Can I even regain control of my system other than safely shutting down via sysrq (if I even have that enabled on this system...) and setting init=/bin/bash on boot?

[Comment 1 Arfrever Frehtes Taifersar Arahesis 2016-04-10 21:58:26 UTC]

/usr/lib64/libnssutil3.so belongs to dev-libs/nss and uses PR_GetEnvSecure symbol which is defined in /usr/lib64/libnspr4.so which belongs to dev-libs/nspr.

So dev-libs/nspr or dev-libs/nss or both of them are broken on your system.
Rebuild them: emerge -1 dev-libs/nspr dev-libs/nss

[Comment 2 Panagiotis Christopoulos (RETIRED) 2016-04-11 21:01:34 UTC]

Did what Arfrever write helped you? I'm resolving this as test-request. Please reopen if the issue persists.

[Comment 3 ncl 2016-04-14 06:06:21 UTC]

(In reply to Panagiotis Christopoulos from comment #2)
> Did what Arfrever write helped you? I'm resolving this as test-request.
> Please reopen if the issue persists.

Yes thankyou, rebuilding nss, which upgraded nspr, seems to allow me to login again. It took me a bit to set up a livedisk to get a chroot in the system as emerge doesn't like the init=/bin/bash trick due to lack of job control.

Is there any recommendation for the future? Should I maybe use --keep-going when emerging so something similar doesn't happen again?