Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 187201 - app-crypt/mit-krb5 breaks openssh w/ USE='kerberos libedit' due to -rpath crap
Summary: app-crypt/mit-krb5 breaks openssh w/ USE='kerberos libedit' due to -rpath crap
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: AMD64 Linux
: High normal (vote)
Assignee: Gentoo Kerberos Maintainers
URL:
Whiteboard:
Keywords:
: 206692 (view as bug list)
Depends on:
Blocks:
 
Reported: 2007-07-31 00:20 UTC by Jose daLuz
Modified: 2010-05-23 04:13 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
log of emerge openssh (openssh.log,156.14 KB, text/plain)
2007-08-02 23:34 UTC, Jose daLuz
Details
config.log from emerge openssh (config.log,552.40 KB, text/plain)
2007-08-03 04:31 UTC, Jose daLuz
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jose daLuz 2007-07-31 00:20:14 UTC
Running sftp from openssh 4.6_p1-r2, I now get the following error:

sftp: error while loading shared libraries: /usr/lib64/libedit.so: invalid ELF header

This .so is a "fake" dynlib:
/* GNU ld script
   Since Gentoo has critical dynamic libraries
   in /lib, and the static versions in /usr/lib,
   we need to have a "fake" dynamic lib in /usr/lib,
   otherwise we run into linking problems.

   See bug http://bugs.gentoo.org/4411 for more info.
 */
OUTPUT_FORMAT ( elf64-x86-64 )
GROUP ( /lib64/libedit.so )

I can't recall the last time I ran sftp on this system, probably months ago, but I did not run into this error before. I have not come across any other program that has the same error. Perhaps this should be filed under libedit instead?

Portage 2.1.3_rc9 (default-linux/amd64/2007.0/desktop, gcc-4.1.2, glibc-2.6-r0, 2.6.22-ck1 x86_64)
=================================================================
System uname: 2.6.22-ck1 x86_64 AMD Athlon(tm) 64 X2 Dual Core Processor 6000+
Gentoo Base System release 2.0.0_alpha4
Timestamp of tree: Mon, 30 Jul 2007 22:20:01 +0000
ccache version 2.4 [enabled]
dev-java/java-config: 1.3.7, 2.0.33-r1
dev-lang/python:     2.4.4-r4
dev-python/pycrypto: 2.0.1-r6
dev-util/ccache:     2.4-r7
sys-apps/sandbox:    1.2.18.1
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.17
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.22-r2
ACCEPT_KEYWORDS="amd64 ~amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=k8 -O2 -pipe -ggdb -msse3"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-march=k8 -O2 -pipe -ggdb -msse3"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--ask --verbose --nospinner"
FEATURES="ccache distlocks fixpackages parallel-fetch sandbox sfperms splitdebug strict unmerge-orphans"
GENTOO_MIRRORS="http://gentoo.osuosl.org/ http://distro.ibiblio.org/pub/linux/distributions/gentoo/"
LANG="en_US.UTF-8"
LC_ALL="en_US.UTF-8"
LINGUAS="en"
MAKEOPTS="-j4"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_EXTRA_OPTS="--timeout=120"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/sunrise /usr/portage/local/layman/gnome-experimental /usr/portage/local/layman/xeffects /usr/portage/local/layman/vmware /usr/local/overlays/myoverlay"
SYNC="rsync://rsync.us.gentoo.org/gentoo-portage"
USE="X a52 aac acl acpi alsa amd64 amr bash-completion berkdb bitmap-fonts bluetooth bzip2 cairo cdda cdr cli cracklib crypt css cups dbus dri dts dvd dvdr dvdread eds emboss encode esd evo fam ffmpeg flac fortran gdbm gif glitz gnome gpm gstreamer gtk hal iconv ipv6 isdnlog java jpeg kde kdehiddenvisibility kerberos ldap libg++ libnotify mad midi mikmod mmx mono mp3 mpeg mudflap ncurses nls nptl nptlonly ogg opengl openmp pam pcre pdf perl pic png pppd python qt3support qt4 quicktime readline reflection ruby samba sdl session spell spl sqlite sse sse2 ssl svg tcpd theora tiff truetype truetype-fonts type1-fonts unicode usb userlocales vcd vorbis x264 xml xorg xulrunner xv xvid zlib" ALSA_CARDS="cmipci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en" USERLAND="GNU" VIDEO_CARDS="vesa nvidia"
Unset:  CTARGET, INSTALL_MASK, LDFLAGS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS
Comment 1 SpanKY gentoo-dev 2007-08-01 21:08:11 UTC
most likely you have crap in your environment which is causing this (like LD vars)

having a linker script in /usr/lib64/ is not broken
Comment 2 Jose daLuz 2007-08-01 23:23:09 UTC
If there's anything I've missed, let me know.

$ env|grep PATH
MANPATH=/home/jdaluz/.gentoo/java-config-2/current-user-vm/man:/usr/local/share/man:/usr/share/man:/usr/share/binutils-data/x86_64-pc-linux-gnu/2.17/man:/usr/share/gcc-data/x86_64-pc-linux-gnu/4.1.1/man:/usr/share/gcc-data/x86_64-pc-linux-gnu/4.1.2/man:/opt/blackdown-jdk-1.4.2.03/man:/etc/java-config/system-vm/man/:/usr/kde/3.5/share/man:/usr/qt/3/doc/man:/opt/vmware/workstation/man
PRELINK_PATH_MASK=/usr/lib/gstreamer-0.10
GUILE_LOAD_PATH=/usr/share/guile/1.8
PATH=/usr/local/bin:/usr/bin:/bin:/opt/bin:/usr/x86_64-pc-linux-gnu/gcc-bin/4.1.2:/opt/stuffit/bin:/opt/blackdown-jdk-1.4.2.03/bin:/opt/blackdown-jdk-1.4.2.03/jre/bin:/usr/kde/3.5/bin:/usr/qt/3/bin:/usr/games/bin:/opt/vmware/workstation/bin
GCC_PATH=/usr/x86_64-pc-linux-gnu/gcc-bin/4.1.2
PYTHONPATH=/usr/lib64/portage/pym
CLASSPATH=.
PKG_CONFIG_PATH=/usr/qt/3/lib64/pkgconfig:/usr/qt/3/lib32/pkgconfig
INFOPATH=/usr/share/info:/usr/share/binutils-data/x86_64-pc-linux-gnu/2.17/info:/usr/share/gcc-data/x86_64-pc-linux-gnu/4.1.1/info:/usr/share/gcc-data/x86_64-pc-linux-gnu/4.1.2/info
WINDOWPATH=7
USB_DEVFS_PATH=/dev/bus/usb
LDPATH=/usr/local/lib://usr/lib32/opengl/nvidia/lib://usr/lib64/opengl/nvidia/lib:/lib:/usr/lib:/lib64:/usr/lib64:/usr/local/lib64:/lib32:/usr/lib32:/usr/local/lib32:/usr/x86_64-pc-linux-gnu/lib:/usr/lib/gcc/x86_64-pc-linux-gnu/4.1.1/32:/usr/lib/gcc/x86_64-pc-linux-gnu/4.1.1:/usr/lib/gcc/x86_64-pc-linux-gnu/4.1.2:/usr/lib/gcc/x86_64-pc-linux-gnu/4.1.2/32:/usr/lib/gcc/x86_64-pc-linux-gnu/4.2.0:/usr/lib/gcc/x86_64-pc-linux-gnu/4.2.0/32:/usr/lib64/nspr:/usr/lib64/nss:/usr/lib32/openmotif-2.2:/opt/blackdown-jdk-1.4.2.03/jre/lib/amd64/:/opt/blackdown-jdk-1.4.2.03/jre/lib/amd64/native_threads/:/opt/blackdown-jdk-1.4.2.03/jre/lib/amd64/classic/:/opt/blackdown-jdk-1.4.2.03/jre/lib/amd64/server/:/usr/lib/qt4:/usr/lib64/qt4:/usr/lib32/qt4:/usr/kde/3.5/lib:/usr/kde/3.5/lib64:/usr/kde/3.5/lib32:/usr/qt/3/lib:/usr/qt/3/lib64:/usr/qt/3/lib32:/opt/firefox:/usr/games/lib:/usr/games/lib32:/usr/lib64/fltk-1.1:/usr/lib64/libstdc++-v3/

$ env|grep LD
LDPATH=/usr/local/lib://usr/lib32/opengl/nvidia/lib://usr/lib64/opengl/nvidia/lib:/lib:/usr/lib:/lib64:/usr/lib64:/usr/local/lib64:/lib32:/usr/lib32:/usr/local/lib32:/usr/x86_64-pc-linux-gnu/lib:/usr/lib/gcc/x86_64-pc-linux-gnu/4.1.1/32:/usr/lib/gcc/x86_64-pc-linux-gnu/4.1.1:/usr/lib/gcc/x86_64-pc-linux-gnu/4.1.2:/usr/lib/gcc/x86_64-pc-linux-gnu/4.1.2/32:/usr/lib/gcc/x86_64-pc-linux-gnu/4.2.0:/usr/lib/gcc/x86_64-pc-linux-gnu/4.2.0/32:/usr/lib64/nspr:/usr/lib64/nss:/usr/lib32/openmotif-2.2:/opt/blackdown-jdk-1.4.2.03/jre/lib/amd64/:/opt/blackdown-jdk-1.4.2.03/jre/lib/amd64/native_threads/:/opt/blackdown-jdk-1.4.2.03/jre/lib/amd64/classic/:/opt/blackdown-jdk-1.4.2.03/jre/lib/amd64/server/:/usr/lib/qt4:/usr/lib64/qt4:/usr/lib32/qt4:/usr/kde/3.5/lib:/usr/kde/3.5/lib64:/usr/kde/3.5/lib32:/usr/qt/3/lib:/usr/qt/3/lib64:/usr/qt/3/lib32:/opt/firefox:/usr/games/lib:/usr/games/lib32:/usr/lib64/fltk-1.1:/usr/lib64/libstdc++-v3/

$ sftp
sftp: error while loading shared libraries: /usr/lib64/libedit.so: invalid ELF header
Comment 3 SpanKY gentoo-dev 2007-08-02 04:21:01 UTC
first verify your env isnt crappy:
env -i `which sftp` -h

if that works, your env sucks ... if it doesnt work, something else sucks

post `readelf -d /usr/bin/sftp` as well
Comment 4 Jose daLuz 2007-08-02 12:02:09 UTC
Looks like it's something else:

$ env -i `which sftp` -h
/usr/bin/sftp: error while loading shared libraries: /usr/lib64/libedit.so: invalid ELF header

readelf  -d /usr/bin/sftp

Dynamic section at offset 0x13028 contains 36 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libssl.so.0.9.8]
 0x0000000000000001 (NEEDED)             Shared library: [libcrypto.so.0.9.8]
 0x0000000000000001 (NEEDED)             Shared library: [libdl.so.2]
 0x0000000000000001 (NEEDED)             Shared library: [libutil.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libz.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libnsl.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libcrypt.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libresolv.so.2]
 0x0000000000000001 (NEEDED)             Shared library: [libgssapi_krb5.so.2]
 0x0000000000000001 (NEEDED)             Shared library: [libkrb5.so.3]
 0x0000000000000001 (NEEDED)             Shared library: [libk5crypto.so.3]
 0x0000000000000001 (NEEDED)             Shared library: [libcom_err.so.2]
 0x0000000000000001 (NEEDED)             Shared library: [libedit.so]
 0x0000000000000001 (NEEDED)             Shared library: [libncurses.so.5]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000000f (RPATH)              Library rpath: [/usr/lib64]
 0x000000000000001d (RUNPATH)            Library runpath: [/usr/lib64]
 0x000000000000000c (INIT)               0x4020b0
 0x000000000000000d (FINI)               0x40e0f8
 0x0000000000000004 (HASH)               0x400278
 0x0000000000000005 (STRTAB)             0x401140
 0x0000000000000006 (SYMTAB)             0x4005e8
 0x000000000000000a (STRSZ)              1161 (bytes)
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000015 (DEBUG)              0x0
 0x0000000000000003 (PLTGOT)             0x5132c0
 0x0000000000000002 (PLTRELSZ)           2376 (bytes)
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000017 (JMPREL)             0x401768
 0x0000000000000007 (RELA)               0x4016f0
 0x0000000000000008 (RELASZ)             120 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x000000006ffffffe (VERNEED)            0x4016c0
 0x000000006fffffff (VERNEEDNUM)         1
 0x000000006ffffff0 (VERSYM)             0x4015ca
 0x0000000000000000 (NULL)               0x0
Comment 5 SpanKY gentoo-dev 2007-08-02 16:58:07 UTC
ok, those DT_RPATH tags shouldnt be there

can you run `emerge openssh >& log` and post the log as an attachment please
Comment 6 Jose daLuz 2007-08-02 23:34:14 UTC
Created attachment 126764 [details]
log of emerge openssh
Comment 7 SpanKY gentoo-dev 2007-08-03 04:18:43 UTC
ah almost ... can you build it up again and once configure finishes running, take the config.log in the build directory and post that as an attachment
Comment 8 Jose daLuz 2007-08-03 04:31:55 UTC
Created attachment 126767 [details]
config.log from emerge openssh
Comment 9 SpanKY gentoo-dev 2007-08-03 12:50:16 UTC
this is kerberos' fault ... it should not be adding:
-L/usr/lib -Wl,-rpath -Wl,/usr/lib
crap to `krb5-config --libs` output
Comment 10 Jakub Moc (RETIRED) gentoo-dev 2008-01-19 19:45:37 UTC
*** Bug 206692 has been marked as a duplicate of this bug. ***
Comment 11 Michael Hammer (RETIRED) gentoo-dev 2008-07-11 07:26:02 UTC
I am not able to reproduce the problem on an actual mit-krb5-1.6.3-r1 installation - therefore I'll close this bug as fixed.
Comment 12 Jose daLuz 2008-07-11 11:42:50 UTC
I can. Once I rebuilt openssh with kerberos USE flag:

$ sftp 
sftp: error while loading shared libraries: /usr/lib64/libedit.so: invalid ELF header
$ eix -e mit-krb5
[I] app-crypt/mit-krb5
     Available versions:  1.5.3 1.5.3-r1 1.6.3 1.6.3-r1 {doc ipv6 krb4 tcl}
     Installed versions:  1.6.3-r1(07:43:15 AM 06/12/2008)(ipv6 -doc -krb4 -tcl)

$ eix -e openssh
[I] net-misc/openssh
     Available versions:  4.4_p1-r6 4.5_p1-r2 (~)4.6_p1-r4 4.7_p1-r6 (~)4.7_p1-r20 (~)5.0_p1-r1 {X X509 chroot hpn kerberos ldap libedit pam selinux skey smartcard static tcpd}
     Installed versions:  5.0_p1-r1(07:36:57 AM 07/11/2008)(X hpn kerberos libedit pam tcpd -X509 -ldap -selinux -skey -smartcard -static)

Note that this has not changed going from 4.6_p1-r2 where I originally ran into it and the current release.

I am going back to no kerberos USE flag (so I can have a functional sftp) but if you need more information let me know and I can switch it back.
Comment 13 SpanKY gentoo-dev 2008-08-19 14:22:00 UTC
there is no need to test against other packages.  if the mit config script outputs -rpath when running --libs, that is broken.
Comment 14 Martin Mokrejš 2009-03-04 11:57:54 UTC
So why is the ebuild not yet masking -rpath? ;-)
Comment 15 Jeremy Olexa (darkside) (RETIRED) archtester gentoo-dev Security 2010-05-23 04:12:29 UTC
+*mit-krb5-1.8.1-r1 (23 May 2010)
+
+  23 May 2010; Jeremy Olexa <darkside@gentoo.org> +mit-krb5-1.8.1-r1.ebuild,
+  +files/CVE-2010-1321.patch:
+  Patch for CVE-2010-1321 - bug #320445. Disable rpath - bug #187201.
+  Installs kerberos.schema - bug #318017. Ebuild clean up. Enable parallel
+  make. Thanks to Eray Aslan
Comment 16 Jeremy Olexa (darkside) (RETIRED) archtester gentoo-dev Security 2010-05-23 04:13:56 UTC
I meant to close this bug with my last comment.