Bug#1010922: samba-libs: linking against libraries in private dirs without RUNPATH

[Paul Wise]

Package: samba-libs
Version: 2:4.16.1+dfsg-4
Severity: important
File: /usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0
File: /usr/lib/x86_64-linux-gnu/samba/libads-samba4.so.0
File: /usr/lib/x86_64-linux-gnu/samba/libnet-keytab-samba4.so.0
File: /usr/lib/x86_64-linux-gnu/samba/libsamba-modules-samba4.so.0
File: /usr/lib/x86_64-linux-gnu/samba/libsmbldaphelper-samba4.so.0

The recent upgrade of samba in Debian testing made libsmbldap link
against libraries that are only in private dirs, without using a custom
library path. This means that every program that uses libsmbldap will
fail to start. It looks like not just libsmbldap has this problem
though, several of the private libraries (libsamba-modules-samba4
libsmbldaphelper-samba4 libads-samba4 libnet-keytab-samba4) also have
this issue too. It appears that other libraries in samba-libs have used
the RUNPATH option to allow finding the private samba libraries.
The commands below are how I discovered and debugged this issue.
I filed this at important, not sure what uses those libraries.

$ adequate samba-libs
samba-libs:amd64: library-not-found /usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0 => libsamba-debug-samba4.so.0
samba-libs:amd64: library-not-found /usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0 => libreplace-samba4.so.0
samba-libs:amd64: library-not-found /usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0 => libsamba-security-samba4.so.0
samba-libs:amd64: library-not-found /usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0 => libsmbd-shim-samba4.so.0

$ ldd /usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0
...
libsamba-debug-samba4.so.0 => not found
libreplace-samba4.so.0 => not found
libsamba-security-samba4.so.0 => not found
libsmbd-shim-samba4.so.0 => not found

$ lddtree /usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0
libsmbldap.so.2.1.0 => /usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0 (interpreter => none)
...
libsamba-debug-samba4.so.0 => not found
libreplace-samba4.so.0 => not found
libsamba-security-samba4.so.0 => not found
libsmbd-shim-samba4.so.0 => not found

$ libtree /usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0
libsmbldap.so.2
...
├── libsmbd-shim-samba4.so.0 not found
├── libsamba-security-samba4.so.0 not found
├── libsamba-debug-samba4.so.0 not found
└── libreplace-samba4.so.0 not found
┊ Paths considered in this order:
┊ 1. rpath:
┊ 2. LD_LIBRARY_PATH was not set
┊ 3. runpath was not set
┊ 4. ld config files:
┊ /usr/lib/atlas
┊ /usr/lib/x86_64-linux-gnu/fakechroot
┊ /usr/lib/x86_64-linux-gnu/libfakeroot
┊ /usr/local/lib
┊ /usr/local/lib/x86_64-linux-gnu
┊ /lib/x86_64-linux-gnu
┊ /usr/lib/x86_64-linux-gnu
┊ /lib32
┊ /usr/lib32
┊ /libx32
┊ /usr/libx32
┊ 5. Standard paths:
┊ /lib
┊ /lib64
┊ /usr/lib
┊ /usr/lib64
Error [/usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0]: Not all dependencies were found
$ echo $?
28

$ objdump -x /usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0 | grep -E 'NEEDED|PATH'
NEEDED libsamba-util.so.0
NEEDED libsmbconf.so.0
NEEDED libsamba-debug-samba4.so.0
NEEDED libreplace-samba4.so.0
NEEDED libsamba-security-samba4.so.0
NEEDED libsmbd-shim-samba4.so.0
NEEDED libldap-2.5.so.0
NEEDED liblber-2.5.so.0
NEEDED libtalloc.so.2
NEEDED libtevent.so.0
NEEDED libc.so.6

$ dpkg -L samba-libs | grep /usr/lib | xargs -d '\n' ldd 2> /dev/null | grep -E 'not found|^/' | grep -B1 'not found'
/usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0:
libsamba-debug-samba4.so.0 => not found
libreplace-samba4.so.0 => not found
libsamba-security-samba4.so.0 => not found
libsmbd-shim-samba4.so.0 => not found
--
/usr/lib/x86_64-linux-gnu/samba/libads-samba4.so.0:
libsmbd-shim-samba4.so.0 => not found
--
/usr/lib/x86_64-linux-gnu/samba/libnet-keytab-samba4.so.0:
libsmbd-shim-samba4.so.0 => not found
--
/usr/lib/x86_64-linux-gnu/samba/libsamba-modules-samba4.so.0:
libsamba-debug-samba4.so.0 => not found
--
/usr/lib/x86_64-linux-gnu/samba/libsmbldaphelper-samba4.so.0:
libreplace-samba4.so.0 => not found
libsmbd-shim-samba4.so.0 => not found

$ objdump -x /usr/lib/x86_64-linux-gnu/libnetapi.so.1.0.0 | grep -iE 'NEEDED.*samba-security|PATH'
NEEDED libsamba-security-samba4.so.0
RUNPATH /usr/lib/x86_64-linux-gnu/samba

$ objdump -x /usr/lib/x86_64-linux-gnu/samba/auth/samba4.so | grep -iE 'NEEDED.*samba-debug-samba4|PATH'
NEEDED libsamba-debug-samba4.so.0
RUNPATH /usr/lib/x86_64-linux-gnu/samba

$ apt-file search smbd-shim-samba
samba-libs: /usr/lib/x86_64-linux-gnu/samba/libsmbd-shim-samba4.so.0

$ apt-file search samba-security
samba-libs: /usr/lib/x86_64-linux-gnu/samba/libsamba-security-samba4.so.0

$ apt-file search samba-debug
libwbclient0: /usr/lib/x86_64-linux-gnu/samba/libsamba-debug-samba4.so.0

$ apt-file search replace-samba
libwbclient0: /usr/lib/x86_64-linux-gnu/samba/libreplace-samba4.so.0

-- System Information:
Debian Release: bookworm/sid
APT prefers testing-debug
APT policy: (900, 'testing-debug'), (900, 'testing'), (800, 'unstable-debug'), (800, 'unstable'), (790, 'buildd-unstable'), (700, 'experimental-debug'), (700, 'experimental'), (690, 'buildd-experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.17.0-2-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_AU.utf8, LC_CTYPE=en_AU.utf8 (charmap=UTF-8), LANGUAGE=en_AU:en
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages samba-libs:amd64 depends on:
ii libacl1 2.3.1-1
ii libavahi-client3 0.8-5
ii libavahi-common3 0.8-5
ii libbsd0 0.11.6-1
ii libc6 2.33-7
ii libcap2 1:2.44-1
ii libgnutls30 3.7.4-2
ii libjansson4 2.14-2
ii libldap-2.5-0 2.5.12+dfsg-1
ii libldb2 2:2.5.0+smb4.16.1-4
ii libpam0g 1.4.0-13
ii libpopt0 1.18-3
ii libtalloc2 2.3.3-4
ii libtdb1 1.4.6-3
ii libtevent0 0.12.0-1
ii libtirpc3 1.3.2-2
ii libwbclient0 2:4.16.1+dfsg-4
ii zlib1g 1:1.2.11.dfsg-4

samba-libs:amd64 recommends no packages.

samba-libs:amd64 suggests no packages.

-- no debconf information

--
bye,
pabs

https://wiki.debian.org/PaulWise

[Michael Tokarev]

Control: tag -1 + confirmed

13.05.2022 11:33, Paul Wise wrote:
> Package: samba-libs
> Version: 2:4.16.1+dfsg-4
> Severity: important
> File: /usr/lib/x86_64-linux-gnu/libsmbldap.so.2.1.0
> File: /usr/lib/x86_64-linux-gnu/samba/libads-samba4.so.0
> File: /usr/lib/x86_64-linux-gnu/samba/libnet-keytab-samba4.so.0
> File: /usr/lib/x86_64-linux-gnu/samba/libsamba-modules-samba4.so.0
> File: /usr/lib/x86_64-linux-gnu/samba/libsmbldaphelper-samba4.so.0
>
> The recent upgrade of samba in Debian testing made libsmbldap link
> against libraries that are only in private dirs, without using a custom
> library path. This means that every program that uses libsmbldap will
> fail to start. It looks like not just libsmbldap has this problem
> though, several of the private libraries (libsamba-modules-samba4
> libsmbldaphelper-samba4 libads-samba4 libnet-keytab-samba4) also have
> this issue too. It appears that other libraries in samba-libs have used
> the RUNPATH option to allow finding the private samba libraries.
> The commands below are how I discovered and debugged this issue.

So far there's just one such library, this is libsmbldap. All other public
libraries from samba-libs does have proper RUNPATH.

It looks like there's something in the build procedure, smells like a
missing dependency somewhere.

> I filed this at important, not sure what uses those libraries.

It looks like while this lib is being put into a public library dir,
and there's a C language header for it (smbldap.h), it is still more
private library.

I'll dig into this one.

Thank you for the bugreport!

/mjt