FreeBSD 15.0-RELEASE: Trouble after upgrade

[Odhiambo Washington]

I have upgraded my FreeBSD 14.3-RELEASE to 15.0-RELEASE using freebsd update.

There is trouble in paradise:

Dec  2 15:13:00 gw /usr/sbin/cron[88206]: in try_dlopen(): /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol "initgroups@FBSD_1.8"
Dec  2 15:13:00 gw /usr/sbin/cron[89387]: in try_dlopen(): /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol "initgroups@FBSD_1.8"
Dec  2 15:13:00 gw /usr/sbin/cron[89387]: in openpam_load_module(): no pam_nologin.so found
Dec  2 15:13:00 gw /usr/sbin/cron[88206]: in openpam_load_module(): no pam_nologin.so found
Dec  2 15:14:00 gw /usr/sbin/cron[46876]: in try_dlopen(): /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol "initgroups@FBSD_1.8"
Dec  2 15:14:00 gw /usr/sbin/cron[46846]: in try_dlopen(): /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol "initgroups@FBSD_1.8"
Dec  2 15:14:00 gw /usr/sbin/cron[46876]: in openpam_load_module(): no pam_nologin.so found
Dec  2 15:14:00 gw /usr/sbin/cron[46846]: in openpam_load_module(): no pam_nologin.so found
Dec  2 15:15:00 gw /usr/sbin/cron[53989]: in try_dlopen(): /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol "initgroups@FBSD_1.8"
Dec  2 15:15:00 gw /usr/sbin/cron[53989]: in openpam_load_module(): no pam_nologin.so found
Dec  2 15:15:00 gw /usr/sbin/cron[54892]: in try_dlopen(): /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol "initgroups@FBSD_1.8"
Dec  2 15:15:00 gw /usr/sbin/cron[54892]: in openpam_load_module(): no pam_nologin.so found
Dec  2 15:15:00 gw /usr/sbin/cron[55782]: in try_dlopen(): /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol "initgroups@FBSD_1.8"
Dec  2 15:15:00 gw /usr/sbin/cron[55782]: in openpam_load_module(): no pam_nologin.so found

But:

root@gw:/ # ls -al /usr/lib/pam_nologin*
lrwxr-xr-x  1 root wheel   16 Dec  7  2018 /usr/lib/pam_nologin.so -> pam_nologin.so.6
-r--r--r--  1 root wheel 6640 Dec  2 14:04 /usr/lib/pam_nologin.so.6
root@gw:/ #

And now I cannot SSH to the server.

It's a VM in Proxmox so I can still access it via the console. However, my terminal is full of the above errors.

--

Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223

 In an Internet failure case, the #1 suspect is a constant: DNS.
"Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-)

[How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]

[The Doctor]

Same problems here. What I am doing is trying to find a library that exists and
link accordingly.

>
>
> --
> Best regards,
> Odhiambo WASHINGTON,
> Nairobi,KE
> +254 7 3200 0004/+254 7 2274 3223
> In an Internet failure case, the #1 suspect is a constant: DNS.

> "Oh, the cruft.", egrep -v '^$|^.*#' ??\_(???)_/?? :-)

> [How to ask smart questions:
> http://www.catb.org/~esr/faqs/smart-questions.html]

--
Member - Liberal International This is doc...@nk.ca Ici doc...@nk.ca
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism ;
Merry Christmas 2025 and Happy New Year 2026

[Dave Cottlehuber]

On Tue, 2 Dec 2025, at 12:21, Odhiambo Washington wrote:
> I have upgraded my FreeBSD 14.3-RELEASE to 15.0-RELEASE using freebsd update.
>
> There is trouble in paradise:

Hi Odhiambo,

Oh dear :-(

> Dec 2 15:13:00 gw /usr/sbin/cron[88206]: in try_dlopen():
> /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol
> "initgroups@FBSD_1.8"
> Dec 2 15:13:00 gw /usr/sbin/cron[89387]: in try_dlopen():
> /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol
> "initgroups@FBSD_1.8"

I'm guessing userland & kernel are out of sync, did you run
freebsd-update both before & after reboot?

Try running `freebsd-update install` again, and see if that
sorts it.

What does `freebsd-version -kru` show you?

ditto for `uname -a`?

A+
Dave

[Odhiambo Washington]

On Tue, Dec 2, 2025 at 6:33 PM Dave Cottlehuber <d...@skunkwerks.at> wrote:

On Tue, 2 Dec 2025, at 12:21, Odhiambo Washington wrote:
> I have upgraded my FreeBSD 14.3-RELEASE to 15.0-RELEASE using freebsd update.
>
> There is trouble in paradise:

Hi Odhiambo,

Oh dear :-(

> Dec  2 15:13:00 gw /usr/sbin/cron[88206]: in try_dlopen():
> /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol
> "initgroups@FBSD_1.8"
> Dec  2 15:13:00 gw /usr/sbin/cron[89387]: in try_dlopen():
> /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol
> "initgroups@FBSD_1.8"

I'm guessing userland & kernel are out of sync, did you run
freebsd-update both before & after reboot?

Yes, I did.

I thought I had all this in my head.

freebsd-update upgrade -r 15.0-RELEASE; freebsd-update install; reboot; freebsd-update install; reboot

I must have forgotten about the last reboot, because after it, some issues resolved themselves.

 

Try running `freebsd-update install` again, and see if that
sorts it.

 

 I did that and nothing was returned as there was nothing more to be installed. 

What does `freebsd-version -kru` show you?

ditto for `uname -a`?

root@gw:/usr/ports/emulators/qemu # freebsd-version -kru
15.0-RELEASE
15.0-RELEASE
15.0-RELEASE
root@gw:/usr/ports/emulators/qemu # uname -a
FreeBSD gw.wash.lan 15.0-RELEASE FreeBSD 15.0-RELEASE releng/15.0-n280995-7aedc8de6446 GENERIC amd64
root@gw:/usr/ports/emulators/qemu #

I did portupgrade -a, and things seem to have all gone well, but not installing qemu-guest-agent is giving me grief about some libs.

I did a backup of my VM before upgrading so if these troubles persist, I will just restore and wait for 15.1

[Dave Cottlehuber]

On Tue, 2 Dec 2025, at 15:40, Odhiambo Washington wrote:
> On Tue, Dec 2, 2025 at 6:33 PM Dave Cottlehuber <d...@skunkwerks.at> wrote:
>> On Tue, 2 Dec 2025, at 12:21, Odhiambo Washington wrote:
>> > I have upgraded my FreeBSD 14.3-RELEASE to 15.0-RELEASE using freebsd update.
>> >
>> > There is trouble in paradise:
>>
>> Hi Odhiambo,
>>
>> Oh dear :-(
>>
>> > Dec 2 15:13:00 gw /usr/sbin/cron[88206]: in try_dlopen():
>> > /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol
>> > "initgroups@FBSD_1.8"
>> > Dec 2 15:13:00 gw /usr/sbin/cron[89387]: in try_dlopen():
>> > /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol
>> > "initgroups@FBSD_1.8"
>>
>> I'm guessing userland & kernel are out of sync, did you run
>> freebsd-update both before & after reboot?
>
> Yes, I did.
> I thought I had all this in my head.
> freebsd-update upgrade -r 15.0-RELEASE; freebsd-update install; reboot;
> freebsd-update install; reboot

It's important to first ensure you're on the latest patches from your
currently supported release, *before upgrading*.

This is the first step in Upgrading using "freebsd update":

https://www.freebsd.org/releases/15.0R/installation/#upgrade-binary

This ensures you have amongst other patches, https://www.freebsd.org/security/advisories/FreeBSD-EN-25:18.freebsd-update.asc which may explain the symptoms.

> I must have forgotten about the last reboot, because after it, some
> issues resolved themselves.
>
>> Try running `freebsd-update install` again, and see if that
>> sorts it.

>> What does `freebsd-version -kru` show you?
>>
>> ditto for `uname -a`?
>
> root@gw:/usr/ports/emulators/qemu # freebsd-version -kru
> 15.0-RELEASE
> 15.0-RELEASE
> 15.0-RELEASE
> root@gw:/usr/ports/emulators/qemu # uname -a
> FreeBSD gw.wash.lan 15.0-RELEASE FreeBSD 15.0-RELEASE

These look fine, modulo the previous issues.

A+
Dave

[Matthias Fechner]

Am 02.12.2025 um 14:21 schrieb Odhiambo Washington:

I have upgraded my FreeBSD 14.3-RELEASE to 15.0-RELEASE using freebsd update.

have you followed these steps?

freebsd-update upgrade -r 15.0-RELEASE
freebsd-update install
# nextboot -k GENERIC
reboot
freebsd-update install
# check that config files in etc are correct!
reboot
# Make sure you point pkg repo definition to correct FreeBSD version
pkg update -f
pkg-static install -f pkg
pkg-static upgrade -F -y
pkg upgrade -f -y
freebsd-update install
reboot

This worked perfectly fine for me.

Matthias

[Odhiambo Washington]

root@gw:/usr/ports/emulators/qemu # pkg-static install -f pkg
Updating FreeBSD-ports-kmods repository catalogue...
FreeBSD-ports-kmods repository is up to date.
All repositories are up to date.
Checking integrity... done (0 conflicting)
The most recent versions of packages are already installed
root@gw:/usr/ports/emulators/qemu # pkg-static upgrade -F -y
Updating FreeBSD-ports-kmods repository catalogue...
FreeBSD-ports-kmods repository is up to date.
All repositories are up to date.
Checking for upgrades (0 candidates): 100%
Processing candidates (0 candidates): 100%
Checking integrity... done (0 conflicting)
Your packages are up to date.
root@gw:/usr/ports/emulators/qemu # pkg upgrade -f -y
Updating FreeBSD-ports-kmods repository catalogue...
FreeBSD-ports-kmods repository is up to date.
All repositories are up to date.
Checking for upgrades (965 candidates): 100%
Processing candidates (965 candidates): 100%
Checking integrity... done (0 conflicting)
Your packages are up to date.
root@gw:/usr/ports/emulators/qemu # freebsd-update install
No updates are available to install.
Run 'freebsd-update [options] fetch' first.
root@gw:/usr/ports/emulators/qemu #

[Dag-Erling Smørgrav]

The Doctor <doc...@doctor.nl2k.ab.ca> writes:

> Odhiambo Washington <odhi...@gmail.com> writes:
> > Dec 2 15:13:00 gw /usr/sbin/cron[88206]: in try_dlopen():
> > /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol
> > "initgroups@FBSD_1.8"

> Same problems here. What I am doing is trying to find a library that exists and
> link accordingly.

initgroups@FBSD_1.8 is provided by /lib/libc.so.7.

I suspect that the root cause of your problem is that you upgraded
directly from 14.3-RELEASE-p3 or older to 15.0-RELEASE instead of first
updating to 14.3-RELEASE-p6.

Please let me know ASAP if you are certain that this is not the case
(i.e. you had 14.3-RELEASE-p4 or newer prior to upgrading to 15.0), in
which case I will investigate further.

Note that if you are using ZFS, freebsd-update will have automatically
saved a boot enviromnent before the upgrade and you can simply revert to
14.3 and redo the upgrade properly.

Otherwise, as long as you can get a root shell on the system, you can
fix it manually as follows:

# /rescue/fetch http://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/15.0-RELEASE/base.txz
# /rescue/tar xf base.txz -C / lib/libc.so.7 lib/libsys.so.7

Once the system is back up, you should run `freebsd-update IDS` to
figure out if anything else needs fixing. I recommend redirecting the
output to a log file.

DES
--
Dag-Erling Smørgrav - d...@FreeBSD.org

[Odhiambo Washington]

On Tue, Dec 2, 2025 at 7:08 PM Dag-Erling Smørgrav <d...@freebsd.org> wrote:

The Doctor <doc...@doctor.nl2k.ab.ca> writes:
> Odhiambo Washington <odhi...@gmail.com> writes:
> > Dec  2 15:13:00 gw /usr/sbin/cron[88206]: in try_dlopen():
> > /usr/lib/pam_nologin.so.6: /lib/libutil.so.10: Undefined symbol
> > "initgroups@FBSD_1.8"
> Same problems here.  What I am doing is trying to find a library that exists and
> link accordingly.

initgroups@FBSD_1.8 is provided by /lib/libc.so.7.

I suspect that the root cause of your problem is that you upgraded
directly from 14.3-RELEASE-p3 or older to 15.0-RELEASE instead of first
updating to 14.3-RELEASE-p6. 

Please let me know ASAP if you are certain that this is not the case
(i.e. you had 14.3-RELEASE-p4 or newer prior to upgrading to 15.0), in
which case I will investigate further.

 

On Nov 26, there was an advisory ' FreeBSD Security Advisory FreeBSD-SA-25:10.unbound'.
On that date I did the freebsd-update fetch && freebsd-update install thing.

Today, I assumed that I was still updated. So it's obviously my mistake that I did not repeat the same thing today before upgrading to 15.0-REL.

 

Note that if you are using ZFS, freebsd-update will have automatically
saved a boot enviromnent before the upgrade and you can simply revert to
14.3 and redo the upgrade properly.

This is a VM and I backed it up before running the upgrade so if things don't get fixed easily, I will just restore it and start over.

I don't use ZFS. My system is UFS.

 

Otherwise, as long as you can get a root shell on the system, you can
fix it manually as follows:

    # /rescue/fetch http://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/15.0-RELEASE/base.txz
    # /rescue/tar xf base.txz -C / lib/libc.so.7 lib/libsys.so.7

Once the system is back up, you should run `freebsd-update IDS` to
figure out if anything else needs fixing.  I recommend redirecting the
output to a log file.

Before running the rescue command, I checked:

wash@gw:~$ ls -al /lib//libsys.so.7
-r--r--r--  1 root wheel 110552 Dec  2 14:04 /lib//libsys.so.7
wash@gw:~$

Also ran the command, but I don't understand the meaning of the output:

root@gw:~ # freebsd-update IDS
Looking up update.FreeBSD.org mirrors... 3 mirrors found.
Fetching metadata signature for 15.0-RELEASE from update2.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
/etc/blacklistd.conf has SHA256 hash cb2660416c75a61b4053cf415a9d90124de82545a6ac343c34b56a6e5be88489, but should have SHA256 hash b69ca6e9e912e01eda7edf09a08b0f77d9f8a84addfb0f3636f6d8ab17482d14.
/etc/crontab has SHA256 hash 196645f8a006cecf9e0518de0ab9204b40d8c06b30b05af765ab76dbb4c8acd3, but should have SHA256 hash bafcaf303afe62d7920c9d07a7129d1f28ade28b1c47ae5a054faf8b5e31eec0.
/etc/devfs.conf has SHA256 hash 87e0e30160bd1c201c6fbe1d3edcdc55483715253d9e40796a674f13179d8064, but should have SHA256 hash 25a0cf0cbc18d8b2a23190dd68316a83c778fbbc02f04445eef9a5031be7b062.
/etc/dumpdates has SHA256 hash 4d6e3474a2da0e4739e422b430f28ad9d4ab29e14a2c440611eaa8d5fe6b9e7f, but should have SHA256 hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855.
/etc/group has SHA256 hash 01490dd7492a89c43d7cd60d0737725dfa19abb693858a166d5fccacbb71ad96, but should have SHA256 hash a76791033e18dcb526c30a6417bdb31ef774649f84e7f4ca0e745549cb15729c.
/etc/hosts has SHA256 hash f4246b769e6a23544fbf82f996965c216e8e5e7055c3b6e324ad0a944ae71cdf, but should have SHA256 hash 336de0d20e14a6e526e147580ef5b0a7167a4ff4ebd788222d71e4c238e7ab2e.
/etc/hosts.equiv has SHA256 hash 5aa209fb5f9850f23bdd4d2380f2bba96581315498e86e5db2cf4f8d73940dc0, but should have SHA256 hash 6669a12d865d7c49fcbdbf89e1393b7ee99191db4af31c4928c84ef5532904bf.
/etc/login.conf has SHA256 hash 6dc42ca55552f752ca823ff536678e7455365243c4462f2197bcd0705240345c, but should have SHA256 hash 8282f0c979204681553a5f95a2b6e3ff5234e21864f88142388f60f66c4aac29.
/etc/login.conf.db has SHA256 hash fa079cd0cbe74f542f1f4d13fd5b1b999157572cdac615f8e2c1b98398ec6f5b, but should have SHA256 hash 52a089ce00eb38b27b5276929c0573d8b07252fcbd846cba14c68bad75d33039.
/etc/mail/aliases has SHA256 hash 78e6cdb2a903bae5b05cb27cd2d677df2195450167762b9ca46efa5619abdc76, but should have SHA256 hash 03d6614a0d82767f188e4224d30cefae8e5869e40786ab2e1704841cfb509174.
/etc/mail/mailer.conf has SHA256 hash cdf25b89cbf07737bf13f94348e6daac135f10a71906e17e308ff1340cbdc325, but should have SHA256 hash f91cec06d9e2e39dbc1e8bd82bfeda2f293f3669818ab0a21bab16777247b3a5.
/etc/master.passwd has SHA256 hash 7979a5ff178f47e87de90911cc7b86118d1a2cd65a823d50f0d2a2db98f9d2ac, but should have SHA256 hash 55dfb5a41ebad44523b26cba443d94c3d55e0b39a32558f81a1d50fed964ec34.
/etc/newsyslog.conf has SHA256 hash 8828927dc58b189997ac0d82d66d88ebe12792cc47df92b9e2c46bb3d6276dab, but should have SHA256 hash ae6618a3158b990fd40878e5bc63b216bdebc310455bf620154e64b44f403ea2.
/etc/ntp.conf has SHA256 hash 048ea9e573650c542fc451e7028563aa70d7b83f146fea2c86f629363e2b450a, but should have SHA256 hash f518111399afe23bc29e1812b27dcb2c967e629c4c4de4669b6482f2fff24121.
/etc/passwd has SHA256 hash b2b57018469a7a6f51f4c475a67b4e7cb5ef4af6bf084f75c4f2262cc6a92e49, but should have SHA256 hash 57d2a756f16439eb2bc13af8d4b0a958ccec88643c6246cfc00e5b0894417eec.
/etc/pkg/FreeBSD.conf has SHA256 hash 267de8fefd7f56a036ac9fc7cce84c38ad0c5cda37464dcf76c8b0ab8bc7dd95, but should have SHA256 hash ab261a3b84ffc11654ac0bafbb7d6b3f1b6afc30bfabab3bcff64259678eac26.
/etc/pwd.db has SHA256 hash de783bc777432eb7e31d9f4bcb78046fe12cd53c036b1e0eb0d35c2410c9d17f, but should have SHA256 hash bd30e09f6e06e4430bbb8fa20c4ed46babaec585d5580a92244c6a4227c5af56.
/etc/security/audit_control has SHA256 hash 008765788e06c56ffcd313f2473bf4a7444cdc6f4e397e981dbf8cf14a7eea2f, but should have SHA256 hash 5955cb54b2a68993917760951e432ec0fb905828c34b1fc6a2cd24b4d05ad038.
/etc/security/audit_user has SHA256 hash 3570076d7dd8e33cb7851a1ad24fe610d767b54dffdef6aef3e3156d46cb7a01, but should have SHA256 hash 1a7142468421f3268958c19cfcda0d809eef1cb46d7d46e4395e52912475945d.
/etc/security/audit_warn has SHA256 hash 972c739ffe0c95e02c8b8fbfcbdba2fc95c6ec7c5c1ff966619021086bffd06c, but should have SHA256 hash d64f0c04327f37a63b0745288c31b7fd597fce6434b3b319f5f81e53e9eba685.
/etc/shells has SHA256 hash 335417f65ea8360c91af791d9b16893d1e6502cbce8e52d3a45b3087c6981b0f, but should have SHA256 hash d4f435c3c24679f19609fcf0e78c473c85582cd0300ebcc0ac3088c34408cde4.
/etc/spwd.db has SHA256 hash e90ef785ef10573b3ed0a4aeffac4bfd079927805a6fa5128ee0180bab9d83e8, but should have SHA256 hash 5b8454a1d288eef2ed215f2280ac5cf9e9197ac1d2a1e46a67ba38c2c0c370e7.
/etc/ssh/sshd_config has SHA256 hash 83b943cb46b8eb5244d6c857b659708d6070366fe4480f4201b2131c10ac87fa, but should have SHA256 hash c1fed6df2e2a5a44fa4481b163408e6f96bb0e5c8bc1331ecf063992ce229d08.
/etc/ssl/cert.pem has SHA256 hash 266d3087b83124ec96c5b15f593aaefaede6b89fc7572c05ea1101f7029a0fc8, but should have SHA256 hash da54fcf51354465573d8a84cdc9e5d35c2dd4b22a1cf2fc55ff9fcb754669349.
/etc/ssl/openssl.cnf has SHA256 hash 216816abe97d6c796d4932a36b10772046ea960821510b0f37756f9d25d73498, but should have SHA256 hash 984447fba5a52f2985c8d42d1a5586b9640c6ebea57b039717ea834a65710360.
/etc/sysctl.conf has SHA256 hash 8e9502ae8f5393d24749c063238234df57ccbc8767950d4add0739c9afc54d53, but should have SHA256 hash 45f469e7a9b4eef887bab7b55397305043fe101e1d6ce6f7e23d758e72f56dc6.
/etc/syslog.conf has SHA256 hash 0e96be9033c4c2374399b133628d21b865708311260b2e7d0ef8215f0ee89e4c, but should have SHA256 hash bccc776a96b65cb40f9a0752293d9abca7453a446f703027a1cf2e0ffb1df526.
/root/.cshrc has SHA256 hash ca3bf73fcc81351cf4e346f6ed0448e5f1b59cf5c0dabdf4e843c05a643b83b0, but should have SHA256 hash d1ba75d6e942aa2f17eb84061fe4edda1d17b9a9ab8e4e2ce3a19e650403b5d7.
/root/.profile has SHA256 hash 86305a373bad6177a2b30c24b224075186d9e3f8d4e7de389893d74f78529755, but should have SHA256 hash 3f8f2a402ed4f114c317babcd655f47eefaf3d938fc9d5f935d9e379964e74df.
/sbin/fsck is owned by user id 1001, but should be owned by user id 0.
/usr/lib/debug/usr/lib/libdevinfo.so.7.debug has SHA256 hash d06d59e4913a6103771409c598945e81dbaac857ea11271e2c03c92cd581aeef, but should have SHA256 hash 7653ff2946527fbb764e1932d767e4787fe8814c645f8c2d2359b43d0884f289.
/usr/lib/libdevinfo.a has SHA256 hash 378b792d00971a8d5ffc45ad7882d08190a244b97de5514f5b2eb75ea0f6db47, but should have SHA256 hash 3d412bd84e6a1a9914610c8e838e4c4afe3b131789d5e36e9371bd5de03e0d68.
/usr/lib/libdevinfo.so.7 has SHA256 hash 667f9592ed95a538077f3fc22461ed3d6ece3deae27b66ec1e6a271807f25110, but should have SHA256 hash 0f1f789aa07dbfdc1df637be1d31f41616ec74188c683d9f706bae0ceb61d904.
/usr/share/examples/bhyve/vmrun.sh has 0555 permissions, but should have 0444 permissions.
/usr/src/sys/contrib/openzfs/cmd/zed/zed.d/resilver_finish-notify.sh is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/ata_err is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/cmd_to is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/defect is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/enc is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/encdev is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/fault_led is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/health is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/hours_on is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/iostat-10s is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/iostat-1s is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/label is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/locate_led is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/model is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/nonmed is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/nvme_err is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/off_ucor is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/pend_sec is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/pwr_cyc is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/r_proc is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/r_ucor is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/realloc is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/rep_ucor is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/serial is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/size is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/slot is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/smart_test is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/smartx is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/temp is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/test_ended is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/test_progress is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/test_status is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/test_type is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/vendor is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/w_proc is a symlink, but should be a regular file.
/usr/src/sys/contrib/openzfs/cmd/zpool/zpool.d/w_ucor is a symlink, but should be a regular file.
/var/account has 0755 permissions, but should have 0750 permissions.
/var/cron/tabs has 0755 permissions, but should have 0700 permissions.
/var/spool is owned by user id 26, but should be owned by user id 0.
/var/spool is owned by group id 26, but should be owned by group id 0.
/var/spool/clientmqueue is owned by user id 26, but should be owned by user id 25.
/var/spool/clientmqueue is owned by group id 26, but should be owned by group id 25.
/var/spool/clientmqueue has 0755 permissions, but should have 0770 permissions.
/var/spool/dma is owned by user id 26, but should be owned by user id 0.
/var/spool/dma is owned by group id 26, but should be owned by group id 6.
/var/spool/lock is owned by user id 26, but should be owned by user id 66.
/var/spool/lock is owned by group id 26, but should be owned by group id 68.
/var/spool/lpd is owned by user id 26, but should be owned by user id 0.
/var/spool/lpd is owned by group id 26, but should be owned by group id 1.
/var/spool/mqueue is owned by user id 26, but should be owned by user id 0.
/var/spool/mqueue is owned by group id 26, but should be owned by group id 1.
/var/spool/output is owned by user id 26, but should be owned by user id 0.
/var/spool/output is owned by group id 26, but should be owned by group id 1.
/var/spool/output/lpd is owned by user id 26, but should be owned by user id 0.
/var/spool/output/lpd is owned by group id 26, but should be owned by group id 1.
root@gw:~ #

--

Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223

 In an Internet failure case, the #1 suspect is a constant: DNS.

"Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-)

[Dag-Erling Smørgrav]

Odhiambo Washington <odhi...@gmail.com> writes:
> On Nov 26, there was an advisory ' FreeBSD Security Advisory
> FreeBSD-SA-25:10.unbound'. On that date I did the freebsd-update
> fetch && freebsd-update install thing. Today, I assumed that I was
> still updated. So it's obviously my mistake that I did not repeat the
> same thing today before upgrading to 15.0-REL.

No, if you updated on Nov 26 then you should have been fine, so
something else went wrong. I will try to see if I can reproduce it.

> Also ran the command, but I don't understand the meaning of the
> output:

None of these are particularly concerning. They are telling you that
you have modified configuration files (which is normal) and that some
files and directories have incorrect permissions (which is something
that sometimes happens with freebsd-update and isn't a big deal). There
are discrepancies in /usr/src but that's easily fixed by replacing the
entire source tree (rm -rf /usr/src then download and extract src.txz).

You can fix at least some of these issues by running the following
commands as root:

mtree -deU -p / -f /etc/mtree/BSD.root.dist
mtree -deU -p /var -f /etc/mtree/BSD.var.dist
mtree -deU -p /usr -f /etc/mtree/BSD.usr.dist

The only lines that surprise me are these:

/usr/lib/debug/usr/lib/libdevinfo.so.7.debug has SHA256 hash d06d59e4913a6103771409c598945e81dbaac857ea11271e2c03c92cd581aeef, but should have SHA256 hash 7653ff2946527fbb764e1932d767e4787fe8814c645f8c2d2359b43d0884f289.
/usr/lib/libdevinfo.a has SHA256 hash 378b792d00971a8d5ffc45ad7882d08190a244b97de5514f5b2eb75ea0f6db47, but should have SHA256 hash 3d412bd84e6a1a9914610c8e838e4c4afe3b131789d5e36e9371bd5de03e0d68.
/usr/lib/libdevinfo.so.7 has SHA256 hash 667f9592ed95a538077f3fc22461ed3d6ece3deae27b66ec1e6a271807f25110, but should have SHA256 hash 0f1f789aa07dbfdc1df637be1d31f41616ec74188c683d9f706bae0ceb61d904.

which is not critical and can be fixed by extracting those files from
base.txz as explained in my previous email.

I assume you will be switching to pkgbase at some point, which will make
correcting this kind of issue much easier.

[Odhiambo Washington]

On Tue, Dec 2, 2025 at 11:07 PM Dag-Erling Smørgrav <d...@freebsd.org> wrote:

Odhiambo Washington <odhi...@gmail.com> writes:
> On Nov 26, there was an advisory ' FreeBSD Security Advisory
> FreeBSD-SA-25:10.unbound'.  On that date I did the freebsd-update
> fetch && freebsd-update install thing.  Today, I assumed that I was
> still updated. So it's obviously my mistake that I did not repeat the
> same thing today before upgrading to 15.0-REL.

No, if you updated on Nov 26 then you should have been fine, so
something else went wrong.  I will try to see if I can reproduce it.

So, I hosed my upgraded server and restored the VM from the backup I made before upgrade.

This is what I had:

root@gw:/home/wash # freebsd-version -kru
14.3-RELEASE-p5
14.3-RELEASE-p5
14.3-RELEASE-p6
root@gw:/home/wash # uname -a
FreeBSD gw.wash.lan 14.3-RELEASE-p5 FreeBSD 14.3-RELEASE-p5 GENERIC amd64

root@gw:/home/wash # freebsd-update fetch

Looking up update.FreeBSD.org mirrors... 3 mirrors found.

Fetching metadata signature for 14.3-RELEASE from update1.freebsd.org... done.

Fetching metadata index... done.
Inspecting system... done.

Preparing to download files... done.

No updates needed to update system to 14.3-RELEASE-p6.
root@gw:/home/wash #

So I suppose I was safe to upgrade, since I had also done a `portupgrade -a`.

I am now embarking on the upgrade to 15.0-RELEASE once again.

 

> Also ran the command, but I don't understand the meaning of the
> output:

None of these are particularly concerning.  They are telling you that
you have modified configuration files (which is normal) and that some
files and directories have incorrect permissions (which is something
that sometimes happens with freebsd-update and isn't a big deal).  There
are discrepancies in /usr/src but that's easily fixed by replacing the
entire source tree (rm -rf /usr/src then download and extract src.txz).

You can fix at least some of these issues by running the following
commands as root:

    mtree -deU -p / -f /etc/mtree/BSD.root.dist
    mtree -deU -p /var -f /etc/mtree/BSD.var.dist
    mtree -deU -p /usr -f /etc/mtree/BSD.usr.dist

I will do this after this upgrade.

 

The only lines that surprise me are these:

    /usr/lib/debug/usr/lib/libdevinfo.so.7.debug has SHA256 hash d06d59e4913a6103771409c598945e81dbaac857ea11271e2c03c92cd581aeef, but should have SHA256 hash 7653ff2946527fbb764e1932d767e4787fe8814c645f8c2d2359b43d0884f289.
    /usr/lib/libdevinfo.a has SHA256 hash 378b792d00971a8d5ffc45ad7882d08190a244b97de5514f5b2eb75ea0f6db47, but should have SHA256 hash 3d412bd84e6a1a9914610c8e838e4c4afe3b131789d5e36e9371bd5de03e0d68.
    /usr/lib/libdevinfo.so.7 has SHA256 hash 667f9592ed95a538077f3fc22461ed3d6ece3deae27b66ec1e6a271807f25110, but should have SHA256 hash 0f1f789aa07dbfdc1df637be1d31f41616ec74188c683d9f706bae0ceb61d904.

which is not critical and can be fixed by extracting those files from base.txz as explained in my previous email.

This libdevinfo.so thing must have been created by me when I was struggling with installing qemu-guest-agent after the upgrade to 15.0. 

Starting with complaints about 'ld-elf.so.1: Shared object "libutil.so.9" not found, required by "pkg"; at some point, I went into a wild goose chase trying to fix things against the counsel of my 6th sense.

It's good I have a full backup of this VM so I can blow it away and restore and try the upgrade again until I get it right - or wait a little longer for others to be bitten and a solution found :-)

I assume you will be switching to pkgbase at some point, which will make correcting this kind of issue much easier.

I have been following the discussions about pkgbase and I am sure to switch to it after I successfully upgrade to 15.0-RELEASE.

[Odhiambo Washington]

On Tue, Dec 2, 2025 at 6:48 PM Matthias Fechner <ide...@fechner.net> wrote:

I tossed my VM and restored from backup, then went through the upgrade process again. Finally, I hit the error that led me into a wild goose chase:

root@gw:/home/wash # shutdown -r now
Shutdown NOW!
shutdown: [pid 70896]
root@gw:/home/wash #
*** FINAL System shutdown message from wa...@gw.wash.lan ***

System going down IMMEDIATELY



System shutdown time has arrived
login as: wash
Keyboard-interactive authentication prompts from server:
| Password for wa...@gw.wash.lan:
End of keyboard-interactive prompts from server
wash@gw:~$ doas su
root@gw:/home/wash # freebsd-update install
pkg: Warning: Major OS version upgrade detected.  Running "pkg bootstrap -f" recommended
Installing updates... done.
root@gw:/home/wash # pkg bootstrap -f
The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]: y
Bootstrapping pkg from pkg+https://pkg.FreeBSD.org/FreeBSD:15:amd64/kmods_quarterly_0, please wait...
pkg: Error fetching https://pkg.FreeBSD.org/FreeBSD:15:amd64/kmods_quarterly_0/Latest/pkg.pkg: Not Found
A pre-built version of pkg could not be found for your system.
root@gw:/home/wash #
root@gw:/home/wash #
root@gw:/home/wash #
root@gw:/home/wash #
root@gw:/home/wash # portupgrade -af
pkg-static: Warning: Major OS version upgrade detected.  Running "pkg bootstrap -f" recommended
pkg-static: Warning: Major OS version upgrade detected.  Running "pkg bootstrap -f" recommended
pkg-static: Warning: Major OS version upgrade detected.  Running "pkg bootstrap -f" recommended
pkg-static: Warning: Major OS version upgrade detected.  Running "pkg bootstrap -f" recommended
[Rebuilding the pkgdb <format:bdb_btree> in /var/db/pkg ... - 0 packages found (-0 +0)  nothing to do]
root@gw:/home/wash # pkg bootstrap -f
The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]: y
Bootstrapping pkg from pkg+https://pkg.FreeBSD.org/FreeBSD:15:amd64/kmods_quarterly_0, please wait...
pkg: Error fetching https://pkg.FreeBSD.org/FreeBSD:15:amd64/kmods_quarterly_0/Latest/pkg.pkg: Not Found
A pre-built version of pkg could not be found for your system.
root@gw:/home/wash # pkg-static install -f pkg
pkg-static: Warning: Major OS version upgrade detected.  Running "pkg bootstrap -f" recommended

Updating FreeBSD-ports-kmods repository catalogue...
FreeBSD-ports-kmods repository is up to date.
All repositories are up to date.
Checking integrity... done (0 conflicting)
The most recent versions of packages are already installed

root@gw:/home/wash # pkg-static upgrade -F -y
pkg-static: Warning: Major OS version upgrade detected.  Running "pkg bootstrap -f" recommended

Updating FreeBSD-ports-kmods repository catalogue...
FreeBSD-ports-kmods repository is up to date.
All repositories are up to date.
Checking for upgrades (0 candidates): 100%
Processing candidates (0 candidates): 100%
Checking integrity... done (0 conflicting)
Your packages are up to date.

root@gw:/home/wash # pkg upgrade -f -y
ld-elf.so.1: Shared object "libutil.so.9" not found, required by "pkg" <=========================================
root@gw:/home/wash # freebsd-update install

No updates are available to install.
Run 'freebsd-update [options] fetch' first.

root@gw:/home/wash # reboot
login as: wash
Keyboard-interactive authentication prompts from server:
| Password for wa...@gw.wash.lan:
End of keyboard-interactive prompts from server
wash@gw:~$ doas su
ld-elf.so.1: Shared object "libutil.so.9" not found, required by "doas" <========================================

wash@gw:~$ 

[Odhiambo Washington]

I started from square one and ended up with the libutil.so.9 error that's been reported by others.

```

ld-elf.so.1: Shared object "libutil.so.9" not found, required by "doas" <========================================

wash@gw:~$ 
```

[freebsd...@passmail.net]

Hello @Odhiambo,

You updated your packages from QUATERLY branch on 15.0-RELEASE but you were using LATEST branch on 14.3-RELEASE

You can create your custom pkg conf.

# mkdir -p /usr/local/etc/pkg/repos

Then add the following content into the file /usr/local/etc/pkg/repos/FreeBSD.conf

--- File Begin ---

FreeBSD-ports: { 

 url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest", 

 mirror_type: "srv", 

 signature_type: "fingerprints", 

 fingerprints: "/usr/share/keys/pkg", 

 enabled: yes 

} 

FreeBSD-ports-kmods: {

 url: "pkg+https://pkg.FreeBSD.org/${ABI}/kmods_latest_${VERSION_MINOR}",

 mirror_type: "srv", 

signature_type: "fingerprints", 

fingerprints: "/usr/share/keys/pkg", 

enabled: yes 

} 

FreeBSD-base: { 

url: "pkg+https://pkg.FreeBSD.org/${ABI}/base_release_${VERSION_MINOR}",

mirror_type: "srv", 

signature_type: "fingerprints", 

fingerprints: "/usr/share/keys/pkgbase-${VERSION_MAJOR}" 

enabled: no 

} 

--- File End ---

After that, you can type the following command and your doas(1) issue should be solved.

# pkg upgrade -f -y

It works fine for me.

Kind regards.

Alexandre

-------- Original Message --------

[Odhiambo Washington]

Hello Alexandre,

I see the file /etc/pkg/FreeBSD.conf.

The /usr/local/etc/pkg/repos/FreeBSD.conf is supposed to be used to override it.

I see that your version of /usr/local/etc/pkg/repos/FreeBSD.conf adds the FreeBSD-ports spec.

During the upgrade, I installed the new version of the file in /etc/pkg/ and it did not have the ports spec.

Also, I mostly use the ports to install the apps on my server, as opposed to packages.

I think I find the ports more flexible. Mixing ports and pkgs has always given me grief.

[Dag-Erling Smørgrav]

Odhiambo Washington <odhi...@gmail.com> writes:
> ld-elf.so.1: Shared object "libutil.so.9" not found, required by "pkg"

When upgrading to 15.0, do not run `freebsd-update install` a third
time. The first time installs the kernel, the second time installs new
files and updates existing ones, the third time deletes old files and
should only be run after you have updated all ports and packages.

[Odhiambo Washington]

I actually thought that the subsequent ones would do nothing since there is nothing to install.

How do I fix the libutil issue?

 

[Dag-Erling Smørgrav]

Odhiambo Washington <odhi...@gmail.com> writes:
> I actually thought that the subsequent ones would do nothing since
> there is nothing to install. How do I fix the libutil issue?

`pkg-static install misc/compat14x` will install a copy of libutil.so.9.

[Odhiambo Washington]

On Wed, Dec 3, 2025 at 5:41 PM Dag-Erling Smørgrav <d...@freebsd.org> wrote:

Odhiambo Washington <odhi...@gmail.com> writes:
> I actually thought that the subsequent ones would do nothing since
> there is nothing to install.  How do I fix the libutil issue?

`pkg-static install misc/compat14x` will install a copy of libutil.so.9.

But is it still needed when there is libutil.so.10?

[Dag-Erling Smørgrav]

Odhiambo Washington <odhi...@gmail.com> writes:

> Dag-Erling Smørgrav <d...@freebsd.org> writes:
> > `pkg-static install misc/compat14x` will install a copy of libutil.so.9.
> But is it still needed when there is libutil.so.10?

It is needed to run old binaries that you haven't updated yet.

[Odhiambo Washington]

On Wed, Dec 3, 2025 at 6:13 PM Dag-Erling Smørgrav <d...@freebsd.org> wrote:

Odhiambo Washington <odhi...@gmail.com> writes:
> Dag-Erling Smørgrav <d...@freebsd.org> writes:
> > `pkg-static install misc/compat14x` will install a copy of libutil.so.9.
> But is it still needed when there is libutil.so.10?

It is needed to run old binaries that you haven't updated yet.

Thank you for this. I know how to solve this problem if it raises its head.