[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

libgcrypt brain dead?


A number of packages, such as openldap have been changed to support
gnutls, instead of openssl, to avoid licensing issues in openssl.

However, it appears that gnutls uses libgcrypt, and libgcrypt has
several serious design issues.

1. libgcrypt doesn't cleanup properly on dlclose, and apparently won't
fix the problem:
This makes gcrypt unsuitable in PAM or NSS.

I was told that the fix is to 'add "__attribute__((destructor))" to a
cleanup function'

2. libgcrypt drops root privileges if called setuid on the assumption
the only reason the program is setuid root is so it can lock memory.

Unfortunately this breaks every setuid program tat uses PAM when PAM
is configured to use ldap and ldap is configured to use gnutls,
because gnutls uses gcrypt.


Unfortunately, gcrypt is used by gnutls, which is used in ldap, which
is frequently used in PAM and NSS. So this is an issue. There might be
other NSS and PAM modules that use it too.

What is the solution? Should we go back to using openssl, at least
with libraries such as openldap that are commonly used in pam and nss

Or is there another way?

Alternatively, have I got something wrong?
Brian May <brian@microcomaustralia.com.au>

Reply to: