Bug#709525: nfs-common: After upgrade to 1.2.8-2, rpc.gssd segfaults on startup
Package: nfs-common
Version: 1:1.2.8-2
Severity: important
Dear Maintainer,
After upgrading to 1.2.8-2 as part of normal Jessie upkeep, rpc.gssd started
segfaulting immediately on startup, and I'm not really able to wrap my head
around just why. The crash happens in libgssglue, in __gss_get_mechanism_cred,
called by gss_init_sec_context, at g_init_sec_context.c:153 (still in libgssglue).
It is rather clear that the crash happens because the copy of mglueP.h that is
shipped with the source of libgssglue does not match that which is shipped with
libkrb5. In the latter, the struct `gss_union_cred_t' has gained a new field
called `loopback', and lost its `auxinfo' field, and when inspecting the
gss_union_cred_t that has been passed to __gss_get_mechanism_cred, it clearly
matched the definition from libkrb5.
However, the fault does not seem to be lying with libgssglue, since the segafult
only happens when nfs-common is upgraded, and downgrading nfs-common back to 1.2.6-3
makes it start working again. A simple guess from my side is that nfs-common has
(erroneously?) been compiled against libkrb5 in some place where it should be compiled
against libgssglue, perhaps? The structure and dependencies between the various
packages involved is, however, far from obvious to me. (At the face of it, it
seems like a hack, to begin with, that libgssglue has a local copy of a private
header file from MIT Kerberos.)
Whatever the problem is, it makes rpc.gssd, and therefore Kerberized NFS mounts,
entirely unusable. Fix pl0x. :)
-- Package-specific info:
-- rpcinfo --
program vers proto port service
100000 4 tcp 111 portmapper
100000 3 tcp 111 portmapper
100000 2 tcp 111 portmapper
100000 4 udp 111 portmapper
100000 3 udp 111 portmapper
100000 2 udp 111 portmapper
100021 1 udp 33453 nlockmgr
100021 3 udp 33453 nlockmgr
100021 4 udp 33453 nlockmgr
100021 1 tcp 54248 nlockmgr
100021 3 tcp 54248 nlockmgr
100021 4 tcp 54248 nlockmgr
100007 2 udp 708 ypbind
100007 1 udp 708 ypbind
100007 2 tcp 709 ypbind
100007 1 tcp 709 ypbind
100024 1 udp 38590 status
100024 1 tcp 43595 status
-- /etc/default/nfs-common --
NEED_STATD=
STATDOPTS=
NEED_IDMAPD=yes
NEED_GSSD=yes
-- /etc/idmapd.conf --
[General]
Verbosity = 0
Pipefs-Directory = /var/lib/nfs/rpc_pipefs
Domain = dolda2000.com
[Mapping]
Nobody-User = nobody
Nobody-Group = nogroup
-- /etc/fstab --
home.nfs:/home /home nfs4 sec=krb5i 0 0
home.nfs:/usr/site /usr/site nfs hard,intr,tcp 0 0
home.nfs:/video /home/pub/video nfs4 sec=krb5i 0 0
-- /proc/mounts --
home.nfs:/home /home nfs4 rw,relatime,vers=4,rsize=131072,wsize=131072,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=krb5i,clientaddr=192.168.1.181,minorversion=0,local_lock=none,addr=192.168.1.1 0 0
home.nfs:/usr/site /usr/site nfs rw,relatime,vers=3,rsize=131072,wsize=131072,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=192.168.1.1,mountvers=3,mountport=50152,mountproto=tcp,local_lock=none,addr=192.168.1.1 0 0
home.nfs:/video /home/pub/video nfs4 rw,relatime,vers=4,rsize=131072,wsize=131072,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=krb5i,clientaddr=192.168.1.181,minorversion=0,local_lock=none,addr=192.168.1.1 0 0
rpc_pipefs /var/lib/nfs/rpc_pipefs rpc_pipefs rw,relatime 0 0
-- System Information:
Debian Release: jessie/sid
APT prefers testing
APT policy: (500, 'testing'), (99, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 3.2.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages nfs-common depends on:
ii adduser 3.113+nmu3
ii initscripts 2.88dsf-41
ii libc6 2.17-3
ii libcap2 1:2.22-1.2
ii libcomerr2 1.42.5-1.1
ii libdevmapper1.02.1 2:1.02.74-7
ii libevent-2.0-5 2.0.19-stable-3
ii libgssglue1 0.4-2
ii libk5crypto3 1.10.1+dfsg-5
ii libkeyutils1 1.5.5-7
ii libkrb5-3 1.10.1+dfsg-5
ii libmount1 2.20.1-5.4
ii libnfsidmap2 0.25-4
ii libtirpc1 0.2.2-5
ii libwrap0 7.6.q-24
ii lsb-base 4.1+Debian9
ii rpcbind 0.2.0-8
ii ucf 3.0025+nmu3
Versions of packages nfs-common recommends:
ii python 2.7.3-5
Versions of packages nfs-common suggests:
pn open-iscsi <none>
pn watchdog <none>
-- no debconf information
Reply to: