bugJailkit - Bugs: bug #20071, /lib/tls removed from Debian...

 
 

bug #20071: /lib/tls removed from Debian (Testing), jailkit does not pick up on changes

Submitter:  Eric Wages <wages>
Submitted:  Mon 04 Jun 2007 03:04:33 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 08 Mar 2018 09:40:32 PM UTC, comment #5: 

found the issue, and fixed it in revision: 1.101

Olivier Sessink <oli4>
Group administrator
Thu 08 Mar 2018 09:31:08 PM UTC, comment #4: 

can you run jk_cp with -v (verbose?)

If I try to reproduce this, I see:

Destination file /home/jail/lib/x86_64-linux-gnu/libc-2.23.so exists, will delete to force update
Copying /lib/x86_64-linux-gnu/libc-2.23.so to /home/jail/lib/x86_64-linux-gnu/libc-2.23.so
Creating symlink /home/jail/lib64/ld-linux-x86-64.so.2 to /lib/x86_64-linux-gnu/ld-2.23.so
Destination file /home/jail/lib/x86_64-linux-gnu/ld-2.23.so exists, will delete to force update
Copying /lib/x86_64-linux-gnu/ld-2.23.so to /home/jail/lib/x86_64-linux-gnu/ld-2.23.so

so it deletes the symlink, and re-creates the correct one... SO I cannot reproduce it..

Olivier Sessink <oli4>
Group administrator
Thu 08 Mar 2018 12:06:29 AM UTC, comment #3: 

Related to this, jk_cp does not correctly pick up changes to symlinks either.  Curiously, what it says it's doing (creating a symlink to the new target) is correct, it just doesn't actually do it.

In this example, ld-linux-x86-64.so.2 pointed to a version of ld.so from debian jessie; I updated to debian stretch and now the link points to a bad filename:


root@host:/var/www/clients/client3/web8# ls -l lib64
total 0
lrwxrwxrwx 1 root root 32 Jul 28  2016 ld-linux-x86-64.so.2 -> /lib/x86_64-linux-gnu/ld-2.19.so
root@host:/var/www/clients/client3/web8# ls -l /lib64/ld-linux-x86-64.so.2                                                       
lrwxrwxrwx 1 root root 32 Jun 15  2017 /lib64/ld-linux-x86-64.so.2 -> /lib/x86_64-linux-gnu/ld-2.24.so


I tried to force that symlink to update via jk_cp -f, and the command output says it created the symlink correctly:


root@host:/var/www/clients/client3/web8# jk_cp -f -j `pwd` /lib64/ld-linux-x86-64.so.2                                           
Creating symlink /var/www/clients/client3/web8/lib64/ld-linux-x86-64.so.2 to /lib/x86_64-linux-gnu/ld-2.24.so
Copying /lib/x86_64-linux-gnu/ld-2.24.so to /var/www/clients/client3/web8/lib/x86_64-linux-gnu/ld-2.24.so



However in fact it did not change the symlink at all, it still points to the old (removed) target:


root@host:/var/www/clients/client3/web8# md5sum  lib64/ld-linux-x86-64.so.2                                                      
md5sum: lib64/ld-linux-x86-64.so.2: No such file or directory
root@host:/var/www/clients/client3/web8# ls -l lib64/ld-linux-x86-64.so.2
lrwxrwxrwx 1 root root 32 Jul 28  2016 lib64/ld-linux-x86-64.so.2 -> /lib/x86_64-linux-gnu/ld-2.19.so
root@host:/var/www/clients/client3/web8# ls -l lib/x86_64-linux-gnu/ld-2.19.so
ls: cannot access 'lib/x86_64-linux-gnu/ld-2.19.so': No such file or directory
root@host:/var/www/clients/client3/web8# ls -l lib/x86_64-linux-gnu/ld-2.24.so
-rwxr-xr-x 1 root root 153288 Jun 15  2017 lib/x86_64-linux-gnu/ld-2.24.so

Anonymous
Mon 04 Jun 2007 08:35:41 PM UTC, comment #2: 

Only comment I can think of is to traverse the library directories (whether it be /lib or /lib/tls), locating the symlinks, and then searching the system's default library paths for similarly named symlinks to see what they point to.

Once the newly updated files are found, copy them to whatever directory in the jail needs them.

Future work may consider about consolidating library directories entirely within the jail.

Thoughts?

Eric Wages <wages>
Mon 04 Jun 2007 07:11:42 PM UTC, comment #1: 

it is a good point, but very much out of the scope what jk_update currently does.

Currently it simply walks all files in the jail, checks if the file on the real system has changed, and if it has changed jk_update will pass that change on to the real system. jk_update does not know if a file is a library or not, so it doesn't know if a file should be searched for in a different location if it is removed from the real system.

any suggestions?

Olivier Sessink <oli4>
Group administrator
Mon 04 Jun 2007 03:04:33 PM UTC, original submission:  

After an apt-get dist-upgrade on debian testing today, I attempted to run jk_update -j /home/chrootusers:

root@<myserver>:~# jk_update -j /home/chrootusers/
/home/chrootusers/lib/libnss_dns-2.3.6.so exists, but cannot stat file /lib/libnss_dns-2.3.6.so: No such file or directory
/home/chrootusers/lib/tls exists, but cannot stat file /lib/tls: No such file or directory
/home/chrootusers/lib/ld-2.3.6.so exists, but cannot stat file /lib/ld-2.3.6.so: No such file or directory
/home/chrootusers/lib/libnsl-2.3.6.so exists, but cannot stat file /lib/libnsl-2.3.6.so: No such file or directory
/home/chrootusers/lib/libnss_compat-2.3.6.so exists, but cannot stat file /lib/libnss_compat-2.3.6.so: No such file or directory
/home/chrootusers/lib/libnss_files-2.3.6.so exists, but cannot stat file /lib/libnss_files-2.3.6.so: No such file or directory
/home/chrootusers/lib/libncurses.so.5.5 exists, but cannot stat file /lib/libncurses.so.5.5: No such file or directory

I had to manually copy over the updated libs and recreate all of the symlinks. Even after doing that, libraries were still broken, not allowing users to log in:

root@<myserver>:/home/chrootusers/lib# su <username>
/bin/bash: relocation error: /lib/tls/libc.so.6: symbol _dl_out_of_memory, version GLIBC_PRIVATE not defined in file ld-linux.so.2 with link time reference

I was able to successfully log in with a remote user's account after a copy over of the new libs from /lib to /home/chrootusers/lib or /home/chrootusers/lib/tls and recreating appropriate symlinks.

It appears that the jk_update code needs to be updated to search for the libs in either /lib or /lib/tls in order to update the jail.


root@<myserver>:/home/chrootusers/lib/tls# cat /proc/version
Linux version 2.6.18-4-amd64 (Debian 2.6.18.dfsg.1-12) (waldi@debian.org) (gcc version 4.1.2 20061115 (prerelease) (Debian 4.1.1-21)) #1 SMP Mon Mar 26 19:17:44 UTC 2007

Eric Wages <wages>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by oli4 (Posted a comment)
  • -email is unavailable- added by wages (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-03-08 oli4 StatusNone Fixed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code