[Pkg-openldap-devel] Bug#705884: slapd-smbk5pwd: lt_dlopenext failed: (smbk5pwd) file not found

[Apollon Oikonomopoulos]

severity 705884 serious
thanks

Hi,

On 18:26 Sun 21 Apr     , Michael Fladischer wrote:
> Package: slapd-smbk5pwd
> Version: 2.4.31-1+nmu1
> Severity: important
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Dear Maintainer,
> 
> upgrading slapd and slapd-smbk5pwd to 2.4.31-1+nmu1 results in slapd not
> starting, if the smbk5pwd module is loaded:
> 
> 51740f86 lt_dlopenext failed: (smbk5pwd) file not found
> 51740f86 config error processing cn=module{0},cn=config: <olcModuleLoad> handler
> exited with 1
> 51740f86 send_ldap_result: conn=-1 op=0 p=0
> 51740f86 slapd destroy: freeing system resources.
> 51740f86 slapd stopped.
> 51740f86 connections_destroy: nothing to destroy.
> 
> There is a suggestion online[0] that this is due to unsatisfied dependencies in
> the dynamic linked libraries but `ldd` does not confirm this:

We were also bitten by this. Dynamic linking is broken, as evident by 
LD_DEBUG:

LD_DEBUG=all slapd
...
864: /usr/lib/ldap/smbk5pwd.so: error: symbol lookup error: undefined symbol: hdb_unseal_keys (fatal)

After digging a bit deeper, this is caused by the amd64 binaries being 
linked against MIT kerberos and *not* heimdal:

apt-cache show slapd-smbk5pwd:amd64 | grep Depends
Depends: slapd (= 2.4.31-1+nmu1), libc6 (>= 2.4), libgcrypt11 (>= 1.4.5), libkadm5srv-mit8, libkrb5-3 (>= 1.6.dfsg.2), libldap-2.4-2 (>= 2.4.7) 

apt-cache show slapd-smbk5pwd:i386 | grep Depends
Depends: slapd (= 2.4.31-1+nmu1), libc6 (>= 2.4), libgcrypt11 (>= 1.4.5), libkadm5srv8-heimdal (>= 1.4.0+git20110226), libkrb5-26-heimdal (>= 1.4.0+git20110226), libldap-2.4-2 (>= 2.4.7)

This was probably caused by the build environment in the uploader's machine,
since amd64 was uploaded as evident in [1].

Installing libkadm5srv8-heimdal and LD_PRELOADING
/usr/lib/x86_64-linux-gnu/libkadm5srv.so.8 gets slapd to start.

I have yet to understand how the package could have ended up linking against
MIT kerberos, since openldap build-depends on heimdal-dev which conflicts with
libkrb5-dev.

A binNMU for amd64 should resolve the issue.

Regards,
Apollon

[1] https://buildd.debian.org/status/package.php?p=openldap&suite=sid