cups pam_ldap auth results in segfault

[raffis]

This only affects libpam-ldap, auhentication works fine with pam_unix.so.
See cups issue https://github.com/apple/cups/issues/5327

    Starting program: /usr/sbin/cupsd -f
    [Thread debugging using libthread_db enabled]
    Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
    [New Thread 0x7ffff1fae700 (LWP 9634)]

    Thread 1 "cupsd" received signal SIGSEGV, Segmentation fault.
    0x00007ffff13893f0 in ?? ()
    (gdb) bt
    #0 0x00007ffff13893f0 in ?? ()
    #1 0x00007ffff590f3f3 in ?? () from /usr/lib/x86_64-linux-gnu/libgnutls.so.30
    #2 0x00007ffff584ac25 in ?? () from /usr/lib/x86_64-linux-gnu/libgnutls.so.30
    #3 0x00007ffff5846d6a in ?? () from /usr/lib/x86_64-linux-gnu/libgnutls.so.30
    #4 0x00007ffff5848f46 in gnutls_record_send () from /usr/lib/x86_64-linux-gnu/libgnutls.so.30
    #5 0x00007ffff7132d70 in _httpTLSWrite () from /usr/lib/x86_64-linux-gnu/libcups.so.2
    #6 0x00007ffff7108816 in ?? () from /usr/lib/x86_64-linux-gnu/libcups.so.2
    #7 0x00007ffff7108ceb in httpFlushWrite () from /usr/lib/x86_64-linux-gnu/libcups.so.2
    #8 0x00007ffff710cda3 in httpWriteResponse () from /usr/lib/x86_64-linux-gnu/libcups.so.2
    #9 0x0000555555576b7b in ?? ()
    #10 0x0000000000000000 in ?? ()
    (gdb)

[root@]---> ldd /lib/x86_64-linux-gnu/security/pam_ldap.so
 linux-vdso.so.1 => (0x00007ffed8971000)
 libldap_r-2.4.so.2 => /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 (0x00007f02f4c2e000)
 liblber-2.4.so.2 => /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 (0x00007f02f4a1f000)
 libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007f02f47e7000)
 libpam.so.0 => /lib/x86_64-linux-gnu/libpam.so.0 (0x00007f02f45d9000)
 libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f02f420f000)
 libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007f02f3ff4000)
 libsasl2.so.2 => /usr/lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007f02f3dd9000)
 libgssapi.so.3 => /usr/lib/x86_64-linux-gnu/libgssapi.so.3 (0x00007f02f3b98000)
 libgnutls.so.30 => /usr/lib/x86_64-linux-gnu/libgnutls.so.30 (0x00007f02f3868000)
 libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f02f364b000)
 libaudit.so.1 => /lib/x86_64-linux-gnu/libaudit.so.1 (0x00007f02f3424000)
 libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f02f3220000)
 /lib64/ld-linux-x86-64.so.2 (0x00007f02f508b000)
 libheimntlm.so.0 => /usr/lib/x86_64-linux-gnu/libheimntlm.so.0 (0x00007f02f3017000)
 libkrb5.so.26 => /usr/lib/x86_64-linux-gnu/libkrb5.so.26 (0x00007f02f2d8d000)
 libasn1.so.8 => /usr/lib/x86_64-linux-gnu/libasn1.so.8 (0x00007f02f2aeb000)
 libcom_err.so.2 => /lib/x86_64-linux-gnu/libcom_err.so.2 (0x00007f02f28e7000)
 libhcrypto.so.4 => /usr/lib/x86_64-linux-gnu/libhcrypto.so.4 (0x00007f02f26b4000)
 libroken.so.18 => /usr/lib/x86_64-linux-gnu/libroken.so.18 (0x00007f02f249e000)
 libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f02f2284000)
 libp11-kit.so.0 => /usr/lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007f02f2020000)
 libidn.so.11 => /usr/lib/x86_64-linux-gnu/libidn.so.11 (0x00007f02f1ded000)
 libtasn1.so.6 => /usr/lib/x86_64-linux-gnu/libtasn1.so.6 (0x00007f02f1bda000)
 libnettle.so.6 => /usr/lib/x86_64-linux-gnu/libnettle.so.6 (0x00007f02f19a4000)
 libhogweed.so.4 => /usr/lib/x86_64-linux-gnu/libhogweed.so.4 (0x00007f02f1771000)
 libgmp.so.10 => /usr/lib/x86_64-linux-gnu/libgmp.so.10 (0x00007f02f14f1000)
 libwind.so.0 => /usr/lib/x86_64-linux-gnu/libwind.so.0 (0x00007f02f12c8000)
 libheimbase.so.1 => /usr/lib/x86_64-linux-gnu/libheimbase.so.1 (0x00007f02f10b9000)
 libhx509.so.5 => /usr/lib/x86_64-linux-gnu/libhx509.so.5 (0x00007f02f0e6e000)
 libsqlite3.so.0 => /usr/lib/x86_64-linux-gnu/libsqlite3.so.0 (0x00007f02f0b99000)
 libffi.so.6 => /usr/lib/x86_64-linux-gnu/libffi.so.6 (0x00007f02f0991000)

[Andreas Hasenack (ahasenack)]

Thanks for filing this bug in Ubuntu.

Could you please share the following information:
- which ubuntu release are you using
- libpam-ldap version
- cups version
- cups and pam configuration wrt authentication so that I can try to reproduce the problem

[Andreas Hasenack (ahasenack)]

I configured cups in a bionic system, pam_ldap and nss_ldap, and made my ldap testuser1 user a member of the local lpadmin group, so that he could try to add a printer. That worked without a segfault.

[raffis (raffis0)]

Try it without nss-ldap, just pam as authentication system and no authorization. I can post more information tomorrow.

[Launchpad Janitor (janitor)]

[Expired for libpam-ldap (Ubuntu) because there has been no activity for 60 days.]