segfault in pam_smbpass.so (reported in syslog)

[Steve Almond]

Binary package hint: libpam-mount

Unable to log into Ubuntu 8.10 (server). Unable to log into Courier, samba, or CUPS' secure pages. Unable to log in via SSH unless I disable UsePAM in sshd_config. Single-user mode seems to work as expected. Apache is still serving webpages, and phpMySQLadmin is working. Server had been up c.75 days before today's reboots, and safe-upgrade'd daily.

Problem appeared to start yesterday, c. 1300 BST, when attempting to print via CUPS/cancel print job in CUPS from an XP machine. Problem may have been dormant for some time, but is now making my web/mail/file-server (almost) unuseable.

Boot appears normal (to me, anyway!). Ubuntu prints server version, name, etc, and prompts for username and password as usual. Entering username and password appears to work as usual, but the server version, etc reappear and server prompts for username again.

Cut-and-paste of login attempt from SSH (OpenSSH/PuTTY on Vista) session

root@[server]:/var/log# login
[FQDN] login: root
Password:
Segmentation fault
root@[server]:/var/log#

Cut-and-paste of corresponding kern log

# tail /var/log/kern.log
[..]
Apr 27 11:56:37 [server] kernel: [ 1111.447944] login[5629]: segfault at 0 ip b7c0cb0b sp bf80dbd0 error 4 in pam_smbpass.so[b7bb0000+12a000]

# tail /var/log/syslog
[..]
Apr 27 11:56:37 [server] kernel: [ 1111.447944] login[5629]: segfault at 0 ip b7c0cb0b sp bf80dbd0 error 4 in pam_smbpass.so[b7bb0000+12a000]

No entries in auth.log

[Steve Almond (k-launchpad-silkandslug-com)]

Re-pointed to correct package

[Thierry Carrez (ttx)]

Looks like a duplicate of bug 303458
What does "grep ldb /var/log/kern.log*" return ?
Do you have strange error messages inside your /var/lib/samba/secrets.tdb file ?

[Steve Almond (k-launchpad-silkandslug-com)]

Yep, it's a duplicate of bug 303458.

Changed file:
  /etc/apparmor.d/abstractions/smbpass

to say:
  /var/lib/samba/*.[lt]db rwk,

which seems to have fixed the problem.

No obvious errors in /var/lib/samba/secrets.tdb - but then I reinstalled samba and libpam_smbpass yesterday, so maybe I wouldn't.

Command:
grep ldb /var/log/kern.log*

gives:

/var/log/kern.log:Apr 26 13:27:32 sja33 kernel: [1796984.714580] type=1503 audit(1240748852.020:24): operation="inode_permission" requested_mask="rw::" denied_mask="rw::" fsuid=0 name="/var/lib/samba/group_mapping.ldb" pid=28475 profile="/usr/sbin/cupsd"
/var/log/kern.log:Apr 26 13:27:32 sja33 kernel: [1796984.770312] type=1503 audit(1240748852.070:25): operation="inode_permission" requested_mask="rw::" denied_mask="rw::" fsuid=0 name="/var/lib/samba/group_mapping.ldb" pid=28475 profile="/usr/sbin/cupsd"
/var/log/kern.log:Apr 26 13:27:44 sja33 kernel: [1796997.450618] type=1503 audit(1240748864.750:26): operation="inode_permission" requested_mask="rw::" denied_mask="rw::" fsuid=0 name="/var/lib/samba/group_mapping.ldb" pid=28475 profile="/usr/sbin/cupsd"
/var/log/kern.log:Apr 26 13:27:44 sja33 kernel: [1796997.454204] type=1503 audit(1240748864.760:27): operation="inode_permission" requested_mask="rw::" denied_mask="rw::" fsuid=0 name="/var/lib/samba/group_mapping.ldb" pid=28475 profile="/usr/sbin/cupsd"
/var/log/kern.log:Apr 26 13:27:48 sja33 kernel: [1797001.114309] type=1503 audit(1240748868.420:28): operation="inode_permission" requested_mask="rw::" denied_mask="rw::" fsuid=0 name="/var/lib/samba/group_mapping.ldb" pid=28475 profile="/usr/sbin/cupsd"
/var/log/kern.log:Apr 26 13:27:48 sja33 kernel: [1797001.130577] type=1503 audit(1240748868.430:29): operation="inode_permission" requested_mask="rw::" denied_mask="rw::" fsuid=0 name="/var/lib/samba/group_mapping.ldb" pid=28475 profile="/usr/sbin/cupsd"
/var/log/kern.log:Apr 28 07:06:43 sja33 kernel: [70116.585177] type=1503 audit(1240898803.075:8): operation="inode_permission" requested_mask="rw::" denied_mask="rw::" fsuid=0 name="/var/lib/samba/group_mapping.ldb" pid=11266 profile="/usr/sbin/cupsd"
/var/log/kern.log:Apr 28 07:06:48 sja33 kernel: [70122.299337] type=1503 audit(1240898808.785:9): operation="inode_permission" requested_mask="rw::" denied_mask="rw::" fsuid=0 name="/var/lib/samba/group_mapping.ldb" pid=11266 profile="/usr/sbin/cupsd"
/var/log/kern.log:Apr 28 07:06:48 sja33 kernel: [70122.303220] type=1503 audit(1240898808.785:10): operation="inode_permission" requested_mask="rw::" denied_mask="rw::" fsuid=0 name="/var/lib/samba/group_mapping.ldb" pid=11266 profile="/usr/sbin/cupsd"

[Steve Almond (k-launchpad-silkandslug-com)]

Thierry, (and others)

Thanks for your help, on this and other bug reports. It took me 10+ hours to work through all the possibilities until I found your comments - and fixed the bug in 10 seconds flat.

Your work /is/ appreciated.

Steve