dkms build triggers pam_mount (requiring password), thus fails

[Jerome Lacoste]

Binary package hint: dkms

My /home partition is encrypted and I confirued pam_mount to mount the decrypted partition.

I used to have no problem with ubuntu 9.04 and dkms.

I've had problems installing the latest virtualbox which uses dkms to recompile the kernel modules.
The part that fails is

    status=`$DKMS status -m vboxdrv -v 3.0.12`
    if echo $status | grep added > /dev/null ||
        echo $status | grep built > /dev/null ||
        echo $status | grep installed > /dev/null
    then
        $DKMS remove -m vboxdrv -v 3.0.12 --all

I've seen that in the command line, running

dkms build ..... causes pam_mount to ask for my password.

not exactly sure why.

This is maybe a mis-configuration on my side (maybe the upgrade to ubuntu 9.10 caused me some issues in pam_mount upgrades ?). I've also seen bug 378833, which seems somewhat similar.

[Jerome Lacoste (jerome-lacoste)]

Some more info:

I've had problems with VirtualBox 3.0.12 as found on
  deb http://download.virtualbox.org/virtualbox/debian karmic non-free

Here's the VirtualBox/DKMS install log

# tail -f /var/log/vbox-install.log
Creating symlink /var/lib/dkms/vboxdrv/3.0.12/source ->
                 /usr/src/vboxdrv-3.0.12

DKMS: add Completed.

Kernel preparation unnecessary for this kernel. Skipping...

Building module:
cleaning build area....
reenter password for pam_mount:

(hangs there)

Probably related to my pam_mount config:

# grep mount /etc/pam.d/common-*
/etc/pam.d/common-auth:auth optional pam_mount.so use_first_pass
/etc/pam.d/common-auth:#auth optional /lib/security/pam_mount.so use_first_pass
/etc/pam.d/common-pammount:# # added for libpam-mount
/etc/pam.d/common-pammount:# @include common-pammount
/etc/pam.d/common-pammount:# above the common-pammount include (just as in the example above).
/etc/pam.d/common-pammount:# replace "optional" with "required" if a user must mount the specified
/etc/pam.d/common-pammount:# priority before these entries, else the pam_mount module is not
/etc/pam.d/common-pammount:# /usr/share/doc/libpam-mount/README.Debian.gz
/etc/pam.d/common-pammount:auth optional pam_mount.so use_first_pass
/etc/pam.d/common-pammount:session optional pam_mount.so
/etc/pam.d/common-session:session optional pam_mount.so
/etc/pam.d/common-session:#session optional /lib/security/pam_mount.so
/etc/pam.d/common-session-noninteractive:session optional pam_mount.so
/etc/pam.d/common-session-noninteractive:#session optional /lib/security/pam_mount.so
root@expresso2:/tmp#

[Ari (ari-reads)]

Did you find a workaround for this? I'm having the exact same problem. I also use pam_mount to mount encrypted partitions on boot. I also see the "reenter password for pam_mount:" in the vbox-install log
I tried installing manually from console with dpkg -i, but no joy

[Ari (ari-reads)]

ugly workarund:
in /etc/pam.d/common-session
add an "#" in front of the pam_mount line.

This doesn't seem to break anything in my system. Encrypted disks are still mounted by pam_mount as it is called during initial logins only.

[Jerome Lacoste (jerome-lacoste)]

I can confirm that the work-around works. I haven't yet rebooted though :)

[Ro (robert-markula)]

This doesn't work. Without the pam_mount option in /etc/pam.d/common-session your encrypted partition won't be opened.

This problem isn't related to DKMS though as it appears with other packages as well. It's a (serious) problem of pam_mount.

[Ari (ari-reads)]

@Ro: in my setup this has done the trick. I've been using it for about 3 weeks now.

[Jerome Lacoste (jerome-lacoste)]

Note: I said earlier that the work-around worked. It allowed me to install the application but at reboot time I had problems with the mounting of my encrypted /home partition. I had to uncomment the line again.

So the work-around didn't work for me fully neither.

[Mario Limonciello (superm1)]

So this is probably caused by the current thing that DKMS is trying to do to not run builds as root:

    #if we're root, try to run as a user instead
    if [ "$USER" = "root" ] && getent passwd nobody 1>/dev/null && su nobody -c "/bin/true" 1>/dev/null; then
        the_make_command="su nobody -c \"$the_make_command\""
        chmod +x $dkms_tree/$module/$module_version/build
        chown -R nobody $dkms_tree/$module/$module_version/build
    fi

    invoke_command "$the_make_command >> $dkms_tree/$module/$module_version/build/make.log 2>&1" "$the_make_command" background

---

I'm intending on switching this over to a daemon user (probably called dkms), but i'm not sure that's going to solve the problem still.

[Mario Limonciello (superm1)]

I'm going to back out that code until we've got a better solution for this type of problem. It will be fixed in the next Lucid upload.

http://linux.dell.com/git/?p=dkms.git;a=commit;h=dab0cb10d5853b128a2b7210b5a6b8edfb20dc50

[Ro (robert-markula)]

Hi Mario,
thanks for your commitment. Is a fix possible for Karmic as well?

[Launchpad Janitor (janitor)]

This bug was fixed in the package dkms - 2.1.1.0-0ubuntu1

---------------
dkms (2.1.1.0-0ubuntu1) lucid; urgency=low

  [ Mario Limonciello ]
  * New upstream version
  * dkms_autoinstall: Minor logic cleanups from submitted patches.
  * dkms_autoinstall: Run under dash since dkms.conf isn't sourced anymore.
  * dkms_autoinstall: Whitespace cleanup.
  * Convert DKMS to an upstart script that starts up before GDM or KDM can
    start. This ensures that drivers are built before X tries to start.
    (LP: #453365)
  * dkms_autoinstall: Rather than having if/else clauses all over the script,
    stub out any functions that aren't provided on Debian/Ubuntu when
    /etc/debian_version isn't present.
  * dkms_autoinstall: Exit immediately if this script is present but DKMS
    isn't anymore rather than sourcing functions and then exiting.
  * kernel_postinst.d_dkms: Launch the upstart script instead. In the process
    all output will be going to /var/log/dkms_autoinstaller (LP: #292606)
  * dkms_autoinstall: Don't ever output to stdout, even with kernel parameters.
  * dkms_autoinstall: Don't log the situation that we already have everything
    installed that needs to be.
  * dkms_autoinstall: Rather than logging to /var/log/dkms_autoinstaller,
    use logger to log to syslog during build and install.
  * dkms_autoinstall: Clean up the method to get arch. These hacks shouldn't
    be necessary. If you have problems with them gone, file a bug and we'll
    fix them more cleanly.
  * dkms_autoinstall: Notate the kernel we are building a module against
    when building it.
  * debian/rules: Don't attempt to stop DKMS on upgrades. It's a task, not
    a daemon, so stop wouldn't do anything.
  * Makefile: Install the old initscript to /usr/lib so that different distros
    can migrate to upstart at their leisure.
  * Makefile: Move any debian specific calls into the Makefile.
  * dkms: Revert the code that runs DKMS as the user "nobody".
    - It's causing problems with people with nonstandard PAM configs because it
      uses "su". (LP: #484725)
    - Also people have reported that nothing should be owned by 'nobody' per
      Debian & Ubuntu policy. This could have been fixed by creating a DKMS
      user, but that still wouldn't solve the problems with using 'su'.
  * dkms: Emit built-module MODULE=foo if initctl is available on the system
    after done building a module.
  * Add a special apport package-hook for when package builds fail to try
    to report them against the package providing that DKMS package.
    (LP: #484871)

  [ Alberto Milone ]
  * dkms_common.postinst: try to build the module for the most recent
    kernel in addition to building it for the current kernel (LP: #474917).

  [ Steve Langasek ]
  * dkms_autoinstall: optimize with a single find call instead of multiple
    loops with ls. (LP: 3484386)
  * dkms_autoinstall: drop localization of the usage message - this is
    inconsistent with all other init scripts on the system.

  [ Pauli Virtanen ]
  * Remove dependence from environment's umask and certain environment
    variables. (LP: #438393, #436039)

  [ Giuseppe Iuculano ]
  * dkms_autoinstall: Correct the prov...

[Jerome Lacoste (jerome-lacoste)]

To me this problem is very problematic as it prevents apt-get from finishing its upgrades.

So I backported the fix to the 09.10 dkms version. Maybe someone wants to apply it ?

[Jerome Lacoste (jerome-lacoste)]

To me this problem is very problematic as it prevents apt-get from finishing its upgrades.

So I backported the fix to the 09.10 dkms version. Maybe someone wants to apply it ?

[AYacopino (ayacopino)]

The patch appears to work under Karmic.
It let me install Virtual Box 3.2.

I have patch dmks using (first make a backup of dkms file):

patch /usr/sbin/dkms 484725_09.10.patch

I didn't have an encrypted file system, but i use pam_mount to mount some samba shares(without encription).
Greetings.