libnss3.so went missing after upgrade

Bug #855171 reported by Hernando Torque on 2011-09-20
366
This bug affects 72 people
Affects Status Importance Assigned to Milestone
ca-certificates (Ubuntu)
High
Unassigned
ca-certificates-java (Ubuntu)
Critical
Unassigned
nss (Ubuntu)
Undecided
Unassigned

Bug Description

A bug in version 20110912ubuntu1 of the ca-certificates-java package, combined with an update to the ca-certificates package, resulted in the incorrect removal of the libnss3.so library from the filesystem of users who had these packages installed. As this library is a dependency of core functionality, including the NetworkManager service which manages networks on the desktop, it is critical to restore this library to the system before rebooting; otherwise users may not have the network access needed to fix the problem.

Users affected by this issue will see the following output on their system:

$ dpkg -s libnss3 | grep Status
Status: install ok installed
$ ls /usr/lib/*-gnu/libnss3.so
ls: cannot access /usr/lib/*-gnu/libnss3.so: No such file or directory
$

Affected users should run the following command to restore the deleted library:

$ sudo apt-get install --reinstall libnss3 libnss3:i386

Users should then ensure they upgrade to version 20110912ubuntu2 or later of the ca-certificates-java package to prevent any further library deletions.

Original description:
I upgraded "ca-certificates" and "light-themes" and afer a reboot my wireless networking was gone. Turns out "/usr/lib/x86_64-linux-gnu/libnss3.so" wasn't there anymore. After restoring that file everything works fine again. Probably related to the other new bugs for this package?

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: ca-certificates 20110502+nmu1ubuntu2
ProcVersionSignature: Ubuntu 3.0.0-11.18-generic 3.0.4
Uname: Linux 3.0.0-11-generic x86_64
ApportVersion: 1.23-0ubuntu1
Architecture: amd64
Date: Wed Sep 21 01:43:05 2011
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Alpha amd64 (20110112)
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: ca-certificates
UpgradeStatus: No upgrade log present (probably fresh install)

Hernando Torque (htorque) wrote :
Marc Deslauriers (mdeslaur) wrote :

I just hit this issue also. Attached is the portion of my dpkg.log that covers what got upgraded.

Marc Deslauriers (mdeslaur) wrote :
Marc Deslauriers (mdeslaur) wrote :

Adding nss for now, so people can find this bug until we figure out what package caused it...

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ca-certificates (Ubuntu):
status: New → Confirmed
Changed in nss (Ubuntu):
status: New → Confirmed
Marc Deslauriers (mdeslaur) wrote :
Yannick Warnier (ywarnier) wrote :

Same problem here, although I was only playing with installing the gnome-shell package at the time. Because of the error, the "network" option in the gnome-control-panel ceased working (I'm using GNOME3) and the network-manager-applet (if this is still its name in GNOME3) disappeared. Had to add the classic eth0 line in my /etc/network/interfaces and connect through ethernet cable to get it working:
$ sudo vim /etc/network/interfaces
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet dhcp
esc :wq
$ sudo ifup eth0

(quoted a bit roughly but maybe that'll help newbies fix the problem temporarily)

Yannick Warnier (ywarnier) wrote :

Forgot to say I'm using Oneiric beta 1 and also did an apt-get update before installing gnome-shell, so I guess I got unlucky and caught a bad update. Where can I find the corresponding libnss3.so (or alternatively is there a command to re-download and reinstall the libnss package "in place")?

Steve Langasek (vorlon) wrote :

So we had to update ca-certificates to call c_rehash over the /etc/ssl/certs directory to fix bad symlinks, and this seems to have exposed a bug in ca-certificates-java: /etc/ca-certificates/update.d/jks-keystore is removing the system libnss3.so from users' systems on failure due to a wrong path.

The fix for ca-certificates-java has been uploaded to the archive and will be published ASAP.

affects: ca-certificates (Ubuntu) → ca-certificates-java (Ubuntu)
Changed in ca-certificates-java (Ubuntu):
importance: Undecided → Critical
status: Confirmed → Fix Released
Changed in ca-certificates (Ubuntu):
status: New → Triaged
importance: Undecided → High
Steve Langasek (vorlon) wrote :

ca-certificates will be uploaded adding a conflict with the broken version of ca-certificates-java to mitigate the problem.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ca-certificates - 20110502+nmu1ubuntu3

---------------
ca-certificates (20110502+nmu1ubuntu3) oneiric; urgency=low

  * Conflict with ca-certificates-java == 20110912ubuntu1, since its hook
    will accidentally remove system libraries. LP: #855171.
 -- Steve Langasek <email address hidden> Tue, 20 Sep 2011 18:25:10 -0700

Changed in ca-certificates (Ubuntu):
status: Triaged → Fix Released
Rémi Menegon (firewave-free) wrote :

I confirm the bug affects the last build. I've just downgraded to 3.12.9+ckbi-1.82-0ubuntu2 and all works again.

Rémi Menegon (firewave-free) wrote :

OK, forget last post, I understand I've just corrected the links by reinstalling libnss3.

JrZabott (jrzabott) wrote :

That was really fun...

First i've tried to load manually by: sudo nm-applet...
Nothing happened..

So, i've resintalled the missing library... and then...

sudo NetworkManager, and it was cool...

That was completelly stupid I admit... But what can I do!? I'm a damm lost newbie, and it worked... so please don't point fingers on me.

LOL

JrZabott (jrzabott) wrote :

talking about it... why my power button keep missing for my uuper bar (i don't know the proper name), everyone knows???

JrZabott (jrzabott) wrote :

I don't know how to create shortcuts on ubuntu, but the sudo unity --replace, is a commom command for me... LOL... almost at each 10 minutes i've got to run this one...

Yannick Warnier (ywarnier) wrote :

I had to remove libnss3 completely to recover the file (which forces me to uninstall evolution, libreoffice and a whole lot of other stuff), but at least that worked out. Thanks, you guys were incredibly fast at fixing it.

Steve Langasek (vorlon) on 2011-09-21
description: updated
Steve Langasek (vorlon) on 2011-09-21
description: updated
Peter Hawkins (hawkinsp) wrote :

For anyone hit by this bug and unable to get a working network to fix it, I found another copy of libnss3.so on my system from the firefox package at /usr/lib/firefox-7.0/libnss3.so. Copying it to /usr/lib allowed network-manager to start, so then I could download and reinstall the libnss3 package as described above. Worth a try if you're stuck.

Martin Pitt (pitti) on 2011-09-21
Changed in nss (Ubuntu):
status: Confirmed → Invalid
status: Invalid → Confirmed

I can also confirm this bug on 11.10 AMD64. I went to install and use my dailies of Chromium and it would fail to start. When I attempted to start the application via the command line, I received an error stating that libnss3.so was missing. I went to do a manual search for the lib in /usr/lib so that I could symlink to, think that may have been the issue. Needless to say, I couldn't find it and ended up having to reinstall the libnss3 package. After a reinstall of said package all issues that I was experiencing ended.

Rocko (rockorequin) wrote :

Yes, the update caused some mighty weird behaviour, including making network-manager disappear. Synaptic said that libnss3 was installed, even though libnss3's properties told me it couldn't tell me the list of installed files because the package wasn't installed. So reinstalling it from Synaptic made no difference.

In the end I was able to reinstall it using dpkg -i on the cached deb file in /var/cache/apt/archives.

Rocko (rockorequin) wrote :

I just tried the updated ca-certificates package (20110912ubuntu2) that said it fixes the problem, and it deleted the /usr/lib/x86_64-linux-gnu/libnss3.so file again.

So the fix didn't work for me.

Fabian Günter (n4zroth) wrote :

I can confirm that the fix doesn't work, Oneiric x64.
After an apt-get dist-upgrade and a reboot the network didn't want to work.

Olli Kankare (o.k) wrote :

Manually installing libnss3_3.12.9+*_amd64.deb with dpkg -i seems to have fixed the problem.

Vladimir Scherbaev (zemik) wrote :

Don't work on 11.10 with:
ii ca-certificates 20110502+nmu1ubuntu3 Common CA certificates
ii ca-certificates-java 20110912ubuntu3 Common CA certificates (JKS keystore)

Just download and install libnss3_3.12.9+ckbi-1.82-0ubuntu5_i386.deb and reboot, works perfectly here

Vladimir Scherbaev (zemik) wrote :

libnss3:
  Installed: 3.12.9+ckbi-1.82-0ubuntu5
  Candidate: 3.12.9+ckbi-1.82-0ubuntu5
  Version table:
 *** 3.12.9+ckbi-1.82-0ubuntu5 0
        500 http://archive.ubuntu.com/ubuntu/ oneiric/main amd64 Packages
        100 /var/lib/dpkg/status

pablomme (pablomme) wrote :

@Vladimir: as the summary states (although the :i386 version is unneeded), you need to do:

sudo apt-get install --reinstall libnss3

The problem is that ca-certificates has removed files from libnss3, so even if libnss3 reports itself as installed you will need to reinstall it in order to recover the missing files. With a bit of luck, you will have libnss3 in /var/cache/apt, and the above command won't need an internet connection to complete successfully - else you will need to configure your connection from the command line, or fetch the package on a second computer and copy it to the affected system using a physical storage device.

Afterwards, update your ca-certificates to a working version.

Rainer Rohde (rainer-rohde) wrote :

My wired and wireless connections are still unmanaged via Gnome Network Manager...

- Device: eth0 -----------------------------------------------------------------
  Type: Wired
  Driver: forcedeth
  State: unmanaged
  Default: no
  HW Address: 34:15:9E:00:E4:10

  Capabilities:
    Carrier Detect: yes

  Wired Properties
    Carrier: off

- Device: eth1 -----------------------------------------------------------------
  Type: 802.11 WiFi
  Driver: wl
  State: unmanaged
  Default: no
  HW Address: F8:1E:DF:E1:87:C5

  Capabilities:

  Wireless Properties
    WEP Encryption: yes
    WPA Encryption: yes
    WPA2 Encryption: yes

  Wireless Access Points

Didier Roche (didrocks) wrote :

After getting the issue with ubuntu2 and reinstalled libnss3, I downgraded to 20110912ubuntu1 and upgraded to 20110912ubuntu3 without any nss file removed.

Changed in nss (Ubuntu):
status: Confirmed → Invalid
Shyam (reddy-shyam) wrote :

I confirm the fix worked fine my end. I had done an update via live cd thought which might have resolved ca-certificates issues and so applying fix, worked just fine. Thanks for the tip off. :)

whoop (whoopwhoop) wrote :

Network connection is back up for me but:
apt-get install --reinstall libnss3

gives me:
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 0 not upgraded.
Need to get 0 B/1,265 kB of archives.
After this operation, 0 B of additional disk space will be used.
E: Internal Error, No file name for libnss3

and I still have no networkmanager applet...

whoop (whoopwhoop) wrote :

Correction, I have applet.... but still E: Internal Error, No file name for libnss3
and various applications are complaining about untrusted https connection...

On Wed, Sep 21, 2011 at 10:08:25PM -0000, whoop wrote:
> Network connection is back up for me but:
> apt-get install --reinstall libnss3

> gives me:
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> 0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 0 not upgraded.
> Need to get 0 B/1,265 kB of archives.
> After this operation, 0 B of additional disk space will be used.
> E: Internal Error, No file name for libnss3

Please reread the instructions from the bug description:

 sudo apt-get install --reinstall libnss3 libnss3:i386

The 'libnss3:i386' at the end is not optional.

--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer http://www.debian.org/
<email address hidden> <email address hidden>

Rainer Rohde (rainer-rohde) wrote :

Even after #34 I still get the "Waiting for network configuration" message during bootup and my Gnome Network Manager doesn't have any managed connections for me and doesn't work as it did only yesterday...

whoop (whoopwhoop) wrote :

thanks

I believe the change that was committed for this is either wrong or incomplete. The original change that actually broke it was removing libnss3.so from the libnss3-1d package. It never should have been there, as it was already in the libnss3 package. However, jks-keystore does:

    nsspkg=$(dpkg-query -L libnss3-1d | sed -n 's,\(.*\)/libnss3\.so$,\1,p')

So, with the new libnss3-1d package, $nsspkg is empty. The “fix” was to add a test later for an empty $nsspkg. I think this is a fine change, and increases the safety of this somewhat sketchy script, but it does not fix the problem that the script is still looking for a file in the libnss3-1d packing list that is not there.

Whether it should be looking for libnss3.so.1d, or looking in the libnss3 packing list, I'm not sure.

Steve Langasek (vorlon) wrote :

On Fri, Sep 23, 2011 at 01:35:18AM -0000, Charles M. Hannum wrote:
> I believe the change that was committed for this is either wrong or
> incomplete. The original change that actually broke it was removing
> libnss3.so from the libnss3-1d package. It never should have been
> there, as it was already in the libnss3 package. However, jks-keystore
> does:

> nsspkg=$(dpkg-query -L libnss3-1d | sed -n
> 's,\(.*\)/libnss3\.so$,\1,p')

No, it doesn't. You appear to be looking at an old version of the hook
script.

--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer http://www.debian.org/
<email address hidden> <email address hidden>

Rainer Rohde (rainer-rohde) wrote :

There seems to be a regression with the latest updates... the indicator is visible, but it displays "No network devices available" after reboot just now.

Rainer Rohde (rainer-rohde) wrote :

Please disregard comment #39; after another reboot it all seems to have gone back to normal again...

Steve Langasek (vorlon) wrote :

On Fri, Sep 30, 2011 at 05:36:49PM -0000, Rainer Rohde wrote:
> There seems to be a regression with the latest updates... the indicator
> is visible, but it displays "No network devices available" after reboot
> just now.

Nothing to do with this bug.

--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer http://www.debian.org/
<email address hidden> <email address hidden>

But there is, or there was maybe some update has solved, something going wrong with networking during this week, I had the same issue as Rainer and opened bug 862215, but closed it after rebooting and getting networking back, thinking it was something specific of my system. This happened to me in two different systems. In one of them networking stopped working at some point (the network manager icon was showing networking enabled but hat the image that you get when there is no connection). A reboot restored networking and hasn't failed yet.

Joshua R. Poulson (jrp) wrote :

Yes, something happened this week, but it was related to decorating the indicators and had nothing to do with the networking stack (it was, in fact, up, the indicator was wrong). Other indicators were also broken this week because of the same bug. Rebooting fixed it for all of these.

As a result, it has nothing to do with this bug.

W. Bourgeois (roundsoftstudio) wrote :

Whoever coded the upgrade process deserves to beaten in public for such an unacceptable bug.

That someone or sometng produced this bug is bad enough, the bigger problem is that I updated my ubuntu yesterday (months after this bug was filed and resolved) and still it happened to me. Why isnt this fixed???

Steve Langasek (vorlon) wrote :

This bug *is* fixed. Why do you think you have the same bug? Please provide more details.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers