Incomplete linking with boost_regex

[Daniel Axtens]

SRU Justification
=================

[Impact]
oslogin fails on Xenial and Trusty.

In auth.log we see:

Oct 17 16:35:59 davecore-oslogin sshd[10073]: PAM unable to dlopen(pam_oslogin_login.so): /lib/security/pam_oslogin_login.so: cannot open shared object file: No such file or directory
Oct 17 16:35:59 davecore-oslogin sshd[10073]: PAM adding faulty module: pam_oslogin_login.so
Oct 17 16:35:59 davecore-oslogin sshd[10073]: PAM unable to dlopen(pam_oslogin_admin.so): /lib/security/pam_oslogin_admin.so: cannot open shared object file: No such file or directory
Oct 17 16:35:59 davecore-oslogin sshd[10073]: PAM adding faulty module: pam_oslogin_admin.so

The error message is a bit deceptive - PAM tries to load the module from the correct location, fails, and then tries the other location where it is missing. It then reports the missing error rather than the real error.

symlink the module into both paths leads to a much more useful error message:

Oct 18 06:45:12 dja-202158 sshd[16554]: PAM unable to dlopen(pam_oslogin_login.so): /lib/security/pam_oslogin_login.so: undefined symbol: _ZN5boost9re_detail12perl_matcherIN9__gnu_cxx17__normal_iteratorIPKcNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEESaINS_9sub_matchISC_EEENS_12regex_traitsIcNS_16cpp_regex_traitsIcEEEEE14construct_initERKNS_11basic_regexIcSJ_EENS_15regex_constants12_match_flagsE
Oct 18 06:45:12 dja-202158 sshd[16554]: PAM adding faulty module: pam_oslogin_login.so
Oct 18 06:45:12 dja-202158 sshd[16554]: PAM unable to dlopen(pam_oslogin_admin.so): /lib/security/pam_oslogin_admin.so: undefined symbol: _ZN5boost9re_detail12perl_matcherIN9__gnu_cxx17__normal_iteratorIPKcNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEESaINS_9sub_matchISC_EEENS_12regex_traitsIcNS_16cpp_regex_traitsIcEEEEE14construct_initERKNS_11basic_regexIcSJ_EENS_15regex_constants12_match_flagsE

[Test case]
 - set up GCE VM
 - turn on oslogin
 - attempt to log in

[Fix]
debian/patches/0002-Set-LDFLAGS-at-the-end-of-the-c-command-line-right-b.patch re-orders the link flags to link boost_regex for oslogin. However, this didn't change the flags for PAM module linking. So fix that too.

[Regression Potential]
- fixes a regression
- limited to oslogin, and how it is linked.

[Other Notes]
We still see a scary list of warnings when building, but they don't seem to have an impact on the common path:
dpkg-shlibdeps: warning: symbol _ZN5boost9re_detail13put_mem_blockEPv used by debian/google-compute-engine-oslogin/lib/libnss_google-compute-engine-oslogin-1.3.1.so found in none of the libraries
dpkg-shlibdeps: warning: symbol _ZN5boost9re_detail14verify_optionsEjNS_15regex_constants12_match_flagsE used by debian/google-compute-engine-oslogin/lib/libnss_google-compute-engine-oslogin-1.3.1.so found in none of the libraries
dpkg-shlibdeps: warning: symbol _ZNK5boost9re_detail31cpp_regex_traits_implementationIcE17transform_primaryEPKcS4_ used by debian/google-compute-engine-oslogin/lib/libnss_google-compute-engine-oslogin-1.3.1.so found in none of the libraries
dpkg-shlibdeps: warning: symbol _ZN5boost13match_resultsIN9__gnu_cxx17__normal_iteratorIPKcNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEESaINS_9sub_matchISB_EEEE12maybe_assignERKSF_ used by debian/google-compute-engine-oslogin/lib/libnss_google-compute-engine-oslogin-1.3.1.so found in none of the libraries
dpkg-shlibdeps: warning: symbol _ZN5boost9re_detail12perl_matcherIN9__gnu_cxx17__normal_iteratorIPKcNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEESaINS_9sub_matchISC_EEENS_12regex_traitsIcNS_16cpp_regex_traitsIcEEEEE14construct_initERKNS_11basic_regexIcSJ_EENS_15regex_constants12_match_flagsE used by debian/google-compute-engine-oslogin/lib/libnss_google-compute-engine-oslogin-1.3.1.so found in none of the libraries
dpkg-shlibdeps: warning: symbol _ZN5boost11basic_regexIcNS_12regex_traitsIcNS_16cpp_regex_traitsIcEEEEE9do_assignEPKcS7_j used by debian/google-compute-engine-oslogin/lib/libnss_google-compute-engine-oslogin-1.3.1.so found in none of the libraries
dpkg-shlibdeps: warning: symbol _ZN5boost9re_detail19raise_runtime_errorERKSt13runtime_error used by debian/google-compute-engine-oslogin/lib/libnss_google-compute-engine-oslogin-1.3.1.so found in none of the libraries
dpkg-shlibdeps: warning: symbol _ZNK5boost9re_detail31cpp_regex_traits_implementationIcE9transformEPKcS4_ used by debian/google-compute-engine-oslogin/lib/libnss_google-compute-engine-oslogin-1.3.1.so found in none of the libraries
dpkg-shlibdeps: warning: symbol _ZN5boost9re_detail24get_default_error_stringENS_15regex_constants10error_typeE used by debian/google-compute-engine-oslogin/lib/libnss_google-compute-engine-oslogin-1.3.1.so found in none of the libraries
dpkg-shlibdeps: warning: symbol _ZN5boost9re_detail13get_mem_blockEv used by debian/google-compute-engine-oslogin/lib/libnss_google-compute-engine-oslogin-1.3.1.so found in none of the libraries

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "set-LDFLAGS-for-PAM.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Balint Reczey (rbalint)]

Fixed in all releases.