Re: kerberos issues with 10.0_BETA post openssl update

[Mark Davies <mark%ecs.vuw.ac.nz@localhost>]

On 4/09/23 22:30, Taylor R Campbell wrote:
> Can you install the debug set on one of the affected systems where you
> can reproduce a problem to get more information out of the stack
> traces?

OK, found a simpler reproducible crash.  Run "kadmin -l" on a kdc and 
try to change a password.

xen2# kadmin -l
kadmin> passwd ecsproctor
ecsproctor%ECS.VUW.AC.NZ@localhost's Password:
Verifying - ecsproctor%ECS.VUW.AC.NZ@localhost's Password:
Segmentation fault (core dumped)

Here is the backtrace

Core was generated by `kadmin'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000000000000000 in ?? ()
(gdb) where
#0  0x0000000000000000 in ?? ()
#1  0x00007f11ca0423d4 in ARCFOUR_string_to_key (context=0x7f11cafc7000, 
enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5,
    password=..., salt=..., opaque=..., key=0x7f11caf514d8)
    at 
/src/work/10/src/crypto/external/bsd/heimdal/dist/lib/krb5/salt-arcfour.c:83
#2  0x00007f11ca041531 in krb5_string_to_key_data_salt 
(context=context@entry=0x7f11cafc7000,
    enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, password=..., salt=..., 
key=0x7f11caf514d8)
    at 
/src/work/10/src/crypto/external/bsd/heimdal/dist/lib/krb5/salt.c:173
#3  0x00007f11ca041662 in krb5_string_to_key_salt 
(context=context@entry=0x7f11cafc7000, enctype=<optimized out>,
    password=password@entry=0x7f7fff434b30 "FooBar123", salt=..., 
key=<optimized out>)
    at 
/src/work/10/src/crypto/external/bsd/heimdal/dist/lib/krb5/salt.c:225
#4  0x00007f11cac11d25 in hdb_generate_key_set_password_with_ks_tuple 
(principal=<optimized out>,
    ks_tuple=<optimized out>, n_ks_tuple=<optimized out>, 
num_keys=<optimized out>, keys=<optimized out>,
    password=<optimized out>, context=<optimized out>)
    at /src/work/10/src/crypto/external/bsd/heimdal/dist/lib/hdb/keys.c:800
#5  hdb_generate_key_set_password_with_ks_tuple (context=0x7f11cafc7000, 
principal=<optimized out>,
    password=password@entry=0x7f7fff434b30 "FooBar123", 
ks_tuple=ks_tuple@entry=0x0,
    n_ks_tuple=n_ks_tuple@entry=0, keys=keys@entry=0x7f7fff434990, 
num_keys=num_keys@entry=0x7f7fff434998)
    at /local/SAVE/10_64.base.debug/usr/include/krb5/hdb-protos.h:346
#6  0x00007f11cb00ef50 in _kadm5_set_keys 
(context=context@entry=0x7f11cafc7180, ent=ent@entry=0x7f7fff434a28,
    n_ks_tuple=n_ks_tuple@entry=0, ks_tuple=ks_tuple@entry=0x0, 
password=password@entry=0x7f7fff434b30 "FooBar123")
    at 
/src/work/10/src/crypto/external/bsd/heimdal/dist/lib/kadm5/set_keys.c:55
#7  0x00007f11cb007813 in change (server_handle=0x7f11cafc7180, 
princ=<optimized out>, keepold=0, n_ks_tuple=0,
    ks_tuple=0x0, password=0x7f7fff434b30 "FooBar123", cond=cond@entry=0)
    at 
/src/work/10/src/crypto/external/bsd/heimdal/dist/lib/kadm5/chpass_s.c:95
#8  0x00007f11cb007969 in kadm5_s_chpass_principal 
(server_handle=<optimized out>, princ=<optimized out>,
    keepold=<optimized out>, n_ks_tuple=<optimized out>, 
ks_tuple=<optimized out>, password=<optimized out>)
    at 
/src/work/10/src/crypto/external/bsd/heimdal/dist/lib/kadm5/chpass_s.c:195
#9  0x00000001d240945d in set_password (keepold=<optimized out>, 
password=<optimized out>,
    principal=0x7f11cafb53c0) at 
/src/work/10/src/crypto/external/bsd/heimdal/dist/kadmin/cpw.c:113
#10 do_cpw_entry (data=<optimized out>, principal=0x7f11cafb53c0)
    at /src/work/10/src/crypto/external/bsd/heimdal/dist/kadmin/cpw.c:141
#11 do_cpw_entry (principal=0x7f11cafb53c0, data=<optimized out>)
    at /src/work/10/src/crypto/external/bsd/heimdal/dist/kadmin/cpw.c:130
#12 0x00000001d240ed3b in foreach_principal (exp_str=<optimized out>, 
func=func@entry=0x1d2409340 <do_cpw_entry>,
    funcname=funcname@entry=0x1d240f97c "cpw", 
data=data@entry=0x7f7fff434ca0)
    at /src/work/10/src/crypto/external/bsd/heimdal/dist/kadmin/util.c:626
#13 0x00000001d240966f in cpw_entry (opt=opt@entry=0x7f7fff434d70, 
argc=1, argv=0x7f11cb268bc8)
    at /src/work/10/src/crypto/external/bsd/heimdal/dist/kadmin/cpw.c:187
#14 0x00000001d2407703 in passwd_wrap (argc=<optimized out>, 
argv=0x7f11cb268bc0) at kadmin-commands.c:263
#15 0x00007f11ca401f48 in sl_command_loop (cmds=cmds@entry=0x1d2614d80 
<commands>,
    prompt=prompt@entry=0x1d2410ef8 "kadmin> ", data=data@entry=0x0)
    at /src/work/10/src/crypto/external/bsd/heimdal/dist/lib/sl/sl.c:333
#16 0x00000001d240f2a5 in main (argc=<optimized out>, argv=<optimized out>)
    at 
/src/work/10/src/crypto/external/bsd/heimdal/dist/kadmin/kadmin.c:290




as to the su issue, I think that is a separate problem related to 
revision 1.10 of pam_ksu.c.  If I revert that then su works.


cheers
mark