This is a custom downstream RHEL 8 patch which rebuilds three

GLIBC_PRIVATE interfaces locally for use by libnss_files.so.2

and libnss_compat.so.2.

The shared objects needs the following 3 functions:

__nss_readline

__nss_parse_line_result

__nss_files_fopen (only requirement for libnss_compat.so.2)

They are implemented in:

nss/nss_parse_line_result.c

nss/nss_readline.c

nss/nss_files_fopen.c

We create wrappers for those functions, recompile, and link directly

into the shared objects:

nss/nss_parse_line_result_int.c

nss/nss_readline_int.c

nss/nss_files_fopen_int.c

After building the new shared objects there are no longer any undefined

global function references to __nss_readline@GLIBC_PRIVATE,

__nss_parse_line_result@GLIBC_PRIVATE or

__nss_files_fopen@GLIBC_PRIVATE.

Instead we see local function definitions in the shared object e.g.

Symbol table '.symtab' contains 628 entries:

...

   486: 0000000000008ce0    92 FUNC    LOCAL  DEFAULT   15 __nss_parse_line_result

...

   494: 0000000000008b70    72 FUNC    LOCAL  DEFAULT   15 __nss_readline_seek

...

   497: 0000000000008bc0   279 FUNC    LOCAL  DEFAULT   15 __nss_readline

...

   510: 0000000000008ce0    82 FUNC    LOCAL  DEFAULT   15 __nss_files_fopen

The remaining GLIBC_PRIVATE references in the shared objects are all

pre-existing and do not impact upgrade scenarios.

For reference the existing and present GLIBC_PRIVATE interfaces are:

__libc_alloc_buffer_alloc_array@@GLIBC_PRIVATE

__libc_alloc_buffer_copy_string@@GLIBC_PRIVATE

__libc_alloc_buffer_create_failure@@GLIBC_PRIVATE

__libc_dynarray_emplace_enlarge@@GLIBC_PRIVATE

__libc_scratch_buffer_grow@@GLIBC_PRIVATE

__resp@@GLIBC_PRIVATE

_nss_files_parse_grent@@GLIBC_PRIVATE

_nss_files_parse_pwent@@GLIBC_PRIVATE

_nss_files_parse_sgent@@GLIBC_PRIVATE

_nss_files_parse_spent@@GLIBC_PRIVATE

errno@@GLIBC_PRIVATE

__nss_database_lookup2@GLIBC_PRIVATE

__nss_lookup_function@GLIBC_PRIVATE

Each was checked for existence in libc.so.6.

A small reproducer was used in testing this patch, included here:

cat >> tst-rhbz1927040.c <

#include <stdio.h>

#include <stdlib.h>

#include <sys/types.h>

#include <errno.h>

#include <pwd.h>

#include <string.h>

int

main (void)

{

  struct passwd *res;

  /* Only lookup via files.  */

  printf ("INFO: Upgrade glibc, then press ENTER to see if libnss_files.so.2 loads.");

  getchar ();

  /* Try to get one entry.  */

  printf ("INFO: Looking up first password entry.\n");

  setpwent ();

  errno = 0;

  res = getpwent ();

  if (res == NULL && errno != 0)

    {

      printf ("FAIL: Could not get entry (%s).\n", strerror(errno));

      exit (1);

    }

  printf ("INFO: First entry passwd.pw_name = \"%s\"\n", res->pw_name);

  printf ("PASS: Call to getpwent succeeded.\n");

  endpwent ();

  exit (0);

}

EOF

Testing RHEL upgrade

from: glibc-2.28-127.el8_3.2

to: glibc-2.28-148.el8

./tst-rhbz1927040

INFO: Upgrade glibc, then press ENTER to see if libnss_files.so.2 loads.

INFO: Looking up first password entry.

INFO: Result was NULL.

PASS: Call to getpwent succeeded.

With LD_DEBUG=all you can observe:

     22697:     /lib64/libnss_files.so.2: error: symbol lookup error: undefined symbol: __nss_files_fopen, version GLIBC_PRIVATE (fatal)

Which is the indication that the upgrade caused the transient IdM lookup failure.

Running again succeeds:

INFO: Upgrade glibc, then press ENTER to see if libnss_files.so.2 loads.

INFO: Looking up first password entry.

INFO: First entry passwd.pw_name = "root"

PASS: Call to getpwent succeeded.

diff --git a/nss/Makefile b/nss/Makefile

index 7359da38feb65618..d5c28a6b5ed3661c 100644

--- a/nss/Makefile

+++ b/nss/Makefile

@@ -92,9 +92,19 @@ extra-libs-others	= $(extra-libs)

 subdir-dirs = $(services:%=nss_%)

 vpath %.c $(subdir-dirs) ../locale/programs ../intl

-

+# In RHEL we add nss_readline, nss_parse_line_result, and

+# nss_files_fopen to the libnss_files-routines in order to avoid the

+# case where a long running process (having never used NSS) attemps to

+# load an NSS module for the first time and that NSS module needs a

+# newer GLIBC_PRIVATE interface.  In effect we must make the NSS modules

+# self-sufficient and not rely on a GLIBC_PRIVATE interface.

+# See: https://bugzilla.redhat.com/show_bug.cgi?id=1927040

+# Note: We must recompile the objects to get the correct global symbol

+#       references, which is why we have the *_int.c wrappers.

 libnss_files-routines	:= $(addprefix files-,$(databases)) \

-			   files-initgroups files-init

+			   files-initgroups files-init \

+			   nss_readline_int nss_parse_line_result_int \

+			   nss_files_fopen_int

 libnss_db-dbs		:= $(addprefix db-,\

 				       $(filter-out hosts network key alias,\

@@ -104,8 +114,10 @@ libnss_db-routines	:= $(libnss_db-dbs) db-open db-init hash-string

 generated		+= $(filter-out db-alias.c db-netgrp.c, \

 					$(addsuffix .c,$(libnss_db-dbs)))

+# See note above regarding nss_files_fopen.

 libnss_compat-routines	:= $(addprefix compat-,grp pwd spwd initgroups) \

-			   nisdomain

+			   nisdomain \

+			   nss_files_fopen_int

 install-others		+= $(inst_vardbdir)/Makefile

diff --git a/nss/nss_files_fopen_int.c b/nss/nss_files_fopen_int.c

new file mode 100644

index 0000000000000000..fa518084fd609b52

--- /dev/null

+++ b/nss/nss_files_fopen_int.c

@@ -0,0 +1,3 @@

+/* Include a local internal copy of __nss_files_fopen to make the NSS

+   module self-contained.  */

+#include <nss_files_fopen.c>

diff --git a/nss/nss_parse_line_result_int.c b/nss/nss_parse_line_result_int.c

new file mode 100644

index 0000000000000000..bc0ee7a251743c9a

--- /dev/null

+++ b/nss/nss_parse_line_result_int.c

@@ -0,0 +1,3 @@

+/* Include a local internal copy of __nss_parse_line_result to make the

+   NSS module self-contained.  */

+#include <nss_parse_line_result.c>

diff --git a/nss/nss_readline_int.c b/nss/nss_readline_int.c

new file mode 100644

index 0000000000000000..0e7bd259733673c9

--- /dev/null

+++ b/nss/nss_readline_int.c

@@ -0,0 +1,3 @@

+/* Include a local internal copy of __nss_readline and

+   __nss_readline_seek to make the NSS module self-contained.  */

+#include <nss_readline.c>