FS#58601 - [dovecot] [postgresql-libs] dovecot/auth: error while loading shared libraries: liblber-2.4.so.2

Attached to Project: Community Packages
Opened by uu5dgyj (uu5dgyj) - Tuesday, 15 May 2018, 07:36 GMT
Last edited by Thore Bödecker (foxxx0) - Friday, 06 July 2018, 11:09 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Dan McGee (toofishes)
Johannes Löthberg (demize)
Levente Polyak (anthraxx)
Thore Bödecker (foxxx0)
Architecture x86_64
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 1
Private No

Details

Description:

Dovecot fails to authenticate client connections, see full error below.

The shared library triggering this error belongs to libldap. However, I do not have a LDAP configuration. I use auth-passwdfile.conf.ext only, while auth-ldap.conf.ext is disabled. It still appears to load the library.

As a consequence dovecot_delivery appears to be broken too. All incoming mails queue up in exim because dovecot_delivery fails with exit code 75.


Additional info:
* dovecot 2.3.1-2
* libldap 2.4.46-1
* linux-4.14.12-1, linux-4.16.3, linux-4.18.1

* full error from journalctl -u dovecot

===
May 15 07:53:04 emerald dovecot[282]: auth: Error: dovecot/auth: error while loading shared libraries: liblber-2.4.so.2: failed to map segment from shared obj>
May 15 07:53:04 emerald dovecot[220]: master: Error: service(auth): command startup failed, throttling for 32 secs
May 15 07:53:04 emerald dovecot[282]: auth: Fatal: master: service(auth): child 5513 returned error 127
May 15 07:53:04 emerald dovecot[282]: imap-login: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=127.0.0.>
May 15 07:53:04 emerald dovecot[282]: imap-login: Warning: Timeout leak: 0x7f9f43694600 (auth-server-connection.c:397)
===


Steps to reproduce:

Connect to dovecot using a IMAP client. It fails to login and journalctl on the server will show the error.

Othet than that I do not know what produced the condition. It happens since May 11th. But I do not see updates of libldap or dovecot on that day.


Steps attempted to solve it:


On May 11th a reboot loaded a new kernel, but I think I ruled that out by trying the three kernels listed above.

Regarding the shared library error I found old bugs, where this was caused by filesystems mounted with "noexec", especially /tmp. I do not see this. But /tmp is tmpfs nowadays.
This task depends upon

Closed by  Thore Bödecker (foxxx0)
Friday, 06 July 2018, 11:09 GMT
Reason for closing:  Not a bug
Additional comments about closing:  user configuration error
Comment by Pascal Ernster (hardfalcon) - Tuesday, 15 May 2018, 10:01 GMT
I can confirm this, seeing exactly the same on one of my machines.

//EDIT: In case it matters: I use the testing repositories on that machine. Rollback to non-testing packages didn't solve the problem, though.
Comment by Pascal Ernster (hardfalcon) - Wednesday, 16 May 2018, 15:04 GMT
This seems to be caused by postgresql-libs 10.4 (both the versions from testing and from extra trigger the problem on my machine).

Rollback to postgresql-libs 10.3-1 solves the issue (but that isn't a permament solution, of course).
Comment by uu5dgyj (uu5dgyj) - Wednesday, 16 May 2018, 19:52 GMT
Can confirm that rolling back to postgresql-libs 10.3-1 quickfixes it.

whats the connection?

knowing that, I see /usr/lib/dovecot/auth is linked with /usr/lib/libpq.so.5

but the error shows a problem with /usr/lib/liblber-2.4.so.2

neither /usr/lib/dovecot/auth nor /usr/lib/libpq.so.5 are linked to liblber-2.4.so.2

there is no postgres used in my dovecot setup and not on that machine at all.
Comment by Thore Bödecker (foxxx0) - Tuesday, 03 July 2018, 07:07 GMT
Could you re-try with the current dovecot 2.3.2-1 in the repository?
Comment by Pascal Ernster (hardfalcon) - Tuesday, 03 July 2018, 09:16 GMT
Yes, the issue still occurs with all packages updated to the latest version from today, even with the testing repos enabled. Reinstalling postgresql-libs 10.3-1 still fixes the issue.

Comment by Thore Bödecker (foxxx0) - Tuesday, 03 July 2018, 09:23 GMT
Can you please provide the output of "doveconf -n"?

I'm running 2.3.2-1 with postgres 10.4-3 just fine without issues here.
To further investigate I need some more details about your specific setup.
Comment by Pascal Ernster (hardfalcon) - Tuesday, 03 July 2018, 09:39 GMT
I've sent you an email.
Comment by Thore Bödecker (foxxx0) - Friday, 06 July 2018, 09:35 GMT
I was able to reproduce the issue in a clean Arch Linux VM using the provided doveconf -n output.

Trying to find the root cause, stay tuned...
Comment by Levente Polyak (anthraxx) - Friday, 06 July 2018, 10:12 GMT
You can attach the output as file, pretty useless to be assigned to a ticket where important output it sent to a single person via email
Comment by Thore Bödecker (foxxx0) - Friday, 06 July 2018, 10:28 GMT
The original requestor asked me in his mail to not distribute his doveconf -n output.

The attached files/outputs of this post contain clean/sanitized versions with no sensitive information of the original requestor.
Comment by Thore Bödecker (foxxx0) - Friday, 06 July 2018, 10:29 GMT
I have tracked it down to an ENOMEM error when trying to mmap() the liblber and am now in contact with upstream to find the cause.
Comment by Levente Polyak (anthraxx) - Friday, 06 July 2018, 10:30 GMT
try increase vsz_limit and set login_process_size = 128
Comment by Pascal Ernster (hardfalcon) - Friday, 06 July 2018, 11:04 GMT
Thanks for the hint, increasing all instances of vsz_limit from 64M to 128M in dovecot.conf fixed the issue for me.
Comment by Thore Bödecker (foxxx0) - Friday, 06 July 2018, 11:09 GMT
This is fixed by simply removing all occurances of vsz_limit, which is best practice in "normal" use cases anyway, according to: https://wiki.dovecot.org/LoginProcess

Loading...