pam_lastlog2.so uses pam_syslog() and other libpam symbols but the autotools build did not link the module against libpam. With the linker default of --as-needed, libpam was discarded and did not end up in the module's ELF NEEDED entries. The module then fails to load via dlopen() in processes that do not themselves link libpam (e.g. systemd on recent Fedora, or weston on journald-based systems without syslog):
PAM unable to dlopen(/usr/lib/security/pam_lastlog2.so): undefined symbol: pam_syslog PAM adding faulty module: /usr/lib/security/pam_lastlog2.so Backport the upstream fix (in 2.41.5) that moves -lpam into LIBADD so it is placed after the object files and retained as a NEEDED entry. Against 2.41.3 only the LIBADD line needs changing. [YOCTO #16320] Signed-off-by: Siva Balasubramanian <[email protected]> --- v2: - Preserve the upstream commit message verbatim in the backported patch and only append the backport info (Upstream-Status, dropped LDFLAGS hunk note), per review feedback from Yoann Congal. - Point Upstream-Status at the util-linux master commit 5683ed6320e00205146cbb3d0c76462733530eca (PR #4358). It is also in the v2.41 stable branch as c8d0af0421f6 (released in 2.41.5) and is already present in 2.42.x, so this backport targets the wrynose branch (still on util-linux 2.41.3). - Retag the subject for the wrynose branch. meta/recipes-core/util-linux/util-linux.inc | 1 + ...ix-libpam-linking-in-autotools-build.patch | 43 +++++++++++++++++++ 2 files changed, 44 insertions(+) create mode 100644 meta/recipes-core/util-linux/util-linux/0001-pam_lastlog2-fix-libpam-linking-in-autotools-build.patch diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc index 0235862666..3cdc1e2c0f 100644 --- a/meta/recipes-core/util-linux/util-linux.inc +++ b/meta/recipes-core/util-linux/util-linux.inc @@ -21,6 +21,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin file://0001-ts-kill-decode-use-RTMIN-from-kill-L-instead-of-hard.patch \ file://0001-tests-script-Disable-size-option-test.patch \ file://0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch \ + file://0001-pam_lastlog2-fix-libpam-linking-in-autotools-build.patch \ " SRC_URI[sha256sum] = "3330d873f0fceb5560b89a7dc14e4f3288bbd880e96903ed9b50ec2b5799e58b" diff --git a/meta/recipes-core/util-linux/util-linux/0001-pam_lastlog2-fix-libpam-linking-in-autotools-build.patch b/meta/recipes-core/util-linux/util-linux/0001-pam_lastlog2-fix-libpam-linking-in-autotools-build.patch new file mode 100644 index 0000000000..90532dde7a --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/0001-pam_lastlog2-fix-libpam-linking-in-autotools-build.patch @@ -0,0 +1,43 @@ +From 5683ed6320e00205146cbb3d0c76462733530eca Mon Sep 17 00:00:00 2001 +From: Karel Zak <[email protected]> +Date: Tue, 19 May 2026 10:54:57 +0200 +Subject: [PATCH] pam_lastlog2: fix libpam linking in autotools build + +Move -lpam from LDFLAGS to LIBADD. When -lpam is in LDFLAGS it +appears on the linker command line before object files, so the +--as-needed linker flag (default on Fedora) discards it before +seeing any undefined PAM symbols. This results in pam_lastlog2.so +missing libpam.so in its ELF NEEDED entries. + +The module then fails to load with dlopen() if the calling process +does not itself link against libpam (e.g., systemd in Fedora 44+): + + PAM unable to dlopen(pam_lastlog2.so): undefined symbol: pam_syslog + +Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2453457 +Signed-off-by: Karel Zak <[email protected]> + +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/5683ed6320e00205146cbb3d0c76462733530eca] +[Dropped the LDFLAGS hunk: the -lpam in LDFLAGS was introduced upstream + after 2.41.3 and is not present in this tree, so only the LIBADD hunk + applies here.] +Signed-off-by: Siva Balasubramanian <[email protected]> +--- + pam_lastlog2/src/Makemodule.am | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/pam_lastlog2/src/Makemodule.am b/pam_lastlog2/src/Makemodule.am +index 40d597c58..876171e9f 100644 +--- a/pam_lastlog2/src/Makemodule.am ++++ b/pam_lastlog2/src/Makemodule.am +@@ -11,7 +11,7 @@ pam_lastlog2_la_CFLAGS = \ + $(SOLIB_CFLAGS) \ + -I$(ul_liblastlog2_incdir) + +-pam_lastlog2_la_LIBADD = liblastlog2.la ++pam_lastlog2_la_LIBADD = liblastlog2.la -lpam + + pam_lastlog2_la_LDFLAGS = $(SOLIB_LDFLAGS) -module -avoid-version -shared + if HAVE_VSCRIPT +-- +2.43.0 -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240214): https://lists.openembedded.org/g/openembedded-core/message/240214 Mute This Topic: https://lists.openembedded.org/mt/120135828/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
