[1553] in athena10
Re: [Debathena] #136: Can we use pam-afs-session?
daemon@ATHENA.MIT.EDU (Debathena Trac)
Thu Mar 12 02:30:07 2009
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
From: "Debathena Trac" <debathena@MIT.EDU>
Cc: debathena@mit.edu
To: broder@mit.edu, nelhage@mit.edu, price@mit.edu
Date: Thu, 12 Mar 2009 06:29:53 -0000
Reply-To:
Message-ID: <052.d475c7cf870524bd1d3d116ca11eef20@mit.edu>
In-Reply-To: <043.be52c0d8d2d379770e278c4319337a9d@mit.edu>
Content-Transfer-Encoding: 8bit
#136: Can we use pam-afs-session?------------------------+---------------------------------------------------
Reporter: broder | Owner:
Type: enhancement | Status: new
Priority: minor | Resolution:
Keywords: |
------------------------+---------------------------------------------------
Comment(by broder):
So the issue was more complex than I understood it to be (this is what you
get for letting me try to decipher issues in C, guys). Turns out it's a
race.
pam_afs_session forks and execs aklog, then the parent process uses
waitpid() to pause until the aklog returns.
If GDM (or whatever is calling into PAM) sets a SIGCHLD handler that's not
SIG_DFL, and aklog returns before waitpid is called, then waitpid either
returns with ECHILD or hangs forever waiting for other children.
The relevant code snippets from pam_athena_locker are:
{{{
struct sigaction act, oldact;
/* Override gdm's SIGCHLD handler that makes waitpid() return -1.
Maybe this leads to some race condition if gdm used that at the
time? */
memset(&act, 0, sizeof(act));
act.sa_handler = SIG_DFL;
sigaction(SIGCHLD, &act, &oldact);
}}}
before the fork, and
{{{
sigaction(SIGCHLD, &oldact, NULL);
}}}
after the waitpid.
Because of both this bug, and the fact that Dapper and Etch don't have a
libpam-afs-session at all, we'll have to build our own packages of the
latest version if we want to switch to this.
The next step, then, is to come up with a patch which does the equivalent
of the code above (possibly with a little more error handling?) and get it
to Russ.
If you want to test that your patch eliminates the race condition, set the
aklog command to /bin/true and sleep for a few seconds before calling
waitpid.
-- Ticket URL: <http://debathena.mit.edu/trac/ticket/136#comment:5>Debathena <http://debathena.mit.edu/>MIT Debian-Athena Project
