Bug 782

Summary: sudo: symbol lookup error: /usr/lib/sudo/system_group.so: undefined symbol: sudo_dso_findsym
Product: Sudo Reporter: Daniel H. <cmpxchg>
Component: SudoAssignee: Todd C. Miller <Todd.Miller>
Status: RESOLVED FIXED    
Severity: normal    
Priority: low    
Version: 1.8.10   
Hardware: PC   
OS: Linux   
Attachments: Link system_group.so with libsudo_util.la

Description Daniel H. 2017-04-06 14:16:46 MDT
I've found this symbol lookup error in the system_group.so

I thinks this is why :


1.) configure detects that the system is using dlopen

    /* Define to 1 if you have the `dlopen' function. */
    #define HAVE_DLOPEN 1

2.) as far as i see sudo_dso_findsym is only defined if
    the system us "shl_load" (HP-UX) 

    common/sudo_dso.c

    #if defined(HAVE_SHL_LOAD)
    ....
    void * sudo_dso_findsym(void *vhandle, const char *symbol)
    ...
   
    #elif defined(HAVE_DLOPEN)
    .....
    #endif

3.) looking at 
  
    plugins/sudoers/group_plugin.c

    #if defined(HAVE_DLOPEN) || defined(HAVE_SHL_LOAD)

    group_plugin = sudo_dso_findsym(group_handle, "group_plugin");
    if (group_plugin == NULL) {

If sudo_dso_findsym is only linked in ,if HAVE_SHL_LOAD is defined the the system_group.so fails an the result is :

nm plugins/system_group/.libs/system_group.so |grep dso_find
                 U sudo_dso_findsym

Configure string used to build sudo 

./configure \
    --libexecdir=/usr/lib/sudo \
    --docdir=/usr/share/doc \
    --with-noexec=/usr/lib/sudo/sudo_noexec.so \
    --with-pam \
    --with-ldap \
    --with-selinux \
    --with-linux-audit \
    --with-logfac=auth \
    --with-insults \
    --with-all-insults \
    --with-ignore-dot \
    --with-tty-tickets \
    --enable-shell-sets-home \
    --enable-warnings \
    --with-sendmail=/usr/sbin/sendmail \
    --with-sudoers-mode=0440 \
    --with-env-editor \
    --without-secure-path \
    --with-passprompt='%%p\x27s password:' \
    --with-rundir=/usr/lib/sudo \
    --with-sssd

CFLAGS="-O2 -g -m64 -fmessage-length=0 -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -Wall -fpie"
LDFLAGS="-pie"
Comment 1 Todd C. Miller 2017-04-06 15:26:38 MDT
sudo_dso_findsym is defined regardless of whether dlopen or shl_load is used. The problem is that system_group.so is not linked against libsudo_util.la and sudoers.so does not export sudo_dso_findsym itself.
Comment 2 Todd C. Miller 2017-04-06 15:28:22 MDT
Created attachment 490 [details]
Link system_group.so with libsudo_util.la

The attached patch will fix the unknown symbol.  Newer versions of sudo don't have this problem since libsudo_util.so is installed and sudoers.so is linked against it.
Comment 3 Todd C. Miller 2017-04-12 08:10:09 MDT
Fixed in newer versions of sudo.