SOLVED: 2.2.1 Upgrade breaks sudo

vajonam

sorry I should have added sudo works when run as root, but not when run as normal user.

phil.davis

I installed sudo package, like I normally do, then login as myself (that is in the admin group) and try to do my normal sudo to become root:

[2.2.1-RELEASE][admin.phil@x.y.z.org]/home/admin.phil: sudo -s
Shared object "libintl.so.9" not found, required by "sudo"
[2.2.1-RELEASE][admin.phil@x.y.z.org]/home/admin.phil:

Whatever the detail of the lib so stuff, it does not work.
Tested on APU 4GB amd64 nanoBSD and Alix 2D13 2GB 32bit nanoBSD

vajonam

@phil.davis:

Whatever the detail of the lib so stuff, it does not work.
Tested on APU 4GB amd64 nanoBSD and Alix 2D13 2GB 32bit nanoBSD

Thanks for confirming.

doktornotor

Executive summary: PBI == useless POS.

vajonam

suspect this has something to do with the right permissions not being available. this is in the system log

 The command '/usr/sbin/pw groupadd admins -g 1999 -M '2000,2001' 2>&1' returned exit code '67', the output was 'pw: user `2000' does not exist'

the admins group is not being created.

phil.davis

@vajonam:

suspect this has something to do with the right permissions not being available. this is in the system log
 The command '/usr/sbin/pw groupadd admins -g 1999 -M '2000,2001' 2>&1' returned exit code '67', the output was 'pw: user `2000' does not exist'
the admins group is not being created.

The cause seems to be that the code tries to add group membership before adding the actual user. This fixes it for me:
https://github.com/pfsense/pfsense/pull/1571

It does not help the sudo lib so problem though. But at least it clears up some system log noise and lets you create a user and put them in a group in one action.

vajonam

@phil.davis:

It does not help the sudo lib so problem though. But at least it clears up some system log noise and lets you create a user and put them in a group in one action.

yeah i sort of did the same thing and it seems to have fixed the groups and users , but just like you the sudo problem still exists. does sudo work for you as root? the fact that it works as root seems to point to some other groups its not a part of.

even as root I cannot sudo some simple commands, something is really broken w/ sudo


[2.2.1-RELEASE][admin@x.y.com]/etc: sudo /usr/local/sbin/pftop 
sudo: /usr/local/sbin/pftop: command not found

can assure you that command exists.

phil.davis

nrpe package is also giving this:

[2.2.1-RELEASE][admin@bast.int.unixathome.org]/root: /usr/pbi/nrpe-amd64/local/libexec/nagios/check_tcp -H bast.int.unixathome.org -p 9102
Shared object "libintl.so.9" not found, required by "check_tcp"

Ref: https://forum.pfsense.org/index.php?topic=90704.0
So sudo is not the only problem child package utility here.

vajonam

can fix the sudo problem my linking by hand

ln -s /usr/pbi/sudo-amd64/lib/libintl.so.9 /usr/local/lib

stuff works then. not sure what happened to these links. i dont know enough about how an execute inside a pbi is jailed to its own env in *bsd.

EDIT:
Maybe to force a rebuild of the ldconfig caches?

doktornotor

@vajonam:

can fix the sudo problem my linking by hand
ln -s /usr/pbi/sudo-amd64/lib/libintl.so.9 /usr/local/lib
stuff works then. not sure what happened to these links. i dont know enough about how an execute inside a pbi is jailed to its own env in *bsd.

EDIT:
Maybe to force a rebuild of the ldconfig caches?

sudo drops the envvars on its own in the first place… Other than that, you do NOT have libintl.so.9 inside /usr/pbi/sudo-amd64/lib? Perhaps, my suggestion to anyone here would be to uninstall the pbi nonsense and install sudo via pkg.

vajonam

@doktornotor:

sudo drops the envvars on its own in the first place… Other than that, you do NOT have libintl.so.9 inside /usr/pbi/sudo-amd64/lib? Perhaps, my suggestion to anyone here would be to uninstall the pbi nonsense and install sudo via pkg.

think there was a typo, but I do have the required libs in /usr/pbi/sudo-amd64/lib

re: you suggestion to move to pkg vs pbi, I can do that, but I am running on 4g NanoBSD image, how will this work the space constrains, last time I tried something I ran out of /var space, I guess I can increase that. will pkg work with the NanoBSD images as well?

doktornotor

@vajonam:

think there was a typo, but I do have the required libs in /usr/pbi/sudo-amd64/lib

I totally do not understand your fix in that case.

P.S. No idea about pkg on nanobsd.

vajonam

file exists under /urs/pbi/sudo-amd64/lib, I am cerating a link TO that file in the /usr/local/lib folder so it know to find it where its looking, for whatever reason sudo doesn't look in its own lib folders first

ln -s SOURCE TARGET

doktornotor

So you do not have that under /usr/local/lib?


$ ls -l /usr/local/lib/libintl.*
-rw-r--r--  1 root  wheel  57216 Aug 26  2013 /usr/local/lib/libintl.a
-rw-r--r--  1 root  wheel    972 Aug 26  2013 /usr/local/lib/libintl.la
lrwxr-xr-x  1 root  wheel     12 Sep  6  2013 /usr/local/lib/libintl.so -> libintl.so.9
-rw-r--r--  1 root  wheel  45501 Mar 13 14:49 /usr/local/lib/libintl.so.8
-rw-r--r--  1 root  wheel  45351 Feb 28 13:18 /usr/local/lib/libintl.so.9

Dunno guys what's up with your boxes.

jimp

sudo seems fine for me on My APU (Full install, amd64), though ALIX (NanoBSD, i386) does show the issue.

I recompiled the package since there was an update to sudo anyhow, it should show up in 15-30 mins or so, give it another try then.

Is everyone with this problem running NanoBSD? Or i386? There must be some common factor.

vajonam

@jimp:

sudo seems fine for me on My APU (Full install, amd64), though ALIX (NanoBSD, i386) does show the issue.

I recompiled the package since there was an update to sudo anyhow, it should show up in 15-30 mins or so, give it another try then.

Is everyone with this problem running NanoBSD? Or i386? There must be some common factor.

I am on NanoBSD AMD64, on APU1D4.

doktornotor

@jimp:

Is everyone with this problem running NanoBSD? Or i386? There must be some common factor.

I can see pretty much everyone here with the issue being on amd64, except Phil who reproduced it on i386 as well.

(The common factor seems to be the PBI hardlinking clusterfuck, frankly…)

vajonam

@doktornotor:

(The common factor seems to be the PBI hardlinking clusterfuck, frankly…)

:-)

apart from the PBI :-), the common factor is also NanoBSD, i think. jimp can you tell me if I should have libintl.so.9 lib in my default image? I didn't think so.

kejianshi

I'm offended by the term "PBI"

jimp

The same binaries work on 2.2 but not 2.2.1 so there must be something that changed there.

So far I can only reproduce it on NanoBSD/i386 but I don't have an amd64 NanoBSD install handy to test.

On my full install I have a libintl.so.9 in /usr/local/lib/ dated Janurary (~2.2-RELEASE time) and it's not on i386.

On your NanoBSD install, check the old slice:

: mount -t ufs /dev/ufs/pfsense1 /mnt
: ls -l /mnt/usr/local/lib/libintl*

or use pfsense0 if that was your previous slice.

The card I'm using started on 2.2.1 snapshots so I can't test that particular case quickly.