php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #80756 Since glibc 2.33 NSS must be initialized before calling chroot(2)
Submitted: 2021-02-16 11:52 UTC Modified: 2021-03-03 08:25 UTC
From: dpa-bugs at aegee dot org Assigned:
Status: Not a bug Package: *General Issues
PHP Version: 7.3.27 OS: Linux from Scratch
Private report: No CVE-ID: None
 [2021-02-16 11:52 UTC] dpa-bugs at aegee dot org
Description:
------------
I use php-fpm 7.3.25 .  For each user php-fpm.ini contains chroot= .  After I upgraded glbc 2.32 → 2.33 php started crashing like crazy, creating core dumps until it filled my entire disk.  I have not investigated the core dumps.  However, after the 2.32 → 2.33 upgrade openldap (which also runs in chroot) also stopped working.  Investigating the cause lead to the conclusion, that since glibc 2.33 chrooted programmes must first initiate NSS and then switch in the chrooted environment, as within the chrooted environment NSS cannot be initialized:

https://sourceware.org/bugzilla/show_bug.cgi?id=27077

In my particular example I had long time ago nscd long time ago running, then I disabled it and the system worked fine this way for many years.  Since the upgrade to glibc 2.33 I must run ncsd again and bind-mount /var/nscd/socket in the chroot(2)ed environment.  This makes php-fpm working again fine.

As outlined in the above PR, since glibc 2.33 NSS must be initialized before switching to chroot.  Please adjust php-fpm accordingly.


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-02-17 10:56 UTC] sjon@php.net
While this bugreport is correct, I'd wait for glibc to conclude their internal discussion, which might lead to them fixing it themselves:

https://sourceware.org/pipermail/libc-alpha/2021-February/122714.html
 [2021-03-03 08:25 UTC] sjon@php.net
-Status: Open +Status: Not a bug
 [2021-03-03 08:25 UTC] sjon@php.net
this change in glibc was reverted: https://sourceware.org/bugzilla/show_bug.cgi?id=27077#c8 which likely confirms the glibc change was considered a mistake

With this change included in newer glibc versions, PHP-FPM should continue to work like it previously did
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Dec 21 13:01:31 2024 UTC