php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #80756 Since glibc 2.33 NSS must be initialized before calling chroot(2)
Submitted: 2021-02-16 11:52 UTC Modified: 2021-03-03 08:25 UTC
From: dpa-bugs at aegee dot org Assigned:
Status: Not a bug Package: *General Issues
PHP Version: 7.3.27 OS: Linux from Scratch
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: dpa-bugs at aegee dot org
New email:
PHP Version: OS:

 

 [2021-02-16 11:52 UTC] dpa-bugs at aegee dot org
Description:
------------
I use php-fpm 7.3.25 .  For each user php-fpm.ini contains chroot= .  After I upgraded glbc 2.32 → 2.33 php started crashing like crazy, creating core dumps until it filled my entire disk.  I have not investigated the core dumps.  However, after the 2.32 → 2.33 upgrade openldap (which also runs in chroot) also stopped working.  Investigating the cause lead to the conclusion, that since glibc 2.33 chrooted programmes must first initiate NSS and then switch in the chrooted environment, as within the chrooted environment NSS cannot be initialized:

https://sourceware.org/bugzilla/show_bug.cgi?id=27077

In my particular example I had long time ago nscd long time ago running, then I disabled it and the system worked fine this way for many years.  Since the upgrade to glibc 2.33 I must run ncsd again and bind-mount /var/nscd/socket in the chroot(2)ed environment.  This makes php-fpm working again fine.

As outlined in the above PR, since glibc 2.33 NSS must be initialized before switching to chroot.  Please adjust php-fpm accordingly.


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-02-17 10:56 UTC] sjon@php.net
While this bugreport is correct, I'd wait for glibc to conclude their internal discussion, which might lead to them fixing it themselves:

https://sourceware.org/pipermail/libc-alpha/2021-February/122714.html
 [2021-03-03 08:25 UTC] sjon@php.net
-Status: Open +Status: Not a bug
 [2021-03-03 08:25 UTC] sjon@php.net
this change in glibc was reverted: https://sourceware.org/bugzilla/show_bug.cgi?id=27077#c8 which likely confirms the glibc change was considered a mistake

With this change included in newer glibc versions, PHP-FPM should continue to work like it previously did
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Fri Apr 16 15:01:24 2021 UTC