Re: [OE-core][wrynose][PATCH v2] util-linux: backport pam_lastlog2 libpam linking fix

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Jul 6, 2026 at 8:30 AM CEST, Siva Balasubramanian wrote:
> pam_lastlog2.so uses pam_syslog() and other libpam symbols but the
> autotools build did not link the module against libpam. With the
> linker default of --as-needed, libpam was discarded and did not end
> up in the module's ELF NEEDED entries. The module then fails to load
> via dlopen() in processes that do not themselves link libpam (e.g.
> systemd on recent Fedora, or weston on journald-based systems without
> syslog):
>
>   PAM unable to dlopen(/usr/lib/security/pam_lastlog2.so): undefined symbol: pam_syslog
>   PAM adding faulty module: /usr/lib/security/pam_lastlog2.so
>
> Backport the upstream fix (in 2.41.5) that moves -lpam into LIBADD so
> it is placed after the object files and retained as a NEEDED entry.
> Against 2.41.3 only the LIBADD line needs changing.

Hello,

I quickly looked at util-linux v2.41.5 and it look like we can upgrade
instead of backporting:
https://github.com/util-linux/util-linux/compare/v2.41.3...v2.41.5

Could you check and, if you think that the upgrade complies with the
stable policy, send the upgrade?

Thanks!

>
> [YOCTO #16320]
>
> Signed-off-by: Siva Balasubramanian <sivakumar.bs@gmail.com>
> ---
> v2:
>  - Preserve the upstream commit message verbatim in the backported
>    patch and only append the backport info (Upstream-Status, dropped
>    LDFLAGS hunk note), per review feedback from Yoann Congal.
>  - Point Upstream-Status at the util-linux master commit
>    5683ed6320e00205146cbb3d0c76462733530eca (PR #4358). It is also in
>    the v2.41 stable branch as c8d0af0421f6 (released in 2.41.5) and is
>    already present in 2.42.x, so this backport targets the wrynose
>    branch (still on util-linux 2.41.3).
>  - Retag the subject for the wrynose branch.
>
>  meta/recipes-core/util-linux/util-linux.inc   |  1 +
>  ...ix-libpam-linking-in-autotools-build.patch | 43 +++++++++++++++++++
>  2 files changed, 44 insertions(+)
>  create mode 100644 meta/recipes-core/util-linux/util-linux/0001-pam_lastlog2-fix-libpam-linking-in-autotools-build.patch
>
> diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
> index 0235862666..3cdc1e2c0f 100644
> --- a/meta/recipes-core/util-linux/util-linux.inc
> +++ b/meta/recipes-core/util-linux/util-linux.inc
> @@ -21,6 +21,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
>             file://0001-ts-kill-decode-use-RTMIN-from-kill-L-instead-of-hard.patch \
>             file://0001-tests-script-Disable-size-option-test.patch \
>             file://0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch \
> +           file://0001-pam_lastlog2-fix-libpam-linking-in-autotools-build.patch \
>             "
>  
>  SRC_URI[sha256sum] = "3330d873f0fceb5560b89a7dc14e4f3288bbd880e96903ed9b50ec2b5799e58b"
> diff --git a/meta/recipes-core/util-linux/util-linux/0001-pam_lastlog2-fix-libpam-linking-in-autotools-build.patch b/meta/recipes-core/util-linux/util-linux/0001-pam_lastlog2-fix-libpam-linking-in-autotools-build.patch
> new file mode 100644
> index 0000000000..90532dde7a
> --- /dev/null
> +++ b/meta/recipes-core/util-linux/util-linux/0001-pam_lastlog2-fix-libpam-linking-in-autotools-build.patch
> @@ -0,0 +1,43 @@
> +From 5683ed6320e00205146cbb3d0c76462733530eca Mon Sep 17 00:00:00 2001
> +From: Karel Zak <kzak@redhat.com>
> +Date: Tue, 19 May 2026 10:54:57 +0200
> +Subject: [PATCH] pam_lastlog2: fix libpam linking in autotools build
> +
> +Move -lpam from LDFLAGS to LIBADD. When -lpam is in LDFLAGS it
> +appears on the linker command line before object files, so the
> +--as-needed linker flag (default on Fedora) discards it before
> +seeing any undefined PAM symbols. This results in pam_lastlog2.so
> +missing libpam.so in its ELF NEEDED entries.
> +
> +The module then fails to load with dlopen() if the calling process
> +does not itself link against libpam (e.g., systemd in Fedora 44+):
> +
> +  PAM unable to dlopen(pam_lastlog2.so): undefined symbol: pam_syslog
> +
> +Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2453457
> +Signed-off-by: Karel Zak <kzak@redhat.com>
> +
> +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/5683ed6320e00205146cbb3d0c76462733530eca]
> +[Dropped the LDFLAGS hunk: the -lpam in LDFLAGS was introduced upstream
> + after 2.41.3 and is not present in this tree, so only the LIBADD hunk
> + applies here.]
> +Signed-off-by: Siva Balasubramanian <sivakumar.bs@gmail.com>
> +---
> + pam_lastlog2/src/Makemodule.am | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/pam_lastlog2/src/Makemodule.am b/pam_lastlog2/src/Makemodule.am
> +index 40d597c58..876171e9f 100644
> +--- a/pam_lastlog2/src/Makemodule.am
> ++++ b/pam_lastlog2/src/Makemodule.am
> +@@ -11,7 +11,7 @@ pam_lastlog2_la_CFLAGS = \
> + 	 $(SOLIB_CFLAGS) \
> + 	 -I$(ul_liblastlog2_incdir)
> +
> +-pam_lastlog2_la_LIBADD = liblastlog2.la
> ++pam_lastlog2_la_LIBADD = liblastlog2.la -lpam
> +
> + pam_lastlog2_la_LDFLAGS = $(SOLIB_LDFLAGS) -module -avoid-version -shared
> + if HAVE_VSCRIPT
> +--
> +2.43.0


-- 
Yoann Congal
Smile ECS