Ubuntu
libp11 package

libengine-pkcs11-openssl installs to wrong directory

Bug #1690287 reported by Luke Faraone
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
engine-pkcs11 (Ubuntu)
Won't Fix
Undecided
Luke Faraone
Ubuntu xenial-updates
libp11 (Debian)
Fix Released
Unknown
libp11 (Ubuntu)
Fix Released
High
Luke Faraone

Bug Description

With both libengine-pkcs11-openssl and openssl installed:

$ openssl engine pkcs11
139951744663256:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:187:filename(/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libpkcs11.so): /usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libpkcs11.so: cannot open shared object file: No such file or directory
139951744663256:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:233:
139951744663256:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:467:
139951744663256:error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:390:id=pkcs11

$ dpkg -L libssl1.0.0 | grep engine | head -n 1
/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines
$ dpkg -L libengine-pkcs11-openssl | grep engine | head -n 1
/usr/lib/x86_64-linux-gnu/openssl-1.0.2/engines

ProblemType: Bug
DistroRelease: Ubuntu 17.04
Package: libengine-pkcs11-openssl 0.4.4-1
ProcVersionSignature: Ubuntu 4.10.0-20.22-generic 4.10.8
Uname: Linux 4.10.0-20-generic x86_64
ApportVersion: 2.20.4-0ubuntu4
Architecture: amd64
CurrentDesktop: Unity:Unity7
Date: Thu May 11 20:04:09 2017
InstallationDate: Installed on 2017-04-09 (32 days ago)
InstallationMedia: Ubuntu 17.04 "Zesty Zapus" - Beta amd64 (20170321)
SourcePackage: libp11
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Luke Faraone (lfaraone) wrote :
Bug Watch Updater (bug-watch-updater)
Changed in libp11 (Debian):
status: Unknown → New
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Thanks Luke for making us aware!

Note/TL;DR: this is openssl 1.0/1.1 fallout, the Debian bug has much more history one it already and Luke is proposing a fix there which we should pick up into 17.04 then as well.

I could confirm this affecting all releases back to trusty which makes me wonder if I'm doing something wrong as I'm certainly no pkcs expert :-/
Need to be revisited once Debian acks on the fix - but to me atm it seems this never worked?! which makes it lower prio than it seems at first.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Older releases had that at least in a non version specific path, so with some hackery one could load it:

Trusty:
openssl engine dynamic -pre SO_PATH:/usr/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:opensc-pkcs11.so

On Artful that verion-free path is no more, but you can still go with a workaround like:
openssl engine dynamic -pre SO_PATH:/usr/lib/x86_64-linux-gnu/openssl-1.0.2/engines/pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:opensc-pkcs11.so

Which all does not mean it should not be fixed, I just wondered if that can be loaded at all.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Luke you assigned the Ubuntu portion to yourself - will you be driving this on the Ubuntu side as well?

Revision history for this message
Luke Faraone (lfaraone) wrote :

> Luke you assigned the Ubuntu portion to yourself - will you be driving this on the Ubuntu side as > well?

I'll need a sponsor (I'm in ~moto, not ~core-dev), but happy to.

Revision history for this message
Luke Faraone (lfaraone) wrote :

Source package was different in 16.04

Changed in engine-pkcs11 (Ubuntu):
milestone: none → xenial-updates
Revision history for this message
Luke Faraone (lfaraone) wrote :

I think there was a *brief* period where this worked correctly in the archive, insofar as the version of ``libengine-pkcs11-openssl`` in Yakkety, built against xenial libssl1.0.0, would've used the right path.

But you are right that this does not appear to ever actually worked in a stable Ubuntu release. I haven't checked lucid, though ;)

Revision history for this message
Luke Faraone (lfaraone) wrote :
Revision history for this message
Luke Faraone (lfaraone) wrote :
Changed in engine-pkcs11 (Ubuntu):
status: New → Triaged
assignee: nobody → Luke Faraone (lfaraone)
Ubuntu Foundations Team Bug Bot (crichton)
tags: added: patch
Bug Watch Updater (bug-watch-updater)
Changed in libp11 (Debian):
status: New → Fix Committed
Bug Watch Updater (bug-watch-updater)
Changed in libp11 (Debian):
status: Fix Committed → Fix Released
Christian Ehrhardt  (paelzer)
tags: added: server-next
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

I checked if I could help sponsoring that already - thanks Luke for all the work!
For engine-pkcs11 one has to realize that it was dropped in artful as it seems.
In that sense for he SRU "it is released" I'd think - at least when the other packages change are complete.

For libp11 it is clearer - but the fix for libp11 in Debian is still in experimental, I guess this might only resolve after the stretch release? Then it will be auto-synced into artful with the fix.
=> From there we have to check SRU'ability (issue is present back to Trusty)

@Luke - please let me know if I got that somehow wrong - or anything else than waiting the few days for Debian to act on and release that fix has to be done atm.

tags: removed: server-next
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Coming by checking bugs that were dormant an unexpected long time.

@Luke: Before doing anything wrong here I wanted to ask on an update of the latest status and next steps in your opinion?

Revision history for this message
Athos Ribeiro (athos-ribeiro) wrote :

libp11 has been fixed since 0.4.4-2. Therefore, the fix is available since bionic.

Since engine-pkcs11 is not available from bionic and on (series under standard support), I am marking it as wontfix.

Changed in engine-pkcs11 (Ubuntu):
status: Triaged → Won't Fix
Changed in libp11 (Ubuntu):
status: Triaged → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.