[Bug 1899103] Re: libpam-cap causes PAM applications to crash

[Dan Bungert]

** Changed in: libcap2 (Ubuntu)
   Importance: Undecided => Medium

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to libcap2 in Ubuntu.
https://bugs.launchpad.net/bugs/1899103

Title:
  libpam-cap causes PAM applications to crash

Status in libcap2 package in Ubuntu:
  Confirmed

Bug description:
  Install ocserv and setup for PAM authentication. On second connection,
  ocserv crashes due to a double free in PAM.

  Repro steps:
  1. Create Dockerfile that installs ocserv + libpam-cap
  ```
  FROM ubuntu:20.04

  RUN apt update && apt install -y ocserv libpam-cap && apt autoremove
  && apt clean

  COPY server-cert.pem /etc/ssl/ocserv_test.cert
  COPY server-key.pem /etc/ssl/ocserv_test.key
  COPY ca-cert.pem /etc/ssl/certs/ssl-cert-snakeoil.pem
  COPY ocserv.conf /etc/ocserv/ocserv.conf

  RUN useradd test
  RUN echo "test\ntest" | passwd test

  ENV MALLOC_CHECK_=3
  CMD ocserv -f -d 1
  ```

  2. Build container:
  ```
  sudo docker build -t ocserv:20.04 .
  ```

  3. Launch container:
  ```
  docker run -p 443:443/tcp -p 443:443/udp -it --rm --device /dev/net/tun --cap-add net_admin ocserv:20.04
  ```

  4. From another console, connect / disconnect:
  ```
  while true; do echo test | openconnect https://localhost -u test --passwd-on-stdin --servercert pin-sha256:qBLVTyoXiFdn+0pW+eSGqnVCEnMbLigVf5vAl1ZewW4= --background && sleep 2 && pkill openconnect && sleep 2;done
  ```

  5. ocserv crashes:
  free(): invalid pointer
  ocserv[8]: main: main-sec-mod-cmd.c:106: command socket for sec-mod closed
  ocserv[8]: main: main.c:1179: error in command from sec-mod
  ocserv[8]: main: termination request received; waiting for children to die

  For more details see:
  https://gitlab.com/openconnect/ocserv/-/issues/361

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libcap2/+bug/1899103/+subscriptions