Bug #48732 for GSSAPI: look for krb5-config in /usr/kerberos/bin

Fri Aug 14 18:31:29 2009 MARKLE [...] cpan.org - Ticket created

Subject:

look for krb5-config in /usr/kerberos/bin

CentOS 5.3 krb5-workstation package installs krb5-* utils in /usr/kerberos/bin and /usr/kerberos/sbin, and adds the bin to the default PATH. As root I can use CPAN to build the package, but when I use `sudo perl -MCPAN -e shell` or sudo a script that uses CPAN directly, CPAN does not use my PATH or root's PATH, and it fails to find the config script. Is it safe to look for krb5-config in /usr/kerberos/bin if it does not find it in the available PATH?

Sat Aug 15 10:24:16 2009 achim [...] grolmsnet.de - Correspondence added

CC:	perlgssapi-developer [...] lists.sourceforge.net
Subject:	Re: [rt.cpan.org #48732] look for krb5-config in /usr/kerberos/bin
Date:	Sat, 15 Aug 2009 16:23:51 +0200
To:	bug-GSSAPI [...] rt.cpan.org, MARKLE [...] cpan.org
From:	Achim Grolms <achim [...] grolmsnet.de>

Hello Mark, if you run the the "perl Makefile.PL" in this way: perl Makefile.PL --gssapiimpl /usr/kerberos You can always specify the path where to look for krb5_config utility. (run "perl Makefile.PL --help" for all available options). In general the GSSAPI-Makefile.PL does not look into the PATH environment, it makes direct use of the systems /usr/bin/which for searching for krb5-config and it's path. From that point of view I suppose if you can make your sudo-toolchain properly run the "which krb5-config" the other parts will work fine. Does this help on your problem? Best Regards, Achim On Saturday 15 August 2009, Mark Hedges via RT wrote: Show quoted text

> Fri Aug 14 18:31:29 2009: Request 48732 was acted upon. > Transaction: Ticket created by MARKLE > Queue: GSSAPI > Subject: look for krb5-config in /usr/kerberos/bin > Broken in: 0.26 > Severity: (no value) > Owner: Nobody > Requestors: MARKLE@cpan.org > Status: new > Ticket <URL: https://rt.cpan.org/Ticket/Display.html?id=48732 > > > > CentOS 5.3 krb5-workstation package installs krb5-* utils in > /usr/kerberos/bin and /usr/kerberos/sbin, and adds the bin to the > default PATH. As root I can use CPAN to build the package, but when I > use `sudo perl -MCPAN -e shell` or sudo a script that uses CPAN > directly, CPAN does not use my PATH or root's PATH, and it fails to find > the config script. Is it safe to look for krb5-config in > /usr/kerberos/bin if it does not find it in the available PATH?

Sat Aug 15 10:24:17 2009 The RT System itself - Status changed from 'new' to 'open'

Sat Aug 15 14:35:47 2009 MARKLE [...] cpan.org - Correspondence added

I have no problem building the module manually. The problem is that I cannot build it with CPAN unless I log in as root. My system admin script has to set up and/or upgrade a large number of modules and I should be able to run it with sudo instead of logging in as root. It should not have to treat some modules specially, it just takes a list and installs them. I can build all other modules using CPAN with sudo unless they have bugs, but this one is broken because it does not look in the "system standard" place for `krb5-config`. I think it's considered a security risk to add PATH to env_keep in /etc/sudoers, and it is certainly not set up by default even on systems that do include a "Defaults env_keep" statement.

Sun Aug 16 18:20:28 2009 achim [...] grolmsnet.de - Correspondence added

CC:	perlgssapi-developer [...] lists.sourceforge.net
Subject:	Re: [rt.cpan.org #48732] look for krb5-config in /usr/kerberos/bin
Date:	Mon, 17 Aug 2009 00:20:05 +0200
To:	bug-GSSAPI [...] rt.cpan.org, MARKLE [...] cpan.org
From:	Achim Grolms <achim [...] grolmsnet.de>

On Saturday 15 August 2009, Mark Hedges via RT wrote: Show quoted text

> I can build all other modules using CPAN with sudo > unless they have bugs, but this one is broken because it does not look > in the "system standard" place for `krb5-config`.

Hello Mark, As far as I know there is no '"system standard" place for `krb5-config'. So the "which krb5-config"-way was choosed because this works on the most platforms, Kerberos-implementions (MIT, Heimdal, Sun) and conditions. The idea was to keep the Makefile.PL's complexity small. But you're correct, on the circumstances you describe the Makefile.PL behaves 'broken'. Your suggestion how Makefile.PL should additonally search the '"system standard" place for `krb5-config`' is... to test a given list of binaries. If I got the idea right that means maintaining a list of paths to search for the krb5-config binary within Makefile.PL? What's the output of perl -e "print $^O; " on your platform? (Sorry I can't provide a patch within the next days... you will get my answer at the end of this week) Best Regards, Achim

Mon Aug 17 12:53:33 2009 MARKLE [...] cpan.org - Correspondence added

Show quoted text

> perl -e "print $^O; "

It says "linux". This is CentOS 5.3. Which is, admittedly, full of problems and I would rather not use it. But I have to use it. So I appreciate your help if the build script can look through a list of other directories that would be awesome. Thanks. Mark

Tue Aug 18 15:59:34 2009 achim [...] grolmsnet.de - Correspondence added

CC:	perlgssapi-developer [...] lists.sourceforge.net
Subject:	Re: [rt.cpan.org #48732] look for krb5-config in /usr/kerberos/bin
Date:	Tue, 18 Aug 2009 21:59:08 +0200
To:	bug-GSSAPI [...] rt.cpan.org, MARKLE [...] cpan.org
From:	Achim Grolms <achim [...] grolmsnet.de>

On Monday 17 August 2009, Mark Hedges via RT wrote: Show quoted text

> So I appreciate your help if > the build script can look through a list of other directories that would > be awesome.

Hello Mark, I've modified the Makefile.PL as discussed. Find the new Makefile.PL attached to this email. Please check if the new Makefile.PL works within your toolchain. Please let me know if that works. Please let me know if there are any problems. Best Regards, Achim

Message body is not shown because sender requested not to inline it.

Tue Aug 18 16:34:42 2009 MARKLE [...] cpan.org - Correspondence added

nope... first I ran `sudo perl -MCPAN -e shell` with a clean CPAN config and did "install GSSAPI" to download and unpack. Got the previous error. Then I copied your Makefile.PL into the build directory, I added 'warn "HELLO\n"' at the top line to make sure I was running the right thing, and tried a "force make" to do the build the same unpacked directory again: cpan[8]> force make GSSAPI Going to read '/root/.cpan/sources/authors/01mailrc.txt.gz' ............................................................................DONE Going to read '/root/.cpan/sources/modules/02packages.details.txt.gz' Database was generated on Tue, 18 Aug 2009 10:27:04 GMT ............................................................................DONE Going to read '/root/.cpan/sources/modules/03modlist.data.gz' Unchanged. Going to write /root/.cpan/Metadata Running make for module 'GSSAPI' Running make for A/AG/AGROLMS/GSSAPI-0.26.tar.gz CPAN.pm: Going to build A/AG/AGROLMS/GSSAPI-0.26.tar.gz HELLO Welcome to GSSAPI.pm setup! run "perl Makefile.PL --help" to see further installation options ---------------------------------------------------------- Searching krb5-config command... not found! at Makefile.PL line 95. Warning: No success on command[/usr/bin/perl Makefile.PL] AGROLMS/GSSAPI-0.26.tar.gz /usr/bin/perl Makefile.PL -- NOT OK Failed during this command: AGROLMS/GSSAPI-0.26.tar.gz : writemakefile NO '/usr/bin/perl Makefile.PL' returned status 256

Tue Aug 18 17:46:49 2009 achim [...] grolmsnet.de - Correspondence added

CC:	perlgssapi-developer [...] lists.sourceforge.net
Subject:	Re: [rt.cpan.org #48732] look for krb5-config in /usr/kerberos/bin
Date:	Tue, 18 Aug 2009 23:46:22 +0200
To:	bug-GSSAPI [...] rt.cpan.org, MARKLE [...] cpan.org
From:	Achim Grolms <achim [...] grolmsnet.de>

On Tuesday 18 August 2009, Mark Hedges via RT wrote: Show quoted text

> Searching krb5-config command... not found! at Makefile.PL line 95. > Warning: No success on command[/usr/bin/perl Makefile.PL]

Hmm... maybe I did the testing the wrong way? 1. I've additionally added the Makefile.PL Version information to the Build output, thanks for the idea. 2. Find below the manual step-by-steps executed I have executed on my platform 3. Please check if this test steps work on your platform by manual executing 4. If they work... please let me know an idea what makes the difference between manual stepping and your build environment. Thank you! Best Regards, Achim achim@mjoelnir ~ $ uname Linux achim@mjoelnir ~/svn_gssapi/GSSAPI $unset PATH achim@mjoelnir ~/svn_gssapi/GSSAPI $ /usr/bin/perl Makefile.PL Welcome to GSSAPI.pm setup! (Makefile.PL Version 0.03) run "perl Makefile.PL --help" to see further installation options ---------------------------------------------------------- Searching krb5-config command... krb5-config NOT found in $PATH... now doing some guesswork: 1. trying /usr/kerberos/bin/krb5-config ...not found. 2. trying /usr/bin/krb5-config ...found. using krb5-config command '/usr/bin/krb5-config'. ---------------------------------------------------------- using GSSAPI implementation Kerberos 5 release 1.5.3 ---------------------------------------------------------- Adding from your Perlinstallation ($Config{lddlflags}) to LDDLFLAGS -shared -L/usr/local/lib ---------------------------------------------------------- Bypassing to LDDLFLAGS -shared -L/usr/local/lib -Wl,-rpath -Wl,/usr/lib ---------------------------------------------------------- Using LIBS -L/usr/lib -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err -lresolv -ldl ---------------------------------------------------------- Using INC includeconfiguration ---------------------------------------------------------- Writing Makefile for GSSAPI

Message body is not shown because sender requested not to inline it.

Sun Apr 25 06:49:08 2010 achim [...] grolmsnet.de - Correspondence added

CC:	bug-GSSAPI [...] rt.cpan.org
Subject:	Re: [rt.cpan.org #48732] look for krb5-config in /usr/kerberos/bin
Date:	Sun, 25 Apr 2010 12:48:52 +0200
To:	MARKLE [...] cpan.org
From:	Achim Grolms <achim [...] grolmsnet.de>

Dear Mark, Does GSSAPI 0.27 fix all problems described by your report? Is there anything open that needs to be fixed now? Thank you! Best Regards, Achim On Tuesday 18 August 2009, achim@grolmsnet.de via RT wrote: Show quoted text

> Queue: GSSAPI > Ticket <URL: http://rt.cpan.org/Ticket/Display.html?id=48732 > > > On Monday 17 August 2009, Mark Hedges via RT wrote:

> > So I appreciate your help if > > the build script can look through a list of other directories that would > > be awesome.

> > Hello Mark, > > I've modified the Makefile.PL as discussed. > Find the new Makefile.PL attached to this email. > > Please check if the new Makefile.PL works within your toolchain. > Please let me know if that works. > Please let me know if there are any problems. > > Best Regards, > Achim

Fri Mar 10 05:31:12 2017 NEILB [...] cpan.org - Correspondence added

Added this here in case anyone else hits this after googling for the error message. On CentOS 7.3 I had to do the following: yum -y install krb5-server krb5-libs krb5-devel Previously I just had to install the first 2 packages to get GSSAPI to install, but this time I needed krb5-devel, and then it installed just fine.

Fri Mar 10 13:06:44 2017 MARKLE [...] cpan.org - Correspondence added

I'm not at that job anymore. I cannot help diagnose. Thanks. -Mark