Problem building an API program against 1.4.1 - Kerberos

This is a discussion on Problem building an API program against 1.4.1 - Kerberos ; -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I just installed krb5-1.4.1 on my FreeBSD machine. (I had to turn off pthread support, otherwise kinit and kadmin fail). As far as I can tell, the MIT Kerberos stuff works. However, after compiling ...

+ Reply to Thread
Results 1 to 13 of 13

Thread: Problem building an API program against 1.4.1

  1. Problem building an API program against 1.4.1

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    I just installed krb5-1.4.1 on my FreeBSD machine. (I had to turn off
    pthread support, otherwise kinit and kadmin fail).

    As far as I can tell, the MIT Kerberos stuff works. However, after
    compiling one of my own programs that uses the MIT K5 API (and which I've
    been running, mostly on Solaris systems, for years), I get this message at
    runtime (the program is called krb5ver):

    /libexec/ld-elf.so.1: Shared object "libk5crypto.so" not found,
    required by "krb5ver"

    But when I look in /usr/local/kerberos/lib, I do see libk5crypto.so as a
    symlink to libk5crypto.so.3, which does exist in the same directory.

    Here's the Makefile I use to build my program:

    - ---------------------------------------------------------------------------------------
    krb5ver:
    gcc -Wall -c -I/usr/local/kerberos/include krb5ver.c
    gcc -o krb5ver krb5ver.o -L/usr/local/kerberos/lib -lk5crypto -lkrb5 -lcom_err
    - ---------------------------------------------------------------------------------------

    I don't know if this problem represents a difference just for FreeBSD (vs
    Solaris), because I haven't yet tried compiling 1.4.1 on Solaris. Or
    whether it has something to do with the fact that the default for 1.4.1 is
    to build with shared libraries (I've always done static builds on Solaris
    with prior releases). If it's the latter, does this mean I need to do
    something different in the Makefile (shown above) that I'm using to build
    my own program?

    More likely, I suspect, it's something else I'm overlooking completely.

    I'd appreciate any suggestions.

    Mike

    __________________________________________________ ___________________
    Mike Friedman System and Network Security
    mikef@ack.Berkeley.EDU 2484 Shattuck Avenue
    1-510-642-1410 University of California at Berkeley
    http://ack.Berkeley.EDU/~mikef http://security.berkeley.edu
    __________________________________________________ ___________________

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 6.5.8

    iQA/AwUBQuz/H60bf1iNr4mCEQKqSgCgsafbbWq1zJbfcHRq+0/jraZeARAAnRlT
    yvKdru8wq2bx/MkbZsCowz7w
    =hEe+
    -----END PGP SIGNATURE-----
    ________________________________________________
    Kerberos mailing list Kerberos@mit.edu
    https://mailman.mit.edu/mailman/listinfo/kerberos


  2. Re: Problem building an API program against 1.4.1

    Mike Friedman writes:

    > As far as I can tell, the MIT Kerberos stuff works. However, after
    > compiling one of my own programs that uses the MIT K5 API (and which
    > I've been running, mostly on Solaris systems, for years), I get this
    > message at runtime (the program is called krb5ver):


    > /libexec/ld-elf.so.1: Shared object "libk5crypto.so" not found,
    > required by "krb5ver"


    > But when I look in /usr/local/kerberos/lib, I do see libk5crypto.so as a
    > symlink to libk5crypto.so.3, which does exist in the same directory.


    > Here's the Makefile I use to build my program:


    > krb5ver:
    > gcc -Wall -c -I/usr/local/kerberos/include krb5ver.c
    > gcc -o krb5ver krb5ver.o -L/usr/local/kerberos/lib -lk5crypto -lkrb5 -lcom_err


    If you install libraries in a non-standard location that the dynamic
    linker doesn't know about, you have to encode the path to the libraries
    into the binary. Adding -R/usr/local/kerberos/lib will probably fix the
    problem.

    --
    Russ Allbery (rra@stanford.edu)

  3. Re: Problem building an API program against 1.4.1

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    On Sun, 31 Jul 2005 at 11:35 (-0700), Russ Allbery wrote:

    >> Here's the Makefile I use to build my program:

    >
    >> krb5ver:
    >> gcc -Wall -c -I/usr/local/kerberos/include krb5ver.c
    >> gcc -o krb5ver krb5ver.o -L/usr/local/kerberos/lib -lk5crypto -lkrb5 -lcom_err

    >
    > If you install libraries in a non-standard location that the dynamic
    > linker doesn't know about, you have to encode the path to the libraries
    > into the binary. Adding -R/usr/local/kerberos/lib will probably fix the
    > problem.


    Russ,

    Thanks, that fixed it! I must say, I didn't even know about the -R option
    to gcc and can't find it in the gcc man page. What does -R do anyway?

    I had just assumed that the '-L/usr/local/kerberos/lib' would be
    sufficient to tell the linker where to find the libraries. Why did only
    libk5crypto have a problem and not, for example, libkrb5?

    (My knowledge about linking is clearly inadequate).

    Thanks again.

    Mike

    __________________________________________________ ___________________
    Mike Friedman System and Network Security
    mikef@ack.Berkeley.EDU 2484 Shattuck Avenue
    1-510-642-1410 University of California at Berkeley
    http://ack.Berkeley.EDU/~mikef http://security.berkeley.edu
    __________________________________________________ ___________________

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 6.5.8

    iQA/AwUBQu0jiK0bf1iNr4mCEQLbngCgg1DINvnK6cyVnMouyojG1v 1z1QcAn0hb
    vtB/gshqU1KzA+KeUb7ZJJyF
    =rUAV
    -----END PGP SIGNATURE-----
    ________________________________________________
    Kerberos mailing list Kerberos@mit.edu
    https://mailman.mit.edu/mailman/listinfo/kerberos


  4. Re: Problem building an API program against 1.4.1

    Mike Friedman writes:

    > Thanks, that fixed it! I must say, I didn't even know about the -R
    > option to gcc and can't find it in the gcc man page. What does -R do
    > anyway?


    > I had just assumed that the '-L/usr/local/kerberos/lib' would be
    > sufficient to tell the linker where to find the libraries. Why did only
    > libk5crypto have a problem and not, for example, libkrb5?


    tries to explain all this.
    I'm pretty sure it was complaining specifically about k5crypto just
    because it was first and would have had trouble with the others as well.

    --
    Russ Allbery (rra@stanford.edu)
    ________________________________________________
    Kerberos mailing list Kerberos@mit.edu
    https://mailman.mit.edu/mailman/listinfo/kerberos


  5. Re: Problem building an API program against 1.4.1

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    On Sun, 31 Jul 2005 at 12:40 (-0700), Russ Allbery wrote:

    > Mike Friedman writes:
    >
    >> Thanks, that fixed it! I must say, I didn't even know about the -R
    >> option to gcc and can't find it in the gcc man page. What does -R do
    >> anyway?

    >
    >> I had just assumed that the '-L/usr/local/kerberos/lib' would be
    >> sufficient to tell the linker where to find the libraries. Why did
    >> only libk5crypto have a problem and not, for example, libkrb5?

    >
    > tries to explain all
    > this. I'm pretty sure it was complaining specifically about k5crypto
    > just because it was first and would have had trouble with the others as
    > well.


    Russ,

    Actually, it's a bit scarier than that. When I first had the problem, I
    used ldd to see which shared libraries were needed or expected by my
    module. And only libk5crypto showed as 'not found'. There was an entry
    for libkrb5. However, what I didn't notice was that the latter was the
    version in /usr/lib, which comes installed with FreeBSD and is not the MIT
    version. That's why I say 'scary', because if not for the missing
    libk5crypto, I might never have noticed that I wasn't using the correct
    libkrb5 either. Whether or not this would have caused more subtle
    problems later I can't really say.

    Anyway, thanks for the pointer to info about -R. I now see that -R
    appears in the Makefiles used in the MIT K5 build as well.

    Mike

    __________________________________________________ ___________________
    Mike Friedman System and Network Security
    mikef@ack.Berkeley.EDU 2484 Shattuck Avenue
    1-510-642-1410 University of California at Berkeley
    http://ack.Berkeley.EDU/~mikef http://security.berkeley.edu
    __________________________________________________ ___________________

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 6.5.8

    iQA/AwUBQu04Ha0bf1iNr4mCEQJczACgniFFhu3Z3OLlN+QO+jXhed v2h9MAoN0B
    9YEgYX67eXXSxVm87mBm2E3Y
    =/lnf
    -----END PGP SIGNATURE-----
    ________________________________________________
    Kerberos mailing list Kerberos@mit.edu
    https://mailman.mit.edu/mailman/listinfo/kerberos


  6. Re: Problem building an API program against 1.4.1

    On Sun, Jul 31, 2005 at 01:44:09PM -0700, Mike Friedman wrote:

    > >Mike Friedman writes:
    > >
    > >>Thanks, that fixed it! I must say, I didn't even know about the -R
    > >>option to gcc and can't find it in the gcc man page. What does -R do
    > >>anyway?

    > >
    > >>I had just assumed that the '-L/usr/local/kerberos/lib' would be
    > >>sufficient to tell the linker where to find the libraries. Why did
    > >>only libk5crypto have a problem and not, for example, libkrb5?


    > Actually, it's a bit scarier than that. When I first had the problem, I
    > used ldd to see which shared libraries were needed or expected by my
    > module. And only libk5crypto showed as 'not found'. There was an entry
    > for libkrb5. However, what I didn't notice was that the latter was the
    > version in /usr/lib, which comes installed with FreeBSD and is not the MIT
    > version. That's why I say 'scary', because if not for the missing
    > libk5crypto, I might never have noticed that I wasn't using the correct
    > libkrb5 either. Whether or not this would have caused more subtle
    > problems later I can't really say.
    >
    > Anyway, thanks for the pointer to info about -R. I now see that -R
    > appears in the Makefiles used in the MIT K5 build as well.


    i won't comment on how capable your system's runtime linker is in using
    your vendor's libkrb5.so.${version} in lieu of a your newly installed
    version (i would sorta winsomely hope that it's doing the right thing,
    given the versioning info built into the libraries and their $(version)
    extensions and such forth, but that's why my-administered machines
    aren't launching rockets and stuff, and i guess maybe API compatibility
    is a completely different fruit from feature compatibility, anyway),
    but couldn't all the problems have been avoided by building with

    gcc -c ${source} `${newly_installed_krb5}/bin/krb5-config --cflags`
    ....
    gcc -o ${target} ${objects} \
    `${newly_installed_krb5}/bin/krb5-config --libs`

    ? or (to possibly uncover a bone of contention) does krb5-config not
    emit -R options?

    i didn't know that FreeBSD exhibited the Solaris-ish non-infection-of-
    runtime-linking-path-without--R-option, so thanks for cluing me in to that
    anyway, and i'll be watching whom my dynamic executables are runtime-link-
    ing with like a hawk from now on
    ________________________________________________
    Kerberos mailing list Kerberos@mit.edu
    https://mailman.mit.edu/mailman/listinfo/kerberos


  7. Re: Problem building an API program against 1.4.1

    ________________________________________________
    Kerberos mailing list Kerberos@mit.edu
    https://mailman.mit.edu/mailman/listinfo/kerberos

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.5 (NetBSD)

    iQEVAwUAQu30ONo1gLFKFEjAAQKjTQf8CJsMoCNg8Rk2EP8vYf ZJEqa6OMGFd20/
    bG40iHrJR4B8/gfojABQ+oV0optwFrabkwavVof3tN1/73CGwTR9SKOt/3c0B/H6
    jbDiElCWS8Yl7x5zzz22zXLG2IEn9QjB5Pp+STVdbKEKBeUrWy w781EV0xjF0XTe
    NuxeAXmxt2kQAcTL+deKorSMjOeCV+3vH08+2zk48uziQ0JHxM BiAXXMVHCt8FH4
    d+O4QzUvvT5wabQ57J0W785BbA3RjHbJeYVuqUq8i3gb0YClwH W/BYIaNCBJEPAH
    cjc2Ba4K7Xn8KUOTh+AJta7gC6kJ2qIMcj86kKrLP2o5QsW+P8 uQ8g==
    =RpZS
    -----END PGP SIGNATURE-----

  8. Re: Problem building an API program against 1.4.1

    >> gcc -c ${source} `${newly_installed_krb5}/bin/krb5-config --cflags`
    >> ...
    >> gcc -o ${target} ${objects} \
    >> `${newly_installed_krb5}/bin/krb5-config --libs`
    >>
    >> ? or (to possibly uncover a bone of contention) does krb5-config not
    >> emit -R options?

    >
    >krb5-config can't not safely emit -R options because it doesn't know what
    >cc is used.


    Hm. I think we have a problem here. Certainly MIT's krb5-config emits
    -R options (on the appropriate platform), and the autoconf glue that
    I've written assumes that it does. I was under the impression that
    gcc (at least on Solaris) passes -R options to ld unmolested (I just
    tested that, and that's true on Solaris).

    --Ken
    ________________________________________________
    Kerberos mailing list Kerberos@mit.edu
    https://mailman.mit.edu/mailman/listinfo/kerberos


  9. Re: Problem building an API program against 1.4.1

    Ken Hornstein writes:

    > Hm. I think we have a problem here. Certainly MIT's krb5-config emits
    > -R options (on the appropriate platform), and the autoconf glue that
    > I've written assumes that it does. I was under the impression that gcc
    > (at least on Solaris) passes -R options to ld unmolested (I just tested
    > that, and that's true on Solaris).


    gcc attempts to do the right thing with -R on platforms that support it,
    but may not recognize the flag on platforms that don't use -R or have some
    other shared library path mechanism.

    --
    Russ Allbery (rra@stanford.edu)

  10. Re: Problem building an API program against 1.4.1

    >> Hm. I think we have a problem here. Certainly MIT's krb5-config emits
    >> -R options (on the appropriate platform), and the autoconf glue that
    >> I've written assumes that it does. I was under the impression that gcc
    >> (at least on Solaris) passes -R options to ld unmolested (I just tested
    >> that, and that's true on Solaris).

    >
    >gcc attempts to do the right thing with -R on platforms that support it,
    >but may not recognize the flag on platforms that don't use -R or have some
    >other shared library path mechanism.


    Presumably krb5-config won't output -R on platforms if the compiler
    doesn't understand it, right? I'm just saying that I've never noticed
    this to be a problem in practice (although judging by what I've seen
    in people's krb5-config scripts, I appear to be the ONLY one who actually
    uses them for their intended purpose :-/).

    --Ken
    ________________________________________________
    Kerberos mailing list Kerberos@mit.edu
    https://mailman.mit.edu/mailman/listinfo/kerberos


  11. Re: Problem building an API program against 1.4.1

    Ken Hornstein writes:

    > Presumably krb5-config won't output -R on platforms if the compiler
    > doesn't understand it, right? I'm just saying that I've never noticed
    > this to be a problem in practice (although judging by what I've seen in
    > people's krb5-config scripts, I appear to be the ONLY one who actually
    > uses them for their intended purpose :-/).


    Well, it's fairly new, and a lot of the Kerberos software out there hasn't
    really changed its Autoconf macros in eons. That being said, I really
    should start using it with the next release of all of my various Kerberos
    apps.

    --
    Russ Allbery (rra@stanford.edu)

  12. Re: Problem building an API program against 1.4.1



    Russ Allbery wrote:
    > Ken Hornstein writes:
    >
    >
    >>Presumably krb5-config won't output -R on platforms if the compiler
    >>doesn't understand it, right? I'm just saying that I've never noticed
    >>this to be a problem in practice (although judging by what I've seen in
    >>people's krb5-config scripts, I appear to be the ONLY one who actually
    >>uses them for their intended purpose :-/).

    >
    >


    The krb5-config in 1.4.1 will use the RPATH_FLAG as set from configure.
    So if you use the same compiler and linker as used to built the krb5 libs
    it should be able to handle "-R" or the "-Wl,-rpath -Wl,"


    > Well, it's fairly new, and a lot of the Kerberos software out there hasn't
    > really changed its Autoconf macros in eons. That being said, I really
    > should start using it with the next release of all of my various Kerberos
    > apps.
    >


    I did make one change in this area which makes it much easier when building,
    so that the -L used during building, does not have to match the -R
    that would be used when in production. The environment variable
    KRB5INAFS can be set to point to the location of the libs duing building.

    FOr example whien building OpenSSH, setting
    KRB5INAFS="/afs/my.cell/build.appls/krb5-1.4.1/@sys"

    With the prefix set to /krb5 will cause:
    ../krb5-config --libs
    -L/afs/my.cell/build.appls/krb5-1.4.1/@sys/krb5/lib -R/krb5/lib
    -lkrb5 -lk5crypto -lkrb5support -lcom_err -lresolv -lsocket -lnsl


    --- ,krb5-config.in Thu Dec 16 15:28:13 2004
    +++ krb5-config.in Tue May 24 12:56:11 2005
    @@ -29,8 +29,9 @@

    prefix=@prefix@
    exec_prefix=@exec_prefix@
    -includedir=@includedir@
    -libdir=@libdir@
    +includedir=${KRB5INAFS}@includedir@
    +libdir=${KRB5INAFS}@libdir@
    +rlibdir=@libdir@
    CC_LINK='@CC_LINK@'
    KRB4_LIB=@KRB4_LIB@
    DES425_LIB=@DES425_LIB@
    @@ -174,7 +175,7 @@
    # Ugly gross hack for our build tree
    lib_flags=`echo $CC_LINK | sed -e 's/\$(CC)//' \
    -e 's/\$(PURE)//' \
    - -e 's#\$(PROG_RPATH)#'$libdir'#' \
    + -e 's#\$(PROG_RPATH)#'$rlibdir'#' \
    -e 's#\$(PROG_LIBPATH)#-L'$libdir'#' \
    -e 's#\$(RPATH_FLAG)#'"$RPATH_FLAG"'#' \
    -e 's#\$(LDFLAGS)#'"$LDFLAGS"'#' \





    --

    Douglas E. Engert
    Argonne National Laboratory
    9700 South Cass Avenue
    Argonne, Illinois 60439
    (630) 252-5444
    ________________________________________________
    Kerberos mailing list Kerberos@mit.edu
    https://mailman.mit.edu/mailman/listinfo/kerberos


  13. Re: Problem building an API program against 1.4.1

    On Mon, Aug 01, 2005 at 12:06:42PM +0200, Love H?rnquist ?strand wrote:

    > krb5-config can't not safely emit -R options because it doesn't know what
    > cc is used.


    good point. maybe there needs to be a krb5-libtool to go with
    krb5-config [grin]. or maybe krb5-gnu-build-system that pack-
    ages autoconf macros that actually use krb5-config and know
    when to sling -R's [snicker]
    ________________________________________________
    Kerberos mailing list Kerberos@mit.edu
    https://mailman.mit.edu/mailman/listinfo/kerberos


+ Reply to Thread