<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:r_ansi;
panose-1:2 11 6 9 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:0in;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">So, I am trying to create a shared object to implement some functionality in libpam. It has dependencies on a number of dynamic objects, but I am trying to include statically linked copies of libcrypto and libssl. These are coming from
a FIPS capable version of OpenSSL (1.0.1)built and tested with a FIPS canister (2.0.9) that I created using the instructions in the Security Policy / User Guide.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is in Debian Linux, using gcc. I’ve created standalone executables this way, but cannot get past the fipsld link step while creating a shared object. After the first link (which succeeds just fine), when fipsld tries to execute
the DSO, there is a segmentation violation:<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">Program received signal SIGSEGV, Segmentation fault.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">0x000055555561d1b9 in do_drbg_init ()<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">(gdb) where<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">#0 0x000055555561d1b9 in do_drbg_init ()<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:106%;font-family:r_ansi">#1 0x00005555555da14e in do_drbg_instantiate ()<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The Makefile looks like this:<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi"># make CC=/usr/local/ssl/fips-2.0/bin/fipsld FIPSLD_CC=gcc<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">INSTALL=/usr/bin/install<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">CC=/usr/local/ssl/fips-2.0/bin/fipsld<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">FIPSLD_CC=gcc<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">DEBUG=-ggdb -DDEBUG_FINGERPRINT_PREMAIN<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">LIB = -L/usr/local/ssl/lib<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">LIBS = -lpam -lcrypt -lstdc++ -ldl
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">#LIBS = -lpam -lcrypt -lstdc++ -ldl /usr/local/ssl/fips-2.0/lib/fipscanister.o<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">INC = -I /usr/local/ssl/include -I ../../..<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">CFLAGS=-DFIPS_SSL -fPIC <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">ARCS = -Wl,-Bstatic -lssl -lcrypto -Wl,-Bdynamic<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">all: pam_sp_auth.so<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">pam_sp_auth.so: pam_sp_auth.o ../../../tpdpass.o ../../../tpd_pwd_cli.o<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi"> $(CC) ${DEBUG} ${INC} ${CFLAGS} ${LIB} ${LDFLAGS} -shared -o pam_sp_auth.so ${LIBS} pam_sp_auth.o ../../../tpdpass.o \<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi"> ../../../tpd_pwd_cli.o ${ARCS}<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">pam_sp_auth.o: pam_sp_auth.c ../../../tpdpass.h
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi"> ${FIPSLD_CC} ${DEBUG} ${INC} ${CFLAGS} -c -o pam_sp_auth.o pam_sp_auth.c<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi">clobber: <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:10.0pt;font-family:r_ansi"> rm -f pam_sp_auth.so pam_sp_auth.o<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:106%;font-family:r_ansi"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It is invoked with:<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:106%;font-family:r_ansi">make CC=/usr/local/ssl/fips-2.0/bin/fipsld FIPSLD_CC=gcc</span><o:p></o:p></p>
<p class="MsoNormal">To make certain that it was not related to the static linkage, I reworked the make to link everything dynamically and I still hit the same issue. Thoughts? Thanks<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>