problem with shl_load and pam

[Bj_5]

Hello!

I try to port a self-written PAM module from Linux to HP-UX 11.00. The problem is, that i have to use some LDAP-functions from an third-party library (IBM SecureWay for HP-UX). Building a standalone-program with them works fine, but when compiled and linked as a shared library it gives the well-known error: Can't shl_load() a library containing Thread Local Storage: /usr/lib/libpthread.1

I've read a lot of stuff about that error and i've tried almost everything that was ever suggested...

I read, that libpthread must be loaded before that library to avoid the problem. So i've tried to link against "-lpthread" too, but no effect. I also tried a lot of combinations, including -ldld, -lc and so on. Nothing. I don't know any further now.

I would use the LD_PRELOAD feature too, but where to set an environment variable for the PAM-environment?

Here the output from "odump -sllibloadlist" for that module, if it helps:

0 libpam_test.1
1 ^ /usr/lib/libibmldap.sl
2 ^ ^ /usr/lib/libc.2
3 ^ ^ ^ /usr/lib/libdld.2
4 ^ ^ /usr/lib/libpthread.1

Is it right, that the load direction ist bottom up? So if libpam_test.1 should be loaded it would be: libpthread, libdld, libc, libibmldap?

Anyone able to help?

Many thanks in advance!!

Bjoern

[Mike Stroyan · Accepted solution]

The only way to make libpthread.1 work in your shared library would be to have it linked into all a.outs that use your shared library. That is not practical with a PAM module.
(It is also really dangerous to think about introducing threading into a bunch of code that was not written or compiled as thread-safe.)
The simplest fix for your problem is to create a small a.out that your shared library communicates with to access the libibmldap.sl functions. You could either fork/exec that a.out for every startup of your shared library, or leave a daemon process that your library can connect to as needed. The best fit will depend on the performance and security requirements of your design.

[Bj_5]

That would be a solution. I think i will try it that way.

Thanks,
Bjoern