[kirkstone 4.0.30] libpam-1.5.2 do_compile fails due to missing headers in pam_namespace.c

Hi Yocto team,

I encountered a compilation failure with libpam-1.5.2-r0 when building an image with Yocto kirkstone 4.0.30 on aarch64 target architecture. The issue appears to be introduced by the CVE-2025-6020 patches backported in the 4.0.29 release.

=== ENVIRONMENT ===
- Yocto Version: 4.0.30 kirkstone
- Target Architecture: aarch64-poky-linux
- Host System: Linux 5.15.0-139-generic
- Package: libpam-1.5.2-r0
- Recipe: /poky/meta/recipes-extended/pam/libpam_1.5.2.bb

=== ERROR LOG ===

ERROR: libpam-1.5.2-r0 do_compile: oe_runmake failed


The compilation fails in modules/pam_namespace/pam_namespace.c with:


../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c: In function 'secure_try_rmdir':

../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c:326:18: warning: implicit declaration of function 'dirname' [-Wimplicit-function-declaration]

  326 |         parent = dirname(buf);

      |                  ^~~~~~~

../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c:326:16: warning: assignment to 'char *' from 'int' makes pointer from integer without a cast [-Wint-conversion]

  326 |         parent = dirname(buf);

      |                ^

../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c: In function 'parse_config_file':

../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c:944:17: warning: implicit declaration of function 'setlocale' [-Wimplicit-function-declaration]

  944 |     oldlocale = setlocale(LC_COLLATE, "C");

      |                 ^~~~~~~~~

../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c:944:27: error: 'LC_COLLATE' undeclared (first use in this function)

  944 |     oldlocale = setlocale(LC_COLLATE, "C");

      |                           ^~~~~~~~~~


make[3]: *** [Makefile:795: pam_namespace.lo] Error 1

=== ROOT CAUSE ===
The CVE-2025-6020-01.patch (added in 4.0.29) removes <libgen.h> and <locale.h> from modules/pam_namespace/pam_namespace.h as part of header cleanup:

diff --git a/modules/pam_namespace/pam_namespace.h b/modules/pam_namespace/pam_namespace.h
...
-#include <libgen.h>
...
-#include <locale.h>

However, modules/pam_namespace/pam_namespace.c still uses:

  *
dirname() function (requires <libgen.h>)
  *
setlocale() function and LC_COLLATE constant (requires <locale.h>)
These functions are called but the headers are no longer included anywhere, causing the compilation to fail.

=== PROPOSED FIX ===
The fix is to add the missing header includes directly to pam_namespace.c. I've attached a patch that resolves this issue.
This patch should be added to the libpam_1.5.2.bb recipe SRC_URI after the CVE-2025-6020 patches.

=== PATCH ===

From: Pushkar

Date: Mon, 13 Oct 2025

Subject: [PATCH] libpam: fix missing headers in pam_namespace.c after CVE-2025-6020 patches


The CVE-2025-6020-01 patch removed libgen.h and locale.h from

pam_namespace.h, but pam_namespace.c still uses dirname(), setlocale(),

and LC_COLLATE from these headers. Add them back to the C file.


This fixes compilation errors on aarch64 and potentially other architectures.


Signed-off-by:


---

 modules/pam_namespace/pam_namespace.c | 2 ++

 1 file changed, 2 insertions(+)


diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c

index 22d8445..1234567 100644

--- a/modules/pam_namespace/pam_namespace.c

+++ b/modules/pam_namespace/pam_namespace.c

@@ -38,6 +38,8 @@

 #include "config.h"

 #include <stdint.h>

 #include "pam_cc_compat.h"

+#include <libgen.h>

+#include <locale.h>

 #include "pam_inline.h"

 #include "pam_namespace.h"

 #include "argv_parse.h"

--

2.25.1

Please let me know if this is a valid issue and or if need any additional information or testing results.

Regards,
Pushkar

To view our privacy policy, including the types of personal information we collect, process and share, and the rights and options you have in this respect, see www.semtech.com/legal.