Re: [yocto] [kirkstone 4.0.30] libpam-1.5.2 do_compile fails due to missing headers in pam_namespace.c

On 10/13/25 20:19, Pushkar Helge via lists.yoctoproject.org wrote:
> Hi Yocto team,
>
> I encountered a compilation failure with libpam-1.5.2-r0 when building
> an image with Yocto kirkstone 4.0.30 on aarch64 target architecture.
> The issue appears to be introduced by the CVE-2025-6020 patches
> backported in the 4.0.29 release.
>
> === ENVIRONMENT ===
> - Yocto Version: 4.0.30 kirkstone
> - Target Architecture: aarch64-poky-linux
> - Host System: Linux 5.15.0-139-generic
> - Package: libpam-1.5.2-r0
> - Recipe: /poky/meta/recipes-extended/pam/libpam_1.5.2.bb
>
> === ERROR LOG ===
>
> ERROR: libpam-1.5.2-r0 do_compile: oe_runmake failed
>
>
> The compilation fails in modules/pam_namespace/pam_namespace.c with:
>
>
> ../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c: In
> function 'secure_try_rmdir':
>
> ../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c:326:18:
> warning: implicit declaration of function 'dirname'
> [-Wimplicit-function-declaration]
>
>   326 |         parent = dirname(buf);
>
>       |                  ^~~~~~~
>
> ../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c:326:16:
> warning: assignment to 'char *' from 'int' makes pointer from integer
> without a cast [-Wint-conversion]
>
>   326 |         parent = dirname(buf);
>
>       |                ^
>
> ../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c: In
> function 'parse_config_file':
>
> ../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c:944:17:
> warning: implicit declaration of function 'setlocale'
> [-Wimplicit-function-declaration]
>
>   944 |     oldlocale = setlocale(LC_COLLATE, "C");
>
>       |                 ^~~~~~~~~
>
> ../../../Linux-PAM-1.5.2/modules/pam_namespace/pam_namespace.c:944:27:
> error: 'LC_COLLATE' undeclared (first use in this function)
>
>   944 |     oldlocale = setlocale(LC_COLLATE, "C");
>
>       |                           ^~~~~~~~~~
>
> make[3]: *** [Makefile:795: pam_namespace.lo] Error 1
>
>
> === ROOT CAUSE ===
> The CVE-2025-6020-01.patch (added in 4.0.29) removes <libgen.h> and
> <locale.h> from modules/pam_namespace/pam_namespace.h as part of
> header cleanup:
>
> diff --git a/modules/pam_namespace/pam_namespace.h
> b/modules/pam_namespace/pam_namespace.h
> ...
> -#include <libgen.h>
> ...
> -#include <locale.h>
>
> However, modules/pam_namespace/pam_namespace.c still uses:
>
>  *
>     dirname() function (requires <libgen.h>)
>  *
>     setlocale() function and LC_COLLATE constant (requires <locale.h>)
>     These functions are called but the headers are no longer included
>     anywhere, causing the compilation to fail.
>
>
> === PROPOSED FIX ===
> The fix is to add the missing header includes directly to
> pam_namespace.c. I've attached a patch that resolves this issue.
> This patch should be added to the libpam_1.5.2.bb recipe SRC_URI after
> the CVE-2025-6020 patches.
>
> === PATCH ===
>
> From: Pushkar
>
> Date: Mon, 13 Oct 2025
>
> Subject: [PATCH] libpam: fix missing headers in pam_namespace.c after
> CVE-2025-6020 patches
>
>
> The CVE-2025-6020-01 patch removed libgen.h and locale.h from
>
> pam_namespace.h, but pam_namespace.c still uses dirname(), setlocale(),
>
> and LC_COLLATE from these headers. Add them back to the C file.
>
>
> This fixes compilation errors on aarch64 and potentially other
> architectures.
>
>
> Signed-off-by:
>
>
> ---
>
>  modules/pam_namespace/pam_namespace.c | 2 ++
>
>  1 file changed, 2 insertions(+)
>
>
> diff --git a/modules/pam_namespace/pam_namespace.c
> b/modules/pam_namespace/pam_namespace.c
>
> index 22d8445..1234567 100644
>
> --- a/modules/pam_namespace/pam_namespace.c
>
> +++ b/modules/pam_namespace/pam_namespace.c
>
> @@ -38,6 +38,8 @@
>
>  #include "config.h"
>
>  #include <stdint.h>
>
>  #include "pam_cc_compat.h"
>
> +#include <libgen.h>
>
> +#include <locale.h>
>
>  #include "pam_inline.h"
>
>  #include "pam_namespace.h"
>
>  #include "argv_parse.h"
>
> --
>
> 2.25.1
>
>
> Please let me know if this is a valid issue and or if need any
> additional information or testing results.
>

To me your investigation and findings make sense at the first sight...
would like to add two notes:

1. I didn't manage to reproduce this. This doesn't invalidate the
problem though - but I'm curious if it requires some extra
config/environment. (I tried it in debian12 docker image, for qemuarm64
target, with default toolchain).
2. This seems to be an upstream issue. Could you please send your fix to
the openembedded-core mailing list[1] (so it can be included in the next
release), and to open an issue/PR with libpam also (so they can fix it
too)? My previous point about reproduction touches this point also.

[1]:
https://docs.yoctoproject.org/dev/contributor-guide/submit-changes.html#sending-the-patches-via-email