Updated the bug description with the standard SRU template.
The issue is already resolved in Stonking (devel) with util-linux
2.42.2-1ubuntu2 (which includes upstream commit 5683ed6320e0). The
debdiff is attached and ready for sponsorship into resolute-proposed.
** Changed in: util-linux (Ubuntu)
Status: Confirmed => Fix Released
** Description changed:
- On Ubuntu 26.04 (util-linux / libpam-lastlog2 2.41.3-3ubuntu2.2, systemd
259.5-0ubuntu3.4),
- every start of [email protected] logs:
+ [ Impact ]
+ When [email protected] starts or PAM sessions are created by systemd-executor,
pam_lastlog2.so fails to load with an "undefined symbol: pam_syslog" error.
+ This happens because pam_lastlog2.so was linked with -lpam placed in LDFLAGS
rather than LIBADD, so the toolchain's --as-needed flag dropped the dependency
on libpam.so.0.
+ As a result, pam_lastlog2 fails to resolve pam_syslog, breaks session
accounting, and logs errors on each user service start.
- (systemd)[3271]: PAM unable to dlopen(pam_lastlog2.so):
/usr/lib/security/pam_lastlog2.so: cannot open shared object file: No such file
or directory
- (systemd)[3271]: PAM adding faulty module: pam_lastlog2.so
+ [ Fix ]
+ Backport upstream commit 5683ed6320e0 ("pam_lastlog2: fix libpam linking in
autotools build").
+ Move -lpam from pam_lastlog2_la_LDFLAGS to pam_lastlog2_la_LIBADD in
pam_lastlog2/Makemodule.am so that the DT_NEEDED entry for libpam.so.0 is
retained when building with --as-needed.
- The real failure is hidden by libpam's fallback path. Loading the module with
- libpam opened RTLD_LOCAL (as systemd-executor does, since systemd dlopens
libpam)
- gives:
+ [ Test Plan ]
+ 1. Inspect the binary dynamic section before and after:
+ readelf -d /usr/lib/x86_64-linux-gnu/security/pam_lastlog2.so | grep NEEDED
+ - Before: only libc.so.6 and liblastlog2.so.2 are listed; libpam.so.0 is
missing.
+ - After: libpam.so.0 is present.
+ 2. Verify module loading under RTLD_LOCAL:
+ Start or restart a systemd user session (e.g. systemctl restart
user@$UID.service).
+ Verify that no "PAM unable to dlopen(pam_lastlog2.so)" or "undefined
symbol: pam_syslog" errors appear in the journal.
+ 3. Verify pam_lastlog2 logs sessions correctly to lastlog2 database.
- pam_lastlog2.so: error: symbol lookup error: undefined symbol:
- pam_syslog
+ [ Where problems could occur ]
+ The change only adds libpam.so.0 to DT_NEEDED of pam_lastlog2.so.
+ pam_lastlog2 already calls pam_syslog() and other PAM APIs.
+ No binary interfaces or other utilities in util-linux are changed.
+ Risk is minimal and strictly limited to pam_lastlog2 loading libpam.so.0
dynamically.
- pam_lastlog2.so has no NEEDED entry for libpam.so.0:
-
- (NEEDED) Shared library: [libc.so.6]
-
- whereas e.g. pam_wtmpdb.so correctly lists libpam.so.0. The module is pulled
in
- via /etc/pam.d/other -> common-session.
-
- This is fixed upstream in util-linux 2.42.2 ("pam_lastlog2: fix libpam
linking in
- autotools build", commit 5683ed6320e00205146cbb3d0c76462733530eca, plus the
earlier
- 3f4cbd7a1510 "add -lpam to Makemodule.am"): -lpam was in LDFLAGS and got
dropped
- by --as-needed; it now lives in pam_lastlog2_la_LIBADD. Same bug in Fedora:
- https://bugzilla.redhat.com/show_bug.cgi?id=2453457
-
- Please backport that change to resolute's util-linux.
-
- ProblemType: Bug
- DistroRelease: Ubuntu 26.04
- Package: libpam-lastlog2 2.41.3-3ubuntu2.2
- ProcVersionSignature: Ubuntu 7.0.0-31.31-generic 7.0.14
- Uname: Linux 7.0.0-31-generic x86_64
- ApportVersion: 2.34.1-0ubuntu0.1
- Architecture: amd64
- CasperMD5CheckResult: pass
- CurrentDesktop: ubuntu:GNOME
- Date: Fri Sep 11 12:01:49 2026
- InstallationDate: Installed on 2026-08-13 (28 days ago)
- InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64
(20260423.1)
- ProcEnviron:
- LANG=en_US.UTF-8
- PATH=(custom, no user)
- SHELL=/bin/bash
- TERM=xterm-256color
- XDG_RUNTIME_DIR=<set>
- SourcePackage: util-linux
- UpgradeStatus: No upgrade log present (probably fresh install)
+ [ Other Info ]
+ This issue is already resolved in Stonking (devel) via util-linux
2.42.2-1ubuntu2, which incorporates upstream commit 5683ed6320e0.
+ Debdiff is targeted to Resolute (26.04).
** Description changed:
[ Impact ]
When [email protected] starts or PAM sessions are created by systemd-executor,
pam_lastlog2.so fails to load with an "undefined symbol: pam_syslog" error.
This happens because pam_lastlog2.so was linked with -lpam placed in LDFLAGS
rather than LIBADD, so the toolchain's --as-needed flag dropped the dependency
on libpam.so.0.
As a result, pam_lastlog2 fails to resolve pam_syslog, breaks session
accounting, and logs errors on each user service start.
[ Fix ]
Backport upstream commit 5683ed6320e0 ("pam_lastlog2: fix libpam linking in
autotools build").
Move -lpam from pam_lastlog2_la_LDFLAGS to pam_lastlog2_la_LIBADD in
pam_lastlog2/Makemodule.am so that the DT_NEEDED entry for libpam.so.0 is
retained when building with --as-needed.
[ Test Plan ]
1. Inspect the binary dynamic section before and after:
readelf -d /usr/lib/x86_64-linux-gnu/security/pam_lastlog2.so | grep NEEDED
- Before: only libc.so.6 and liblastlog2.so.2 are listed; libpam.so.0 is
missing.
- After: libpam.so.0 is present.
2. Verify module loading under RTLD_LOCAL:
Start or restart a systemd user session (e.g. systemctl restart
user@$UID.service).
Verify that no "PAM unable to dlopen(pam_lastlog2.so)" or "undefined
symbol: pam_syslog" errors appear in the journal.
3. Verify pam_lastlog2 logs sessions correctly to lastlog2 database.
[ Where problems could occur ]
The change only adds libpam.so.0 to DT_NEEDED of pam_lastlog2.so.
pam_lastlog2 already calls pam_syslog() and other PAM APIs.
No binary interfaces or other utilities in util-linux are changed.
Risk is minimal and strictly limited to pam_lastlog2 loading libpam.so.0
dynamically.
[ Other Info ]
This issue is already resolved in Stonking (devel) via util-linux
2.42.2-1ubuntu2, which incorporates upstream commit 5683ed6320e0.
Debdiff is targeted to Resolute (26.04).
+
+ --- Original Report ---
+
+ On Ubuntu 26.04 (util-linux / libpam-lastlog2 2.41.3-3ubuntu2.2, systemd
259.5-0ubuntu3.4),
+ every start of [email protected] logs:
+
+ (systemd)[3271]: PAM unable to dlopen(pam_lastlog2.so):
/usr/lib/security/pam_lastlog2.so: cannot open shared object file: No such file
or directory
+ (systemd)[3271]: PAM adding faulty module: pam_lastlog2.so
+
+ The real failure is hidden by libpam's fallback path. Loading the module with
+ libpam opened RTLD_LOCAL (as systemd-executor does, since systemd dlopens
libpam)
+ gives:
+
+ pam_lastlog2.so: error: symbol lookup error: undefined symbol:
+ pam_syslog
+
+ pam_lastlog2.so has no NEEDED entry for libpam.so.0:
+
+ (NEEDED) Shared library: [libc.so.6]
+
+ whereas e.g. pam_wtmpdb.so correctly lists libpam.so.0. The module is pulled
in
+ via /etc/pam.d/other -> common-session.
+
+ This is fixed upstream in util-linux 2.42.2 ("pam_lastlog2: fix libpam
linking in
+ autotools build", commit 5683ed6320e00205146cbb3d0c76462733530eca, plus the
earlier
+ 3f4cbd7a1510 "add -lpam to Makemodule.am"): -lpam was in LDFLAGS and got
dropped
+ by --as-needed; it now lives in pam_lastlog2_la_LIBADD. Same bug in Fedora:
+ https://bugzilla.redhat.com/show_bug.cgi?id=2453457
+
+ Please backport that change to resolute's util-linux.
+
+ ProblemType: Bug
+ DistroRelease: Ubuntu 26.04
+ Package: libpam-lastlog2 2.41.3-3ubuntu2.2
+ ProcVersionSignature: Ubuntu 7.0.0-31.31-generic 7.0.14
+ Uname: Linux 7.0.0-31-generic x86_64
+ ApportVersion: 2.34.1-0ubuntu0.1
+ Architecture: amd64
+ CasperMD5CheckResult: pass
+ CurrentDesktop: ubuntu:GNOME
+ Date: Fri Sep 11 12:01:49 2026
+ InstallationDate: Installed on 2026-08-13 (28 days ago)
+ InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64
(20260423.1)
+ ProcEnviron:
+ LANG=en_US.UTF-8
+ PATH=(custom, no user)
+ SHELL=/bin/bash
+ TERM=xterm-256color
+ XDG_RUNTIME_DIR=<set>
+ SourcePackage: util-linux
+ UpgradeStatus: No upgrade log present (probably fresh install)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167039
Title:
pam_lastlog2.so not linked against libpam: "undefined symbol:
pam_syslog" when loaded by systemd-executor
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/util-linux/+bug/2167039/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
