ports/121573: port 'krb5' (MIT Kerberos) generates non-working ksu

[Randy Reitz]

>Number:         121573
>Category:       ports
>Synopsis:       port 'krb5' (MIT Kerberos) generates non-working ksu
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Mar 10 18:30:03 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Randy Reitz
>Release:        7.0-RELEASE
>Organization:
Fermilab
>Environment:
FreeBSD dtmb.dhcp.fnal.gov 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Feb 24 19:59:52 UTC 2008     root at logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386
>Description:
I needed to install the krb5 port so that the kadmin client would work with the MIT KDCs installed at Fermilab.  I found that the krb5 port ksu command generates the error...

[rreitz at dtmb ~]$ ksu
/libexec/ld-elf.so.1: /usr/lib/libkrb5.so: Undefined symbol "initialize_asn1_error_table_r"
[rreitz at dtmb ~]$ which ksu
/usr/local/bin/ksu

Once I installed the krb5 port, I had to set LD_LIBRARY_PATH=/usr/local/lib in order to get the clients (kinit, klist, etc) working.  However, since krb5 is suid root, the LD_LIBRARY_PATH environment is ignored. Looking at the ksu, I see the libkrb5.so from the default Heimdal Kerberos is being called...

[rreitz at dtmb ~]$ ldd /usr/local/bin/ksu
/usr/local/bin/ksu:
	libkrb5.so => /usr/lib/libkrb5.so (0x2808f000)
	libk5crypto.so => /usr/local/lib/libk5crypto.so (0x280c9000)
	libcom_err.so => /usr/lib/libcom_err.so (0x280ed000)
	libkrb5support.so => /usr/local/lib/libkrb5support.so (0x280ef000)
	libc.so.7 => /lib/libc.so.7 (0x280f7000)



>How-To-Repeat:
Install the krb5 port on a clean FreeBSD 7.0-RELEASE install (developer).  Run ksu.
>Fix:
- provide a way to remove the default Heimdal Kerberos, or

- Add LDFLAGS to top level makefile ...
CONFIGURE_ENV=          INSTALL="${INSTALL}" YACC=/usr/bin/yacc \
                        CFLAGS="${CFLAGS}" \
                        LDFLAGS="-rpath /usr/local/lib"   <-- add this line
and
- fix the Makefile (or Makefile.in) in /usr/ports/security/krb5/work/krb5-1.6.3/src/clients/ksu so the LDFLAGS is correct.  It's currently ...
LDFLAGS =  -rpath=/usr/lib:/usr/local/lib
I can't follow configure to understand where this line originates.

>Release-Note:
>Audit-Trail:
>Unformatted: