Segfault in Apache/Courier using LDAP on Amd64 hardened

[Dragonlord]

I'm in progress of migrating an old i386 non-hardened server over to a new amd64 hardened machine. So far everything went well except a few buggers ( ocaml not compilable with PIE enabled ) which I could sort out myself but now I'm stuck on a huge fun killler.

The network system relies on LDAP for doing all security checks ( email, web, svn and so forth ). OpenLDAP works without a problem. I could mirgrate the LDAP database over and I can query from another computer or using ldapsearch without a problem. But whenever Apache or Courier-IMAP tries to authenticate using LDAP the child processes always segfault right away.

I tried already recompiling openldap, apache and courier-authlib but without success. I don't know where the problem could be. I don't mind compiling some package there without PIE enabled if this is the problem since LDAP access is only on the server in the end ( although I would prefer not having to do so ). The following situation I have:

1) OpenLDAP server runs ( OK )
2) ldapsearch yields correct results ( OK )
3) Test connection from another computer on LDAP works ( OK )
4) courier-authlib crashes trying to use LDAP ( BAD )
5) apache2 crashes trying to authenticate against LDAP ( BAD )

For point 4 I checked the logs but they showed not much useful even if debug is at max. What I found out is that courier-authlib queries for the informations in the LDAP and successfully received but then things crash right afterwards.

For point 5 I have no pointers at all. In the logs I only get "[notice] child pid 2365 exit signal Segmentation fault (11)". It happens only as soon as LDAP is used.

Has anybody an idea what could be the problem? Is there a sort of libldap that could react bad to PIE and would require particular recompilation?
_________________
DragonDreams: Leader and Head Programmer

[Dragonlord]

I played around with the noPIE compiler to test which package seems to be broken. I tried the following( P=PIE, N=NoPIE )

1) openldap(P), apr-util(P), apache(P) => Segfault
2) openldap(P), apr-util(N), apache(P) => Segfault
3) openldap(P), apr-util(P), apache(N) => No Segfault

As it looks it is the apache package which has a broken LDAP support ( or rather PIE is broken ). This though bugs me a bit since I had the intention to protect Apache being a potential brake-in point. Any ideas why apache fails under PIE with LDAP but not PHP/PostgreSQL?
_________________
DragonDreams: Leader and Head Programmer

[kimptoc]

Hi,

Not sure if this is related, but I have an amd64 gentoo box, not hardened and just upgraded PHP and started getting segfaults in squirrelmail - that uses php/courier.

I have now downgraded PHP and things are working ok.

That is php-5.2.3-r3 causes segfaults, but returning to php-5.2.2-r1 fixes it.