cracklib expects its dictionaries to be target-endian and generating them during the build using cracklib-native generates them host-endian. This works unless host and target are different endianness. The best fix would be to generate them using cracklib-native for the desired target-endian format or to change cracklib to be fixed endian (this could have a small performance impact depending on the format).
This is a well known defect of cracklib, see the README of cracklib: ... 160 These files are NOT byte-order independent, in fact they are probably 161 ARCHITECTURE SPECIFIC, mostly due to speed constraints. ... There are 4 solutions to fix this issue: *1 Unify to create the dict files in big endian, and convert to host endian while load them. This could fix the endian issue on multi platform. Modify the source file of cracklib: lib/packlib.c *2 Create the dict files at the target run time rather than build time, it workarounds this issue. Modify cracklib_2.8.22.bb ... pkg_postinst_${PN} () { if [ -n "$D" ]; then exit 1 fi /usr/sbin/create-cracklib-dict ${datadir}/${PN}/* } ... *3 Create the dict files at the build time with option to tell which type of endian(big or little) is used according to the target's endian. Modify cracklib_2.8.22.bb, script create-cracklib-dict, source file of cracklib: lib/packlib.c, util/packer.c *4 Load dict files with checking to tell what the dict's endian is, if it is different with target, convert it. This could fix the endian issue on multi platform. Tell the dict's endian by the value of magic flag in dict file. Modify source file of cracklib: lib/packlib.c.
I have sent the pull request about solution 1, this is the endian issue on multiple platforms, and the host/network byte order convert is the classic solution to resolve the similar problem. //Hongxu
The first solution would cause a change on the target system, and would not work for Read-Only systems.
(In reply to comment #3) > The first solution would cause a change on the target system, and would not > work for Read-Only systems. Hi Saul, Maybe the description about solution 1 is not clear, the creation of dict files is still at build time but in big endian rather than host endian, and it could work for Read-Only system. //Hongxu
In meta/recipes-extended/cracklib/cracklib_2.8.22.bb ... 24 do_install_append_class-target() { 25 create-cracklib-dict -o ${D}${datadir}/cracklib/pw_dict ${D}${datadir}/cracklib/cracklib-small 26 } ... It will invoke the previous function at build time in which create-cracklib-dict is cracklib-native's. //Hongxu
Merged into master: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=a28959eae74049c2d3719a3fe1bd8cce2a2edbe1 Please verify.
Verified with poky (master:676fd3f394a0c0576b63c77ed2184bf5f42c29b6) Verify steps: 1. set below lines in conf/local.conf MACHINE ?= "qemumips" IMAGE_INSTALL_append = " cracklib" DISTRO_FEATURES_append += " pam" 2. bitbake core-image-sato-sdk 3. do pam test a. scp pam-plugin-debug-1.1.6-r2.mips32.rpm pam-plugin-access-1.1.6-r2.mips32.rpm pam-plugin-cracklib-1.1.6-r2.mips32.rpm pam-plugin-time-1.1.6-r2.mips32.rpm pam-plugin-pwhistory-1.1.6-r2.mips32.rpm pam-plugin-succeed-if-1.1.6-r2.mips32.rpm root@192.168.7.2:~/ b. scp libpam-xtests-1.1.6-r2.mips32.rpm root@192.168.7.2:~/ c. inatall the rpm files on qemu d. on qemu, cd /usr/share/Linux-PAM/xtests e. ./run-xtests.sh . tst-pam_cracklib1 f. ./run-xtests.sh . tst-pam_cracklib2 4. do cracklib sanity test a. cd /tmp/work/mips32-poky-linux/cracklib/2.8.22-r0/build/util/.libs b. scp test* root@192.168.7.2:/home/root c. on qemu, test the 3 applications: testlib testnum teststr