Merge ~ahasenack/ubuntu/+source/bind9:bionic-rtld-deepbind-1769440 into ubuntu/+source/bind9:ubuntu/bionic-devel

[Andreas Hasenack]

Cherry pick from cosmic's bd16d30d40b8487c6f79afe317d79a0dea204a6f, same fix. There is a small offset that I kept.

Bug has the SRU template with testing instructions. It's a bit complicated, since it involves installing freeipa and a VM (not lxd) must be used.

Bileto ticket: https://bileto.ubuntu.com/#/ticket/3467
PPA: ppa:ci-train-ppa-service/3467

There is currently an armhf regression with resource-agents/1:4.1.0~rc1-1ubuntu1. Looking at the testing history, it seems to be a recurring failure. I don't have access to an armhf system to verify what is going on, but it looks like installing ldirectord is failing there for some reason.

Other tests are still running and I will re-evaluate once they are all done.

[Andreas Hasenack (ahasenack)]

I just noticed that the patch file has some issues:
- two "Description" fields
- diff "noise"
- the author is actually someone from Redhat, not Karl. See https://bugzilla.redhat.com/show_bug.cgi?id=1410433#c4, which points at https://pagure.io/fedora-bind/c/3d5ea105bd877f0069452e450320f8877b01cb52?branch=master

Should I fix these issues here, even though they already exist in the cosmic package? i.e., keep the patch as a cherry-pick, or change it?

[Christian Ehrhardt  (paelzer)]

yeah, I'd ask to fix this up.
- second description should go away, IMHO "not-needed" is the right entry at forwarded for this case
- The origin is actually either
   https://pagure.io/fedora-bind/blob/3d5ea105bd877f0069452e450320f8877b01cb52/f/bind-9.11-rh1410433.patch
  or
  https://salsa.debian.org/dns-team/bind9/blob/afc6b5fe2e359e4e7eadc256cd94481965418b4b/debian/patches/skip-rtld-deepbind-for-dyndb.diff
- and yes Author is only needed if we massively backport-change (and even then you can carry Original-Author) - both not needed here

Furthermore the changelog entry does not refer to the patch being added, that should also be fixed up IMHO

review: Needs Fixing

[Andreas Hasenack (ahasenack)]

Thanks for the review.

Since the overall change is small, I pushed --force my updates. Please take another look.

[Christian Ehrhardt  (paelzer)]

looks much better now +1

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, tagged and uploaded.

diff --git a/debian/changelog b/debian/changelog
index 6451196..c044c8d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+bind9 (1:9.11.3+dfsg-1ubuntu1.3) bionic; urgency=medium
+
+  [ Karl Stenerud ]
+  * d/p/skip-rtld-deepbind-for-dyndb.diff: fix named-pkcs11 crashing on
+    startup. Thanks to Petr Menšík <[e-mail]> (LP: #1769440)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 10 Oct 2018 14:33:34 -0300
+
 bind9 (1:9.11.3+dfsg-1ubuntu1.2) bionic-security; urgency=medium
 
   * SECURITY UPDATE: denial of service crash when deny-answer-aliases
diff --git a/debian/patches/series b/debian/patches/series
index f33db52..53637f6 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -15,3 +15,4 @@ CVE-2018-5738.patch
 CVE-2018-5740-1.patch
 CVE-2018-5740-2.patch
 CVE-2018-5740-3.patch
+skip-rtld-deepbind-for-dyndb.diff
diff --git a/debian/patches/skip-rtld-deepbind-for-dyndb.diff b/debian/patches/skip-rtld-deepbind-for-dyndb.diff
 new file mode 100644
index 0000000..7e87582
--- /dev/null
+++ b/debian/patches/skip-rtld-deepbind-for-dyndb.diff
@@ -0,0 +1,29 @@
+Description: RTLD_DEEPBIND conflicts with pkcs11 libraries, skip it for dyndb
+ The crash manifested itself when deploying FreeIPA, as described in the
+ Ubuntu bug. This is a distro-only patch because of the way bind9 is built, so
+ no forwarding is needed.
+ .
+ Debian applied the same patch to its bind9 package at
+ https://salsa.debian.org/dns-team/bind9/commit/afc6b5fe2e359e4e7eadc256cd94481965418b4b
+Author: Petr Menšík <[e-mail]>
+Origin: https://pagure.io/fedora-bind/blob/3d5ea105bd877f0069452e450320f8877b01cb52/f/bind-9.11-rh1410433.patch
+Bug-Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1410433
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/freeipa/+bug/1769440
+Forwarded: not-needed
+Last-Update: 2018-10-11
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
+index e21a84c7..ac18162c 100644
+--- a/lib/dns/dyndb.c
++++ b/lib/dns/dyndb.c
+@@ -133,9 +133,6 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
+ 		      instname, filename);
+ 
+ 	flags = RTLD_NOW|RTLD_LOCAL;
+-#ifdef RTLD_DEEPBIND
+-	flags |= RTLD_DEEPBIND;
+-#endif
+ 
+ 	handle = dlopen(filename, flags);
+ 	if (handle == NULL)