[python-ldap] Solaris, Python-LDAP, Apache: SEGFAULT due to shared library mismatch?

[Steffen Moser]

Hi all,

I've got a problem with Python-LDAP on our Solaris 11 based work-
group and storage server which is mainly used to host a bunch of 
web applications (based on PHP and Python). 

Let me recap the basic data:

 - Solaris 11.1 (x86_64)

 - Apache/2.2.24 (Unix) DAV/2 mod_wsgi/3.3 Python/2.6.8 
   mod_ssl/2.2.24 OpenSSL/1.0.0k

 - Python-LDAP 2.4.13 (self-compiled and linked against OpenLDAP 
   2.4.30)

Compilation and installation of Python-LDAP worked well, but as soon
as a Python script actually uses the LDAP connection, the web server
worker process dies with a "Segmentation Fault". 

When I deactivate the Apache module "mod_ldap.so", the problem is 
gone and Python-LDAP seems to run quite fine, but the thing is: The 
Apache web server also hosts applications which actually need 
"mod_ldap.so" and PHP, so I can't go for that solution.

I suppose that I've found the cause for the problem. While everything
which is related to Apache (the Apache modules, PHP, and so on), comes 
with Oracle Solaris and needs LDAP is linked to Oracle's own LDAP 
library "/usr/lib/libldap.so.5". 

This is, for example, the case for Apache's "mod_ldap.so":

 | smoser at regulus:~# ldd /usr/apache2/2.2/libexec/mod_ldap.so
 |         libldap.so.5 =>  /usr/lib/libldap.so.5
 |         libc.so.1 =>     /lib/libc.so.1
 |         libsasl.so.1 =>  /usr/lib/libsasl.so.1
 |         libsocket.so.1 =>        /lib/libsocket.so.1
 |         libnsl.so.1 =>   /lib/libnsl.so.1
 |         libmd.so.1 =>    /lib/libmd.so.1
 |         libnspr4.so =>   /usr/lib/mps/libnspr4.so
 |         libplc4.so =>    /usr/lib/mps/libplc4.so
 |         libnss3.so =>    /usr/lib/mps/libnss3.so
 |         libssl3.so =>    /usr/lib/mps/libssl3.so
 |         libmp.so.2 =>    /lib/libmp.so.2
 |         libsoftcrypto.so.1 =>    /lib/libsoftcrypto.so.1
 |         libelf.so.1 =>   /lib/libelf.so.1
 |         libpthread.so.1 =>       /lib/libpthread.so.1
 |         librt.so.1 =>    /lib/librt.so.1
 |         libdl.so.1 =>    /lib/libdl.so.1
 |         libnssutil3.so =>        /usr/lib/mps/libnssutil3.so
 |         libplds4.so =>   /usr/lib/mps/libplds4.so
 |         libthread.so.1 =>        /lib/libthread.so.1
 |         libcryptoutil.so.1 =>    /lib/libcryptoutil.so.1
 |         libm.so.2 =>     /lib/libm.so.2


Python-LDAP is depending on OpenLDAP, so I can't link it against
Sun's LDAP libraries (as stated in the FAQs of Python-LDAP):

 | smoser at regulus:~# ldd /usr/lib/python2.6/site-packages/python_ldap-2.4.13-py2.6-solaris-2.11-i86pc.egg/_ldap.so
 |         libldap-2.4.so.2 =>      /usr/lib/libldap-2.4.so.2
 |         liblber-2.4.so.2 =>      /usr/lib/liblber-2.4.so.2
 |         libsasl.so.1 =>  /usr/lib/libsasl.so.1
 |         libssl.so.1.0.0 =>       /lib/libssl.so.1.0.0
 |         libcrypto.so.1.0.0 =>    /lib/libcrypto.so.1.0.0
 |         libpython2.6.so.1.0 =>   /usr/lib/libpython2.6.so.1.0
 |         libresolv.so.2 =>        /lib/libresolv.so.2
 |         libnsl.so.1 =>   /lib/libnsl.so.1
 |         libsocket.so.1 =>        /lib/libsocket.so.1
 |         libc.so.1 =>     /lib/libc.so.1
 |         libmd.so.1 =>    /lib/libmd.so.1
 |         libdl.so.1 =>    /lib/libdl.so.1
 |         libm.so.2 =>     /lib/libm.so.2
 |         libmp.so.2 =>    /lib/libmp.so.2
 |         libsoftcrypto.so.1 =>    /lib/libsoftcrypto.so.1
 |         libelf.so.1 =>   /lib/libelf.so.1
 |         libcryptoutil.so.1 =>    /lib/libcryptoutil.so.1


So my questions are:

 - Can anybody confirm that this is really the probable cause for the
problem that we've encountered?

 - Is there any way to get both LDAP libraries to work in one 
instance of apache? 

 - Can I link the OpenLDAP libs statically or won't that help?

 - I am not an expert in linking programs in Solaris, but is it 
possible to have the OpenLDAP libraries linked to a separate 
namespace so that they don't interfere in Apache?


As far as I know, my options will be:

 - Re-compile Apache and everything that depends on it by linking
all the LDAP related things to OpenLDAP libs.

 - Run two instances of Apache on two different ports: One for the
PHP applications and one for the Python applications. The one for 
Python applications must not load any module that is linked against 
Oracle's LDAP lib while the one for the other applications must not
load any module that is linked against OpenLDAP lib.

 - Modify Python-LDAP that it can be linked against Oracle's LDAP
library (I assume that this is really a _lot_ of work).

 - Are there any other options that I might have missed?


I would be very glad if someone could help me. Thank you very much 
in advance!

Kind regards,
Steffen