Re: libldap and _r-functions

[Luke Howard <lukeh@padl.com>]

>Simply put, the NSS (and PAM) architecture is problematic in
>that all kinds of code which conflicts with the program can
>be linked in at run time.  The program has little protection
>from the module and the module has little protection from the
>program.  I don't view this as a OpenLDAP-specific problem,
>as there simply is little we can do to prevent program/module
>conflicts at the library level.  (Not to say that we couldn't
>use separate symbols in libldap and libldap_r, but more to
>say that use of separate symbols won't do all that much to
>prevent program/module conflicts that are inherit in the
>NSS (and PAM) architecture).

Probably the only way to avoid conflicts (unfortunately) is to
statically link libldap{_r} into nss_ldap, and ensure that its
symbols are not exported.

Of course, if we had have adopted a client/server architecture
for nss_ldap this could have been avoided...

-- Luke

--