Arch Linux

fredbezies

Member

Registered: 2011-07-28

Posts: 367

[SOLVED] Gnu TLS 3.8.9 breaks virt-manager on start

Hello.

I wasn't able to report the bug on the bug tracker so I report it here. After I upgraded gnutls to its version 3.8.9, Virt-Manager crashes on start with this error log:

Traceback (most recent call last):
  File "/usr/lib/python3.13/site-packages/libvirt.py", line 16, in <module>
    import cygvirtmod as libvirtmod  # type: ignore
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ModuleNotFoundError: No module named 'cygvirtmod'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/bin/virt-manager", line 6, in <module>
    from virtManager import virtmanager
  File "/usr/share/virt-manager/virtManager/virtmanager.py", line 19, in <module>
    from virtinst import BuildConfig
  File "/usr/share/virt-manager/virtinst/__init__.py", line 43, in <module>
    _set_libvirt_error_handler()
    ~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/share/virt-manager/virtinst/__init__.py", line 33, in _set_libvirt_error_handler
    import libvirt
  File "/usr/lib/python3.13/site-packages/libvirt.py", line 19, in <module>
    raise lib_e
  File "/usr/lib/python3.13/site-packages/libvirt.py", line 13, in <module>
    import libvirtmod  # type: ignore
    ^^^^^^^^^^^^^^^^^
ImportError: libleancrypto.so.1: l'objet partagé ne peut pas être ouvert via dlopen()

The last line can be translated by: ImportError: libleancrypto.so.1: shared object cannot be opened via dlopen()

Current fix? Downgrading gnutls to 3.8.8.

Last edited by fredbezies (2025-02-09 13:31:04)

loqs

Member

Registered: 2014-03-06

Posts: 18,334

Re: [SOLVED] Gnu TLS 3.8.9 breaks virt-manager on start

pacman -Qikk leancrypto gnutls
pacman -Qo /usr/lib/libleancrypto.so.1

fredbezies

Member

Registered: 2011-07-28

Posts: 367

Re: [SOLVED] Gnu TLS 3.8.9 breaks virt-manager on start

pacman -Qikk leancrypto gnutls
pacman -Qo /usr/lib/libleancrypto.so.1

First line:

pacman -Qikk leancrypto gnutls
Name            : leancrypto
Version         : 1.2.0-1
Description     : Lean cryptographic library usable for bare-metal environments
Architecture    : x86_64
URL             : https://leancrypto.org
Licenses        : GPL-2.0-or-later  LicenseRef-BSDvariant
                  LicenseRef-leancrypto
Groups          : None
Provides        : None
Depends On      : glibc
Optional Deps   : None
Required By     : gnutls
Optional For    : None
Conflicts With  : None
Replaces        : None
Installed Size  : 2,40 MiB
Packager        : Andreas Radke <andyrtr@archlinux.org>
Build Date      : sam. 08 f
Install Date    : sam. 08 f
Install Reason  : Installed as a dependency for another package
Install Script  : No
Validated By    : Signature

leancrypto: 95 total files, 0 altered files
Name            : gnutls
Version         : 3.8.9-1
Description     : A library which provides a secure layer over a reliable
                  transport layer
Architecture    : x86_64
URL             : https://www.gnutls.org/
Licenses        : GPL-3.0-or-later AND LGPL-2.1-or-later
Groups          : None
Provides        : None
Depends On      : glibc  gcc-libs  gmp  libtasn1  zlib  nettle  leancrypto
                  libp11-kit  libidn2  zstd  libidn2.so=0-64  libunistring
                  brotli
Optional Deps   : tpm2-tss: support for TPM2 wrapped keys [installed]
Required By     : aria2  cups  ffmpeg  fwupd  gcr-4  glib-networking
                  gnome-control-center  gnupg  gtk-vnc  libcamera  libcups
                  libcurl-gnutls  libjcat  libmicrohttpd  libnbd  libnfs
                  libngtcp2  libnice  libvirt  libvncserver  libzip  pan
                  passim  pkcs11-helper  qemu-img  qemu-system-x86  qpdf
                  rtmpdump  samba  smbclient  swtpm  tigervnc  vte3  vte4  wget
                  xmlsec  zeromq
Optional For    : systemd
Conflicts With  : None
Replaces        : None
Installed Size  : 8,00 MiB
Packager        : Andreas Radke <andyrtr@archlinux.org>
Build Date      : sam. 08 f
Install Date    : sam. 08 f
Install Reason  : Installed as a dependency for another package
Install Script  : No
Validated By    : Signature

gnutls: 1342 total files, 0 altered files

Line 2:

pacman -Qo /usr/lib/libleancrypto.so.1
/usr/lib/libleancrypto.so.1 is owned by leancrypto 1.2.0-1

loqs

Member

Registered: 2014-03-06

Posts: 18,334

Re: [SOLVED] Gnu TLS 3.8.9 breaks virt-manager on start

From the top of /usr/lib/python3.13/site-packages/libvirt.py

try:
    import libvirtmod  # type: ignore
except ImportError as lib_e:
    try:
        import cygvirtmod as libvirtmod  # type: ignore
    except ImportError as cyg_e:
        if "No module named" in str(cyg_e):
            raise lib_e

What if you manually in python:

import libvirtmod

The libvirtmod python module is provided by libvirt-python so the import should not fail and the except block never performed.

dom1nic

Member

From: Germany

Registered: 2025-02-08

Posts: 1

Website

Re: [SOLVED] Gnu TLS 3.8.9 breaks virt-manager on start

Python 3.13.2 (main, Feb  5 2025, 08:05:21) [GCC 14.2.1 20250128] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import libvirtmod
Traceback (most recent call last):
  File "<python-input-0>", line 1, in <module>
    import libvirtmod
ImportError: libleancrypto.so.1: shared object cannot be dlopen()ed
>>>
KeyboardInterrupt
>>>

Scimmia

Fellow

Registered: 2012-09-01

Posts: 12,426

Re: [SOLVED] Gnu TLS 3.8.9 breaks virt-manager on start

I wonder if this is an execstack issue. Can you try

patchelf --clear-execstack /usr/lib/libleancrypto.so.1

and see if it works? If not, just reinstall the leancrypto package to undo the potential changes

loqs

Member

Registered: 2014-03-06

Posts: 18,334

Re: [SOLVED] Gnu TLS 3.8.9 breaks virt-manager on start

b884307 add additional hardening compiler flags stipulated by openssf.org includes `-Wl,-z,nodlopen` which blocks the library being loaded by dlopen.

Scimmia

Fellow

Registered: 2012-09-01

Posts: 12,426

Re: [SOLVED] Gnu TLS 3.8.9 breaks virt-manager on start

Oh nice, I wonder if anyone's let gnutls know

AndyRTR

Developer

From: Magdeburg/Germany

Registered: 2005-10-07

Posts: 1,642

Re: [SOLVED] Gnu TLS 3.8.9 breaks virt-manager on start

https://gitlab.com/gnutls/gnutls/-/issues

metak

Member

Registered: 2009-09-27

Posts: 199

Re: [SOLVED] Gnu TLS 3.8.9 breaks virt-manager on start

kf.coreaddons: "Could not load plugin from /usr/lib/qt6/plugins/kf6/thumbcreator/ffmpegthumbs.so: Cannot load library /usr/lib/qt6/plugins/kf6/thumbcreator/ffmpegthumbs.so: libleancrypto.so.1: shared object cannot be dlopen()ed"
kf.coreaddons: "Could not load plugin from /usr/lib/qt6/plugins/kf6/thumbcreator/ffmpegthumbs.so: Cannot load library /usr/lib/qt6/plugins/kf6/thumbcreator/ffmpegthumbs.so: libleancrypto.so.1: shared object cannot be dlopen()ed"

Same issue with dolphin/ffmpegthumbs after this update and my workaround was to rebuild leancrypto without `nodlopen` in meson.build.

fredbezies

Member

Registered: 2011-07-28

Posts: 367

Re: [SOLVED] Gnu TLS 3.8.9 breaks virt-manager on start

Leancrypto 1.2.0-2 works for me. Thanks for the fix!