From: Jan Engelhardt <jengelh@inai.de>
Date: 2022-12-22 00:09:20.375896408 +0100
References: https://bugzilla.suse.com/show_bug.cgi?id=1206592

The theory for this sssd crash is that during rpm upgrading it,
sssd-2.8.2 gets installed, %post runs to restart it, but oh no,
sssd-ldap-2.7.4 is still in the system. sssd_be(-2.8.2) then falls
over its feet when it loads 2.7.4 .so files. Addin symvers like below
should prevent this and pin the modules to another: sssd_be's attempt
to dlopen libsss_ldap.so(-2.7.4) will fail because
libsss_ldap.so(-2.7.4) cannot find a libsss_util.so(-2.7.4), since
the system only has libsss_util.so(-2.8.2) at this point.

---
 Makefile.am |   44 ++++++++++++++++++++++++++++++--------------
 1 file changed, 30 insertions(+), 14 deletions(-)

Index: sssd-2.10.1/Makefile.am
===================================================================
--- sssd-2.10.1.orig/Makefile.am
+++ sssd-2.10.1/Makefile.am
@@ -971,7 +971,11 @@ libsss_debug_la_SOURCES = \
 libsss_debug_la_LIBADD = \
     $(SYSLOG_LIBS)
 libsss_debug_la_LDFLAGS = \
-    -avoid-version
+    -avoid-version ${symv}
+EXTRA_libsss_debug_la_DEPENDENCIES = x.sym
+symv = -Wl,--version-script=${builddir}/x.sym
+x.sym: ${top_builddir}/config.status
+	echo "V_${PACKAGE_VERSION} { global: *; };" >$@
 
 pkglib_LTLIBRARIES += libsss_child.la
 libsss_child_la_SOURCES = src/util/child_common.c
@@ -981,7 +985,8 @@ libsss_child_la_LIBADD = \
     $(DHASH_LIBS) \
     libsss_debug.la \
     $(NULL)
-libsss_child_la_LDFLAGS = -avoid-version
+libsss_child_la_LDFLAGS = -avoid-version ${symv}
+EXTRA_libsss_child_la_DEPENDENCIES = x.sym
 
 pkglib_LTLIBRARIES += libsss_crypt.la
 
@@ -1021,7 +1026,8 @@ libsss_crypt_la_LIBADD = \
     libsss_debug.la \
     $(NULL)
 libsss_crypt_la_LDFLAGS = \
-    -avoid-version
+    -avoid-version ${symv}
+EXTRA_libsss_crypt_la_DEPENDENCIES = x.sym
 
 pkglib_LTLIBRARIES += libsss_cert.la
 
@@ -1046,8 +1052,9 @@ libsss_cert_la_LIBADD = \
     libsss_debug.la \
     $(NULL)
 libsss_cert_la_LDFLAGS = \
-    -avoid-version \
+    -avoid-version ${symv} \
     $(NULL)
+EXTRA_libsss_cert_la_DEPENDENCIES = x.sym
 
 generate-sbus-code:
 	$(builddir)/sbus_generate.sh $(abs_srcdir)
@@ -1148,8 +1155,9 @@ libsss_sbus_la_CFLAGS = \
     $(DBUS_CFLAGS) \
     $(NULL)
 libsss_sbus_la_LDFLAGS = \
-    -avoid-version \
+    -avoid-version ${symv} \
     $(NULL)
+EXTRA_libsss_sbus_la_DEPENDENCIES = x.sym
 
 pkglib_LTLIBRARIES += libsss_sbus_sync.la
 libsss_sbus_sync_la_SOURCES = \
@@ -1184,8 +1192,9 @@ libsss_sbus_sync_la_CFLAGS = \
     $(UNICODE_LIBS) \
     $(NULL)
 libsss_sbus_sync_la_LDFLAGS = \
-    -avoid-version \
+    -avoid-version ${symv} \
     $(NULL)
+EXTRA_libsss_sbus_sync_la_DEPENDENCIES = x.sym
 
 pkglib_LTLIBRARIES += libsss_iface.la
 libsss_iface_la_SOURCES = \
@@ -1214,8 +1223,9 @@ libsss_iface_la_CFLAGS = \
     $(DBUS_CFLAGS) \
     $(NULL)
 libsss_iface_la_LDFLAGS = \
-    -avoid-version \
+    -avoid-version ${symv} \
     $(NULL)
+EXTRA_libsss_iface_la_DEPENDENCIES = x.sym
 
 pkglib_LTLIBRARIES += libsss_iface_sync.la
 libsss_iface_sync_la_SOURCES = \
@@ -1242,8 +1252,9 @@ libsss_iface_sync_la_CFLAGS = \
     $(DBUS_CFLAGS) \
     $(NULL)
 libsss_iface_sync_la_LDFLAGS = \
-    -avoid-version \
+    -avoid-version ${symv} \
     $(NULL)
+EXTRA_libsss_iface_sync_la_DEPENDENCIES = x.sym
 
 pkglib_LTLIBRARIES += libsss_util.la
 libsss_util_la_SOURCES = \
@@ -1338,7 +1349,8 @@ endif
 if BUILD_PASSKEY
 libsss_util_la_SOURCES += src/db/sysdb_passkey_user_verification.c
 endif # BUILD_PASSKEY
-libsss_util_la_LDFLAGS = -avoid-version
+libsss_util_la_LDFLAGS = -avoid-version ${symv}
+EXTRA_libsss_util_la_DEPENDENCIES = x.sym
 
 SSSD_INTERNAL_LTLIBS = \
     libsss_util.la \
@@ -1354,7 +1366,7 @@ lib_LTLIBRARIES = libipa_hbac.la \
                   $(NULL)
 
 pkgconfig_DATA += src/lib/ipa_hbac/ipa_hbac.pc
-libipa_hbac_la_DEPENDENCIES = src/lib/ipa_hbac/ipa_hbac.exports
+EXTRA_libipa_hbac_la_DEPENDENCIES = src/lib/ipa_hbac/ipa_hbac.exports
 libipa_hbac_la_SOURCES = \
     src/lib/ipa_hbac/hbac_evaluator.c \
     src/util/sss_utf8.c
@@ -1682,8 +1694,9 @@ libifp_iface_la_CFLAGS = \
     $(DBUS_CFLAGS) \
     $(NULL)
 libifp_iface_la_LDFLAGS = \
-    -avoid-version \
+    -avoid-version ${symv} \
     $(NULL)
+EXTRA_libifp_iface_la_DEPENDENCIES = x.sym
 
 pkglib_LTLIBRARIES += libifp_iface_sync.la
 libifp_iface_sync_la_SOURCES = \
@@ -1708,8 +1721,9 @@ libifp_iface_sync_la_CFLAGS = \
     $(DBUS_CFLAGS) \
     $(NULL)
 libifp_iface_sync_la_LDFLAGS = \
-    -avoid-version \
+    -avoid-version ${symv} \
     $(NULL)
+EXTRA_libifp_iface_sync_la_DEPENDENCIES = x.sym
 
 sssd_ifp_SOURCES = \
     src/responder/ifp/ifpsrv.c \
@@ -4314,8 +4328,9 @@ libsss_ldap_common_la_LIBADD = \
     $(SSSD_INTERNAL_LTLIBS) \
     $(NULL)
 libsss_ldap_common_la_LDFLAGS = \
-    -avoid-version \
+    -avoid-version ${symv} \
     $(NULL)
+EXTRA_libsss_ldap_common_la_DEPENDENCIES = x.sym
 if BUILD_SYSTEMTAP
 libsss_ldap_common_la_LIBADD += stap_generated_probes.lo
 endif
@@ -4371,7 +4386,8 @@ libsss_krb5_common_la_LIBADD = \
     $(SSSD_INTERNAL_LTLIBS) \
     $(NULL)
 libsss_krb5_common_la_LDFLAGS = \
-    -avoid-version
+    -avoid-version ${symv}
+EXTRA_libsss_krb5_common_la_DEPENDENCIES = x.sym
 
 libsss_ldap_la_SOURCES = \
     src/providers/ldap/ldap_init.c \