[nssldap] Weird behaviour with TLS: pipes, forks, etc

[Andreas Hasenack <ahasenack [at] terra.com.br>]

I have a weird behaviour in nss_ldap-255 (didn't test much older
versions) which only manifests itself when using start_tls or plain ldaps.
The problem also goes away when using nscd.

Building a package with rpm just fails without explanation:
(...)
Wrote: /home/goetz/rpm/null/RPMS/i586/null-dummy-2-2mdv2008.0.i586.rpm
Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.2403
error: Bad exit status from /var/tmp/rpm-tmp.2403 (%clean)

But the script in question is plain simple and works if I call it manually:
$ /bin/sh -e /var/tmp/rpm-tmp.2403
+ umask 022
+ cd /home/goetz/rpm/null/SPECS/../BUILD
+ rm -rf /var/tmp/null-2-root
+ exit 0

The whole build procedure works if I use a wrapper for rpm called "bm", which
is basically a python script to help building packages. Further debugging with
strace showed that it works with this wrapper because it is ignoring SIGPIPE.

So, any clues about how to further debug this? I have seen previously in
nss_ldap's history errors with forks, signals and pipes. Maybe they are
back?

Summarizing:
- without encryption, it works
- ignoring SIGPIPE, it works
- with nscd (after the cache is populated), it works.

My /etc/ldap.conf is this:
base dc=example,dc=com
uri ldap://localhost:3899
ssl start_tls
tls_checkpeer no
pam_password exop
nss_map_attribute uniqueMember member
nss_schema rfc2307bis