Skip to content
GitLab
Explore
Sign in
Register
Commits on Source (289)
3e6b84f8
VERSION: Bump version up to 4.9.6...
Mar 11, 2019
00baebb8
lib: Make idmap_cache return negative mappings
Mar 12, 2019
d9b762a3
idmap_cache: Only touch "sid" on success in find_xid_to_sid
Mar 12, 2019
bdeacbab
winbind: Initialize "expired" parameter to idmap_cache_xid2sid
Mar 12, 2019
527ecdbe
winbind: Now we explicitly track if we got ids from cache
Mar 12, 2019
71f7738c
idmap_cache: Introduce idmap_cache_find_xid2sid
Mar 12, 2019
d74b8a1c
torture: Add tests for idmap cache
Mar 12, 2019
5bf41f42
winbind: Use idmap_cache_find_xid2sid
Mar 12, 2019
713c48eb
lib: Introduce winbind_xid_to_sid
Mar 12, 2019
522b8501
lib: Add dom_sid_str_buf
Mar 12, 2019
f175abcc
passdb: Introduce xid_to_sid
Mar 12, 2019
1f915119
passdb: Make [ug]id_to_sid use xid_to_sid
Mar 12, 2019
f506180c
passdb: Update ABI to 0.27.2
Mar 12, 2019
7f74413a
lib/winbind_util: Move include out of ifdef
Mar 12, 2019
65c85aee
lib/winbind_util: Add winbind_xid_to_sid for --without-winbind
Mar 12, 2019
f232cd76
CI: don't use swap
Mar 12, 2019
aaefa8ea
WHATSNEW: mention new vfs_glusterfs_fuse module
Mar 12, 2019
fc40f87e
lib:util: Move debug message for mkdir failing to log level 1
Mar 12, 2019
1e408871
Send status to systemd on daemon start
Mar 22, 2019
166dd92d
ndr_spoolss_buf: fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT()
Mar 22, 2019
6c2d5bca
s3:script: Fix jobid check in test_smbspool.sh
Mar 22, 2019
d311eff5
s3:client: Pass DEVICE_URI and AUTH_INFO_REQUIRED env to smbspool
Mar 22, 2019
590fd475
s3:client: Evaluate the AUTH_INFO_REQUIRED variable set by cups
Mar 22, 2019
e07b8444
s3:client: Make sure we work on a copy of the title
Mar 22, 2019
7f4492c7
s3:client: Fix smbspool device uri handling
Mar 22, 2019
6e76e884
ctdb-packaging: ctdb package should not own system library directory
Mar 22, 2019
9e4b17aa
ctdb-packaging: Test package requires tcpdump
Mar 22, 2019
eb4e66cd
ctdb: Initialize addr struct to zero before reparsing as IPV4
Mar 22, 2019
5f94bc51
ctdb-tests: Add some testing for IPv4-mapped IPv6 address parsing
Mar 22, 2019
b861e5e9
s4:librpc: Fix installation of Samba
Mar 22, 2019
139da67c
python/samba: PY3 port for ridalloc_exop test to work
Mar 28, 2019
5602db1b
python/samba: extra ndr_unpack needs bytes function
Mar 28, 2019
7bcb0729
selftest: force running with TZ=UTC
Mar 28, 2019
9339b096
blackbox/dbcheck-links.sh: reproduce lost deleted object problem
Mar 28, 2019
44c83b09
dsdb:repl_meta_data: allow CONTROL_DBCHECK_FIX_LINK_DN_NAME to by pass rename
Mar 28, 2019
0aaf7c98
dbcheck: use DSDB_CONTROL_DBCHECK_FIX_LINK_DN_NAME when renaming deleted objects
Mar 28, 2019
76de43f0
dbcheck: do isDeleted, systemFlags and replPropertyMetaData detection first
Mar 28, 2019
07ebd654
dbcheck: don't move already deleted objects to LostAndFound
Mar 28, 2019
7402d9cf
dbcheck: don't remove dangling one-way links on already deleted objects
Mar 28, 2019
45850169
dbcheck: add find_repl_attid() helper function
Mar 28, 2019
860b04aa
blackbox/dbcheck-links.sh: add regression test for lost deleted object repair
Mar 28, 2019
107883df
dbcheck: detect the change after deletion bug
Mar 28, 2019
aebf46d9
python/samba/netcmd: provide SUPPRESS_HELP via Option class
Mar 28, 2019
02f3d0a1
dbcheck: add --selftest-check-expired-tombstones cmdline option
Mar 28, 2019
543fc3e9
blackbox/dbcheck*.sh: pass --selftest-check-expired-tombstones to dbcheck
Mar 28, 2019
3fca3dcc
blackbox/dbcheck-links.sh: prepare regression test for skipping expired tombstones
Mar 28, 2019
693c3498
dbcheck: don't check expired tombstone objects by default anymore
Mar 28, 2019
42b62465
dbcheck: use the str() value of the "name" attribute
Mar 28, 2019
d44f2157
py/graph: use 2.6 compatible check for set membership
Mar 28, 2019
87ffad41
py/kcc_utils: py2.6 compatibility
Mar 28, 2019
4644b23b
Fix typos in "valid"
Mar 28, 2019
223352ee
regfio: Use correct function names in debug information
Mar 28, 2019
b5ae06cc
regfio: Add trivial unit test
Mar 28, 2019
f3552ad5
regfio: Improve handling of malformed registry hive files
Mar 28, 2019
0cc35082
regfio: Update code near recent changes to match README.Coding
Mar 28, 2019
055b971a
regfio tests: Update comment style to match README.Coding
Mar 28, 2019
5b716115
s3:waf: Fix the detection of makdev() macro on Linux
Mar 28, 2019
9c52fdc1
s3:lib: Fix the debug message for adding cache entries.
Apr 02, 2019
d59cefc8
libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response
Apr 02, 2019
49231313
VERSION: Bump version up to 4.9.6...
Apr 05, 2019
b708ce3f
CVE-2019-3870 tests: Extend smbd tests to check for umask being overwritten
Apr 05, 2019
83cc536a
CVE-2019-3870 tests: Add test to check file-permissions are correct after provision
Apr 05, 2019
65a175aa
CVE-2019-3870 pysmbd: Include tests to show the outside umask has no impact
Apr 05, 2019
30db4865
CVE-2019-3870 pysmbd: Move umask manipuations as close as possible to users
Apr 05, 2019
c92ac5ad
CVE-2019-3870 pysmbd: Ensure a zero umask is set for smbd.mkdir()
Apr 05, 2019
d53121af
CVE-2019-3880 s3: rpc: winreg: Remove implementations of SaveKey/RestoreKey.
Apr 05, 2019
424563db
WHATSNEW: Add release notes for Samba 4.9.6.
Apr 05, 2019
dd7b68d1
VERSION: Disable GIT_SNAPSHOT for the 4.9.6 release.
Apr 05, 2019
8ee79597
Merge tag 'samba-4.9.6' into v4-9-test
Apr 08, 2019
d162726a
VERSION: Bump version up to 4.9.7.
Apr 08, 2019
b1d1f5f5
docs: Update smbclient manpage for --max-protocol
Apr 09, 2019
be37e77b
s3:libads: Print more information when LDAP fails
Apr 09, 2019
0acb2e42
s3:libsmb: Add some useful debug output to cliconnect
Apr 09, 2019
7dce8031
s3:libnet: Fix debug message in libnet_DomainJoin()
Apr 09, 2019
1a239fa0
auth:ntlmssp: Add back CRAP ndr debug output
Apr 09, 2019
33ec6f82
auth:creds: Prefer the principal over DOMAIN/username when using NTLM
Apr 09, 2019
cf210317
s3:libnet: Use more secure name for the JOIN krb5.conf
Apr 09, 2019
55da00ce
s3:libads: Make sure we can lookup KDCs which are not configured
Apr 09, 2019
e933ddb7
s3:ldap: Leave add machine code early for pre-existing accounts
Apr 09, 2019
4147349c
s3-libnet_join: always pass down admin domain to ads layer
Apr 09, 2019
d101da49
s3-libnet_join: setup libnet join error string when AD connect fails
Apr 09, 2019
7f1811ee
s3-libnet_join: allow fallback to NTLMSSP auth in libnet_join
Apr 09, 2019
d78118d0
py/provision: fix for Python 2.6
Apr 09, 2019
d415458f
ctdb-scripts: Reindent some functions prior to making changes
Apr 12, 2019
11758628
ctdb-scripts: Rename variable nfslock_service to nfs_lock_service
Apr 12, 2019
022b9a6c
ctdb-scripts: Add test variable CTDB_NFS_DISTRO_STYLE
Apr 12, 2019
f0082767
ctdb-scripts: Factor out nfs_load_config()
Apr 12, 2019
5a97b7f0
ctdb-scripts: Stop/start mount/rquotad/status via NFS call-out
Apr 12, 2019
7932032d
ctdb-scripts: Start NFS quota service if defined
Apr 12, 2019
aee71ea6
ctdb-scripts: Add systemd services to NFS call-out
Apr 12, 2019
14069988
ctdb-tests: Update NFS test infrastructure to support systemd services
Apr 12, 2019
dae0e8ec
ctdb-scripts: Allow load_system_config() to take multiple alternatives
Apr 12, 2019
49fa0881
ctdb-scripts: Update statd-callout to try several configuration files
Apr 12, 2019
116c874f
memcache: Introduce struct for storing talloc pointer
Apr 12, 2019
a54038bf
memcache: Properly track the size of talloc objects
Apr 12, 2019
e09262b7
memcache: Increase size of default memcache to 512k
Apr 12, 2019
e974e440
torture: Add test for talloc size accounting in memcache
Apr 12, 2019
d9c47cb8
ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"
Apr 15, 2019
945a41d3
ctdb-common: Avoid race between fd and signal events
Apr 15, 2019
7aa443a3
s3:smbd: handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO
Apr 24, 2019
189 additional commits have been omitted to prevent performance issues.
Hide whitespace changes
Inline
Side-by-side
.gitlab-ci.yml
View file @
fa5ae722
...
...
@@ -7,12 +7,7 @@ variables:
GIT_DEPTH
:
"
3"
before_script
:
-
echo "Build starting (preparing swap)..."
-
if [ $(df -m / --output=avail | tail -n1) -gt 10240 ]; then
sudo dd if=/dev/zero of=/samba-swap bs=1M count=6144;
sudo mkswap /samba-swap;
sudo swapon /samba-swap;
fi
-
echo "Build starting..."
after_script
:
-
tar -xf logs.tar.gz system-info.txt -O
...
...
VERSION
View file @
fa5ae722
...
...
@@ -25,7 +25,7 @@
########################################################
SAMBA_VERSION_MAJOR=4
SAMBA_VERSION_MINOR=9
SAMBA_VERSION_RELEASE=
5
SAMBA_VERSION_RELEASE=
11
########################################################
# If a official release has a serious bug #
...
...
WHATSNEW.txt
View file @
fa5ae722
==============================
Release Notes for Samba 4.9.11
July 03, 2019
==============================
This is the latest stable release of the Samba 4.9 release series.
In yesterday's Samba 4.9.10 release, LDAP_REFERRAL_SCHEME_OPAQUE was added to
db_module.h in order to fix bug #12478. Unfortunately, the ldb version was not
raised. Samba >= 4.9.10 is no longer able to build with ldb 1.4.6. This version
includes the new ldb version. Please note that there are just the version bumps
in ldb and Samba, no code change. If you don't build Samba with an external ldb
library, you can ignore this release and keep using 4.9.11.
Changes since 4.9.10:
---------------------
o Stefan Metzmacher <metze@samba.org>
* BUG 12478: ldb: Release ldb 1.4.7.
#######################################
Reporting bugs & Development Discussion
#######################################
Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.
If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
database (https://bugzilla.samba.org/).
======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================
Release notes for older releases follow:
----------------------------------------
==============================
Release Notes for Samba 4.9.10
July 02, 2019
==============================
This is the latest stable release of the Samba 4.9 release series.
Changes since 4.9.9:
--------------------
o Jeremy Allison <jra@samba.org>
* BUG 13938: s3: SMB1: Don't allow recvfile on stream fsp's.
* BUG 13956: s3: winbind: Fix crash when invoking winbind idmap scripts.
* BUG 13964: smbd does not correctly parse arguments passed to dfree and
quota scripts.
o Andrew Bartlett <abartlet@samba.org>
* BUG 13981: docs: Improve documentation of "lanman auth" and "ntlm auth"
connection.
o Björn Baumbach <bb@sernet.de>
* BUG 14002: python/ntacls: Use correct "state directory" smb.conf option
instead of "state dir".
o Ralph Boehme <slow@samba.org>
* BUG 13840: registry: Add a missing include.
* BUG 13938: s3:smbd: Don't use recvfile on streams.
* BUG 13944: SMB guest authentication may fail.
* BUG 13958: AppleDouble conversion breaks Resourceforks.
* BUG 13964: s3: lib: Rename all uses of file_pload_XXX -> file_ploadv_XXX.
* BUG 13968: vfs_fruit makes direct use of syscalls like mmap() and pread().
* BUG 13987: s3:mdssvc: Fix flex compilation error.
o Günther Deschner <gd@samba.org>
* BUG 13872: s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly.
o David Disseldorp <ddiss@samba.org>
* BUG 13940: vfs_ceph: Fix cephwrap_flistxattr() debug message.
o Aaron Haslett <aaronhaslett@catalyst.net.nz>
* BUG 13799: dsdb:samdb: Schemainfo update with relax control.
o Amitay Isaacs <amitay@gmail.com>
* BUG 13943: ctdb-common: Fix memory leak in run_proc.
o Aliaksei Karaliou <akaraliou@panasas.com>
* BUG 13964: smbd does not correctly parse arguments passed to dfree and
quota scripts.
o Volker Lendecke <vl@samba.org>
* BUG 13903: winbind: Fix overlapping id ranges.
* BUG 13957: smbd: Fix a panic.
o Gary Lockyer <gary@catalyst.net.nz>
* BUG 12478: ldap server: Generate correct referral schemes.
* BUG 13902: lib util debug: Increase format buffer to 4KiB.
* BUG 13941: Fix use after free detected by AddressSanitizer.
* BUG 13942: s4 dsdb: Fix use after free in
samldb_rename_search_base_callback.
o Stefan Metzmacher <metze@samba.org>
* BUG 12204: Samba fails to replicate schema 69.
* BUG 13713: Schema replication fails if link crosses chunk boundary
backwards.
* BUG 13799: 'samba-tool domain schemaupgrade' uses relax control and skips
the schemaInfo update.
* BUG 13916: dsdb:audit_log: avoid printing "... remote host [Unknown] SID
[(NULL SID)] ...".
* BUG 13917: python/ntacls: We only need security.SEC_STD_READ_CONTROL in
order to get the ACL.
* BUG 13919: smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling.
o Shyamsunder Rathi <shyam.rathi@nutanix.com>
* BUG 13947: s3:loadparm: Ensure to truncate FS Volume Label at multibyte
boundary.
o Robert Sander <r.sander@heinlein-support.de>
* BUG 13918: s3: modules: ceph: Use current working directory instead of
share path.
o Christof Schmitt <cs@samba.org>
* BUG 13831: Fix inconsistent output from wbinfo --sid-to-name depending on
cache state.
o Andreas Schneider <asn@samba.org>
* BUG 13937: Fix several issues detected by GCC 9.
* BUG 13939: s3:smbspool: Fix regression printing with Kerberos credentials.
o Martin Schwenke <martin@meltin.net>
* BUG 13923: ctdb-tools: Fix ctdb dumpmemory to avoid printing trailing NUL.
* BUG 13930: ctdb-daemon: Never use 0 as a client ID.
* BUG 13943: ctdb-common: Fix memory leak.
o Rafael David Tinoco <rafaeldtinoco@ubuntu.com>
* BUG 13984: ctdb-scripts: Fix tcp_tw_recycle existence check.
o Ralph Wuerthner <ralph.wuerthner@de.ibm.com>
* BUG 13904: Log early startup failures.
#######################################
Reporting bugs & Development Discussion
#######################################
Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.
If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
database (https://bugzilla.samba.org/).
======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================
=============================
Release Notes for Samba 4.9.9
June 19, 2019
=============================
This is a security release in order to address the following defect:
o CVE-2019-12435 (Samba AD DC Denial of Service in DNS management server
(dnsserver))
=======
Details
=======
o CVE-2019-12435:
An authenticated user can crash the Samba AD DC's RPC server process via a
NULL pointer dereference.
For more details and workarounds, please refer to the security advisory.
Changes since 4.9.8:
--------------------
o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* BUG 13922: CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found
in DnssrvOperation2.
#######################################
Reporting bugs & Development Discussion
#######################################
Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.
If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
database (https://bugzilla.samba.org/).
======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================
----------------------------------------------------------------------
=============================
Release Notes for Samba 4.9.8
May 14, 2019
=============================
This is a security release in order to address the following defect:
o CVE-2018-16860 (Samba AD DC S4U2Self/S4U2Proxy unkeyed checksum)
=======
Details
=======
o CVE-2018-16860:
The checksum validation in the S4U2Self handler in the embedded Heimdal KDC
did not first confirm that the checksum was keyed, allowing replacement of
the requested target (client) principal.
For more details and workarounds, please refer to the security advisory.
Changes since 4.9.7:
--------------------
o Isaac Boukris <iboukris@gmail.com>
* BUG 13685: CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed
checksum.
#######################################
Reporting bugs & Development Discussion
#######################################
Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.
If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
database (https://bugzilla.samba.org/).
======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================
----------------------------------------------------------------------
=============================
Release Notes for Samba 4.9.7
May 1, 2019
=============================
This is the latest stable release of the Samba 4.9 release series.
Changes since 4.9.6:
--------------------
o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* BUG 13837: py/kcc_utils: py2.6 compatibility.
* BUG 13882: py/provision: Fix for Python 2.6.
o Andrew Bartlett <abartlet@samba.org>
* BUG 13840: regfio: Update code near recent changes to match README.Coding.
o Günther Deschner <gd@samba.org>
* BUG 13861: 'net ads join' to child domain fails when using
"-U admin@forestroot".
o David Disseldorp <ddiss@samba.org>
* BUG 13858: vfs_snapper: Drop unneeded fstat handler.
* BUG 13896: vfs_ceph: Explicitly enable libcephfs POSIX ACL support.
o Philipp Gesang <philipp.gesang@intra2net.com>
* BUG 13869: libcli: Permit larger values of DataLength in
SMB2_ENCRYPTION_CAPABILITIES of negotiate response.
o Michael Hanselmann <public@hansmi.ch>
* BUG 13840: regfio: Improve handling of malformed registry hive files.
o Amitay Isaacs <amitay@samba.org>
* BUG 13895: ctdb-common: Avoid race between fd and signal events.
o Volker Lendecke <vl@samba.org>
* BUG 13813: Fix idmap cache pollution with S-1-22- IDs on winbind hickup.
o Marcos Mello <marcosfrm@gmail.com>
* BUG 11568: Send status to systemd on daemon start.
o Stefan Metzmacher <metze@samba.org>
* BUG 10097: s3:smbd: Handle IO_REPARSE_TAG_DFS in
SMB_FIND_FILE_FULL_DIRECTORY_INFO.
* BUG 10344: smb2_tcon: Avoid STATUS_PENDING completely on tdis.
* BUG 12844: smb2_tcon: Avoid STATUS_PENDING responses for tree connect.
* BUG 12845: smb2_sesssetup: Avoid STATUS_PENDING responses for session
setup.
* BUG 13698: smb2_tcon: Avoid STATUS_PENDING responses for tree connect.
* BUG 13796: smb2_sesssetup: Avoid STATUS_PENDING responses for session
setup.
* BUG 13816: dbcheck in the middle of the tombstone garbage collection causes
replication failures.
* BUG 13818: ndr_spoolss_buf: Fix out of scope use of stack variable in
NDR_SPOOLSS_PUSH_ENUM_OUT().
* BUG 13862: vfs_default: Fix vfswrap_offload_write_send()
NT_STATUS_INVALID_VIEW_SIZE check.
* BUG 13863: smb2_server: Grant all 8192 credits to clients.
o Noel Power <noel.power@suse.com>
* python/samba: extra ndr_unpack needs bytes function
o Anoop C S <anoopcs@redhat.com>
* BUG 13872: s3/vfs_glusterfs[_fuse]: Dynamically determine NAME_MAX.
o Christof Schmitt <cs@samba.org>
* passdb: Update ABI to 0.27.2.
* BUG 13813: lib/winbind_util: Add winbind_xid_to_sid for --without-winbind.
* BUG 13865: memcache: Increase size of default memcache to 512k.
o Andreas Schneider <asn@samba.org>
* BUG 13823: lib:util: Move debug message for mkdir failing to log level 1.
* BUG 13832: Printing via smbspool backend with Kerberos auth fails.
* BUG 13847: s4:librpc: Fix installation of Samba.
* BUG 13848: s3:lib: Fix the debug message for adding cache entries.
* BUG 13853: s3:waf: Fix the detection of makdev() macro on Linux.
* BUG 13857: docs: Update smbclient manpage for --max-protocol.
* BUG 13861: 'net ads join' to child domain fails when using
"-U admin@forestroot".
o Zhu Shangzhong <zhu.shangzhong@zte.com.cn>
* BUG 13839: ctdb: Initialize addr struct to zero before reparsing as IPV4.
o Martin Schwenke <martin@meltin.net>
* BUG 13838: ctdb package should not own system library directory.
* BUG 13860: CTDB restarts failed NFS RPC services by hand, which is
incompatible with systemd.
* BUG 13888: ctdb-daemon: Revert "We can not assume that just because we
could complete a TCP handshake".
#######################################
Reporting bugs & Development Discussion
#######################################
Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.
If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
database (https://bugzilla.samba.org/).
======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================
----------------------------------------------------------------------
=============================
Release Notes for Samba 4.9.6
April 8, 2019
=============================
This is a security release in order to address the following defects:
o CVE-2019-3870 (World writable files in Samba AD DC private/ dir)
o CVE-2019-3880 (Save registry file outside share as unprivileged user)
=======
Details
=======
o CVE-2019-3870:
During the provision of a new Active Directory DC, some files in the private/
directory are created world-writable.
o CVE-2019-3880:
Authenticated users with write permission can trigger a symlink traversal to
write or detect files outside the Samba share.
For more details and workarounds, please refer to the security advisories.
Changes since 4.9.5:
--------------------
o Andrew Bartlett <abartlet@samba.org>
* BUG 13834: CVE-2019-3870: pysmbd: Ensure a zero umask is set for
smbd.mkdir().
o Jeremy Allison <jra@samba.org>
* BUG 13851: CVE-2018-14629: rpc: winreg: Remove implementations of
SaveKey/RestoreKey.
#######################################
Reporting bugs & Development Discussion
#######################################
Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.
If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored. All bug reports should
be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
database (https://bugzilla.samba.org/).
======================================================================
== Our Code, Our Bugs, Our Responsibility.
== The Samba Team
======================================================================
----------------------------------------------------------------------
=============================
Release Notes for Samba 4.9.5
March 12, 2019
...
...
@@ -136,8 +589,8 @@ database (https://bugzilla.samba.org/).
======================================================================
Release notes for older releases follow:
----------------------------------------
----------------------------------------------------------------------
=============================
Release Notes for Samba 4.9.4
...
...
@@ -986,6 +1439,19 @@ The 'samba_gpoupdate' command (used in applying Group Policies to the
Samba machine itself) has been renamed to "samba_gpupdate" and had the
syntax changed to better match the same tool on Windows.
New glusterfs_fuse VFS module
-----------------------------
The new vfs_glusterfs_fuse module improves performance when Samba
accesses a glusterfs volume mounted via FUSE (Filesystem in Userspace
as part of the Linux kernel). It achieves that by leveraging a
mechanism to retrieve the appropriate case of filenames by querying a
specific extended attribute in the filesystem. No extra configuration
is required to use this module, only glusterfs_fuse needs to be set in
the "vfs objects" parameter. Further details can be found in the
vfs_glusterfs_fuse(8) manpage. This new vfs_glusterfs_fuse module does
not replace the existing vfs_glusterfs module, it just provides an
additional, alternative mechanism to access a Gluster volume.
REMOVED FEATURES
================
...
...
auth/credentials/credentials.c
View file @
fa5ae722
...
...
@@ -1115,7 +1115,7 @@ _PUBLIC_ void cli_credentials_get_ntlm_username_domain(struct cli_credentials *c
const
char
**
username
,
const
char
**
domain
)
{
if
(
cred
->
principal_obtained
>
cred
->
username_obtained
)
{
if
(
cred
->
principal_obtained
>
=
cred
->
username_obtained
)
{
*
domain
=
talloc_strdup
(
mem_ctx
,
""
);
*
username
=
cli_credentials_get_principal
(
cred
,
mem_ctx
);
}
else
{
...
...
auth/ntlmssp/ntlmssp_client.c
View file @
fa5ae722
...
...
@@ -342,6 +342,22 @@ NTSTATUS ntlmssp_client_challenge(struct gensec_security *gensec_security,
}
}
if
(
DEBUGLEVEL
>=
10
)
{
struct
CHALLENGE_MESSAGE
*
challenge
=
talloc
(
ntlmssp_state
,
struct
CHALLENGE_MESSAGE
);
if
(
challenge
!=
NULL
)
{
NTSTATUS
status
;
challenge
->
NegotiateFlags
=
chal_flags
;
status
=
ntlmssp_pull_CHALLENGE_MESSAGE
(
&
in
,
challenge
,
challenge
);
if
(
NT_STATUS_IS_OK
(
status
))
{
NDR_PRINT_DEBUG
(
CHALLENGE_MESSAGE
,
challenge
);
}
TALLOC_FREE
(
challenge
);
}
}
if
(
chal_flags
&
NTLMSSP_TARGET_TYPE_SERVER
)
{
ntlmssp_state
->
server
.
is_standalone
=
true
;
}
else
{
...
...
@@ -702,6 +718,22 @@ NTSTATUS ntlmssp_client_challenge(struct gensec_security *gensec_security,
return
nt_status
;
}
if
(
DEBUGLEVEL
>=
10
)
{
struct
AUTHENTICATE_MESSAGE
*
authenticate
=
talloc
(
ntlmssp_state
,
struct
AUTHENTICATE_MESSAGE
);
if
(
authenticate
!=
NULL
)
{
NTSTATUS
status
;
authenticate
->
NegotiateFlags
=
ntlmssp_state
->
neg_flags
;
status
=
ntlmssp_pull_AUTHENTICATE_MESSAGE
(
out
,
authenticate
,
authenticate
);
if
(
NT_STATUS_IS_OK
(
status
))
{
NDR_PRINT_DEBUG
(
AUTHENTICATE_MESSAGE
,
authenticate
);
}
TALLOC_FREE
(
authenticate
);
}
}
/*
* We always include the MIC, even without:
* av_flags->Value.AvFlags |= NTLMSSP_AVFLAG_MIC_IN_AUTHENTICATE_MESSAGE;
...
...
ctdb/common/event_script.c
View file @
fa5ae722
...
...
@@ -117,7 +117,8 @@ int event_script_get_list(TALLOC_CTX *mem_ctx,
}
*
out
=
script_list
;
return
0
;
ret
=
0
;
goto
done
;
nomem:
ret
=
ENOMEM
;
...
...
ctdb/common/run_proc.c
View file @
fa5ae722
...
...
@@ -295,13 +295,22 @@ again:
proc
->
result
.
sig
=
WTERMSIG
(
status
);
}
/* Confirm that all data has been read from the pipe */
if
(
proc
->
fd
!=
-
1
)
{
proc_read_handler
(
ev
,
proc
->
fde
,
0
,
proc
);
TALLOC_FREE
(
proc
->
fde
);
proc
->
fd
=
-
1
;
}
DLIST_REMOVE
(
run_ctx
->
plist
,
proc
);
/* Active run_proc request */
if
(
proc
->
req
!=
NULL
)
{
run_proc_done
(
proc
->
req
);
}
else
{
talloc_free
(
proc
);
}
DLIST_REMOVE
(
run_ctx
->
plist
,
proc
);
goto
again
;
}
...
...
@@ -419,6 +428,7 @@ static void run_proc_done(struct tevent_req *req)
if
(
state
->
proc
->
output
!=
NULL
)
{
state
->
output
=
talloc_steal
(
state
,
state
->
proc
->
output
);
}
talloc_steal
(
state
,
state
->
proc
);
tevent_req_done
(
req
);
}
...
...
ctdb/common/sock_daemon.c
View file @
fa5ae722
...
...
@@ -893,7 +893,7 @@ static void sock_daemon_run_socket_fail(struct tevent_req *subreq)
subreq
,
struct
tevent_req
);
struct
sock_daemon_run_state
*
state
=
tevent_req_data
(
req
,
struct
sock_daemon_run_state
);
const
char
*
sockpath
=
NULL
;
const
char
*
sockpath
=
"INVALID"
;
int
ret
=
0
;
bool
status
;
...
...
ctdb/config/functions
View file @
fa5ae722
...
...
@@ -33,15 +33,16 @@ fi
load_system_config ()
{
if [ -z "$1" ] ; then
return
fi
if [ -f "${CTDB_SYS_ETCDIR}/sysconfig/$1" ]; then
. "${CTDB_SYS_ETCDIR}/sysconfig/$1"
elif [ -f "${CTDB_SYS_ETCDIR}/default/$1" ]; then
. "${CTDB_SYS_ETCDIR}/default/$1"
fi
for _i ; do
if [ -f "${CTDB_SYS_ETCDIR}/sysconfig/${_i}" ]; then
. "${CTDB_SYS_ETCDIR}/sysconfig/${_i}"
return
elif [ -f "${CTDB_SYS_ETCDIR}/default/${_i}" ]; then
. "${CTDB_SYS_ETCDIR}/default/${_i}"
return
fi
done
}
# load_script_options [ component script ]
...
...
ctdb/config/nfs-checks.d/10.status.check
View file @
fa5ae722
...
...
@@ -2,6 +2,6 @@
version="1"
restart_every=2
unhealthy_after=6
service_stop_cmd="
killall -q -9 rpc.
stat
d
"
service_start_cmd="
rpc.statd ${STATD_HA_CALLOUT:+-H} $STATD_HA_CALLOUT ${STATD_HOSTNAME:+-n} $STATD_HOSTNAME ${STATD_PORT:+-p} $STATD_PORT ${STATD_OUTGOING_PORT:+-o} $STATD_OUTGOING_PORT
"
service_stop_cmd="
$CTDB_NFS_CALLOUT stop
stat
us
"
service_start_cmd="
$CTDB_NFS_CALLOUT start status
"
service_debug_cmd="program_stack_traces rpc.statd 5"
ctdb/config/nfs-checks.d/40.mountd.check
View file @
fa5ae722
...
...
@@ -2,6 +2,6 @@
version="1"
restart_every=2
unhealthy_after=6
service_stop_cmd="
killall -q -9 rpc.
mountd"
service_start_cmd="
rpc.mountd $RPCMOUNTDOPTS ${MOUNTD_PORT:+-p} $MOUNTD_PORT
"
service_stop_cmd="
$CTDB_NFS_CALLOUT stop
mountd"
service_start_cmd="
$CTDB_NFS_CALLOUT start mountd
"
service_debug_cmd="program_stack_traces rpc.mountd 5"
ctdb/config/nfs-checks.d/50.rquotad.check
View file @
fa5ae722
...
...
@@ -2,6 +2,6 @@
version="1"
restart_every=2
unhealthy_after=6
service_stop_cmd="
killall -q -9 rpc.
rquotad"
service_start_cmd="
rpc.rquotad ${RQUOTAD_PORT:+-p} $RQUOTAD_PORT
"
service_stop_cmd="
$CTDB_NFS_CALLOUT stop
rquotad"
service_start_cmd="
$CTDB_NFS_CALLOUT start rquotad
"
service_debug_cmd="program_stack_traces rpc.rquotad 5"
ctdb/config/nfs-linux-kernel-callout
View file @
fa5ae722
...
...
@@ -12,20 +12,66 @@ set -e
# hook for testing.
nfs_exports_file
=
"
${
CTDB_NFS_EXPORTS_FILE
:-
/var/lib/nfs/etab
}
"
# Red Hat
nfs_service
=
"nfs"
nfslock_service
=
"nfslock"
nfs_config
=
"/etc/sysconfig/nfs"
# As above, edit the default value below. CTDB_NFS_DISTRO_STYLE is a
# test variable only.
nfs_distro_style
=
"
${
CTDB_NFS_DISTRO_STYLE
:-
sysvinit
-redhat
}
"
case
"
$nfs_distro_style
"
in
systemd-
*
)
# Defaults
nfs_service
=
"nfs-server"
nfs_lock_service
=
"rpc-statd"
nfs_mountd_service
=
"nfs-mountd"
nfs_status_service
=
"rpc-statd"
nfs_rquotad_service
=
"rpc-rquotad"
nfs_config
=
"/etc/sysconfig/nfs"
nfs_rquotad_config
=
""
# Not use with systemd, restart via service
case
"
$nfs_distro_style
"
in
*
-redhat
|
*
-suse
)
:
# Defaults only
;;
*
-debian
)
nfs_rquotad_service
=
"quotarpc"
;;
*
)
echo
"Internal error"
exit
1
esac
;;
# SUSE
#nfs_service="nfsserver"
#nfslock_service=""
#nfs_config="/etc/sysconfig/nfs"
sysvinit-
*
)
# Defaults
nfs_service
=
"nfs"
nfs_lock_service
=
""
nfs_mountd_service
=
""
nfs_status_service
=
""
nfs_rquotad_service
=
""
nfs_config
=
"/etc/sysconfig/nfs"
nfs_rquotad_config
=
"
$nfs_config
"
case
"
$nfs_distro_style
"
in
*
-redhat
)
nfs_lock_service
=
"nfslock"
;;
*
-suse
)
nfs_service
=
"nfsserver"
;;
*
-debian
)
nfs_service
=
"nfs-kernel-server"
nfs_config
=
"/etc/default/nfs-kernel-server"
nfs_rquotad_config
=
"/etc/default/quota"
;;
*
)
echo
"Internal error"
exit
1
esac
;;
# Debian
#nfs_service="nfs-kernel-serve
r"
#nfslock_service=""
#nfs_config="/etc/default/nfs-kernel-server"
*
)
echo
"Internal erro
r"
exit
1
esac
# Override for unit testing
if
[
-z
"
$PROCFS_PATH
"
]
;
then
...
...
@@ -46,50 +92,70 @@ EOF
exit
1
}
##################################################
nfs_load_config
()
{
_config
=
"
${
1
:-${
nfs_config
}}
"
if
[
-r
"
$_config
"
]
;
then
.
"
$_config
"
fi
}
##################################################
# Basic service stop and start
basic_stop
()
{
case
"
$1
"
in
case
"
$1
"
in
nfs
)
service
"
$nfs_service
"
stop
if
[
-n
"
$nfslock_service
"
]
;
then
service
"
$nfslock_service
"
stop
fi
;;
nfslock
)
if
[
-n
"
$nfslock_service
"
]
;
then
service
"
$nfslock_service
"
stop
else
if
[
-n
"
$nfs_rquotad_service
"
]
;
then
service
"
$nfs_rquotad_service
"
stop
fi
service
"
$nfs_service
"
stop
fi
;;
if
[
-n
"
$nfs_lock_service
"
]
;
then
service
"
$nfs_lock_service
"
stop
fi
;;
nfslock
)
if
[
-n
"
$nfs_lock_service
"
]
;
then
service
"
$nfs_lock_service
"
stop
else
service
"
$nfs_service
"
stop
fi
;;
*
)
usage
esac
usage
esac
}
basic_start
()
{
case
"
$1
"
in
case
"
$1
"
in
nfs
)
if
[
-n
"
$nfslock_service
"
]
;
then
service
"
$nfslock_service
"
start
fi
service
"
$nfs_service
"
start
;;
nfslock
)
if
[
-n
"
$nfslock_service
"
]
;
then
service
"
$nfslock_service
"
start
else
if
[
-n
"
$nfs_lock_service
"
]
;
then
service
"
$nfs_lock_service
"
start
fi
service
"
$nfs_service
"
start
fi
;;
if
[
-n
"
$nfs_rquotad_service
"
]
;
then
service
"
$nfs_rquotad_service
"
start
fi
;;
nfslock
)
if
[
-n
"
$nfs_lock_service
"
]
;
then
service
"
$nfs_lock_service
"
start
else
service
"
$nfs_service
"
start
fi
;;
*
)
usage
esac
usage
esac
}
##################################################
...
...
@@ -97,32 +163,109 @@ basic_start ()
service_stop
()
{
case
"
$1
"
in
case
"
$1
"
in
nfs
)
echo
0
>
"
${
PROCFS_PATH
}
/fs/nfsd/threads"
basic_stop
"nfs"
>
/dev/null 2>&1
||
true
pkill
-9
nfsd
;;
echo
0
>
"
${
PROCFS_PATH
}
/fs/nfsd/threads"
basic_stop
"nfs"
>
/dev/null 2>&1
||
true
pkill
-9
nfsd
;;
nlockmgr
)
basic_stop
"nfslock"
>
/dev/null 2>&1
||
true
;;
basic_stop
"nfslock"
>
/dev/null 2>&1
||
true
;;
mountd
)
if
[
-n
"
$nfs_mountd_service
"
]
;
then
service
"
$nfs_mountd_service
"
stop
return
fi
# Default to stopping by hand
killall
-q
-9
rpc.mountd
;;
rquotad
)
if
[
-n
"
$nfs_rquotad_service
"
]
;
then
service
"
$nfs_rquotad_service
"
stop
return
fi
# Default to stopping by hand
killall
-q
-9
rpc.rquotad
;;
status
)
if
[
-n
"
$nfs_status_service
"
]
;
then
service
"
$nfs_status_service
"
stop
return
fi
# Default to stopping by hand
killall
-q
-9
rpc.statd
;;
*
)
usage
esac
usage
esac
}
service_start
()
{
case
"
$1
"
in
case
"
$1
"
in
nfs
)
basic_start
"nfs"
;;
basic_start
"nfs"
;;
nlockmgr
)
basic_start
"nfslock"
;;
basic_start
"nfslock"
;;
mountd
)
if
[
-n
"
$nfs_mountd_service
"
]
;
then
service
"
$nfs_mountd_service
"
start
return
fi
# Default to starting by hand
nfs_load_config
if
[
-z
"
$RPCMOUNTDOPTS
"
]
;
then
RPCMOUNTDOPTS
=
"
${
MOUNTD_PORT
:+-p
}
$MOUNTD_PORT
"
fi
# shellcheck disable=SC2086
rpc.mountd
$RPCMOUNTDOPTS
;;
rquotad
)
if
[
-n
"
$nfs_rquotad_service
"
]
;
then
service
"
$nfs_rquotad_service
"
start
return
fi
# Default to starting by hand
nfs_load_config
"
$nfs_rquotad_config
"
if
[
-z
"
$RPCRQUOTADOPTS
"
]
;
then
RPCRQUOTADOPTS
=
"
${
RQUOTAD_PORT
:+-p
}
$RQUOTAD_PORT
"
fi
# shellcheck disable=SC2086
rpc.rquotad
$RPCRQUOTADOPTS
;;
status
)
if
[
-n
"
$nfs_status_service
"
]
;
then
service
"
$nfs_status_service
"
start
return
fi
# Default to starting by hand
nfs_load_config
# Red Hat uses STATDARG, Debian uses STATDOPTS
opts
=
"
${
STATDARG
:-${
STATDOPTS
:-
''
}}
"
if
[
-z
"
$opts
"
]
;
then
# shellcheck disable=SC2086
set
--
\
${
STATD_HA_CALLOUT
:+-H
}
$STATD_HA_CALLOUT
\
${
STATD_HOSTNAME
:+-n
}
$STATD_HOSTNAME
\
${
STATD_PORT
:+-p
}
$STATD_PORT
\
${
STATD_OUTGOING_PORT
:+-o
}
$STATD_OUTGOING_PORT
opts
=
"
$*
"
fi
# shellcheck disable=SC2086
rpc.statd
$opts
;;
*
)
usage
esac
usage
esac
}
##################################################
...
...
@@ -138,8 +281,8 @@ nfs_startup ()
basic_stop
"nfs"
||
true
basic_start
"nfs"
_f
=
"
${
PROCFS_PATH
}
/sys/net/ipv4/tcp_tw_recycle"
if
[
"
$_f
"
]
;
then
echo
1
>
"
$_f
"
if
[
-f
"
$_f
"
]
;
then
echo
1
>
"
$_f
"
fi
}
...
...
@@ -149,9 +292,7 @@ nfs_startup ()
nfs_check_thread_count
()
{
# Load NFS configuration to get desired number of threads.
if
[
-r
"
$nfs_config
"
]
;
then
.
"
$nfs_config
"
fi
nfs_load_config
# If $RPCNFSDCOUNT/$USE_KERNEL_NFSD_NUMBER isn't set then we could
# guess the default from the initscript. However, let's just
...
...
ctdb/config/statd-callout
View file @
fa5ae722
...
...
@@ -20,7 +20,8 @@ die ()
exit
1
}
load_system_config
"nfs"
# Try different variables to find config file for NFS_HOSTNAME
load_system_config
"nfs"
"nfs-common"
[
-n
"
$NFS_HOSTNAME
"
]
||
\
die
"NFS_HOSTNAME is not configured. statd-callout failed"
...
...
ctdb/doc/ctdb-etcd.7
View file @
fa5ae722
...
...
@@ -2,12 +2,12 @@
.\" Title: ctdb-etcd
.\" Author:
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\" Date: 0
3/12
/2019
.\" Date: 0
7/03
/2019
.\" Manual: CTDB - clustered TDB database
.\" Source: ctdb
.\" Language: English
.\"
.TH "CTDB\-ETCD" "7" "0
3/12
/2019" "ctdb" "CTDB \- clustered TDB database"
.TH "CTDB\-ETCD" "7" "0
7/03
/2019" "ctdb" "CTDB \- clustered TDB database"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
...
...
ctdb/doc/ctdb-script.options.5
View file @
fa5ae722
...
...
@@ -2,12 +2,12 @@
.\" Title: ctdb-script.options
.\" Author:
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\" Date: 0
3/12
/2019
.\" Date: 0
7/03
/2019
.\" Manual: CTDB - clustered TDB database
.\" Source: ctdb
.\" Language: English
.\"
.TH "CTDB\-SCRIPT\&.OPTIO" "5" "0
3/12
/2019" "ctdb" "CTDB \- clustered TDB database"
.TH "CTDB\-SCRIPT\&.OPTIO" "5" "0
7/03
/2019" "ctdb" "CTDB \- clustered TDB database"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
...
...
ctdb/doc/ctdb-statistics.7
View file @
fa5ae722
...
...
@@ -2,12 +2,12 @@
.\" Title: ctdb-statistics
.\" Author:
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\" Date: 0
3/12
/2019
.\" Date: 0
7/03
/2019
.\" Manual: CTDB - clustered TDB database
.\" Source: ctdb
.\" Language: English
.\"
.TH "CTDB\-STATISTICS" "7" "0
3/12
/2019" "ctdb" "CTDB \- clustered TDB database"
.TH "CTDB\-STATISTICS" "7" "0
7/03
/2019" "ctdb" "CTDB \- clustered TDB database"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
...
...
ctdb/doc/ctdb-tunables.7
View file @
fa5ae722
...
...
@@ -2,12 +2,12 @@
.\" Title: ctdb-tunables
.\" Author:
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\" Date: 0
3/12
/2019
.\" Date: 0
7/03
/2019
.\" Manual: CTDB - clustered TDB database
.\" Source: ctdb
.\" Language: English
.\"
.TH "CTDB\-TUNABLES" "7" "0
3/12
/2019" "ctdb" "CTDB \- clustered TDB database"
.TH "CTDB\-TUNABLES" "7" "0
7/03
/2019" "ctdb" "CTDB \- clustered TDB database"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
...
...
ctdb/doc/ctdb.1
View file @
fa5ae722
...
...
@@ -2,12 +2,12 @@
.\" Title: ctdb
.\" Author:
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\" Date: 0
3/12
/2019
.\" Date: 0
7/03
/2019
.\" Manual: CTDB - clustered TDB database
.\" Source: ctdb
.\" Language: English
.\"
.TH "CTDB" "1" "0
3/12
/2019" "ctdb" "CTDB \- clustered TDB database"
.TH "CTDB" "1" "0
7/03
/2019" "ctdb" "CTDB \- clustered TDB database"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
...
...
ctdb/doc/ctdb.7
View file @
fa5ae722
...
...
@@ -2,12 +2,12 @@
.\" Title: ctdb
.\" Author:
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\" Date: 0
3/12
/2019
.\" Date: 0
7/03
/2019
.\" Manual: CTDB - clustered TDB database
.\" Source: ctdb
.\" Language: English
.\"
.TH "CTDB" "7" "0
3/12
/2019" "ctdb" "CTDB \- clustered TDB database"
.TH "CTDB" "7" "0
7/03
/2019" "ctdb" "CTDB \- clustered TDB database"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
...
...
Prev
1
2
3
4
5
…
17
Next