ctdb/config/ctdb.service

@@ -2,6 +2,7 @@
 Description=CTDB
 Documentation=man:ctdbd(1) man:ctdb(7)
 After=network-online.target time-sync.target
+ConditionFileNotEmpty=/etc/ctdb/nodes
 
 [Service]
 Type=forking

ctdb/config/events/legacy/60.nfs.script

@@ -6,9 +6,9 @@
 
 . "${CTDB_BASE}/functions"
 
-service_name="nfs"
+service_name="nfs-kernel-server"
 
-load_system_config "nfs"
+load_system_config "nfs-kernel-server"
 
 load_script_options
 

ctdb/config/nfs-linux-kernel-callout

@@ -32,6 +32,9 @@ systemd-*)
 		: # Defaults only
 		;;
 	*-debian)
+		nfs_service="nfs-kernel-server"
+		nfs_lock_service=""
+		nfs_config="/etc/default/nfs-kernel-server"
 		nfs_rquotad_service="quotarpc"
 		;;
 	*)

ctdb/config/statd-callout

@@ -21,14 +21,14 @@ die ()
 }
 
 # Try different variables to find config file for NFS_HOSTNAME
-load_system_config "nfs" "nfs-common"
+load_system_config "nfs" "nfs-common" "nfs-kernel-server"
 
 [ -n "$NFS_HOSTNAME" ] || \
     die "NFS_HOSTNAME is not configured. statd-callout failed"
 
 ############################################################
 
-ctdb_setup_state_dir "service" "nfs"
+ctdb_setup_state_dir "service" "nfs-kernel-server"
 
 # script_state_dir set by ctdb_setup_state_dir()
 # shellcheck disable=SC2154

debian/changelog

@@ -4,6 +4,8 @@ samba (2:4.9.11+dfsg-1) UNRELEASED; urgency=medium
   * New upstream release
     - Bump ldb Build-Depends to 2:1.5.1+really1.4.7
     - Fixes printing via smbspool backend with kerberos auth (Closes: #931481)
+    - Drop security patches, merged upstream
+  * Enable vfs_nfs4acl_xattr (Closes: #930540)
 
   [ Rafael David Tinoco ]
   * debian/rules: Make DEB_HOST_ARCH_CPU initialized through dpkg-architecture
@@ -18,7 +20,7 @@ samba (2:4.9.11+dfsg-1) UNRELEASED; urgency=medium
     - d/ctdb.postrm: remove leftovers from /var/lib/ctdb/*
     - Add examples of NFS HA CTDB config files + helper script
 
- -- Mathieu Parent <sathieu@debian.org>  Sun, 07 Jul 2019 10:19:29 +0200
+ -- Mathieu Parent <sathieu@debian.org>  Sun, 07 Jul 2019 19:28:55 +0200
 
 samba (2:4.9.5+dfsg-5) unstable; urgency=high
 

debian/patches/CVE-2019-12435-4.9-03.patch

-From 0d86acb75fe645a4306a3278334f28b320b1a6ab Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Wed, 22 May 2019 12:58:01 +1200
-Subject: [PATCH 1/2] CVE-2019-12435 rpc/dns: avoid NULL deference if zone not
- found in DnssrvOperation
-
-We still want to return DOES_NOT_EXIST when request_filter is not 0.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=13922
-
-Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Andrew Bartlett <abartlet@samba.org>
----
- python/samba/tests/dcerpc/dnsserver.py        | 25 +++++++++++++++++++
- .../rpc_server/dnsserver/dcerpc_dnsserver.c   |  7 +++++-
- 2 files changed, 31 insertions(+), 1 deletion(-)
-
-diff --git a/python/samba/tests/dcerpc/dnsserver.py b/python/samba/tests/dcerpc/dnsserver.py
-index 53e1abde042..db9ed156148 100644
---- a/python/samba/tests/dcerpc/dnsserver.py
-+++ b/python/samba/tests/dcerpc/dnsserver.py
-@@ -28,6 +28,7 @@ from samba.dcerpc import dnsp, dnsserver, security
- from samba.tests import RpcInterfaceTestCase, env_get_var_value
- from samba.netcmd.dns import ARecord, AAAARecord, PTRRecord, CNameRecord, NSRecord, MXRecord, SRVRecord, TXTRecord
- from samba import sd_utils, descriptor
-+from samba import WERRORError, werror
- 
- class DnsserverTests(RpcInterfaceTestCase):
- 
-@@ -707,6 +708,30 @@ class DnsserverTests(RpcInterfaceTestCase):
-                                                 'ServerInfo')
-         self.assertEquals(dnsserver.DNSSRV_TYPEID_SERVER_INFO, typeid)
- 
-+
-+    # This test is to confirm that we do not support multizone operations,
-+    # which are designated by a non-zero dwContext value (the 3rd argument
-+    # to DnssrvOperation).
-+    def test_operation_invalid(self):
-+        non_zone = 'a-zone-that-does-not-exist'
-+        typeid = dnsserver.DNSSRV_TYPEID_NAME_AND_PARAM
-+        name_and_param = dnsserver.DNS_RPC_NAME_AND_PARAM()
-+        name_and_param.pszNodeName = 'AllowUpdate'
-+        name_and_param.dwParam = dnsp.DNS_ZONE_UPDATE_SECURE
-+        try:
-+            res = self.conn.DnssrvOperation(self.server,
-+                                            non_zone,
-+                                            1,
-+                                            'ResetDwordProperty',
-+                                            typeid,
-+                                            name_and_param)
-+        except WERRORError as e:
-+            if e.args[0] == werror.WERR_DNS_ERROR_ZONE_DOES_NOT_EXIST:
-+                return
-+
-+        # We should always encounter a DOES_NOT_EXIST error.
-+        self.fail()
-+
-     def test_operation2(self):
-         client_version = dnsserver.DNS_CLIENT_VERSION_LONGHORN
-         rev_zone = '1.168.192.in-addr.arpa'
-diff --git a/source4/rpc_server/dnsserver/dcerpc_dnsserver.c b/source4/rpc_server/dnsserver/dcerpc_dnsserver.c
-index b42d7c549d1..4e28778c89a 100644
---- a/source4/rpc_server/dnsserver/dcerpc_dnsserver.c
-+++ b/source4/rpc_server/dnsserver/dcerpc_dnsserver.c
-@@ -1955,7 +1955,12 @@ static WERROR dcesrv_DnssrvOperation(struct dcesrv_call_state *dce_call, TALLOC_
- 						&r->in.pData);
- 	} else {
- 		z = dnsserver_find_zone(dsstate->zones, r->in.pszZone);
--		if (z == NULL && request_filter == 0) {
-+		/*
-+		 * In the case that request_filter is not 0 and z is NULL,
-+		 * the request is for a multizone operation, which we do not
-+		 * yet support, so just error on NULL zone name.
-+		 */
-+		if (z == NULL) {
- 			return WERR_DNS_ERROR_ZONE_DOES_NOT_EXIST;
- 		}
- 
--- 
-2.17.1
-
-
-From f05cc18c08a63850d956a0b8b325d88c5be3bef9 Mon Sep 17 00:00:00 2001
-From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Date: Wed, 22 May 2019 13:23:25 +1200
-Subject: [PATCH 2/2] CVE-2019-12435 rpc/dns: avoid NULL deference if zone not
- found in DnssrvOperation2
-
-We still want to return DOES_NOT_EXIST when request_filter is not 0.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=13922
-
-Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
-Reviewed-by: Andrew Bartlett <abartlet@samba.org>
----
- python/samba/tests/dcerpc/dnsserver.py        | 26 +++++++++++++++++++
- .../rpc_server/dnsserver/dcerpc_dnsserver.c   |  7 ++++-
- 2 files changed, 32 insertions(+), 1 deletion(-)
-
-diff --git a/python/samba/tests/dcerpc/dnsserver.py b/python/samba/tests/dcerpc/dnsserver.py
-index db9ed156148..7264a290ef2 100644
---- a/python/samba/tests/dcerpc/dnsserver.py
-+++ b/python/samba/tests/dcerpc/dnsserver.py
-@@ -732,6 +732,32 @@ class DnsserverTests(RpcInterfaceTestCase):
-         # We should always encounter a DOES_NOT_EXIST error.
-         self.fail()
- 
-+    # This test is to confirm that we do not support multizone operations,
-+    # which are designated by a non-zero dwContext value (the 5th argument
-+    # to DnssrvOperation2).
-+    def test_operation2_invalid(self):
-+        client_version = dnsserver.DNS_CLIENT_VERSION_LONGHORN
-+        non_zone = 'a-zone-that-does-not-exist'
-+        typeid = dnsserver.DNSSRV_TYPEID_NAME_AND_PARAM
-+        name_and_param = dnsserver.DNS_RPC_NAME_AND_PARAM()
-+        name_and_param.pszNodeName = 'AllowUpdate'
-+        name_and_param.dwParam = dnsp.DNS_ZONE_UPDATE_SECURE
-+        try:
-+            res = self.conn.DnssrvOperation2(client_version,
-+                                             0,
-+                                             self.server,
-+                                             non_zone,
-+                                             1,
-+                                             'ResetDwordProperty',
-+                                             typeid,
-+                                             name_and_param)
-+        except WERRORError as e:
-+            if e.args[0] == werror.WERR_DNS_ERROR_ZONE_DOES_NOT_EXIST:
-+                return
-+
-+        # We should always encounter a DOES_NOT_EXIST error.
-+        self.fail()
-+
-     def test_operation2(self):
-         client_version = dnsserver.DNS_CLIENT_VERSION_LONGHORN
-         rev_zone = '1.168.192.in-addr.arpa'
-diff --git a/source4/rpc_server/dnsserver/dcerpc_dnsserver.c b/source4/rpc_server/dnsserver/dcerpc_dnsserver.c
-index 4e28778c89a..353754f9261 100644
---- a/source4/rpc_server/dnsserver/dcerpc_dnsserver.c
-+++ b/source4/rpc_server/dnsserver/dcerpc_dnsserver.c
-@@ -2167,7 +2167,12 @@ static WERROR dcesrv_DnssrvOperation2(struct dcesrv_call_state *dce_call, TALLOC
- 						&r->in.pData);
- 	} else {
- 		z = dnsserver_find_zone(dsstate->zones, r->in.pszZone);
--		if (z == NULL && request_filter == 0) {
-+		/*
-+		 * In the case that request_filter is not 0 and z is NULL,
-+		 * the request is for a multizone operation, which we do not
-+		 * yet support, so just error on NULL zone name.
-+		 */
-+		if (z == NULL) {
- 			return WERR_DNS_ERROR_ZONE_DOES_NOT_EXIST;
- 		}
- 
--- 
-2.17.1
-

debian/patches/CVE-2019-3880-v4-9-02.patch

-From a803d2524b8c06e2c360db0c686a212ac49f7321 Mon Sep 17 00:00:00 2001
-From: Jeremy Allison <jra@samba.org>
-Date: Thu, 21 Mar 2019 14:51:30 -0700
-Subject: [PATCH] CVE-2019-3880 s3: rpc: winreg: Remove implementations of
- SaveKey/RestoreKey.
-
-The were not using VFS backend calls and could only work
-locally, and were unsafe against symlink races and other
-security issues.
-
-If the incoming handle is valid, return WERR_BAD_PATHNAME.
-
-[MS-RRP] states "The format of the file name is implementation-specific"
-so ensure we don't allow this.
-
-As reported by Michael Hanselmann.
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=13851
-
-Signed-off-by: Jeremy Allison <jra@samba.org>
-Reviewed-by: Andrew Bartlett <abartlet@samba.org>
----
- source3/rpc_server/winreg/srv_winreg_nt.c | 92 ++-----------------------------
- 1 file changed, 4 insertions(+), 88 deletions(-)
-
-diff --git a/source3/rpc_server/winreg/srv_winreg_nt.c b/source3/rpc_server/winreg/srv_winreg_nt.c
-index d9ee8d0602d..816c6bb2a12 100644
---- a/source3/rpc_server/winreg/srv_winreg_nt.c
-+++ b/source3/rpc_server/winreg/srv_winreg_nt.c
-@@ -640,46 +640,6 @@ WERROR _winreg_AbortSystemShutdown(struct pipes_struct *p,
- }
- 
- /*******************************************************************
-- ********************************************************************/
--
--static int validate_reg_filename(TALLOC_CTX *ctx, char **pp_fname )
--{
--	char *p = NULL;
--	int num_services = lp_numservices();
--	int snum = -1;
--	const char *share_path = NULL;
--	char *fname = *pp_fname;
--
--	/* convert to a unix path, stripping the C:\ along the way */
--
--	if (!(p = valid_share_pathname(ctx, fname))) {
--		return -1;
--	}
--
--	/* has to exist within a valid file share */
--
--	for (snum=0; snum<num_services; snum++) {
--		if (!lp_snum_ok(snum) || lp_printable(snum)) {
--			continue;
--		}
--
--		share_path = lp_path(talloc_tos(), snum);
--
--		/* make sure we have a path (e.g. [homes] ) */
--		if (strlen(share_path) == 0) {
--			continue;
--		}
--
--		if (strncmp(share_path, p, strlen(share_path)) == 0) {
--			break;
--		}
--	}
--
--	*pp_fname = p;
--	return (snum < num_services) ? snum : -1;
--}
--
--/*******************************************************************
-  _winreg_RestoreKey
-  ********************************************************************/
- 
-@@ -687,36 +647,11 @@ WERROR _winreg_RestoreKey(struct pipes_struct *p,
- 			  struct winreg_RestoreKey *r)
- {
- 	struct registry_key *regkey = find_regkey_by_hnd( p, r->in.handle );
--	char *fname = NULL;
--	int snum = -1;
- 
--	if ( !regkey )
-+	if ( !regkey ) {
- 		return WERR_INVALID_HANDLE;
--
--	if ( !r->in.filename || !r->in.filename->name )
--		return WERR_INVALID_PARAMETER;
--
--	fname = talloc_strdup(p->mem_ctx, r->in.filename->name);
--	if (!fname) {
--		return WERR_NOT_ENOUGH_MEMORY;
- 	}
--
--	DEBUG(8,("_winreg_RestoreKey: verifying restore of key [%s] from "
--		 "\"%s\"\n", regkey->key->name, fname));
--
--	if ((snum = validate_reg_filename(p->mem_ctx, &fname)) == -1)
--		return WERR_BAD_PATHNAME;
--
--	/* user must posses SeRestorePrivilege for this this proceed */
--
--	if ( !security_token_has_privilege(p->session_info->security_token, SEC_PRIV_RESTORE)) {
--		return WERR_ACCESS_DENIED;
--	}
--
--	DEBUG(2,("_winreg_RestoreKey: Restoring [%s] from %s in share %s\n",
--		 regkey->key->name, fname, lp_servicename(talloc_tos(), snum) ));
--
--	return reg_restorekey(regkey, fname);
-+	return WERR_BAD_PATHNAME;
- }
- 
- /*******************************************************************
-@@ -727,30 +662,11 @@ WERROR _winreg_SaveKey(struct pipes_struct *p,
- 		       struct winreg_SaveKey *r)
- {
- 	struct registry_key *regkey = find_regkey_by_hnd( p, r->in.handle );
--	char *fname = NULL;
--	int snum = -1;
- 
--	if ( !regkey )
-+	if ( !regkey ) {
- 		return WERR_INVALID_HANDLE;
--
--	if ( !r->in.filename || !r->in.filename->name )
--		return WERR_INVALID_PARAMETER;
--
--	fname = talloc_strdup(p->mem_ctx, r->in.filename->name);
--	if (!fname) {
--		return WERR_NOT_ENOUGH_MEMORY;
- 	}
--
--	DEBUG(8,("_winreg_SaveKey: verifying backup of key [%s] to \"%s\"\n",
--		 regkey->key->name, fname));
--
--	if ((snum = validate_reg_filename(p->mem_ctx, &fname)) == -1 )
--		return WERR_BAD_PATHNAME;
--
--	DEBUG(2,("_winreg_SaveKey: Saving [%s] to %s in share %s\n",
--		 regkey->key->name, fname, lp_servicename(talloc_tos(), snum) ));
--
--	return reg_savekey(regkey, fname);
-+	return WERR_BAD_PATHNAME;
- }
- 
- /*******************************************************************
--- 
-2.11.0
-

debian/patches/fix-nfs-service-name-to-nfs-kernel-server.patch

+From: Rafael David Tinoco <rafaeldtinoco@gmail.com>
 Subject: fix nfs service name to nfs-kernel-server
 
 Upstream code used to comment in/out service script names related to a specific
@@ -14,16 +15,14 @@ This temporary patch fixes the NFS service name for Debian & Ubuntu.
 
 Signed-off-by: Rafael David Tinoco <rafaeldtinoco@ubuntu.com>
 
-Author: Rafael David Tinoco <rafaeldtinoco@gmail.com>
 Bug-Debian: https://bugs.debian.org/929931
 Bug-Ubuntu: https://bugs.launchpad.net/bugs/722201
 Last-Update: 2018-06-26
-
 ---
  ctdb/config/events/legacy/60.nfs.script | 4 ++--
- ctdb/config/nfs-linux-kernel-callout    | 12 ++++++------
+ ctdb/config/nfs-linux-kernel-callout    | 3 +++
  ctdb/config/statd-callout               | 4 ++--
- 3 files changed, 10 insertions(+), 10 deletions(-)
+ 3 files changed, 7 insertions(+), 4 deletions(-)
 
 diff --git a/ctdb/config/events/legacy/60.nfs.script b/ctdb/config/events/legacy/60.nfs.script
 index 2eb90b421c8..5c6a0903322 100755

debian/patches/series

@@ -8,9 +8,5 @@ add-so-version-to-private-libraries
 heimdal-rfc3454.txt
 nsswitch-Add-try_authtok-option-to-pam_winbind.patch
 smbd.service-Run-update-apparmor-samba-profile-befor.patch
-CVE-2019-3880-v4-9-02.patch
-CVE-2019-3870-v4-9-04.patch
-CVE-2018-16860-v4-9-06.patch
-CVE-2019-12435-4.9-03.patch
 fix-nfs-service-name-to-nfs-kernel-server.patch
 ctdb-config-depend-on-etc-ctdb-nodes-file.patch

debian/rules

@@ -49,7 +49,7 @@ conf_args = \
 		--with-syslog \
 		--with-utmp \
 		--with-winbind \
-		--with-shared-modules=idmap_rid,idmap_ad,idmap_adex,idmap_hash,idmap_ldap,idmap_tdb2,vfs_dfs_samba4,auth_samba4 \
+		--with-shared-modules=idmap_rid,idmap_ad,idmap_adex,idmap_hash,idmap_ldap,idmap_tdb2,vfs_dfs_samba4,auth_samba4,vfs_nfs4acl_xattr \
 		--with-automount \
 		--with-ldap \
 		--with-ads \