Fix regression with symlinks inside shares
resolves: RHEL-115067
This commit is contained in:
Andreas Schneider
parent
b82d1170f3
commit
461be24a82
@ -1,7 +1,7 @@
|
||||
From 3c29fc78029e1274f931e171c9e04c19ad0182c1 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Thu, 17 Aug 2023 01:05:54 +0300
|
||||
Subject: [PATCH 01/44] gp: Support more global trust directories
|
||||
Subject: [PATCH 01/50] gp: Support more global trust directories
|
||||
|
||||
In addition to the SUSE global trust directory, add support for RHEL and
|
||||
Debian-based distributions (including Ubuntu).
|
||||
@ -66,7 +66,7 @@ index 312c8ddf467..1b90ab46e90 100644
|
||||
From 063606e8ec83a58972df47eb561ab267f8937ba4 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Thu, 17 Aug 2023 01:09:28 +0300
|
||||
Subject: [PATCH 02/44] gp: Support update-ca-trust helper
|
||||
Subject: [PATCH 02/50] gp: Support update-ca-trust helper
|
||||
|
||||
This is used on RHEL/Fedora instead of update-ca-certificates. They
|
||||
behave similarly so it's enough to change the command name.
|
||||
@ -110,7 +110,7 @@ index 1b90ab46e90..cefdafa21b2 100644
|
||||
From 3b548bf280ca59ef12a7af10a9131813067a850a Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Fri, 11 Aug 2023 18:46:42 +0300
|
||||
Subject: [PATCH 03/44] gp: Change root cert extension suffix
|
||||
Subject: [PATCH 03/50] gp: Change root cert extension suffix
|
||||
|
||||
On Ubuntu, certificates must end in '.crt' in order to be considered by
|
||||
the `update-ca-certificates` helper.
|
||||
@ -144,7 +144,7 @@ index cefdafa21b2..c562722906b 100644
|
||||
From 7592ed5032836dc43f657f66607a0a4661edcdb4 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Fri, 18 Aug 2023 17:06:43 +0300
|
||||
Subject: [PATCH 04/44] gp: Test with binary content for certificate data
|
||||
Subject: [PATCH 04/50] gp: Test with binary content for certificate data
|
||||
|
||||
This fails all GPO-related tests that call `gpupdate --rsop`.
|
||||
|
||||
@ -222,7 +222,7 @@ index 00000000000..0aad59607c2
|
||||
From 7f7b235bda9e85c5ea330e52e734d1113a884571 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Wed, 16 Aug 2023 12:20:11 +0300
|
||||
Subject: [PATCH 05/44] gp: Convert CA certificates to base64
|
||||
Subject: [PATCH 05/50] gp: Convert CA certificates to base64
|
||||
|
||||
I don't know whether this applies universally, but in our case the
|
||||
contents of `es['cACertificate'][0]` are binary, so cleanly converting
|
||||
@ -295,7 +295,7 @@ index 0aad59607c2..00000000000
|
||||
From 49cc74015a603e80048a38fe635cd1ac28938ee4 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Fri, 18 Aug 2023 17:16:23 +0300
|
||||
Subject: [PATCH 06/44] gp: Test adding new cert templates enforces changes
|
||||
Subject: [PATCH 06/50] gp: Test adding new cert templates enforces changes
|
||||
|
||||
Ensure that cepces-submit reporting additional templates and re-applying
|
||||
will enforce the updated policy.
|
||||
@ -428,7 +428,7 @@ index 00000000000..4edc1dce730
|
||||
From 4c0906bd79f030e591701234bc54bc749a42d686 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Wed, 16 Aug 2023 12:37:17 +0300
|
||||
Subject: [PATCH 07/44] gp: Template changes should invalidate cache
|
||||
Subject: [PATCH 07/50] gp: Template changes should invalidate cache
|
||||
|
||||
If certificate templates are added or removed, the autoenroll extension
|
||||
should react to this and reapply the policy. Previously this wasn't
|
||||
@ -493,7 +493,7 @@ index 4edc1dce730..00000000000
|
||||
From e61f30dc2518d5a1c239f090baea4a309307f3f8 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Fri, 18 Aug 2023 17:26:59 +0300
|
||||
Subject: [PATCH 08/44] gp: Test disabled enrollment unapplies policy
|
||||
Subject: [PATCH 08/50] gp: Test disabled enrollment unapplies policy
|
||||
|
||||
For this we need to stage a Registry.pol file with certificate
|
||||
autoenrollment enabled, but with checkboxes unticked.
|
||||
@ -594,7 +594,7 @@ index 00000000000..83bc9f0ac1f
|
||||
From 7757b9b48546d71e19798d1260da97780caa99c3 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Wed, 16 Aug 2023 12:33:59 +0300
|
||||
Subject: [PATCH 09/44] gp: Send list of keys instead of dict to remove
|
||||
Subject: [PATCH 09/50] gp: Send list of keys instead of dict to remove
|
||||
|
||||
`cache_get_all_attribute_values` returns a dict whereas we need to pass
|
||||
a list of keys to `remove`. These will be interpolated in the gpdb search.
|
||||
@ -640,7 +640,7 @@ index 83bc9f0ac1f..00000000000
|
||||
From 4e9b2e6409c5764ec0e66cc6c90b08e70f702e7c Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Tue, 9 Jan 2024 08:50:01 +0100
|
||||
Subject: [PATCH 10/44] python:gp: Print a nice message if cepces-submit can't
|
||||
Subject: [PATCH 10/50] python:gp: Print a nice message if cepces-submit can't
|
||||
be found
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15552
|
||||
@ -697,7 +697,7 @@ index 64c35782ae8..08d1a7348cd 100644
|
||||
From fb3aefff51c02cf8ba3f8dfeb7d3f971e8d4902a Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Mon, 8 Jan 2024 18:05:08 +0200
|
||||
Subject: [PATCH 11/44] gpo: Test certificate policy without NDES
|
||||
Subject: [PATCH 11/50] gpo: Test certificate policy without NDES
|
||||
|
||||
As of 8231eaf856b, the NDES feature is no longer required on Windows, as
|
||||
cert auto-enroll can use the certificate from the LDAP request.
|
||||
@ -901,7 +901,7 @@ index 00000000000..f1e590bc7d8
|
||||
From 1a9af36177c7491687c75df151474bb10285f00e Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Thu, 18 Jan 2024 20:23:24 +0200
|
||||
Subject: [PATCH 12/44] gpo: Decode base64 root cert before importing
|
||||
Subject: [PATCH 12/50] gpo: Decode base64 root cert before importing
|
||||
|
||||
The reasoning behind this is described in the previous commit message,
|
||||
but essentially this should either be wrapped in certificate blocks and
|
||||
@ -954,7 +954,7 @@ index f1e590bc7d8..00000000000
|
||||
From f5fc88f9ae255f4dc135580f0fa4a02f5addc390 Mon Sep 17 00:00:00 2001
|
||||
From: Gabriel Nagy <gabriel.nagy@canonical.com>
|
||||
Date: Fri, 19 Jan 2024 11:36:19 +0200
|
||||
Subject: [PATCH 13/44] gpo: Do not get templates list on first run
|
||||
Subject: [PATCH 13/50] gpo: Do not get templates list on first run
|
||||
|
||||
This is a visual fix and has no impact on functionality apart from
|
||||
cleaner log messages.
|
||||
@ -1003,7 +1003,7 @@ index cd5e54f1110..559c903e1a2 100644
|
||||
From e8a6219181f2af87813b53fd09684650c1aa6f90 Mon Sep 17 00:00:00 2001
|
||||
From: David Mulder <dmulder@samba.org>
|
||||
Date: Fri, 5 Jan 2024 08:47:07 -0700
|
||||
Subject: [PATCH 14/44] gp: Skip site GP list if no site is found
|
||||
Subject: [PATCH 14/50] gp: Skip site GP list if no site is found
|
||||
|
||||
[MS-GPOL] 3.2.5.1.4 Site Search says if the site
|
||||
search returns ERROR_NO_SITENAME, the GP site
|
||||
@ -1071,7 +1071,7 @@ index 617ef79350c..babd8f90748 100644
|
||||
From d0d1a890d6f2466691fa4ee663232ee0bd1c3776 Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Mon, 22 Jan 2024 14:14:30 +0100
|
||||
Subject: [PATCH 15/44] python:gp: Avoid path check for cepces-submit
|
||||
Subject: [PATCH 15/50] python:gp: Avoid path check for cepces-submit
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
@ -1117,7 +1117,7 @@ index 559c903e1a2..7325d5132cf 100644
|
||||
From 7f6c9a4945635c6eb8ada2255bd0febbf0f4e540 Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Mon, 22 Jan 2024 14:07:47 +0100
|
||||
Subject: [PATCH 16/44] python:gp: Improve logging for certificate enrollment
|
||||
Subject: [PATCH 16/50] python:gp: Improve logging for certificate enrollment
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
@ -1177,7 +1177,7 @@ index 7325d5132cf..a25a9678587 100644
|
||||
From 5321d5b5bd24d7659743576f2e12a7dc0a93a828 Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Mon, 22 Jan 2024 15:04:36 +0100
|
||||
Subject: [PATCH 17/44] python:gp: Do not print an error, if CA already exists
|
||||
Subject: [PATCH 17/50] python:gp: Do not print an error, if CA already exists
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
@ -1223,7 +1223,7 @@ index a25a9678587..0b23cd688db 100644
|
||||
From 6a7a8a4090b8cdb8e71f4ad590260ceeda253ce2 Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Mon, 22 Jan 2024 15:05:02 +0100
|
||||
Subject: [PATCH 18/44] python:gp: Do not print an error if template already
|
||||
Subject: [PATCH 18/50] python:gp: Do not print an error if template already
|
||||
exists
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
@ -1270,7 +1270,7 @@ index 0b23cd688db..db681cb6f69 100644
|
||||
From 43dc3d5d833bc1db885eb45402decd3225a7c946 Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Mon, 22 Jan 2024 15:05:24 +0100
|
||||
Subject: [PATCH 19/44] python:gp: Log an error if update fails
|
||||
Subject: [PATCH 19/50] python:gp: Log an error if update fails
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
@ -1307,7 +1307,7 @@ index db681cb6f69..c8ad2039dc6 100644
|
||||
From d8276d6a098d10f405b8f24c4dfb82af4496607c Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Mon, 22 Jan 2024 15:46:24 +0100
|
||||
Subject: [PATCH 20/44] python:gp: Improve working of log messages to avoid
|
||||
Subject: [PATCH 20/50] python:gp: Improve working of log messages to avoid
|
||||
confusion
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
@ -1360,7 +1360,7 @@ index c8ad2039dc6..2b7f7d22c2b 100644
|
||||
From 585357bf0d8889747a2769c2451ee34766087d95 Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Mon, 29 Jan 2024 17:46:30 +0100
|
||||
Subject: [PATCH 21/44] python:gp: Fix logging with gp
|
||||
Subject: [PATCH 21/50] python:gp: Fix logging with gp
|
||||
|
||||
This allows enable INFO level logging with: `samba-gpupdate -d3`
|
||||
|
||||
@ -1402,7 +1402,7 @@ index a74a8707d50..c3de32825db 100644
|
||||
From 14ceb0b5f2f954bbabdaf78b8185fc515e3c8294 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
|
||||
Date: Wed, 13 Mar 2024 13:55:41 +0100
|
||||
Subject: [PATCH 22/44] docs-xml: Add parameter all_groupmem to idmap_ad
|
||||
Subject: [PATCH 22/50] docs-xml: Add parameter all_groupmem to idmap_ad
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
@ -1444,7 +1444,7 @@ index b364bbfa231..de6d36afe95 100644
|
||||
From ac4184c8c3220263cb6f1a46a012533ed1c4e047 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
|
||||
Date: Tue, 12 Mar 2024 13:20:24 +0100
|
||||
Subject: [PATCH 23/44] s3:winbindd: Improve performance of lookup_groupmem()
|
||||
Subject: [PATCH 23/50] s3:winbindd: Improve performance of lookup_groupmem()
|
||||
in idmap_ad
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
@ -1527,7 +1527,7 @@ index d7a665abbc6..e625aa6473f 100644
|
||||
From d0e2002efcc37055b35c351a6b936e6ab89fad32 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
|
||||
Date: Mon, 25 Mar 2024 22:38:18 +0100
|
||||
Subject: [PATCH 24/44] selftest: Add "winbind expand groups = 1" to
|
||||
Subject: [PATCH 24/50] selftest: Add "winbind expand groups = 1" to
|
||||
setup_ad_member_idmap_ad
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
@ -1561,7 +1561,7 @@ index 44ac4a5901a..606c65f8ab1 100755
|
||||
From 9625b6aed981aa4e70fe11d9d1acdb54db7591a3 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
|
||||
Date: Thu, 14 Mar 2024 15:24:21 +0100
|
||||
Subject: [PATCH 25/44] tests: Add a test for "all_groups=no" to
|
||||
Subject: [PATCH 25/50] tests: Add a test for "all_groups=no" to
|
||||
test_idmap_ad.sh
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
@ -1634,7 +1634,7 @@ index 7ae112ada71..1d4bd395ba9 100755
|
||||
From e5890e63c35a4a5af29ae16e6dd734c4a3a304cc Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Tue, 28 May 2024 13:51:53 +0200
|
||||
Subject: [PATCH 26/44] s3:libads: Allow get_kdc_ip_string() to lookup the KDCs
|
||||
Subject: [PATCH 26/50] s3:libads: Allow get_kdc_ip_string() to lookup the KDCs
|
||||
IP
|
||||
|
||||
Remove the requirement to provide an IP address. We should look up the
|
||||
@ -1699,7 +1699,7 @@ index 50f4a6de3c6..ddf97c11973 100644
|
||||
From 96a1ecd8db249fa03db60259cf76fdef9c1bd749 Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Tue, 28 May 2024 13:53:51 +0200
|
||||
Subject: [PATCH 27/44] s3:libads: Do not fail if we don't get an IP passed
|
||||
Subject: [PATCH 27/50] s3:libads: Do not fail if we don't get an IP passed
|
||||
down
|
||||
|
||||
The IP should be optional and we should look it up if not provided.
|
||||
@ -1733,7 +1733,7 @@ index ddf97c11973..f74d8eb567c 100644
|
||||
From 4934642b7a7d92c6d81ba25ef6e4b66e3805f708 Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Tue, 28 May 2024 13:54:24 +0200
|
||||
Subject: [PATCH 28/44] s3:winbind: Fix idmap_ad creating an invalid local
|
||||
Subject: [PATCH 28/50] s3:winbind: Fix idmap_ad creating an invalid local
|
||||
krb5.conf
|
||||
|
||||
In case of a trusted domain, we are providing the realm of the primary
|
||||
@ -1789,7 +1789,7 @@ index 5c9fe07db95..b8002825161 100644
|
||||
From cccc902c64c93db317bf4707d0af5e56b2887286 Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Schneider <asn@samba.org>
|
||||
Date: Mon, 22 Jul 2024 12:26:55 +0200
|
||||
Subject: [PATCH 29/44] s3:notifyd: Use a watcher per db record
|
||||
Subject: [PATCH 29/50] s3:notifyd: Use a watcher per db record
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
@ -2307,7 +2307,7 @@ index 36c08f47c54..db8e6e1c005 100644
|
||||
From b04cb93ee52aac0ce7213d0581d69e852df52d4a Mon Sep 17 00:00:00 2001
|
||||
From: Ralph Boehme <slow@samba.org>
|
||||
Date: Mon, 5 Feb 2024 15:03:48 +0100
|
||||
Subject: [PATCH 30/44] smbd: simplify handling of failing fstat() after
|
||||
Subject: [PATCH 30/50] smbd: simplify handling of failing fstat() after
|
||||
unlinking file
|
||||
|
||||
close_remove_share_mode() already called vfs_stat_fsp(), so we can skip the
|
||||
@ -2371,7 +2371,7 @@ index 3581c4b9173..93c12e00eb0 100644
|
||||
From 29f0c0fb2f1cb0cfc4c615d31e82048b46a2cb0d Mon Sep 17 00:00:00 2001
|
||||
From: Noel Power <noel.power@suse.com>
|
||||
Date: Tue, 20 Feb 2024 09:26:29 +0000
|
||||
Subject: [PATCH 31/44] s3/smbd: If we fail to close file_handle ensure we
|
||||
Subject: [PATCH 31/50] s3/smbd: If we fail to close file_handle ensure we
|
||||
should reset the fd
|
||||
|
||||
if fsp_flags.fstat_before_close == true then close_file_smb will call
|
||||
@ -2452,7 +2452,7 @@ index 93c12e00eb0..74be444fef5 100644
|
||||
From ed138c4d679e8291de18162e1cac65cc9da33b4d Mon Sep 17 00:00:00 2001
|
||||
From: Jeremy Allison <jra@samba.org>
|
||||
Date: Wed, 15 Jan 2025 10:21:19 -0800
|
||||
Subject: [PATCH 32/44] auth: Add missing talloc_free() in error code path.
|
||||
Subject: [PATCH 32/50] auth: Add missing talloc_free() in error code path.
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
@ -2489,7 +2489,7 @@ index b914075d85c..196654b36bd 100644
|
||||
From f8a7d7a3e8c3be3c7742c874239766b34c25ef3e Mon Sep 17 00:00:00 2001
|
||||
From: Jeremy Allison <jra@samba.org>
|
||||
Date: Thu, 16 Jan 2025 16:12:31 -0800
|
||||
Subject: [PATCH 33/44] auth: Cleanup exit code paths in kerberos_decode_pac().
|
||||
Subject: [PATCH 33/50] auth: Cleanup exit code paths in kerberos_decode_pac().
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
@ -2761,7 +2761,7 @@ index 196654b36bd..abb096bde1b 100644
|
||||
From 9fd06d5c331f5babaf417cc7339d12854a79fe4b Mon Sep 17 00:00:00 2001
|
||||
From: Stefan Metzmacher <metze@samba.org>
|
||||
Date: Thu, 15 Feb 2024 17:29:46 +0100
|
||||
Subject: [PATCH 34/44] s3:libsmb/dsgetdcname: use
|
||||
Subject: [PATCH 34/50] s3:libsmb/dsgetdcname: use
|
||||
NETLOGON_NT_VERSION_AVOID_NT4EMUL
|
||||
|
||||
In 2024 we always want an active directory response...
|
||||
@ -2798,7 +2798,7 @@ index 280ccd585b0..6fcaa26810c 100644
|
||||
From 58e28d056f2df0906ee77ccfb9b56e8a764b38b4 Mon Sep 17 00:00:00 2001
|
||||
From: Stefan Metzmacher <metze@samba.org>
|
||||
Date: Tue, 7 May 2024 14:53:24 +0000
|
||||
Subject: [PATCH 35/44] s3:libsmb: allow store_cldap_reply() to work with a
|
||||
Subject: [PATCH 35/50] s3:libsmb: allow store_cldap_reply() to work with a
|
||||
ipv6 response
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15642
|
||||
@ -2856,7 +2856,7 @@ index 6fcaa26810c..da173e7bbb0 100644
|
||||
From e4d5269b2359c670acdf0cba81248f148ae68c17 Mon Sep 17 00:00:00 2001
|
||||
From: Stefan Metzmacher <metze@samba.org>
|
||||
Date: Fri, 11 Oct 2024 13:32:22 +0000
|
||||
Subject: [PATCH 36/44] s3:libsmb: let discover_dc_netbios() return
|
||||
Subject: [PATCH 36/50] s3:libsmb: let discover_dc_netbios() return
|
||||
DOMAIN_CONTROLLER_NOT_FOUND
|
||||
|
||||
We may get NT_STATUS_NOT_FOUND when the name can't be resolved
|
||||
@ -2902,7 +2902,7 @@ index da173e7bbb0..8278959dd7d 100644
|
||||
From d90d2b0e985913247f43192cb94eec0efb3e9046 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
|
||||
Date: Wed, 2 Jul 2025 21:59:48 +0200
|
||||
Subject: [PATCH 37/44] s3-winbindd: Fix internal winbind dsgetdcname calls
|
||||
Subject: [PATCH 37/50] s3-winbindd: Fix internal winbind dsgetdcname calls
|
||||
w.r.t. domain name
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
@ -3086,7 +3086,7 @@ index fe93528787d..eca4116d0c8 100644
|
||||
From 7da6072ce95bca445368f6d0453247c8f92fcdf2 Mon Sep 17 00:00:00 2001
|
||||
From: Stefan Metzmacher <metze@samba.org>
|
||||
Date: Fri, 9 May 2025 09:38:41 +0200
|
||||
Subject: [PATCH 38/44] s3:winbindd: avoid using any netlogon call to get a dc
|
||||
Subject: [PATCH 38/50] s3:winbindd: avoid using any netlogon call to get a dc
|
||||
name
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15876
|
||||
@ -3389,7 +3389,7 @@ index f0fd18a8fa6..47c68257b12 100644
|
||||
From ad54ceadacfbcf0d9c96ad773e50db96003e2c08 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
|
||||
Date: Wed, 23 Jul 2025 15:09:21 +0200
|
||||
Subject: [PATCH 39/44] s3:winbindd: Resolve dc name using CLDAP also for
|
||||
Subject: [PATCH 39/50] s3:winbindd: Resolve dc name using CLDAP also for
|
||||
ROLE_IPA_DC
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
@ -3443,7 +3443,7 @@ index 195259daa43..86dbf68f033 100644
|
||||
From b73efffbb02903427af2c2cc57171d4848ca11f8 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
|
||||
Date: Mon, 4 Aug 2025 08:35:29 +0200
|
||||
Subject: [PATCH 40/44] docs-xml: Make smb.conf 'server role' value consistent
|
||||
Subject: [PATCH 40/50] docs-xml: Make smb.conf 'server role' value consistent
|
||||
with ROLE_IPA_DC in libparam
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
@ -3480,7 +3480,7 @@ index 4ea4e4751ee..40244e125ce 100644
|
||||
From 832a4e31630fd441f8ab4325439f90d561cb8fa4 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
|
||||
Date: Mon, 4 Aug 2025 23:26:02 +0200
|
||||
Subject: [PATCH 41/44] s3:netlogon: IPA DC is the PDC as well - allow
|
||||
Subject: [PATCH 41/50] s3:netlogon: IPA DC is the PDC as well - allow
|
||||
ROLE_IPA_DC in _netr_DsRGetForestTrustInformation()
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
@ -3520,7 +3520,7 @@ index c5a4b0ef30c..7957d3ab34d 100644
|
||||
From 8d5638581dfc539c8524d7a507e8cc8977e827a2 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= <pfilipensky@samba.org>
|
||||
Date: Mon, 4 Aug 2025 23:28:24 +0200
|
||||
Subject: [PATCH 42/44] s3:utils: Allow ROLE_IPA_DC to allow to use Kerberos in
|
||||
Subject: [PATCH 42/50] s3:utils: Allow ROLE_IPA_DC to allow to use Kerberos in
|
||||
gensec
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
@ -3569,7 +3569,7 @@ index cff3c53845f..2968ca47734 100644
|
||||
From 3ef02a381cdc83549506e159ebc457730c06c547 Mon Sep 17 00:00:00 2001
|
||||
From: Ralph Boehme <slow@samba.org>
|
||||
Date: Tue, 22 Jul 2025 19:22:31 +0200
|
||||
Subject: [PATCH 43/44] libads: fix get_kdc_ip_string()
|
||||
Subject: [PATCH 43/50] libads: fix get_kdc_ip_string()
|
||||
|
||||
Correctly handle the interaction between optionally passed in DC via
|
||||
pss and DC lookup.
|
||||
@ -3620,7 +3620,7 @@ index f74d8eb567c..f324321c87b 100644
|
||||
From b0dbc167f85deabff2af5b18bc201e8db0d3b97d Mon Sep 17 00:00:00 2001
|
||||
From: Ralph Boehme <slow@samba.org>
|
||||
Date: Tue, 22 Jul 2025 19:16:14 +0200
|
||||
Subject: [PATCH 44/44] winbindd: use find_domain_from_name_noinit() in
|
||||
Subject: [PATCH 44/50] winbindd: use find_domain_from_name_noinit() in
|
||||
find_dns_domain_name()
|
||||
|
||||
Avoid triggering a connection to a DC of a trusted domain.
|
||||
@ -3650,3 +3650,579 @@ index eca4116d0c8..3a7a9114988 100644
|
||||
--
|
||||
2.51.0
|
||||
|
||||
|
||||
From 1961f54ce07f7dc3cfcae5c00b96b39109f08b3a Mon Sep 17 00:00:00 2001
|
||||
From: Ralph Boehme <slow@samba.org>
|
||||
Date: Tue, 19 Dec 2023 11:11:55 +0100
|
||||
Subject: [PATCH 45/50] vfs_default: allow disabling /proc/fds and
|
||||
RESOLVE_NO_SYMLINK at compile time
|
||||
|
||||
This will be used in CI to have a gitlab runner without all modern Linux
|
||||
features we make use of as part of path processing:
|
||||
|
||||
- O_PATH
|
||||
- openat2() with RESOLVE_NO_SYMLINKS
|
||||
- somehow safely reopen an O_PATH file handle
|
||||
|
||||
That gives what a classix UNIX like AIX or Solaris offers feature wise.
|
||||
|
||||
Other OSes support other combinations of those features, but we leave the
|
||||
exersize of possibly adding more runners supporting those combinations to the
|
||||
reader.
|
||||
|
||||
The following list shows which features are available and used by Samba on a few
|
||||
OSes:
|
||||
|
||||
| O_PATH | RESOLVE_NO_SYMLINKS | Safe reopen | CI covered
|
||||
--------|----------------|---------------------|----------------------------
|
||||
| Supported Used | Supported Used | Supported Used |
|
||||
============================================================================
|
||||
Linux | + + | + + | + + | +
|
||||
FreeBSD | + + | + [1] - | + [2] - | -
|
||||
AIX | - - | - - | - - | +
|
||||
|
||||
[1] via open() flag O_RESOLVE_BENEATH
|
||||
[2] via open() flag O_EMPTY_PATH
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15549
|
||||
|
||||
Signed-off-by: Ralph Boehme <slow@samba.org>
|
||||
Reviewed-by: Volker Lendecke <vl@samba.org>
|
||||
(cherry picked from commit 5c2f96442a25a1725809a28b3719afbc0bd01830)
|
||||
---
|
||||
source3/modules/vfs_default.c | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c
|
||||
index 1d4b9b1a840..8d78831492f 100644
|
||||
--- a/source3/modules/vfs_default.c
|
||||
+++ b/source3/modules/vfs_default.c
|
||||
@@ -52,6 +52,9 @@ static int vfswrap_connect(vfs_handle_struct *handle, const char *service, const
|
||||
bool bval;
|
||||
|
||||
handle->conn->have_proc_fds = sys_have_proc_fds();
|
||||
+#ifdef DISABLE_PROC_FDS
|
||||
+ handle->conn->have_proc_fds = false;
|
||||
+#endif
|
||||
|
||||
/*
|
||||
* assume the kernel will support openat2(),
|
||||
@@ -70,6 +73,9 @@ static int vfswrap_connect(vfs_handle_struct *handle, const char *service, const
|
||||
handle->conn->open_how_resolve |=
|
||||
VFS_OPEN_HOW_RESOLVE_NO_SYMLINKS;
|
||||
}
|
||||
+#ifdef DISABLE_VFS_OPEN_HOW_RESOLVE_NO_SYMLINKS
|
||||
+ handle->conn->open_how_resolve &= ~VFS_OPEN_HOW_RESOLVE_NO_SYMLINKS;
|
||||
+#endif
|
||||
|
||||
return 0; /* Return >= 0 for success */
|
||||
}
|
||||
--
|
||||
2.51.0
|
||||
|
||||
|
||||
From 26de62a2a968dd5b73af296251b26112cdd533e5 Mon Sep 17 00:00:00 2001
|
||||
From: Ralph Boehme <slow@samba.org>
|
||||
Date: Tue, 19 Dec 2023 11:12:49 +0100
|
||||
Subject: [PATCH 46/50] CI: disable /proc/fds and RESOLVE_NO_SYMLINK in
|
||||
samba-no-opath-build runner
|
||||
|
||||
This is a more sensible combination of missing Linux specific features:
|
||||
|
||||
- O_PATH
|
||||
- openat2() with RESOLVE_NO_SYMLINKS
|
||||
- somehow safely reopen an O_PATH file handle
|
||||
|
||||
Currently only O_PATH is disabled for these jobs, but that doesn't really match
|
||||
and know OS.
|
||||
|
||||
The following list shows which features are available and used by Samba on a few
|
||||
OSes:
|
||||
|
||||
| O_PATH | RESOLVE_NO_SYMLINKS | Safe reopen | CI covered
|
||||
--------|----------------|---------------------|----------------------------
|
||||
| Supported Used | Supported Used | Supported Used |
|
||||
============================================================================
|
||||
Linux | + + | + + | + + | +
|
||||
FreeBSD | + + | + [1] - | + [2] - | -
|
||||
AIX | - - | - - | - - | +
|
||||
|
||||
So by also disabling RESOLVE_NO_SYMLINKS and Safe Reopen, we cover classic UNIX
|
||||
systems like AIX.
|
||||
|
||||
[1] via open() flag O_RESOLVE_BENEATH
|
||||
[2] via open() flag O_EMPTY_PATH
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15549
|
||||
|
||||
Signed-off-by: Ralph Boehme <slow@samba.org>
|
||||
Reviewed-by: Volker Lendecke <vl@samba.org>
|
||||
(cherry picked from commit 62cbe145c7e500c4759ed2005c78bd5056c87f43)
|
||||
---
|
||||
script/autobuild.py | 2 +-
|
||||
selftest/skip.opath-required | 6 ++++++
|
||||
2 files changed, 7 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/script/autobuild.py b/script/autobuild.py
|
||||
index e074c39d3c0..85043032d73 100755
|
||||
--- a/script/autobuild.py
|
||||
+++ b/script/autobuild.py
|
||||
@@ -296,7 +296,7 @@ tasks = {
|
||||
"samba-no-opath-build": {
|
||||
"git-clone-required": True,
|
||||
"sequence": [
|
||||
- ("configure", "ADDITIONAL_CFLAGS='-DDISABLE_OPATH=1' ./configure.developer --without-ad-dc " + samba_configure_params),
|
||||
+ ("configure", "ADDITIONAL_CFLAGS='-DDISABLE_OPATH=1 -DDISABLE_VFS_OPEN_HOW_RESOLVE_NO_SYMLINKS=1 -DDISABLE_PROC_FDS=1' ./configure.developer --without-ad-dc " + samba_configure_params),
|
||||
("make", "make -j"),
|
||||
("check-clean-tree", CLEAN_SOURCE_TREE_CMD),
|
||||
("chmod-R-a-w", "chmod -R a-w ."),
|
||||
diff --git a/selftest/skip.opath-required b/selftest/skip.opath-required
|
||||
index c3a13f5ec6e..67764a0b027 100644
|
||||
--- a/selftest/skip.opath-required
|
||||
+++ b/selftest/skip.opath-required
|
||||
@@ -14,3 +14,9 @@
|
||||
# available this works fine. So for now restrict testing posix
|
||||
# extensions to environments where we have O_PATH around
|
||||
^samba.tests.smb1posix
|
||||
+
|
||||
+# These don't work without /proc/fd support
|
||||
+^samba3.blackbox.test_symlink_traversal.*\(fileserver\)
|
||||
+^samba3.blackbox.shadow_copy_torture.*\(fileserver\)
|
||||
+^samba3.blackbox.virus_scanner.*\(fileserver:local\)
|
||||
+^samba3.blackbox.shadow_copy2.*\(fileserver.*\)
|
||||
--
|
||||
2.51.0
|
||||
|
||||
|
||||
From 2c27aae5a4c8d7368dc142fb2be36919296d2a02 Mon Sep 17 00:00:00 2001
|
||||
From: Ralph Boehme <slow@samba.org>
|
||||
Date: Tue, 2 Jan 2024 12:49:14 +0100
|
||||
Subject: [PATCH 47/50] smbd: pass symlink target path to
|
||||
safe_symlink_target_path()
|
||||
|
||||
Moves processing the symlink error response to the caller
|
||||
filename_convert_dirfsp(). Prepares for using this in
|
||||
non_widelink_open(), where it will replace symlink_target_below_conn()
|
||||
with the same functionality.
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15549
|
||||
|
||||
Signed-off-by: Ralph Boehme <slow@samba.org>
|
||||
Reviewed-by: Volker Lendecke <vl@samba.org>
|
||||
(back-ported from commit 0515dded4ddb49e5570ae7df51126af1a2d643de)
|
||||
---
|
||||
source3/include/proto.h | 5 +++
|
||||
source3/smbd/filename.c | 72 +++++++++++++++++++----------------------
|
||||
2 files changed, 38 insertions(+), 39 deletions(-)
|
||||
|
||||
diff --git a/source3/include/proto.h b/source3/include/proto.h
|
||||
index 8eed81d8f2e..13240033bf1 100644
|
||||
--- a/source3/include/proto.h
|
||||
+++ b/source3/include/proto.h
|
||||
@@ -719,6 +719,11 @@ struct smb_filename *synthetic_smb_fname(TALLOC_CTX *mem_ctx,
|
||||
const SMB_STRUCT_STAT *psbuf,
|
||||
NTTIME twrp,
|
||||
uint32_t flags);
|
||||
+NTSTATUS safe_symlink_target_path(TALLOC_CTX *mem_ctx,
|
||||
+ const char *connectpath,
|
||||
+ const char *target,
|
||||
+ size_t unparsed,
|
||||
+ char **_relative);
|
||||
NTSTATUS filename_convert_dirfsp(
|
||||
TALLOC_CTX *ctx,
|
||||
connection_struct *conn,
|
||||
diff --git a/source3/smbd/filename.c b/source3/smbd/filename.c
|
||||
index 8693dcf1153..45fb90381e2 100644
|
||||
--- a/source3/smbd/filename.c
|
||||
+++ b/source3/smbd/filename.c
|
||||
@@ -942,44 +942,34 @@ static char *symlink_target_path(
|
||||
return ret;
|
||||
}
|
||||
|
||||
-static NTSTATUS safe_symlink_target_path(
|
||||
- TALLOC_CTX *mem_ctx,
|
||||
- const char *connectpath,
|
||||
- const char *name_in,
|
||||
- const char *substitute,
|
||||
- size_t unparsed,
|
||||
- char **_name_out)
|
||||
+NTSTATUS safe_symlink_target_path(TALLOC_CTX *mem_ctx,
|
||||
+ const char *connectpath,
|
||||
+ const char *target,
|
||||
+ size_t unparsed,
|
||||
+ char **_relative)
|
||||
{
|
||||
- char *target = NULL;
|
||||
char *abs_target = NULL;
|
||||
char *abs_target_canon = NULL;
|
||||
const char *relative = NULL;
|
||||
- char *name_out = NULL;
|
||||
- NTSTATUS status = NT_STATUS_NO_MEMORY;
|
||||
bool in_share;
|
||||
+ NTSTATUS status = NT_STATUS_NO_MEMORY;
|
||||
|
||||
- target = symlink_target_path(mem_ctx, name_in, substitute, unparsed);
|
||||
- if (target == NULL) {
|
||||
- goto fail;
|
||||
- }
|
||||
-
|
||||
- DBG_DEBUG("name_in: %s, substitute: %s, unparsed: %zu, target=%s\n",
|
||||
- name_in,
|
||||
- substitute,
|
||||
- unparsed,
|
||||
- target);
|
||||
+ DBG_DEBUG("connectpath [%s] target [%s] unparsed [%zu]\n",
|
||||
+ connectpath, target, unparsed);
|
||||
|
||||
if (target[0] == '/') {
|
||||
- abs_target = target;
|
||||
+ abs_target = talloc_strdup(mem_ctx, target);
|
||||
} else {
|
||||
- abs_target = talloc_asprintf(
|
||||
- target, "%s/%s", connectpath, target);
|
||||
- if (abs_target == NULL) {
|
||||
- goto fail;
|
||||
- }
|
||||
+ abs_target = talloc_asprintf(mem_ctx,
|
||||
+ "%s/%s",
|
||||
+ connectpath,
|
||||
+ target);
|
||||
+ }
|
||||
+ if (abs_target == NULL) {
|
||||
+ goto fail;
|
||||
}
|
||||
|
||||
- abs_target_canon = canonicalize_absolute_path(target, abs_target);
|
||||
+ abs_target_canon = canonicalize_absolute_path(abs_target, abs_target);
|
||||
if (abs_target_canon == NULL) {
|
||||
goto fail;
|
||||
}
|
||||
@@ -994,15 +984,14 @@ static NTSTATUS safe_symlink_target_path(
|
||||
goto fail;
|
||||
}
|
||||
|
||||
- name_out = talloc_strdup(mem_ctx, relative);
|
||||
- if (name_out == NULL) {
|
||||
+ *_relative = talloc_strdup(mem_ctx, relative);
|
||||
+ if (*_relative == NULL) {
|
||||
goto fail;
|
||||
}
|
||||
|
||||
status = NT_STATUS_OK;
|
||||
- *_name_out = name_out;
|
||||
fail:
|
||||
- TALLOC_FREE(target);
|
||||
+ TALLOC_FREE(abs_target);
|
||||
return status;
|
||||
}
|
||||
|
||||
@@ -1438,6 +1427,7 @@ NTSTATUS filename_convert_dirfsp(
|
||||
size_t unparsed = 0;
|
||||
NTSTATUS status;
|
||||
char *target = NULL;
|
||||
+ char *safe_target = NULL;
|
||||
size_t symlink_redirects = 0;
|
||||
|
||||
next:
|
||||
@@ -1476,17 +1466,21 @@ next:
|
||||
* resolve all symlinks locally.
|
||||
*/
|
||||
|
||||
- status = safe_symlink_target_path(
|
||||
- mem_ctx,
|
||||
- conn->connectpath,
|
||||
- name_in,
|
||||
- substitute,
|
||||
- unparsed,
|
||||
- &target);
|
||||
+ target = symlink_target_path(mem_ctx, name_in, substitute, unparsed);
|
||||
+ if (target == NULL) {
|
||||
+ return NT_STATUS_NO_MEMORY;
|
||||
+ }
|
||||
+
|
||||
+ status = safe_symlink_target_path(mem_ctx,
|
||||
+ conn->connectpath,
|
||||
+ target,
|
||||
+ unparsed,
|
||||
+ &safe_target);
|
||||
+ TALLOC_FREE(target);
|
||||
if (!NT_STATUS_IS_OK(status)) {
|
||||
return status;
|
||||
}
|
||||
- name_in = target;
|
||||
+ name_in = safe_target;
|
||||
|
||||
symlink_redirects += 1;
|
||||
|
||||
--
|
||||
2.51.0
|
||||
|
||||
|
||||
From 99d7e841d4e18f760c137530bbed0dea6115311a Mon Sep 17 00:00:00 2001
|
||||
From: Ralph Boehme <slow@samba.org>
|
||||
Date: Tue, 2 Jan 2024 13:25:25 +0100
|
||||
Subject: [PATCH 48/50] smbd: add a directory argument to
|
||||
safe_symlink_target_path()
|
||||
|
||||
Existing caller passes NULL, no change in behaviour. Prepares for
|
||||
replacing symlink_target_below_conn() in open.c.
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15549
|
||||
|
||||
Signed-off-by: Ralph Boehme <slow@samba.org>
|
||||
Reviewed-by: Volker Lendecke <vl@samba.org>
|
||||
(cherry picked from commit fc80c72d658a41fe4d93b24b793b52c91b350175)
|
||||
---
|
||||
source3/include/proto.h | 1 +
|
||||
source3/smbd/filename.c | 15 ++++++++++++++-
|
||||
2 files changed, 15 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/source3/include/proto.h b/source3/include/proto.h
|
||||
index 13240033bf1..15c5839caf8 100644
|
||||
--- a/source3/include/proto.h
|
||||
+++ b/source3/include/proto.h
|
||||
@@ -721,6 +721,7 @@ struct smb_filename *synthetic_smb_fname(TALLOC_CTX *mem_ctx,
|
||||
uint32_t flags);
|
||||
NTSTATUS safe_symlink_target_path(TALLOC_CTX *mem_ctx,
|
||||
const char *connectpath,
|
||||
+ const char *dir,
|
||||
const char *target,
|
||||
size_t unparsed,
|
||||
char **_relative);
|
||||
diff --git a/source3/smbd/filename.c b/source3/smbd/filename.c
|
||||
index 45fb90381e2..55a49e0ba93 100644
|
||||
--- a/source3/smbd/filename.c
|
||||
+++ b/source3/smbd/filename.c
|
||||
@@ -944,6 +944,7 @@ static char *symlink_target_path(
|
||||
|
||||
NTSTATUS safe_symlink_target_path(TALLOC_CTX *mem_ctx,
|
||||
const char *connectpath,
|
||||
+ const char *dir,
|
||||
const char *target,
|
||||
size_t unparsed,
|
||||
char **_relative)
|
||||
@@ -959,10 +960,21 @@ NTSTATUS safe_symlink_target_path(TALLOC_CTX *mem_ctx,
|
||||
|
||||
if (target[0] == '/') {
|
||||
abs_target = talloc_strdup(mem_ctx, target);
|
||||
- } else {
|
||||
+ } else if (dir == NULL) {
|
||||
+ abs_target = talloc_asprintf(mem_ctx,
|
||||
+ "%s/%s",
|
||||
+ connectpath,
|
||||
+ target);
|
||||
+ } else if (dir[0] == '/') {
|
||||
abs_target = talloc_asprintf(mem_ctx,
|
||||
"%s/%s",
|
||||
+ dir,
|
||||
+ target);
|
||||
+ } else {
|
||||
+ abs_target = talloc_asprintf(mem_ctx,
|
||||
+ "%s/%s/%s",
|
||||
connectpath,
|
||||
+ dir,
|
||||
target);
|
||||
}
|
||||
if (abs_target == NULL) {
|
||||
@@ -1473,6 +1485,7 @@ next:
|
||||
|
||||
status = safe_symlink_target_path(mem_ctx,
|
||||
conn->connectpath,
|
||||
+ NULL,
|
||||
target,
|
||||
unparsed,
|
||||
&safe_target);
|
||||
--
|
||||
2.51.0
|
||||
|
||||
|
||||
From 5041a6fa5cdfd21bf697249d900ea5c107d355a2 Mon Sep 17 00:00:00 2001
|
||||
From: Ralph Boehme <slow@samba.org>
|
||||
Date: Tue, 2 Jan 2024 14:34:26 +0100
|
||||
Subject: [PATCH 49/50] smbd: use safe_symlink_target_path() in
|
||||
symlink_target_below_conn()
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15549
|
||||
|
||||
Signed-off-by: Ralph Boehme <slow@samba.org>
|
||||
Reviewed-by: Volker Lendecke <vl@samba.org>
|
||||
(cherry picked from commit 1965fc77b3852a0593e13897af08f5304a1ce3a2)
|
||||
---
|
||||
selftest/skip.opath-required | 2 -
|
||||
source3/smbd/open.c | 73 +++++++-----------------------------
|
||||
2 files changed, 14 insertions(+), 61 deletions(-)
|
||||
|
||||
diff --git a/selftest/skip.opath-required b/selftest/skip.opath-required
|
||||
index 67764a0b027..9c6ba481cdf 100644
|
||||
--- a/selftest/skip.opath-required
|
||||
+++ b/selftest/skip.opath-required
|
||||
@@ -16,7 +16,5 @@
|
||||
^samba.tests.smb1posix
|
||||
|
||||
# These don't work without /proc/fd support
|
||||
-^samba3.blackbox.test_symlink_traversal.*\(fileserver\)
|
||||
^samba3.blackbox.shadow_copy_torture.*\(fileserver\)
|
||||
^samba3.blackbox.virus_scanner.*\(fileserver:local\)
|
||||
-^samba3.blackbox.shadow_copy2.*\(fileserver.*\)
|
||||
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
|
||||
index 74be444fef5..6582bd60245 100644
|
||||
--- a/source3/smbd/open.c
|
||||
+++ b/source3/smbd/open.c
|
||||
@@ -571,7 +571,6 @@ out:
|
||||
static NTSTATUS symlink_target_below_conn(
|
||||
TALLOC_CTX *mem_ctx,
|
||||
const char *connection_path,
|
||||
- size_t connection_path_len,
|
||||
struct files_struct *fsp,
|
||||
struct files_struct *dirfsp,
|
||||
struct smb_filename *symlink_name,
|
||||
@@ -579,9 +578,7 @@ static NTSTATUS symlink_target_below_conn(
|
||||
{
|
||||
char *target = NULL;
|
||||
char *absolute = NULL;
|
||||
- const char *relative = NULL;
|
||||
NTSTATUS status;
|
||||
- bool ok;
|
||||
|
||||
if (fsp_get_pathref_fd(fsp) != -1) {
|
||||
/*
|
||||
@@ -594,69 +591,28 @@ static NTSTATUS symlink_target_below_conn(
|
||||
talloc_tos(), dirfsp, symlink_name, &target);
|
||||
}
|
||||
|
||||
+ status = safe_symlink_target_path(talloc_tos(),
|
||||
+ connection_path,
|
||||
+ dirfsp->fsp_name->base_name,
|
||||
+ target,
|
||||
+ 0,
|
||||
+ &absolute);
|
||||
if (!NT_STATUS_IS_OK(status)) {
|
||||
- DBG_DEBUG("readlink_talloc failed: %s\n", nt_errstr(status));
|
||||
+ DBG_DEBUG("safe_symlink_target_path() failed: %s\n",
|
||||
+ nt_errstr(status));
|
||||
return status;
|
||||
}
|
||||
|
||||
- if (target[0] != '/') {
|
||||
- char *tmp = talloc_asprintf(
|
||||
- talloc_tos(),
|
||||
- "%s/%s/%s",
|
||||
- connection_path,
|
||||
- dirfsp->fsp_name->base_name,
|
||||
- target);
|
||||
-
|
||||
- TALLOC_FREE(target);
|
||||
-
|
||||
- if (tmp == NULL) {
|
||||
- return NT_STATUS_NO_MEMORY;
|
||||
- }
|
||||
- target = tmp;
|
||||
- }
|
||||
-
|
||||
- DBG_DEBUG("redirecting to %s\n", target);
|
||||
-
|
||||
- absolute = canonicalize_absolute_path(talloc_tos(), target);
|
||||
- TALLOC_FREE(target);
|
||||
-
|
||||
- if (absolute == NULL) {
|
||||
- return NT_STATUS_NO_MEMORY;
|
||||
- }
|
||||
-
|
||||
- /*
|
||||
- * We're doing the "below connection_path" here because it's
|
||||
- * cheap. It might be that we get a symlink out of the share,
|
||||
- * pointing to yet another symlink getting us back into the
|
||||
- * share. If we need that, we would have to remove the check
|
||||
- * here.
|
||||
- */
|
||||
- ok = subdir_of(
|
||||
- connection_path,
|
||||
- connection_path_len,
|
||||
- absolute,
|
||||
- &relative);
|
||||
- if (!ok) {
|
||||
- DBG_NOTICE("Bad access attempt: %s is a symlink "
|
||||
- "outside the share path\n"
|
||||
- "conn_rootdir =%s\n"
|
||||
- "resolved_name=%s\n",
|
||||
- symlink_name->base_name,
|
||||
- connection_path,
|
||||
- absolute);
|
||||
- TALLOC_FREE(absolute);
|
||||
- return NT_STATUS_OBJECT_NAME_NOT_FOUND;
|
||||
- }
|
||||
-
|
||||
- if (relative[0] == '\0') {
|
||||
+ if (absolute[0] == '\0') {
|
||||
/*
|
||||
* special case symlink to share root: "." is our
|
||||
* share root filename
|
||||
*/
|
||||
- absolute[0] = '.';
|
||||
- absolute[1] = '\0';
|
||||
- } else {
|
||||
- memmove(absolute, relative, strlen(relative)+1);
|
||||
+ TALLOC_FREE(absolute);
|
||||
+ absolute = talloc_strdup(talloc_tos(), ".");
|
||||
+ if (absolute == NULL) {
|
||||
+ return NT_STATUS_NO_MEMORY;
|
||||
+ }
|
||||
}
|
||||
|
||||
*_target = absolute;
|
||||
@@ -834,7 +790,6 @@ again:
|
||||
status = symlink_target_below_conn(
|
||||
talloc_tos(),
|
||||
connpath,
|
||||
- connpath_len,
|
||||
fsp,
|
||||
discard_const_p(files_struct, dirfsp),
|
||||
smb_fname_rel,
|
||||
--
|
||||
2.51.0
|
||||
|
||||
|
||||
From f2fc99f0c7d441115a486413f345c0226a00b38b Mon Sep 17 00:00:00 2001
|
||||
From: Ralph Boehme <slow@samba.org>
|
||||
Date: Mon, 18 Dec 2023 12:35:58 +0100
|
||||
Subject: [PATCH 50/50] smbd: use dirfsp and atname in open_directory()
|
||||
|
||||
On systems without /proc/fd support this avoid the expensive chdir()
|
||||
logic in non_widelink_open(). open_file_ntcreate() already passes
|
||||
dirfsp and atname to reopen_from_fsp(), it was just missed in the
|
||||
conversion.
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15549
|
||||
|
||||
Reviewed-by: Volker Lendecke <vl@samba.org>
|
||||
Signed-off-by: Ralph Boehme <slow@samba.org>
|
||||
|
||||
Autobuild-User(master): Volker Lendecke <vl@samba.org>
|
||||
Autobuild-Date(master): Mon Jan 22 12:00:56 UTC 2024 on atb-devel-224
|
||||
|
||||
(cherry picked from commit 2713023250f15cf9971d88620cab9dd4afd0dc73)
|
||||
|
||||
Autobuild-User(v4-19-test): Jule Anger <janger@samba.org>
|
||||
Autobuild-Date(v4-19-test): Mon Jan 29 11:59:41 UTC 2024 on atb-devel-224
|
||||
---
|
||||
source3/smbd/open.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
|
||||
index 6582bd60245..b9849f82396 100644
|
||||
--- a/source3/smbd/open.c
|
||||
+++ b/source3/smbd/open.c
|
||||
@@ -4865,8 +4865,8 @@ static NTSTATUS open_directory(connection_struct *conn,
|
||||
|
||||
if (access_mask & need_fd_access) {
|
||||
status = reopen_from_fsp(
|
||||
- fsp->conn->cwd_fsp,
|
||||
- fsp->fsp_name,
|
||||
+ parent_dir_fname->fsp,
|
||||
+ smb_fname_atname,
|
||||
fsp,
|
||||
O_RDONLY | O_DIRECTORY,
|
||||
0,
|
||||
--
|
||||
2.51.0
|
||||
|
||||
|
||||
@ -147,7 +147,7 @@
|
||||
%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
|
||||
|
||||
%global samba_version 4.19.4
|
||||
%global baserelease 10
|
||||
%global baserelease 11
|
||||
# This should be rc1 or %%nil
|
||||
%global pre_release %nil
|
||||
|
||||
@ -4479,6 +4479,9 @@ fi
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Thu Sep 25 2025 Andreas Schneider <asn@redhat.com> - 4.19.4-11
|
||||
- resolves: RHEL-115067 - Fix regression with symlinks inside shares
|
||||
|
||||
* Wed Aug 27 2025 Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-10
|
||||
- resolves: RHEL-101902 - Fix DC discovery after Windows netlogon hardening - follow-up
|
||||
- resolves: RHEL-111318 - Fix winbind fork bomb in 'IPA with AD trust' environment
|
||||
|
||||
Loading…
Reference in New Issue
Block a user