diff --git a/.gitignore b/.gitignore index 2de4b69..a91c0a6 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -SOURCES/samba-4.23.5.tar.xz +SOURCES/samba-4.24.5.tar.xz SOURCES/samba-pubkey_AA99442FB680B620.gpg diff --git a/.samba.metadata b/.samba.metadata index 646b34e..f39dced 100644 --- a/.samba.metadata +++ b/.samba.metadata @@ -1,2 +1,2 @@ -19e3789510e8306f9584f56e198559f5c1c5bbc2 SOURCES/samba-4.23.5.tar.xz +d8bc9b1cb04f3d03fcf96f5af4b959f7ec26cefd SOURCES/samba-4.24.5.tar.xz 971f563c447eda8d144d6c9e743cd0f0488c0d9e SOURCES/samba-pubkey_AA99442FB680B620.gpg diff --git a/SOURCES/redhat-4.23.patch b/SOURCES/redhat-4.23.patch deleted file mode 100644 index 6652d4b..0000000 --- a/SOURCES/redhat-4.23.patch +++ /dev/null @@ -1,957 +0,0 @@ -From e8384b6daea3b8091ad1bcfce84efc9e2c6a746d Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= -Date: Thu, 22 Jan 2026 14:27:09 +0100 -Subject: [PATCH 01/13] s3:libads: Allocate cli_credentials on a stackframe -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This fixes: -ERROR: talloc_free with references at ../../source3/libads/ldap_utils.c:158 - -What happens: - -* `struct cli_credentials *creds` is allocated on `ads` talloc context -* gensec_set_credentials() creates a talloc_reference to `creds` -* TALLOC_FREE(creds) sees two parents and complains - -All other code is using temporary talloc_stackframe() for `creds`. -Do it here as well. - -Signed-off-by: Pavel Filipenský -Reviewed-by: Stefan Metzmacher - -Autobuild-User(master): Stefan Metzmacher -Autobuild-Date(master): Fri Jan 23 11:20:28 UTC 2026 on atb-devel-224 ---- - source3/libads/ldap_utils.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c -index 9d6d962a2bc..d01afa69697 100644 ---- a/source3/libads/ldap_utils.c -+++ b/source3/libads/ldap_utils.c -@@ -99,6 +99,7 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind - struct cli_credentials *creds = NULL; - char *cred_name = NULL; - NTSTATUS ntstatus; -+ TALLOC_CTX *frame = talloc_stackframe(); - - if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) && - ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) && -@@ -119,18 +120,20 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind - DBG_NOTICE("Search for %s in <%s> failed: %s\n", - expr, bp, ads_errstr(status)); - SAFE_FREE(bp); -+ TALLOC_FREE(frame); - return status; - } - - ntstatus = ads->auth.reconnect_state->fn(ads, - ads->auth.reconnect_state->private_data, -- ads, &creds); -+ frame, &creds); - if (!NT_STATUS_IS_OK(ntstatus)) { - DBG_WARNING("Failed to get creds for realm(%s): %s\n", - ads->server.realm, nt_errstr(ntstatus)); - DBG_WARNING("Search for %s in <%s> failed: %s\n", - expr, bp, ads_errstr(status)); - SAFE_FREE(bp); -+ TALLOC_FREE(frame); - return status; - } - -@@ -151,11 +154,11 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind - * callers depend on it being around. - */ - ads_disconnect(ads); -- TALLOC_FREE(creds); -+ TALLOC_FREE(frame); - SAFE_FREE(bp); - return status; - } -- TALLOC_FREE(creds); -+ TALLOC_FREE(frame); - - *res = NULL; - --- -2.53.0 - - -From 7af95c7cb142aeb5f422a69d3b7a0ea3c0d2c2c2 Mon Sep 17 00:00:00 2001 -From: Samuel Cabrero -Date: Mon, 26 Jan 2026 13:36:02 +0100 -Subject: [PATCH 02/13] s3:rpc_client: Fix memory leak opening local named pipe - -If no local server name was passed to rpc_pipe_open_local_np() then -get_myname() was called with NULL talloc context instead of the -current stackframe. - -This was causing an increase of memory usage on busy servers with long-living -rpcd_* workers. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15979 - -Signed-off-by: Samuel Cabrero -Reviewed-by: Noel Power -Reviewed-by: Volker Lendecke - -Autobuild-User(master): Volker Lendecke -Autobuild-Date(master): Tue Jan 27 10:13:40 UTC 2026 on atb-devel-224 - -(cherry picked from commit 24dc455362fb49ef81c99d95880e106a234ce29a) ---- - source3/rpc_client/cli_pipe.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c -index e3f48526492..c61b8eb16cf 100644 ---- a/source3/rpc_client/cli_pipe.c -+++ b/source3/rpc_client/cli_pipe.c -@@ -3625,7 +3625,7 @@ NTSTATUS rpc_pipe_open_local_np( - } - - if (local_server_name == NULL) { -- local_server_name = get_myname(result); -+ local_server_name = get_myname(frame); - } - - if (local_server_addr != NULL) { --- -2.53.0 - - -From ab1287f78bd9d2397c8eb26fbedafa028e2aaa16 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Tue, 2 Dec 2025 17:17:33 +0100 -Subject: [PATCH 03/13] s3-selftest: mention in-memory ccache usage when - nothing is provided - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider ---- - source3/script/tests/test_net_ads_kerberos.sh | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/source3/script/tests/test_net_ads_kerberos.sh b/source3/script/tests/test_net_ads_kerberos.sh -index 8a3c9ef2bc7..92d3996d078 100755 ---- a/source3/script/tests/test_net_ads_kerberos.sh -+++ b/source3/script/tests/test_net_ads_kerberos.sh -@@ -30,6 +30,7 @@ KRB5CCNAME="FILE:$KRB5CCNAME_PATH" - ## Test "net ads kerberos kinit" variants - ################################################# - -+#simply uses in memory ccache - testit "net_ads_kerberos_kinit" \ - "$VALGRIND" "$BINDIR"/net ads kerberos kinit \ - -U"$USERNAME"%"$PASSWORD" "$ADDARGS" \ -@@ -50,6 +51,7 @@ rm -f "$KRB5CCNAME_PATH" - # --use-krb5-ccache=${KRB5CCNAME} \ - # || failed=$((failed + 1)) - -+#simply uses in memory ccache - testit "net_ads_kerberos_kinit (-P)" \ - "$VALGRIND" "$BINDIR"/net ads kerberos kinit \ - -P "$ADDARGS" \ --- -2.53.0 - - -From 0aa0d39e9a5deb77114f40930b599f11fd7cf3b6 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Tue, 2 Dec 2025 17:18:41 +0100 -Subject: [PATCH 04/13] s3-selftest: verify KRB5CCNAME presence after kinit - using klist - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider ---- - source3/script/tests/test_net_ads_kerberos.sh | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/source3/script/tests/test_net_ads_kerberos.sh b/source3/script/tests/test_net_ads_kerberos.sh -index 92d3996d078..c53520cf733 100755 ---- a/source3/script/tests/test_net_ads_kerberos.sh -+++ b/source3/script/tests/test_net_ads_kerberos.sh -@@ -14,6 +14,12 @@ PREFIX="$4" - shift 4 - ADDARGS="$*" - -+if [ -x $(which klist) ]; then -+ KLIST=$(which klist); -+else -+ KLIST="test -e"; -+fi -+ - incdir=$(dirname "$0")/../../../testprogs/blackbox - . "$incdir"/subunit.sh - -@@ -41,6 +47,9 @@ testit "net_ads_kerberos_kinit (KRB5CCNAME env set)" \ - "$VALGRIND" "$BINDIR"/net ads kerberos kinit \ - -U"$USERNAME"%"$PASSWORD" "$ADDARGS" \ - || failed=$((failed + 1)) -+testit "klist env $KRB5CCNAME" \ -+ "$KLIST" "$KRB5CCNAME" \ -+ || failed=$((failed +1)) - unset KRB5CCNAME - rm -f "$KRB5CCNAME_PATH" - -@@ -62,6 +71,9 @@ testit "net_ads_kerberos_kinit (-P and KRB5CCNAME env set)" \ - "$VALGRIND" "$BINDIR"/net ads kerberos kinit \ - -P "$ADDARGS" \ - || failed=$((failed + 1)) -+testit "klist env $KRB5CCNAME" \ -+ "$KLIST" "$KRB5CCNAME" \ -+ || failed=$((failed +1)) - unset KRB5CCNAME - rm -f "$KRB5CCNAME_PATH" - --- -2.53.0 - - -From b9c07d59c6a20931b80fa104629477ab8f78b4ad Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Tue, 2 Dec 2025 17:01:31 +0100 -Subject: [PATCH 05/13] s3-selftest: Activate "net ads kerberos kinit" tests - with --use-krb5-ccache - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider ---- - selftest/knownfail | 2 ++ - source3/script/tests/test_net_ads_kerberos.sh | 30 +++++++++++-------- - 2 files changed, 20 insertions(+), 12 deletions(-) - -diff --git a/selftest/knownfail b/selftest/knownfail -index ab2d79d7114..76f1dae605d 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -338,3 +338,5 @@ - - # We currently don't send referrals for LDAP modify of non-replicated attrs - ^samba4.ldap.rodc.python\(rodc\).__main__.RodcTests.test_modify_nonreplicated.* -+ -+^samba3.blackbox.net_ads_kerberos.*.klist.*--use-krb5-ccache.* -diff --git a/source3/script/tests/test_net_ads_kerberos.sh b/source3/script/tests/test_net_ads_kerberos.sh -index c53520cf733..b7933bab6a6 100755 ---- a/source3/script/tests/test_net_ads_kerberos.sh -+++ b/source3/script/tests/test_net_ads_kerberos.sh -@@ -53,12 +53,15 @@ testit "klist env $KRB5CCNAME" \ - unset KRB5CCNAME - rm -f "$KRB5CCNAME_PATH" - --# --use-krb5-ccache is not working --#testit "net_ads_kerberos_kinit (with --use-krb5-ccache)" \ --# $VALGRIND $BINDIR/net ads kerberos kinit \ --# -U$USERNAME%$PASSWORD $ADDARGS \ --# --use-krb5-ccache=${KRB5CCNAME} \ --# || failed=$((failed + 1)) -+testit "net_ads_kerberos_kinit (with --use-krb5-ccache)" \ -+ "$VALGRIND" "$BINDIR"/net ads kerberos kinit \ -+ -U"$USERNAME"%"$PASSWORD" "$ADDARGS" \ -+ --use-krb5-ccache="${KRB5CCNAME_PATH}" \ -+ || failed=$((failed + 1)) -+testit "klist --use-krb5-ccache $KRB5CCNAME_PATH" \ -+ "$KLIST" "$KRB5CCNAME_PATH" \ -+ || failed=$((failed +1)) -+rm -f "$KRB5CCNAME_PATH" - - #simply uses in memory ccache - testit "net_ads_kerberos_kinit (-P)" \ -@@ -77,12 +80,15 @@ testit "klist env $KRB5CCNAME" \ - unset KRB5CCNAME - rm -f "$KRB5CCNAME_PATH" - --# --use-krb5-ccache is not working --#testit "net_ads_kerberos_kinit (-P with --use-krb5-ccache)" \ --# $VALGRIND $BINDIR/net ads kerberos kinit \ --# -P $ADDARGS \ --# --use-krb5-ccache=${KRB5CCNAME} \ --# || failed=$((failed + 1)) -+testit "net_ads_kerberos_kinit (-P with --use-krb5-ccache)" \ -+ "$VALGRIND" "$BINDIR"/net ads kerberos kinit \ -+ -P "$ADDARGS" \ -+ --use-krb5-ccache="${KRB5CCNAME_PATH}" \ -+ || failed=$((failed + 1)) -+testit "klist --use-krb5-ccache $KRB5CCNAME_PATH" \ -+ "$KLIST" "$KRB5CCNAME_PATH" \ -+ || failed=$((failed +1)) -+rm -f "$KRB5CCNAME_PATH" - - - ################################################# --- -2.53.0 - - -From c82b7636b633575621e8e5964a93332956c238ff Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Tue, 2 Dec 2025 16:56:44 +0100 -Subject: [PATCH 06/13] s3-net: properly setup krb5 ccache name via - --use-krb5-ccache - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider ---- - selftest/knownfail | 2 -- - source3/utils/net.c | 19 ++++++++++++------- - source3/utils/net_ads.c | 4 ++++ - 3 files changed, 16 insertions(+), 9 deletions(-) - -diff --git a/selftest/knownfail b/selftest/knownfail -index 76f1dae605d..ab2d79d7114 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -338,5 +338,3 @@ - - # We currently don't send referrals for LDAP modify of non-replicated attrs - ^samba4.ldap.rodc.python\(rodc\).__main__.RodcTests.test_modify_nonreplicated.* -- --^samba3.blackbox.net_ads_kerberos.*.klist.*--use-krb5-ccache.* -diff --git a/source3/utils/net.c b/source3/utils/net.c -index ecabd980d0c..271c96cf804 100644 ---- a/source3/utils/net.c -+++ b/source3/utils/net.c -@@ -1396,7 +1396,7 @@ static struct functable net_func[] = { - cli_credentials_get_principal_obtained(c->creds); - enum credentials_obtained password_obtained = - cli_credentials_get_password_obtained(c->creds); -- char *krb5ccname = NULL; -+ const char *krb5ccname = NULL; - - if (principal_obtained == CRED_SPECIFIED) { - c->explicit_credentials = true; -@@ -1415,15 +1415,20 @@ static struct functable net_func[] = { - } - - /* cli_credentials_get_ccache_name_obtained() would not work -- * here, we also cannot get the content of --use-krb5-ccache= so -- * for now at least honour the KRB5CCNAME environment variable -- * to get 'net ads kerberos' functions to work at all - gd */ -- -- krb5ccname = getenv("KRB5CCNAME"); -- if (krb5ccname == NULL) { -+ * here but we can now access the content of the -+ * --use-krb5-ccache option via cli credentials. Fallback to -+ * KRB5CCNAME environment variable to get 'net ads kerberos' -+ * functions to work at all - gd */ -+ -+ krb5ccname = cli_credentials_get_out_ccache_name(c->creds); -+ if (krb5ccname == NULL || krb5ccname[0] == '\0') { -+ krb5ccname = getenv("KRB5CCNAME"); -+ } -+ if (krb5ccname == NULL || krb5ccname[0] == '\0') { - krb5ccname = talloc_strdup(c, "MEMORY:net"); - } - if (krb5ccname == NULL) { -+ DBG_ERR("Not able to setup krb5 ccache"); - exit(1); - } - c->opt_krb5_ccache = krb5ccname; -diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c -index d49b7537e71..5c57a0b290e 100644 ---- a/source3/utils/net_ads.c -+++ b/source3/utils/net_ads.c -@@ -3245,7 +3245,11 @@ static int net_ads_kerberos_kinit(struct net_context *c, int argc, const char ** - if (ret) { - d_printf(_("failed to kinit password: %s\n"), - nt_errstr(status)); -+ return ret; - } -+ -+ d_printf("Stored Kerberos TGT in: %s\n", c->opt_krb5_ccache); -+ - return ret; - } - --- -2.53.0 - - -From 4f5ffea631d805564f7e92cc5f0f2f7ad55ba493 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Sat, 13 Dec 2025 13:49:37 +0100 -Subject: [PATCH 07/13] doc-xml: Document "net ads kerberos" commands -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Günther Deschner -Autobuild-Date(master): Mon Jan 5 15:49:04 UTC 2026 on atb-devel-224 ---- - docs-xml/manpages/net.8.xml | 139 ++++++++++++++++++++++++++++++++++++ - 1 file changed, 139 insertions(+) - -diff --git a/docs-xml/manpages/net.8.xml b/docs-xml/manpages/net.8.xml -index d9293d0bb34..737415b3722 100644 ---- a/docs-xml/manpages/net.8.xml -+++ b/docs-xml/manpages/net.8.xml -@@ -1810,7 +1810,146 @@ the following entry types; - - - -+ -+ ADS KERBEROS -+ -+ -+ Issue Kerberos operations against an Active Directory KDC. -+ -+ -+ -+ -+ -+ ADS KERBEROS KINIT -+ -+ -+ Issue a kinit request for a given user. When no other options are -+ defined the ticket granting ticket (TGT) will be stored in a memory cache. -+ -+ -+ -+ To store the TGT in a different location either use the -+ option or set the -+ KRB5CCNAME environment variable. -+ -+ -+Example: net ads kerberos kinit -P --krb5-ccache=/tmp/krb5cache -+ -+ -+ -+ -+ ADS KERBEROS RENEW -+ -+ -+ Renew an already acquired ticket granting ticket (TGT). -+ -+ -+Example: net ads kerberos renew -+ -+ -+ -+ -+ ADS KERBEROS PAC -+ -+ -+ Request a Kerberos PAC while authenticating to an Active Directory KDC. -+ -+ -+ -+ The following commands are provided: -+ -+ -+ -+net ads kerberos pac dump - Dump a PAC to stdout. -+net ads kerneros pac save - Save a PAC to a file. -+ -+ -+ -+ All commands allow to define an impersonation principal to do a Kerberos -+ Service for User (S4U2SELF) operation via -+ the impersonate=STRING option. -+ The impersonation principal can have multiple different formats: -+ -+ -+ -+ -+ user@MY.REALM -+ This is the default format. -+ -+ -+ user@MY.REALM@MY.REALM -+ The Kerberos Service for User (S4U2SELF) also supports -+ Enterprise Principals. -+ -+ -+ user@UPN.SUFFIX@MY.REALM -+ Enterprise Principal using a defined upn suffix. -+ -+ -+ user@WORKGROUP@MY.REALM -+ Enterprise Principal with netbios domain name. -+ This format is currently not supported by Samba AD. -+ -+ - -+ -+ By default net will request a service ticket for the local service -+ of the joined machine. A different service can be defined via -+ local_service=STRING. -+ -+ -+ -+ -+ ADS KERBEROS PAC DUMP [impersonate=string] [local_service=string] [pac_buffer_type=int] -+ -+ -+ Request a Kerberos PAC while authenticating to an Active Directory KDC. -+ The PAC will be printed on stdout. -+ -+ -+ -+ When no specific pac_buffer is selected, all buffers will be printed. -+ It is possible to select a specific one via -+ pac_buffer_type=INT from this list: -+ -+ -+ -+1 PAC_TYPE_LOGON_INFO -+2 PAC_TYPE_CREDENTIAL_INFO -+6 PAC_TYPE_SRV_CHECKSUM -+7 PAC_TYPE_KDC_CHECKSUM -+10 PAC_TYPE_LOGON_NAME -+11 PAC_TYPE_CONSTRAINED_DELEGATION -+12 PAC_TYPE_UPN_DNS_INFO -+13 PAC_TYPE_CLIENT_CLAIMS_INFO -+14 PAC_TYPE_DEVICE_INFO -+15 PAC_TYPE_DEVICE_CLAIMS_INFO -+16 PAC_TYPE_TICKET_CHECKSUM -+17 PAC_TYPE_ATTRIBUTES_INFO -+18 PAC_TYPE_REQUESTER_SID -+19 PAC_TYPE_FULL_CHECKSUM -+ -+ -+Example: net ads kerberos pac dump -P impersonate=anyuser@MY.REALM.COM -+ -+ -+ -+ -+ ADS KERBEROS PAC SAVE [impersonate=string] [local_service=string] [filename=string] -+ -+ -+ Request a Kerberos PAC while authenticating to an Active Directory KDC. -+ The PAC will be saved in a file. -+ -+ -+ -+ The filename to store the PAC can be set via the -+ filename=STRING option. -+ -+ -+Example: net ads kerberos pac save -U user%password filename=/tmp/pacstore -+ -+ - - SAM CREATEBUILTINGROUP <NAME> - --- -2.53.0 - - -From f634526bd95b8396ea7f5f1c8ed059eb01a5286b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= -Date: Tue, 3 Feb 2026 12:53:10 +0100 -Subject: [PATCH 08/13] s3:utils: 'net ads kerberos kinit' should use also - default ccache name from krb5.conf -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This is re-introducing the behavior from samba-4.20 where both these -commands operated on the same ccache (default_ccache_name in -[libdefaults] section of krb5.conf) - - 'net ads kerberos kinit -P' - 'klist' - - With samba-4.21 it no longer works, 'net ads kerberos kinit -P' - fallbacks to 'MEMORY:net' (which is of a very limited use, ticket - cannot be used by other process) and klist finds no ticket. - - The order is changed from: - - --use-krb5-ccache - env "KRB5CCNAME" - "MEMORY:net" - -to ("MEMORY:net" is removed): - - --use-krb5-ccache - env "KRB5CCNAME" - default_ccache_name - -'--use-krb5-ccache=MEMORY:net' can be used to validate the credentials. - -Use smb_force_krb5_cc_default_name() instead of krb5_cc_default_name() -because of commit: -1ca6fb5 make sure krb5_cc_default[_name]() is no longer used directly - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15993 - -Signed-off-by: Pavel Filipenský -Reviewed-by: Andreas Schneider -(cherry picked from commit 4cc6a13590434f6a3aa1add663728188970d727e) ---- - source3/utils/net.c | 36 ++++++++++++++++++++++++++---------- - 1 file changed, 26 insertions(+), 10 deletions(-) - -diff --git a/source3/utils/net.c b/source3/utils/net.c -index 271c96cf804..0ce03f8213d 100644 ---- a/source3/utils/net.c -+++ b/source3/utils/net.c -@@ -54,6 +54,7 @@ - #include "source3/utils/passwd_proto.h" - #include "auth/gensec/gensec.h" - #include "lib/param/param.h" -+#include "lib/krb5_wrap/krb5_samba.h" - - #ifdef WITH_FAKE_KASERVER - #include "utils/net_afs.h" -@@ -1414,18 +1415,33 @@ static struct functable net_func[] = { - CRED_SPECIFIED); - } - -- /* cli_credentials_get_ccache_name_obtained() would not work -- * here but we can now access the content of the -- * --use-krb5-ccache option via cli credentials. Fallback to -- * KRB5CCNAME environment variable to get 'net ads kerberos' -- * functions to work at all - gd */ -- -+ /* -+ * Priority order for krb5 credential cache name -+ * -+ * via cli_credentials_get_out_ccache_name() : -+ * -+ * 1. '--use-krb5-ccache' option -+ * -+ * via krb5_cc_default_name() : -+ * -+ * 2. KRB5CCNAME environment variable -+ * 3. default_ccache_name in [libdefaults] section of krb5.conf -+ * 4. ...more - krb5_cc_default_name() always returns something -+ * - see documentation -+ */ - krb5ccname = cli_credentials_get_out_ccache_name(c->creds); - if (krb5ccname == NULL || krb5ccname[0] == '\0') { -- krb5ccname = getenv("KRB5CCNAME"); -- } -- if (krb5ccname == NULL || krb5ccname[0] == '\0') { -- krb5ccname = talloc_strdup(c, "MEMORY:net"); -+ krb5_context ct = NULL; -+ krb5_error_code ret = smb_krb5_init_context_common(&ct); -+ -+ if (ret == 0) { -+ krb5ccname = smb_force_krb5_cc_default_name(ct); -+ if (krb5ccname != NULL) { -+ krb5ccname = talloc_strdup(c, -+ krb5ccname); -+ } -+ krb5_free_context(ct); -+ } - } - if (krb5ccname == NULL) { - DBG_ERR("Not able to setup krb5 ccache"); --- -2.53.0 - - -From 0ca830d6ddded29b2b5d1969ebcbc4df1156656e Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= -Date: Thu, 5 Feb 2026 16:04:25 +0100 -Subject: [PATCH 09/13] manpages: Update NET ADS KERBEROS KINIT manpage -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15993 - -Signed-off-by: Pavel Filipenský -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Pavel Filipensky -Autobuild-Date(master): Thu Feb 5 21:11:13 UTC 2026 on atb-devel-224 - -(cherry picked from commit 9d083a28fe45afd8f82441c6e24255e4c64c113b) ---- - docs-xml/manpages/net.8.xml | 36 ++++++++++++++++++++++++++++-------- - 1 file changed, 28 insertions(+), 8 deletions(-) - -diff --git a/docs-xml/manpages/net.8.xml b/docs-xml/manpages/net.8.xml -index 737415b3722..b793361a27f 100644 ---- a/docs-xml/manpages/net.8.xml -+++ b/docs-xml/manpages/net.8.xml -@@ -1823,17 +1823,37 @@ the following entry types; - ADS KERBEROS KINIT - - -- Issue a kinit request for a given user. When no other options are -- defined the ticket granting ticket (TGT) will be stored in a memory cache. -+ Issue a kinit request for a given user. The following methods can be used -+ to specify where to store the ticket granting ticket (TGT) (in order of -+ precedence): - - -- -- To store the TGT in a different location either use the -- option or set the -- KRB5CCNAME environment variable. -- -+ -+ -+ option -+ -+ -+ KRB5CCNAME environment variable -+ -+ -+ default_ccache_name setting in krb5.conf -+ -+ - --Example: net ads kerberos kinit -P --krb5-ccache=/tmp/krb5cache -+Examples: -+ -+Use file based cache (FILE:/tmp/krb5cache) -+ -+net ads kerberos kinit -P --use-krb5-ccache=/tmp/krb5cache -+ -+ -+ -+Use memory cache (MEMORY:net) to verify the authentication -+ -+net ads kerberos kinit -P --use-krb5-ccache=MEMORY:net -+ -+ -+ - - - --- -2.53.0 - - -From 44b613d80c6a3818cc6ca593d57d51cd1bc00aa5 Mon Sep 17 00:00:00 2001 -From: Noel Power -Date: Fri, 13 Feb 2026 11:54:46 +0000 -Subject: [PATCH 10/13] selftest: Update tests to use - --use-kereros=desired|required no creds - -Add tests to call smbclient without passing credentials to -demonstrate failure with --use-kereros=desired - -Also add knownfail - -Signed-off-by: Noel Power -Reviewed-by: Andreas Schneider -(cherry picked from commit a22af9420965083b99b956477d1833000b7f2414) ---- - selftest/knownfail | 2 ++ - source3/script/tests/test_smbclient_kerberos.sh | 12 ++++++++++++ - 2 files changed, 14 insertions(+) - -diff --git a/selftest/knownfail b/selftest/knownfail -index ab2d79d7114..f0a5f7bb935 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -315,6 +315,8 @@ - # ad_member don't support ntlmv1 (not even over SMB1) - ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.member.creds.*as.user.*ad_member - ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user.*ad_member -+# regression smbclient using --use-kerberos=desired https://bugzilla.samba.org/show_bug.cgi?id=15789 -+samba3.blackbox.smbclient.kerberos.smbclient.smb3.kerberos.desired \(no user/pass\).* - #nt-vfs server blocks read with execute access - ^samba4.smb2.read.access - #ntvfs server blocks copychunk with execute access on read handle -diff --git a/source3/script/tests/test_smbclient_kerberos.sh b/source3/script/tests/test_smbclient_kerberos.sh -index 31678d17e28..1139efd70d7 100755 ---- a/source3/script/tests/test_smbclient_kerberos.sh -+++ b/source3/script/tests/test_smbclient_kerberos.sh -@@ -73,6 +73,18 @@ test_smbclient "smbclient.smb3.kerberos.desired[//${SERVER}/tmp]" \ - --use-kerberos=desired -U${USERNAME}%${PASSWORD} -mSMB3 || - failed=$(expr $failed + 1) - -+test_smbclient "smbclient.smb3.kerberos.desired (no user/pass) [//${SERVER}/tmp]" \ -+ "ls; quit" //${SERVER}/tmp \ -+ --use-kerberos=desired -mSMB3 || -+ failed=$(expr $failed + 1) -+ -+test_smbclient "smbclient.smb3.kerberos.required (no user/pass) [//${SERVER}/tmp]" \ -+ "ls; quit" //${SERVER}/tmp \ -+ --use-kerberos=required -mSMB3 || -+ failed=$(expr $failed + 1) -+ -+ -+ - $samba_kdestroy - - rm -rf $KRB5CCNAME_PATH --- -2.53.0 - - -From 65f70c0505759489a8b219e1297f8cdee2cc260a Mon Sep 17 00:00:00 2001 -From: Noel Power -Date: Mon, 19 Jan 2026 15:46:59 +0000 -Subject: [PATCH 11/13] auth/credentials: Fix regression with - --use-kerberos=desired for smbclient - -As part of the gse_krb5 processing the following call chain - -gensec_gse_client_start() - ---> gensec_kerberos_possible() - ---> cli_credentials_authentication_requested() - -gensec_kerberos_possible() will always fail when -cli_credentials_get_kerberos_state() returns CRED_USE_KERBEROS_DESIRED - -It seems since use kerberos == desired is the default that it isn't -necessary to see if credentials were modified to indicated authentication -was requested. gensec_kerberos_possible() should afaics return true -if kerberos is desired OR required (regardless of whether credentials -were requested) - -This commit removes the knownfail associated with this bug. - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789 -Signed-off-by: -Reviewed-by: Andreas Schneider -(cherry picked from commit 88f42eb222f299189d5f5f8204ae353e63a50970) ---- - auth/gensec/gensec_util.c | 5 ----- - selftest/knownfail | 2 -- - 2 files changed, 7 deletions(-) - -diff --git a/auth/gensec/gensec_util.c b/auth/gensec/gensec_util.c -index 0c7688d33d2..af6d198d48f 100644 ---- a/auth/gensec/gensec_util.c -+++ b/auth/gensec/gensec_util.c -@@ -362,7 +362,6 @@ char *gensec_get_unparsed_target_principal(struct gensec_security *gensec_securi - NTSTATUS gensec_kerberos_possible(struct gensec_security *gensec_security) - { - struct cli_credentials *creds = gensec_get_credentials(gensec_security); -- bool auth_requested = cli_credentials_authentication_requested(creds); - enum credentials_use_kerberos krb5_state = - cli_credentials_get_kerberos_state(creds); - char *user_principal = NULL; -@@ -370,10 +369,6 @@ NTSTATUS gensec_kerberos_possible(struct gensec_security *gensec_security) - const char *target_principal = gensec_get_target_principal(gensec_security); - const char *hostname = gensec_get_target_hostname(gensec_security); - -- if (!auth_requested) { -- return NT_STATUS_INVALID_PARAMETER; -- } -- - if (krb5_state == CRED_USE_KERBEROS_DISABLED) { - return NT_STATUS_INVALID_PARAMETER; - } -diff --git a/selftest/knownfail b/selftest/knownfail -index f0a5f7bb935..ab2d79d7114 100644 ---- a/selftest/knownfail -+++ b/selftest/knownfail -@@ -315,8 +315,6 @@ - # ad_member don't support ntlmv1 (not even over SMB1) - ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.member.creds.*as.user.*ad_member - ^samba3.blackbox.smbclient_auth.plain.*option=clientntlmv2auth=no.*mNT1.member.creds.*as.user.*ad_member --# regression smbclient using --use-kerberos=desired https://bugzilla.samba.org/show_bug.cgi?id=15789 --samba3.blackbox.smbclient.kerberos.smbclient.smb3.kerberos.desired \(no user/pass\).* - #nt-vfs server blocks read with execute access - ^samba4.smb2.read.access - #ntvfs server blocks copychunk with execute access on read handle --- -2.53.0 - - -From 8c955cad98b197936fceaf98306047e1f929ddfe Mon Sep 17 00:00:00 2001 -From: Noel Power -Date: Mon, 19 Jan 2026 16:10:10 +0000 -Subject: [PATCH 12/13] s3/libsmb: cli_session_creds_init fails when kerberos - is desired - -There is a regression with code using cli_session_creds_init when -cli_credentials_get_kerberos_state() returns CRED_USE_KERBEROS_DESIRED - -Authentication succeeds when boolean fallback_after_kerberos is false -and fails when true. -There doesn't seem to be a good reason why the value of -fallback_after_kerberos should initialise the krb5 ccache or not. -It would seems that krb5 cache should be setup for creds -for *any* kerberos auth (whether fallback is enabled or not) - -Partial patch from (see bug referenced below) -Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789 -Signed-off-by: Noel Power -Reviewed-by: Andreas Schneider -(cherry picked from commit 1c48599105736499d18aa1f647bce9e1f8dbdcca) ---- - source3/libsmb/cliconnect.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c -index 116f746d37e..3fd423d8e5f 100644 ---- a/source3/libsmb/cliconnect.c -+++ b/source3/libsmb/cliconnect.c -@@ -218,7 +218,7 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx, - goto fail; - } - } -- } else if (use_kerberos && !fallback_after_kerberos) { -+ } else if (use_kerberos) { - const char *error_string = NULL; - int rc; - --- -2.53.0 - - -From 015167aea7ece2bb683f86aa4b8c688d7a83267d Mon Sep 17 00:00:00 2001 -From: Noel Power -Date: Mon, 19 Jan 2026 16:18:02 +0000 -Subject: [PATCH 13/13] s3/libsmb: block anon authentication fallback is - use-kerberos = desired - -When cli_credentials_get_kerberos_state returns CRED_USE_KERBEROS_REQUIRED -libsmbclient method SMBC_server_internal will still try to fallback to -anon NTLM. This patch prevents that. - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789 -Signed-off-by: Noel Power -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Noel Power -Autobuild-Date(master): Tue Feb 17 16:06:18 UTC 2026 on atb-devel-224 - -(cherry picked from commit bc868800276fe09cbcb206ebe4cb4da32af7599f) ---- - source3/libsmb/libsmb_server.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/source3/libsmb/libsmb_server.c b/source3/libsmb/libsmb_server.c -index f9b52e1f05a..8c7208aaee0 100644 ---- a/source3/libsmb/libsmb_server.c -+++ b/source3/libsmb/libsmb_server.c -@@ -632,6 +632,8 @@ SMBC_server_internal(TALLOC_CTX *ctx, - password_used = ""; - - if (smbc_getOptionNoAutoAnonymousLogin(context) || -+ cli_credentials_get_kerberos_state(creds) == -+ CRED_USE_KERBEROS_REQUIRED || - !NT_STATUS_IS_OK(cli_session_setup_anon(c))) { - - cli_shutdown(c); --- -2.53.0 - diff --git a/SOURCES/redhat-4.24.patch b/SOURCES/redhat-4.24.patch new file mode 100644 index 0000000..61d3498 --- /dev/null +++ b/SOURCES/redhat-4.24.patch @@ -0,0 +1,80 @@ +From 1de6565c25272b536607e7e787d65765a3ad5220 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= +Date: Thu, 22 Jan 2026 14:27:09 +0100 +Subject: [PATCH] s3:libads: Allocate cli_credentials on a stackframe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This fixes: +ERROR: talloc_free with references at ../../source3/libads/ldap_utils.c:158 + +What happens: + +* `struct cli_credentials *creds` is allocated on `ads` talloc context +* gensec_set_credentials() creates a talloc_reference to `creds` +* TALLOC_FREE(creds) sees two parents and complains + +All other code is using temporary talloc_stackframe() for `creds`. +Do it here as well. + +Signed-off-by: Pavel Filipenský +Reviewed-by: Stefan Metzmacher + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Fri Jan 23 11:20:28 UTC 2026 on atb-devel-224 +--- + source3/libads/ldap_utils.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c +index 9d6d962a2bc..d01afa69697 100644 +--- a/source3/libads/ldap_utils.c ++++ b/source3/libads/ldap_utils.c +@@ -99,6 +99,7 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind + struct cli_credentials *creds = NULL; + char *cred_name = NULL; + NTSTATUS ntstatus; ++ TALLOC_CTX *frame = talloc_stackframe(); + + if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) && + ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) && +@@ -119,18 +120,20 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind + DBG_NOTICE("Search for %s in <%s> failed: %s\n", + expr, bp, ads_errstr(status)); + SAFE_FREE(bp); ++ TALLOC_FREE(frame); + return status; + } + + ntstatus = ads->auth.reconnect_state->fn(ads, + ads->auth.reconnect_state->private_data, +- ads, &creds); ++ frame, &creds); + if (!NT_STATUS_IS_OK(ntstatus)) { + DBG_WARNING("Failed to get creds for realm(%s): %s\n", + ads->server.realm, nt_errstr(ntstatus)); + DBG_WARNING("Search for %s in <%s> failed: %s\n", + expr, bp, ads_errstr(status)); + SAFE_FREE(bp); ++ TALLOC_FREE(frame); + return status; + } + +@@ -151,11 +154,11 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind + * callers depend on it being around. + */ + ads_disconnect(ads); +- TALLOC_FREE(creds); ++ TALLOC_FREE(frame); + SAFE_FREE(bp); + return status; + } +- TALLOC_FREE(creds); ++ TALLOC_FREE(frame); + + *res = NULL; + +-- +2.53.0 + diff --git a/SOURCES/samba-4.23.5.tar.asc b/SOURCES/samba-4.23.5.tar.asc deleted file mode 100644 index cb3ee28..0000000 --- a/SOURCES/samba-4.23.5.tar.asc +++ /dev/null @@ -1,16 +0,0 @@ ------BEGIN PGP SIGNATURE----- - -iQIzBAABCgAdFiEEgfXigyvSVFoYl7cTqplEL7aAtiAFAmlzV8sACgkQqplEL7aA -tiCrUxAAkEcyHkI48DZpwRd+0rP2IJC+6vpGj/RSGHdlyztw3R+49EOW9HURNqsl -8FHHUairod5CzyXc2UfoZNHuo5s3YE2WOuxSur2W8/FYPVllX9sOvNilaQsplvDX -8zMsQ4Ky5z57EeScDFaGl/NPypLcJ5i2hrBHRrn4Gsa5koKs9M+BlO1/xH8TBFPG -hAAXaLFw8pkMFDEIIrRMdOGAUeNaBq3dVkfzPAgd6FYAAUjuP/3O2gM87zLPgbf1 -5Deg+HYNLhKaAUNJPs3OuiLZTN3FpRAif/DKJCL16kbNxygN71OXI1vf20BooNpj -qTx3xseHraHkTy3HElru5CTlW+jYPLd7UqHcH0g+wRp/xlwH5vR7vc+wZpyFmOfm -OThXsVzZKzwQo9Ce+N9vs0FgSR0BLXvHHIs77XV0BdC3G/tE+iOPsp1GFbmhC5Dn -F/hqFmbKBBNiqv2v1s3mT1rX8DNeUaHA44coJJnr8vc9fMtrqkDuBiAOtzknm+j+ -IW3NLWsvl2y94anc9Aq6Ffanc1qSwVvdFNb/d1dZjR7sLP19UdJAFZTiJ/V2yQET -++AX9DKBtIO0KguJowEROrRu+inOT/Rs4PLwxxbtEVxqmqH7An+nO0FzV+xSjI/1 -l+zLG3njDFDSDS/cXvrnzvFAWqs/5pKmlhcDzAicnuUgIzsKd08= -=qxcw ------END PGP SIGNATURE----- diff --git a/SOURCES/samba-4.24.5.tar.asc b/SOURCES/samba-4.24.5.tar.asc new file mode 100644 index 0000000..4d510ae --- /dev/null +++ b/SOURCES/samba-4.24.5.tar.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEgfXigyvSVFoYl7cTqplEL7aAtiAFAmpg4boACgkQqplEL7aA +tiDZrBAAiBI8SST7hZeDLH5NYqyduC8PWrgOm6ljVrsqwPOofIt1HVbJNmeujQx4 ++9EuVATaf5S2+RS94hZmnJOxY2Bqd5LfXM3i+uaKAYkXx+qjBzFhT0qEGW0L+ZQl +x4fA0X5T0TdGF/022KRyZDt6LsgKl+O+0FiminuHDgqE8EsMNZ1jwjtbtn4cZVfn +OU0Cq0w0TP38QDMkDxsLu+ZrrHR0gxmp0KVR+pLjUXITwXsLYtXmOnforCUKhdIt +aIAg9B7uHrUMXPdF68s0msIFAA9aW9Y2UQPN7xRCvhlkKRwJKqLrFPJeRsaNrUkB +beOXqjMCs3WUtnBSCmJGKWaWAiQhazxSfBdo1obNI6CYNOy47ibwUzDUBGfBeeJ2 +1kcEtQRKSo1I6yzTYptj7LlOHBaN9eB/myIrmaTyzn9v/RHgZ2dx9lCa12h+kkjS +SnrTHJUpsNry26vtbV/5yph0cYRLo8A4bjoSWTINioa3KtN71384rQjgeaIK9Szb +Du4Cs2cQzcLZ6Fj5TertAnL+sW0WnI+kmN5EVxzSffqLSzrBI18dTG13mFNweFV2 +mC72vW1mPdAE5rqjzwMahcxril2zKvezD8F2mP77gGs+oWxkEM9Wiuz2AfSEToZQ +bg2oli+FIG9aGhRRjpxFaiYWq6gsws9h0a8as87YbAd+a2futPQ= +=onxY +-----END PGP SIGNATURE----- diff --git a/SPECS/samba.spec b/SPECS/samba.spec index 00a8f44..5afbc99 100644 --- a/SPECS/samba.spec +++ b/SPECS/samba.spec @@ -2,7 +2,7 @@ ## (rpmautospec version 0.6.5) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: - release_number = 6; + release_number = 1; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} @@ -16,7 +16,17 @@ # or # rpmbuild --rebuild --with testsuite samba.src.rpm # +# If you just want to run a single test, you can use: +# fedpkg mockbuild --with testsuite -- --define 'SAMBA_TESTS regex' samba.src.rpm +# or +# rpmbuild --rebuild --with testsuite --define='SAMBA_TESTS regex' samba.src.rpm +# %bcond testsuite 0 +%if %{with testsuite} +# As the file list is empty for running just the tests, we have empty debuginfo +# package. Disable it to avoid error reporting. +%global debug_package %{nil} +%endif # Build with internal talloc, tevent, tdb # @@ -112,7 +122,8 @@ # Build the etcd helpers by default on Fedora %if 0%{?fedora} -%bcond etcd_mutex 1 +# disable etcd mutex helper as etcd is orphaned in Fedora now +%bcond etcd_mutex 0 %else %bcond etcd_mutex 0 %endif @@ -130,7 +141,13 @@ %bcond lmdb 0 %endif -%global samba_version 4.23.5 +%if 0%{?fedora} >= 43 +%bcond varlink 1 +%else +%bcond varlink 0 +%endif + +%global samba_version 4.24.5 # The release field is extended: # [.][.]%%{?dist}[.] @@ -175,8 +192,8 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.4.3 -%global tdb_version 1.4.14 +%global talloc_version 2.4.4 +%global tdb_version 1.4.15 %global tevent_version 0.17.1 %global required_mit_krb5 1.20.1 @@ -236,15 +253,15 @@ Source202: samba.abignore # # git clone git@gitlab.com:samba-redhat/samba.git # cd samba -# git checkout v4-23-redhat -# git format-patch --stdout -l1 --no-renames -N > redhat-4.23.patch +# git checkout v4-24-redhat +# git format-patch --stdout -l1 --no-renames -N > redhat-4.24.patch # where N is number of commits -Patch0: redhat-4.23.patch +Patch0: redhat-4.24.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -345,6 +362,12 @@ BuildRequires: pkgconfig(libsystemd) %if 0%{?fedora} >= 43 BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) +%else +Provides: bundled(ngtcp2) +%endif + +%if %{with varlink} +BuildRequires: pkgconfig(libvarlink) >= 24 %endif %ifnarch i686 @@ -460,7 +483,7 @@ Unix. Summary: Samba client programs Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libsmbclient} @@ -483,12 +506,62 @@ The %{name}-client package provides some SMB/CIFS clients to complement the built-in SMB/CIFS filesystem in Linux. These clients allow access of SMB/CIFS shares and printing to SMB/CIFS printers. +### CORE-LIBS +%package core-libs +Summary: Samba core libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} + +Provides: bundled(libreplace) = %{samba_depver} + +%description core-libs +The samba-core-libs package contains foundational libraries needed by +both Samba servers and clients. This includes error handling, utilities, +and basic support libraries. + +### NDR-LIBS +%package ndr-libs +Summary: Samba NDR libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} + +Provides: %{name}-common-libs = %{samba_depver} +Obsoletes: %{name}-common-libs < %{samba_depver} + +%if %{without dc} && %{without testsuite} +Obsoletes: samba-dc < %{samba_depver} +Obsoletes: samba-dc-libs < %{samba_depver} +Obsoletes: samba-dc-bind-dlz < %{samba_depver} +%endif + +# ctdb-tests package has been dropped if we do not build the testsuite +%if %{with clustering} +%if %{without testsuite} +Obsoletes: ctdb-tests < %{samba_depver} +Obsoletes: ctdb-tests-debuginfo < %{samba_depver} +# endif without testsuite +%endif +# endif with clustering +%endif + +# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions +# of the distro +%if %{without vfs_glusterfs} +Obsoletes: samba-vfs-glusterfs < %{samba_depver} +# endif without vfs_glusterfs +%endif + +%description ndr-libs +The samba-ndr-libs package contains NDR (Network Data Representation) +encoding libraries used by both Samba servers and clients. + ### CLIENT-LIBS %package client-libs Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -518,50 +591,10 @@ Obsoletes: samba4-common < %{samba_depver} samba-common provides files necessary for both the server and client packages of Samba. -### COMMON-LIBS -%package common-libs -Summary: Libraries used by both Samba servers and clients -Requires(pre): samba-common = %{samba_depver} -Requires: samba-common = %{samba_depver} -Requires: %{name}-client-libs = %{samba_depver} -Requires: libldb = %{samba_depver} -%if %{with libwbclient} -Requires: libwbclient = %{samba_depver} -%endif - -Provides: bundled(libreplace) = %{samba_depver} - -%if %{without dc} && %{without testsuite} -Obsoletes: samba-dc < %{samba_depver} -Obsoletes: samba-dc-libs < %{samba_depver} -Obsoletes: samba-dc-bind-dlz < %{samba_depver} -%endif - -# ctdb-tests package has been dropped if we do not build the testsuite -%if %{with clustering} -%if %{without testsuite} -Obsoletes: ctdb-tests < %{samba_depver} -Obsoletes: ctdb-tests-debuginfo < %{samba_depver} -# endif without testsuite -%endif -# endif with clustering -%endif - -# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions -# of the distro -%if %{without vfs_glusterfs} -Obsoletes: samba-vfs-glusterfs < %{samba_depver} -# endif without vfs_glusterfs -%endif - -%description common-libs -The samba-common-libs package contains internal libraries needed by the -SMB/CIFS clients. - ### COMMON-TOOLS %package common-tools Summary: Tools for Samba clients -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} @@ -599,7 +632,7 @@ and for GPO management on domain members. ### RPC %package dcerpc Summary: DCE RPC binaries -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -617,7 +650,7 @@ The samba-dcerpc package contains binaries that serve DCERPC over named pipes. Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -661,7 +694,7 @@ The samba-dc-provision package provides files to setup a domain controller %package dc-libs Summary: Samba AD Domain Controller Libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -699,8 +732,10 @@ name server related details of Samba AD. ### DEVEL %package devel Summary: Developer tools for Samba libraries -Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: libnetapi = %{samba_depver} @@ -755,7 +790,7 @@ Summary: Samba VFS module for GlusterFS Requires: glusterfs-api >= 3.4.0.16 Requires: glusterfs >= 3.4.0.16 Requires: %{name} = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -806,7 +841,7 @@ the Kerberos credentials cache of the user issuing the print job. %package ldb-ldap-modules Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -817,7 +852,7 @@ samba-gpupdate. ### LIBS %package libs Summary: Samba libraries -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -838,7 +873,7 @@ against the SMB, RPC and other protocols provided by the Samba suite. Summary: The NETAPI library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -860,7 +895,7 @@ develop programs that link against the NETAPI library in the Samba suite. Summary: The SMB client library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -885,7 +920,7 @@ suite. %if %{with libwbclient} %package -n libwbclient Summary: The winbind client library -Requires: %{name}-client-libs = %{samba_depver} +# libwbclient.so only links to libc - no samba library dependencies needed Conflicts: sssd-libwbclient %description -n libwbclient @@ -910,7 +945,7 @@ library. %package -n python3-%{name} Summary: Samba Python3 libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-cryptography @@ -980,7 +1015,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-test-libs = %{samba_depver} @@ -1011,7 +1046,7 @@ packages of Samba. ### TEST-LIBS %package test-libs Summary: Libraries need by the testing tools for Samba servers and clients -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -1044,8 +1079,8 @@ as a user using the `net usershare` command. Summary: Samba winbind Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} -Requires(post): %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires(post): %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires(post): %{name}-client-libs = %{samba_depver} @@ -1078,7 +1113,7 @@ Windows user and group accounts on Linux. %package winbind-clients Summary: Samba winbind clients Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} @@ -1148,7 +1183,7 @@ necessary to communicate to the Winbind Daemon Summary: Samba Winexe Windows Binary License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -1163,7 +1198,7 @@ Winexe is a Remote Windows-command executor %package -n ctdb Summary: A Clustered Database based on Samba's Trivial Database (TDB) -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-winbind-clients = %{samba_depver} @@ -1336,6 +1371,13 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - # Make sure we do not build with heimdal code rm -rfv third_party/heimdal +%if %{with testsuite} +# WARNING: Don't change that for production! +# +# Shorten the priviliged dir, as unix sockets only have 108 chars +sed -i 's/#define WINBINDD_PRIV_SOCKET_SUBDIR.*/#define WINBINDD_PRIV_SOCKET_SUBDIR "wb_priv"/' nsswitch/winbind_struct_protocol.h +%endif + %build %if %{with includelibs} %global _talloc_lib ,talloc,pytalloc,pytalloc-util @@ -1445,6 +1487,9 @@ export PYTHONARCHDIR=%{python3_sitearch} %endif %if %{with prometheus} --with-prometheus-exporter \ +%endif +%if %{with varlink} + --with-systemd-userdb \ %endif --with-profiling-data \ --with-systemd \ @@ -1609,6 +1654,9 @@ rm -f %{buildroot}%{_mandir}/man3/PyLdb* # CTDB %if %{with clustering} touch %{buildroot}%{_libexecdir}/ctdb/statd_callout + +# Remove symlinks that are marked as %ghost (CTDB will create them at runtime) +rm -f %{buildroot}%{_sysconfdir}/ctdb/statd-callout #endif with clustering %endif @@ -1624,20 +1672,37 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout # in the timestamp so the year 2038 problem is deferred till 2446. # https://bugzilla.samba.org/show_bug.cgi?id=14546 # -for t in samba3.smb2.timestamps.time_t_15032385535 \ - samba3.smb2.timestamps.time_t_10000000000 \ - samba3.smb2.timestamps.time_t_4294967295 \ - ; do - echo "^$t" >> selftest/knownfail.d/fedora.%{dist} -done -cat selftest/knownfail.d/fedora.%{dist} +if [ "$(df --portability --print-type "$(pwd)" | grep -c ext4)" == "1" ]; then + cat > selftest/knownfail.d/fedora%{dist} << EOF +^samba3.smb2.timestamps.time_t_15032385535 +^samba3.smb2.timestamps.time_t_10000000000 +^samba3.smb2.timestamps.time_t_4294967295 +EOF +fi + +echo +echo "Content of selftest/knownfail.d/fedora%{dist}:" +cat selftest/knownfail.d/fedora%{dist} || true + +cat >> selftest/skip << EOF +# FIXME: Investigate why it fails. Might be CUPS is not running? +^samba3.rpc.spoolss.printserver +EOF + +echo +echo "Content of selftest/skip:" +cat selftest/skip export TDB_NO_FSYNC=1 export NMBD_DONT_LOG_STDOUT=1 export SMBD_DONT_LOG_STDOUT=1 export WINBINDD_DONT_LOG_STDOUT=1 export SAMBA_DCERPCD_DONT_LOG_STDOUT=1 +%if "x%{?SAMBA_TESTS}" != "x" +%{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 TESTS="%{SAMBA_TESTS}" +%else %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 +%endif #endif with testsuite %endif @@ -1683,7 +1748,7 @@ fi %ldconfig_scriptlets client-libs -%ldconfig_scriptlets common-libs +%ldconfig_scriptlets ndr-libs %if %{with dc} %ldconfig_scriptlets dc-libs @@ -1798,6 +1863,7 @@ fi %{_libdir}/samba/vfs/acl_xattr.so %{_libdir}/samba/vfs/aio_fork.so %{_libdir}/samba/vfs/aio_pthread.so +%{_libdir}/samba/vfs/aio_ratelimit.so %{_libdir}/samba/vfs/audit.so %{_libdir}/samba/vfs/btrfs.so %{_libdir}/samba/vfs/cap.so @@ -1860,6 +1926,7 @@ fi %{_mandir}/man8/vfs_acl_xattr.8* %{_mandir}/man8/vfs_aio_fork.8* %{_mandir}/man8/vfs_aio_pthread.8* +%{_mandir}/man8/vfs_aio_ratelimit.8* %{_mandir}/man8/vfs_audit.8* %{_mandir}/man8/vfs_btrfs.8* %{_mandir}/man8/vfs_cap.8* @@ -1977,33 +2044,104 @@ fi #endif with includelibs %endif +### CORE-LIBS +%files core-libs +%dir %{_libdir}/samba + +# +# Tier 0: Private libraries - libc only dependencies +# +%{_libdir}/samba/libreplace-private-samba.so +%{_libdir}/samba/libsocket-blocking-private-samba.so +%{_libdir}/samba/libsys-rw-private-samba.so +%{_libdir}/samba/libtime-basic-private-samba.so + +# +# Tier 1: Private libraries - system libs (libtalloc, libsystemd) +# +%{_libdir}/samba/libsamba-debug-private-samba.so +%{_libdir}/samba/libserver-role-private-samba.so + +# +# Tier 1: Public libraries - system libs (libtalloc) +# +%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* + +# +# Tier 2: Private libraries - adds gnutls +# +%{_libdir}/samba/libgenrand-private-samba.so + +# +# Tier 2: Public libraries - adds gnutls, icu, tevent +# +%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* +%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* + +### NDR-LIBS +%files ndr-libs + +# +# Core NDR library +# +%{_libdir}/libndr.so.%{libndr_so_version}* + +# +# Tier 0: libc only dependencies +# +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Tier 1: system libs only (libtalloc) +# +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so + +# +# Tier 2: depends on core-libs (debug, replace) +# +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so + +# +# Tier 3: depends on core-libs (util, errors, ndr) +# +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so + +# +# Tier 4: depends on core-libs + Tier 3 libs +# +%{_libdir}/samba/libsamba-security-private-samba.so + +# +# NDR encoding libraries +# +%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* +%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* +%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* %{_libdir}/libdcerpc-server-core.so.%{libdcerpc_server_core_so_version}* %{_libdir}/libdcerpc.so.%{libdcerpc_so_version}* -%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* -%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* -%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* -%{_libdir}/libndr.so.%{libndr_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* -%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* -%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* %{_libdir}/libsamdb.so.%{libsamdb_so_version}* %{_libdir}/libsmbconf.so.%{libsmbconf_so_version}* %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* -%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* - -%dir %{_libdir}/samba %{_libdir}/samba/libCHARSET3-private-samba.so %{_libdir}/samba/libMESSAGING-SEND-private-samba.so -%{_libdir}/samba/libMESSAGING-private-samba.so %{_libdir}/samba/libaddns-private-samba.so %{_libdir}/samba/libads-private-samba.so %{_libdir}/samba/libasn1util-private-samba.so -%{_libdir}/samba/libauth-private-samba.so %{_libdir}/samba/libauthkrb5-private-samba.so %{_libdir}/samba/libcli-cldap-private-samba.so %{_libdir}/samba/libcli-ldap-common-private-samba.so @@ -2016,20 +2154,12 @@ fi %{_libdir}/samba/libcluster-private-samba.so %{_libdir}/samba/libcmdline-contexts-private-samba.so %{_libdir}/samba/libcommon-auth-private-samba.so -%{_libdir}/samba/libctdb-event-client-private-samba.so -%{_libdir}/samba/libdbwrap-private-samba.so %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so %{_libdir}/samba/libdcerpc-samba-private-samba.so %{_libdir}/samba/libevents-private-samba.so -%{_libdir}/samba/libflag-mapping-private-samba.so -%{_libdir}/samba/libgenrand-private-samba.so %{_libdir}/samba/libgensec-private-samba.so -%{_libdir}/samba/libgpext-private-samba.so -%{_libdir}/samba/libgpo-private-samba.so %{_libdir}/samba/libgse-private-samba.so %{_libdir}/samba/libhttp-private-samba.so -%{_libdir}/samba/libinterfaces-private-samba.so -%{_libdir}/samba/libiov-buf-private-samba.so %{_libdir}/samba/libkrb5samba-private-samba.so %{_libdir}/samba/libldbsamba-private-samba.so %{_libdir}/samba/liblibcli-lsa3-private-samba.so @@ -2042,45 +2172,36 @@ fi %{_libdir}/samba/libmsrpc3-private-samba.so %{_libdir}/samba/libndr-samba-private-samba.so %{_libdir}/samba/libndr-samba4-private-samba.so -%{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so %if 0%{?rhel} %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so %{_libdir}/samba/libngtcp2-private-samba.so %endif %{_libdir}/samba/libnpa-tstream-private-samba.so -%{_libdir}/samba/libposix-eadb-private-samba.so -%{_libdir}/samba/libprinter-driver-private-samba.so -%{_libdir}/samba/libprinting-migrate-private-samba.so %{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so -%{_libdir}/samba/libsamba-debug-private-samba.so %{_libdir}/samba/libsamba-modules-private-samba.so -%{_libdir}/samba/libsamba-security-private-samba.so %{_libdir}/samba/libsamba-security-trusts-private-samba.so %{_libdir}/samba/libsamba-sockets-private-samba.so -%{_libdir}/samba/libsamba3-util-private-samba.so %{_libdir}/samba/libsamdb-common-private-samba.so %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so -%{_libdir}/samba/libserver-role-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so -%{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so -%{_libdir}/samba/libsmbldaphelper-private-samba.so -%{_libdir}/samba/libstable-sort-private-samba.so -%{_libdir}/samba/libsys-rw-private-samba.so -%{_libdir}/samba/libsocket-blocking-private-samba.so -%{_libdir}/samba/libtalloc-report-printf-private-samba.so -%{_libdir}/samba/libtalloc-report-private-samba.so -%{_libdir}/samba/libtdb-wrap-private-samba.so -%{_libdir}/samba/libtime-basic-private-samba.so -%{_libdir}/samba/libtorture-private-samba.so -%{_libdir}/samba/libutil-crypt-private-samba.so -%{_libdir}/samba/libutil-reg-private-samba.so -%{_libdir}/samba/libutil-setid-private-samba.so -%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Command line library +# +%{_libdir}/samba/libcmdline-private-samba.so + +# +# Password database modules (depend on libsamba-passdb) +# +%dir %{_libdir}/samba/ldb +%dir %{_libdir}/samba/pdb +%{_libdir}/samba/pdb/smbpasswd.so +%{_libdir}/samba/pdb/tdbsam.so %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* @@ -2131,19 +2252,6 @@ fi %{_mandir}/man5/smbpasswd.5* %{_mandir}/man7/samba.7* -### COMMON-LIBS -%files common-libs -# common libraries -%{_libdir}/samba/libcmdline-private-samba.so -%{_libdir}/samba/libreplace-private-samba.so - -%dir %{_libdir}/samba/ldb - -%dir %{_libdir}/samba/pdb -%{_libdir}/samba/pdb/ldapsam.so -%{_libdir}/samba/pdb/smbpasswd.so -%{_libdir}/samba/pdb/tdbsam.so - ### COMMON-TOOLS %files common-tools %{_bindir}/net @@ -2392,6 +2500,7 @@ fi %{_includedir}/samba-4.0/util/idtree_random.h %{_includedir}/samba-4.0/util/signal.h %{_includedir}/samba-4.0/util/substitute.h +%{_includedir}/samba-4.0/util/talloc_keep_secret.h %{_includedir}/samba-4.0/util/tevent_ntstatus.h %{_includedir}/samba-4.0/util/tevent_unix.h %{_includedir}/samba-4.0/util/tevent_werror.h @@ -2500,6 +2609,28 @@ fi %{_libdir}/samba/libRPC-SERVER-LOOP-private-samba.so %{_libdir}/samba/libRPC-WORKER-private-samba.so +# +# Server-side libraries (not used by libsmbclient) +# +%{_libdir}/samba/libauth-private-samba.so +%{_libdir}/samba/libctdb-event-client-private-samba.so +%{_libdir}/samba/libgpext-private-samba.so +%{_libdir}/samba/libgpo-private-samba.so +%{_libdir}/samba/libMESSAGING-private-samba.so +%{_libdir}/samba/libnet-keytab-private-samba.so +%{_libdir}/samba/libposix-eadb-private-samba.so +%{_libdir}/samba/libprinter-driver-private-samba.so +%{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libsmbd-base-private-samba.so +%{_libdir}/samba/libsmbldaphelper-private-samba.so +%{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libutil-crypt-private-samba.so + +# +# Password database modules (server-side, links to libsmbldaphelper) +# +%{_libdir}/samba/pdb/ldapsam.so + ### LIBNETAPI %files -n libnetapi %{_libdir}/libnetapi.so.%{libnetapi_so_version}* @@ -2589,6 +2720,7 @@ fi %{python3_sitearch}/samba/__init__.py %dir %{python3_sitearch}/samba/__pycache__ %{python3_sitearch}/samba/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/__pycache__/asn1.*.pyc %{python3_sitearch}/samba/__pycache__/auth_util.*.pyc %{python3_sitearch}/samba/__pycache__/colour.*.pyc %{python3_sitearch}/samba/__pycache__/common.*.pyc @@ -2597,12 +2729,14 @@ fi %{python3_sitearch}/samba/__pycache__/dnsresolver.*.pyc %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc %{python3_sitearch}/samba/__pycache__/functional_level.*.pyc +%{python3_sitearch}/samba/__pycache__/generate_csr.*.pyc %{python3_sitearch}/samba/__pycache__/getopt.*.pyc %{python3_sitearch}/samba/__pycache__/gkdi.*.pyc %{python3_sitearch}/samba/__pycache__/graph.*.pyc %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/__pycache__/idmap.*.pyc %{python3_sitearch}/samba/__pycache__/join.*.pyc +%{python3_sitearch}/samba/__pycache__/key_credential_link.*.pyc %{python3_sitearch}/samba/__pycache__/lsa_utils.*.pyc %{python3_sitearch}/samba/__pycache__/logger.*.pyc %{python3_sitearch}/samba/__pycache__/mdb_util.*.pyc @@ -2622,6 +2756,7 @@ fi %{python3_sitearch}/samba/__pycache__/xattr.*.pyc %{python3_sitearch}/samba/_glue.*.so %{python3_sitearch}/samba/_ldb.*.so +%{python3_sitearch}/samba/asn1.py %{python3_sitearch}/samba/auth.*.so %{python3_sitearch}/samba/auth_util.py %{python3_sitearch}/samba/dbchecker.py @@ -2762,6 +2897,7 @@ fi %{python3_sitearch}/samba/emulate/__init__.py %{python3_sitearch}/samba/emulate/traffic.py %{python3_sitearch}/samba/emulate/traffic_packets.py +%{python3_sitearch}/samba/generate_csr.py %dir %{python3_sitearch}/samba/gp %dir %{python3_sitearch}/samba/gp/__pycache__ %{python3_sitearch}/samba/gp/__init__.py @@ -2832,6 +2968,7 @@ fi %{python3_sitearch}/samba/gp_parse/gp_ini.py %{python3_sitearch}/samba/gp_parse/gp_pol.py %{python3_sitearch}/samba/hresult.*.so +%{python3_sitearch}/samba/key_credential_link.py %{python3_sitearch}/samba/logger.py %{python3_sitearch}/samba/mdb_util.py %{python3_sitearch}/samba/ms_display_specifiers.py @@ -2843,6 +2980,8 @@ fi %{python3_sitearch}/samba/netcmd/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/common.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/computer.*.pyc +%{python3_sitearch}/samba/netcmd/__pycache__/computer_generate_csr.*.pyc +%{python3_sitearch}/samba/netcmd/__pycache__/computer_keytrust.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/contact.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/dbcheck.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/delegation.*.pyc @@ -2872,6 +3011,8 @@ fi %{python3_sitearch}/samba/netcmd/__pycache__/visualize.*.pyc %{python3_sitearch}/samba/netcmd/common.py %{python3_sitearch}/samba/netcmd/computer.py +%{python3_sitearch}/samba/netcmd/computer_generate_csr.py +%{python3_sitearch}/samba/netcmd/computer_keytrust.py %{python3_sitearch}/samba/netcmd/contact.py %{python3_sitearch}/samba/netcmd/dbcheck.py %{python3_sitearch}/samba/netcmd/delegation.py @@ -3001,7 +3142,9 @@ fi %{python3_sitearch}/samba/netcmd/user/disable.py %{python3_sitearch}/samba/netcmd/user/edit.py %{python3_sitearch}/samba/netcmd/user/enable.py +%{python3_sitearch}/samba/netcmd/user/generate_csr.py %{python3_sitearch}/samba/netcmd/user/getgroups.py +%{python3_sitearch}/samba/netcmd/user/keytrust.py %{python3_sitearch}/samba/netcmd/user/list.py %{python3_sitearch}/samba/netcmd/user/move.py %{python3_sitearch}/samba/netcmd/user/password.py @@ -3013,7 +3156,9 @@ fi %{python3_sitearch}/samba/netcmd/user/__pycache__/disable.*.pyc %{python3_sitearch}/samba/netcmd/user/__pycache__/edit.*.pyc %{python3_sitearch}/samba/netcmd/user/__pycache__/enable.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/generate_csr.*.pyc %{python3_sitearch}/samba/netcmd/user/__pycache__/getgroups.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/keytrust.*.pyc %{python3_sitearch}/samba/netcmd/user/__pycache__/list.*.pyc %{python3_sitearch}/samba/netcmd/user/__pycache__/move.*.pyc %{python3_sitearch}/samba/netcmd/user/__pycache__/password.*.pyc @@ -3200,6 +3345,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_dn.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_env_tests.*.pyc @@ -3222,6 +3368,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/imports.*.pyc %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc %{python3_sitearch}/samba/tests/__pycache__/key_credential_link.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/key_credential_link_samdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc @@ -3439,6 +3586,7 @@ fi %{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dsdb.py %{python3_sitearch}/samba/tests/dsdb_api.py +%{python3_sitearch}/samba/tests/dsdb_dn.py %{python3_sitearch}/samba/tests/dsdb_dns.py %{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py @@ -3481,6 +3629,7 @@ fi %{python3_sitearch}/samba/tests/kcc/kcc_utils.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %{python3_sitearch}/samba/tests/key_credential_link.py +%{python3_sitearch}/samba/tests/key_credential_link_samdb.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc @@ -3502,12 +3651,14 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgt_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/key_trust_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/netlogon.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_certificate_mapping_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/protected_users_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc @@ -3545,12 +3696,14 @@ fi %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgt_tests.py +%{python3_sitearch}/samba/tests/krb5/key_trust_tests.py %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/lockout_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/netlogon.py %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py +%{python3_sitearch}/samba/tests/krb5/pkinit_certificate_mapping_tests.py %{python3_sitearch}/samba/tests/krb5/pkinit_tests.py %{python3_sitearch}/samba/tests/krb5/protected_users_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py @@ -3683,8 +3836,10 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_auth_policy.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_auth_silo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_check_password_script.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_generate_csr.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_get_kerberos_ticket.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_getpassword_gmsa.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_keytrust.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_gpg.*.pyc @@ -3731,8 +3886,10 @@ fi %{python3_sitearch}/samba/tests/samba_tool/user_auth_policy.py %{python3_sitearch}/samba/tests/samba_tool/user_auth_silo.py %{python3_sitearch}/samba/tests/samba_tool/user_check_password_script.py +%{python3_sitearch}/samba/tests/samba_tool/user_generate_csr.py %{python3_sitearch}/samba/tests/samba_tool/user_get_kerberos_ticket.py %{python3_sitearch}/samba/tests/samba_tool/user_getpassword_gmsa.py +%{python3_sitearch}/samba/tests/samba_tool/user_keytrust.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_base.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py @@ -3796,8 +3953,9 @@ fi %files test-libs %if %{with dc} %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so -%endif +%else %{_libdir}/samba/libdsdb-module-private-samba.so +%endif ### USERSHARES %files usershares @@ -4063,6 +4221,33 @@ fi %changelog ## START: Generated by rpmautospec +* Tue Jul 28 2026 Pavel Filipenský - 0:4.24.5-1 +- Update to version 4.24.5 +- resolves: RHEL-175124 + +* Fri May 29 2026 Pavel Filipenský - 0:4.24.3-1 +- Update to version 4.24.3 +- resolves: RHEL-156320 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: + various flaws +- resolves: RHEL-161658 - CVE-2026-4480 Samba: Remote Code Execution in + printing +- resolves: RHEL-170594 - CVE-2026-40170 samba: ngtcp2 +- resolves: RHEL-177925 - CVE-2026-4408 samba: Remote Code Execution in + SAMR +- resolves: RHEL-166869 - build hardening with FORTIFY_SOURCE + +* Wed May 27 2026 Pavel Filipenský - 0:4.24.2-1 +- Update to version 4.24.2 +- resolves: RHEL-175124 + +* Tue Apr 21 2026 Pavel Filipenský - 0:4.23.5-8 +- Fix 'net ads join' AD replication race with multiple DCs +- resolves: RHEL-169665 + +* Tue Apr 21 2026 Pavel Filipenský - 0:4.23.5-7 +- Fix samba automount triggering for more file systems +- resolves: RHEL-169726 + * Thu Feb 19 2026 Pavel Filipenský - 0:4.23.5-6 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150824