From cc8c80c04bab6ec65a12dbe779bfb12b2b6f793a Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 11 Aug 2021 11:25:37 +0530 Subject: [PATCH 001/295] Exclude PyDSDB library files Following library files are built without AD DC but has dependency on other components which are only available with DC: /usr/lib64/python3.9/site-packages/samba/dsdb.cpython-39-x86_64-linux-gnu.so /usr/lib64/python3.9/site-packages/samba/dsdb_dns.cpython-39-x86_64-linux-gnu.so Therefore we remove those from buildroot. resolves: #1991353 --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 2ab345f..b180f57 100644 --- a/samba.spec +++ b/samba.spec @@ -1201,6 +1201,8 @@ for i in \ %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ %{python3_sitearch}/samba/dnsserver.py \ %{python3_sitearch}/samba/domain_update.py \ + %{python3_sitearch}/samba/dsdb.*.so + %{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/forest_update.py \ %{python3_sitearch}/samba/kcc/__init__.py \ %{python3_sitearch}/samba/kcc/debug.py \ From db523c32dadf81f3e245ea121ed9e2f01ed6b744 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 11 Aug 2021 11:26:39 +0530 Subject: [PATCH 002/295] Move `samba-tool` from samba-dc to samba-common-tools sub-package samba-tool is now built in a non AD DC environment and has been improved to prevent crashes due to import errors. See the following commits in upstream: * https://git.samba.org/?p=samba.git;a=commit;h=779d0f02718b3812024bafcd5477ec3039c7a0cf * https://git.samba.org/?p=samba.git;a=commit;h=fb5fe30e824d2d511188053ce04cf797b769727a * https://git.samba.org/?p=samba.git;a=commit;h=f241fe5d46e8dd2b3265be7eddbd6686a6f920db * https://git.samba.org/?p=samba.git;a=commit;h=a45ea91cd7e8335319c96ea5bda02014f584df63 related: #1991353 --- samba.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index b180f57..3b2523b 100644 --- a/samba.spec +++ b/samba.spec @@ -1193,7 +1193,6 @@ for i in \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ - %{_mandir}/man8/samba-tool.8 \ %{_mandir}/man8/samba-gpupdate.8 \ %{_libdir}/samba/ldb/ildap.so \ %{_libdir}/samba/ldb/ldbsamba_extensions.so \ @@ -1854,6 +1853,7 @@ fi %{_bindir}/net %{_bindir}/pdbedit %{_bindir}/profiles +%{_bindir}/samba-tool %{_bindir}/smbcontrol %{_bindir}/smbpasswd %{_bindir}/testparm @@ -1862,13 +1862,13 @@ fi %{_mandir}/man1/testparm.1* %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* +%{_mandir}/man8/samba-tool.8* %{_mandir}/man8/smbpasswd.8* ### DC %if %{with dc} || %{with testsuite} %files dc %{_unitdir}/samba.service -%{_bindir}/samba-tool %{_sbindir}/samba %{_sbindir}/samba_dnsupdate %{_sbindir}/samba_downgrade_db @@ -1936,7 +1936,6 @@ fi %{_mandir}/man8/samba.8* %{_mandir}/man8/samba_downgrade_db.8* %{_mandir}/man8/samba-gpupdate.8* -%{_mandir}/man8/samba-tool.8* %dir %{_datadir}/samba/admx %{_datadir}/samba/admx/samba.admx %dir %{_datadir}/samba/admx/en-US From 58450895a08c194351abe938afcbe60571e8c087 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 10 Aug 2021 14:39:45 +0200 Subject: [PATCH 003/295] Require libs packages to be updated before restarting winbindd --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index 3b2523b..033a8fa 100644 --- a/samba.spec +++ b/samba.spec @@ -812,9 +812,12 @@ Summary: Samba winbind Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires(post): %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires(post): %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} %if %{with libwbclient} From b904ff11a5a0b84613c4dcfbc3a8014a7103f52c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 10 Aug 2021 15:23:24 +0200 Subject: [PATCH 004/295] Use more CPUs for re-linking during the install step if possible --- samba.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 033a8fa..bbbdccc 100644 --- a/samba.spec +++ b/samba.spec @@ -1103,7 +1103,8 @@ pushd pidl popd %install -%make_install +# Do not use %%make_install, make is just a wrapper around waf in Samba! +%{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot} install -d -m 0755 %{buildroot}/usr/{sbin,bin} install -d -m 0755 %{buildroot}%{_libdir}/security From 47c27ed2c1c2af27aae766e11c72a7f0d5b45a98 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 10 Aug 2021 15:51:28 +0200 Subject: [PATCH 005/295] Document how to build with fedpkg --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index bbbdccc..15573f1 100644 --- a/samba.spec +++ b/samba.spec @@ -2,12 +2,16 @@ # # To build and run the tests use: # +# fedpkg local --with testsuite +# or # rpmbuild --rebuild --with testsuite samba.src.rpm # %bcond_with testsuite # Build with internal talloc, tevent, tdb and ldb. # +# fedpkg local --with=testsuite --with=includelibs +# or # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm # %bcond_with includelibs From 68140d413f26c4fbcaab6a0094e363411f5f35bc Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Thu, 12 Aug 2021 16:23:20 +0530 Subject: [PATCH 006/295] Fix inclusion of PyDSDB library files Commit cc8c80c04bab6ec65a12dbe779bfb12b2b6f793a removed the following PyDSDB library files from buildroot: * /usr/lib64/python3.9/site-packages/samba/dsdb.cpython-39-x86_64-linux-gnu.so * /usr/lib64/python3.9/site-packages/samba/dsdb_dns.cpython-39-x86_64-linux-gnu.so This was done under the impression that their dependency on libdnsserver-common-samba4.so was not built in a non AD DC environment. But in reality it was also conditionally removed from the buildroot. Apart from including PyDSDB back into python3-samba, we avoid removing libdnsserver-common-samba4.so from buildroot and subsequently include it in samba-libs to satisfy all dependencies. Additionally we remove PyDSDB listing from %files section of python3-samba-dc sub-package. --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 15573f1..1da51f3 100644 --- a/samba.spec +++ b/samba.spec @@ -1196,7 +1196,6 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ %{_libdir}/samba/libdfs-server-ad-samba4.so \ - %{_libdir}/samba/libdnsserver-common-samba4.so \ %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ %{_mandir}/man8/samba.8 \ @@ -2168,6 +2167,7 @@ fi %{_libdir}/samba/libauth4-samba4.so %{_libdir}/samba/libauth-unix-token-samba4.so %{_libdir}/samba/libdcerpc-samba4.so +%{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libshares-samba4.so %{_libdir}/samba/libsmbpasswdparser-samba4.so %{_libdir}/samba/libxattr-tdb-samba4.so @@ -2350,6 +2350,8 @@ fi %{python3_sitearch}/samba/descriptor.py %{python3_sitearch}/samba/dnsresolver.py %{python3_sitearch}/samba/drs_utils.py +%{python3_sitearch}/samba/dsdb.*.so +%{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py %{python3_sitearch}/samba/gpclass.py @@ -2541,8 +2543,6 @@ fi %{python3_sitearch}/samba/dcerpc/dnsserver.*.so %{python3_sitearch}/samba/dckeytab.*.so -%{python3_sitearch}/samba/dsdb.*.so -%{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/domain_update.py %{python3_sitearch}/samba/forest_update.py %{python3_sitearch}/samba/ms_forest_updates_markdown.py From 713db3d97218989e8deca020371d7ee02551e598 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 12 Aug 2021 14:41:44 +0200 Subject: [PATCH 007/295] Add missing Requires in samba-common-tools for samba-tool --- samba.spec | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index 1da51f3..b1d4937 100644 --- a/samba.spec +++ b/samba.spec @@ -119,7 +119,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 4 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -461,6 +461,13 @@ Requires: samba-libs = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +# samba-tool needs python3-samba +Requires: python3-%{samba} = %{samba_depver} +# samba-tool needs tdbbackup +Requires: tdb-tools +# samba-tool needs mdb_copy +Requires: lmdb + Provides: bundled(libreplace) %description common-tools @@ -482,10 +489,6 @@ Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -# samba-tool needs tdbbackup -Requires: tdb-tools -# samba-tool needs mdb_copy -Requires: lmdb Requires: ldb-tools Requires: python3-setproctitle # Force using libldb version to be the same as build version @@ -4006,6 +4009,9 @@ fi %endif %changelog +* Thu Aug 12 2021 Andreas Schneider - 4.15.0rc2-4 +- Package samba-tool correctly + * Mon Aug 09 2021 Guenther Deschner - 4.15.0rc2-3 - Update to Samba 4.15.0rc2 - resolves: #1991634 From 376ef2f0e02481aa621ca99edd2426b606c217a0 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 13 Aug 2021 09:12:01 -0700 Subject: [PATCH 008/295] Fix samba-common-tools dependency It was literally "python3-%{samba}", which obviously didn't work. --- samba.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index b1d4937..230cfcf 100644 --- a/samba.spec +++ b/samba.spec @@ -119,7 +119,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 4 +%global baserelease 5 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -462,7 +462,7 @@ Requires: libwbclient = %{samba_depver} %endif # samba-tool needs python3-samba -Requires: python3-%{samba} = %{samba_depver} +Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools # samba-tool needs mdb_copy @@ -4009,10 +4009,13 @@ fi %endif %changelog -* Thu Aug 12 2021 Andreas Schneider - 4.15.0rc2-4 +* Fri Aug 13 2021 Adam Williamson - 4.15.0-0.5.rc2 +- Fix samba-common-tools dependency + +* Thu Aug 12 2021 Andreas Schneider - 4.15.0-0.4.rc2 - Package samba-tool correctly -* Mon Aug 09 2021 Guenther Deschner - 4.15.0rc2-3 +* Mon Aug 09 2021 Guenther Deschner - 4.15.0-0.3.rc2 - Update to Samba 4.15.0rc2 - resolves: #1991634 From cffce0ef3ee070d168ab58bb91a8d73b6173395d Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Thu, 12 Aug 2021 20:43:41 +0530 Subject: [PATCH 009/295] Remove duplicate listing for libdnsserver-common-samba4.so libdnsserver-common-samba4.so is already getting packaged in samba-libs sub-package(see 68140d413f26c4fbcaab6a0094e363411f5f35bc) and samba-dc-libs pulls in samba-libs. Therefore removing it from samba-dc-libs. --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 230cfcf..5880a08 100644 --- a/samba.spec +++ b/samba.spec @@ -1988,7 +1988,6 @@ fi %endif %{_libdir}/libdcerpc-server.so.* -%{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libdsdb-module-samba4.so %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so %{_libdir}/samba/libscavenge-dns-records-samba4.so From 6410d154ebb5884e7d2d23a8585faa74730e5389 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Mon, 16 Aug 2021 13:21:01 +0530 Subject: [PATCH 010/295] Revert "Exclude PyDSDB library files" This reverts commit cc8c80c04bab6ec65a12dbe779bfb12b2b6f793a. --- samba.spec | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 5880a08..9110f2a 100644 --- a/samba.spec +++ b/samba.spec @@ -119,7 +119,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 5 +%global baserelease 6 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -1210,8 +1210,6 @@ for i in \ %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ %{python3_sitearch}/samba/dnsserver.py \ %{python3_sitearch}/samba/domain_update.py \ - %{python3_sitearch}/samba/dsdb.*.so - %{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/forest_update.py \ %{python3_sitearch}/samba/kcc/__init__.py \ %{python3_sitearch}/samba/kcc/debug.py \ @@ -4008,6 +4006,9 @@ fi %endif %changelog +* Mon Aug 16 2021 Anoop C S - 4.15.0-0.6.rc2 +- Avoid removing PyDSDB library files from buildroot for non AD DC build + * Fri Aug 13 2021 Adam Williamson - 4.15.0-0.5.rc2 - Fix samba-common-tools dependency From fe6291ff86b2f3e9af2416d97144332807d7057a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 25 Aug 2021 13:24:34 +0200 Subject: [PATCH 011/295] Add ceph and etcd mutex helpers for CTDB Guenther --- samba-ctdb-etcd-reclock.patch | 30 +++++++++++++++ samba.spec | 69 ++++++++++++++++++++++++++++++++++- 2 files changed, 97 insertions(+), 2 deletions(-) create mode 100644 samba-ctdb-etcd-reclock.patch diff --git a/samba-ctdb-etcd-reclock.patch b/samba-ctdb-etcd-reclock.patch new file mode 100644 index 0000000..2a55408 --- /dev/null +++ b/samba-ctdb-etcd-reclock.patch @@ -0,0 +1,30 @@ +From 939aed0498269df3c1e012f3b68c314b583f25bd Mon Sep 17 00:00:00 2001 +From: Martin Schwenke +Date: Tue, 27 Apr 2021 15:46:14 +1000 +Subject: [PATCH] utils: Use Python 3 + +Due to the number of flake8 and pylint warnings it is unclear if the +source has Python 3 incompatibilities. These will be cleaned up in +subsequent commits. + +Signed-off-by: "L.P.H. van Belle" +Reviewed-by: Martin Schwenke +Reviewed-by: David Disseldorp +Reviewed-by: Jose A. Rivera +--- + ctdb/utils/etcd/ctdb_etcd_lock | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ctdb/utils/etcd/ctdb_etcd_lock b/ctdb/utils/etcd/ctdb_etcd_lock +index 000c6bb7208..7f5194eff0a 100755 +--- a/ctdb/utils/etcd/ctdb_etcd_lock ++++ b/ctdb/utils/etcd/ctdb_etcd_lock +@@ -1,4 +1,4 @@ +-#!/usr/bin/python ++#!/usr/bin/env python3 + # + # This program is free software: you can redistribute it and/or modify + # it under the terms of the GNU General Public License as published by +-- +2.31.1 + diff --git a/samba.spec b/samba.spec index 9110f2a..9752b92 100644 --- a/samba.spec +++ b/samba.spec @@ -46,18 +46,21 @@ %bcond_without winexe %endif -# Build vfs_ceph module by default on 64bit Fedora +# Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 %bcond_without vfs_cephfs +%bcond_without ceph_mutex %else %bcond_with vfs_cephfs +%bcond_with ceph_mutex #endifarch %endif %else %bcond_with vfs_cephfs +%bcond_with ceph_mutex #endif fedora %endif @@ -117,9 +120,16 @@ %bcond_with pcp_pmda %endif +# Build the etcd helpers by default on Fedora +%if 0%{?fedora} +%bcond_without etcd_mutex +%else +%bcond_with etcd_mutex +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 6 +%global baserelease 7 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -189,6 +199,7 @@ Source14: samba.pamd Source201: README.downgrade Patch0: samba-s4u.patch +Patch1: samba-ctdb-etcd-reclock.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -299,6 +310,12 @@ BuildRequires: liburing-devel >= 0.4 %if %{with pcp_pmda} BuildRequires: pcp-libs-devel %endif +%if %{with ceph_mutex} +BuildRequires: librados-devel +%endif +%if %{with etcd_mutex} +BuildRequires: python3-etcd +%endif %if %{with dc} || %{with testsuite} # Add python3-iso8601 to avoid that the @@ -998,6 +1015,31 @@ Performance Co-Pilot (PCP) support for CTDB #endif with pcp_pmda %endif +%if %{with etcd_mutex} + +%package -n ctdb-etcd-mutex +Summary: CTDB ETCD mutex helper +Requires: ctdb = %{samba_depver} +Requires: python3-etcd + +%description -n ctdb-etcd-mutex +Support for using an existing ETCD cluster as a mutex helper for CTDB + +#endif with etcd_mutex +%endif + +%if %{with ceph_mutex} + +%package -n ctdb-ceph-mutex +Summary: CTDB ceph mutex helper +Requires: ctdb = %{samba_depver} + +%description -n ctdb-ceph-mutex +Support for using an existing CEPH cluster as a mutex helper for CTDB + +#endif with ceph_mutex +%endif + #endif with clustering %endif @@ -1090,6 +1132,12 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %endif %if %{with pcp_pmda} --enable-pmda \ +%endif +%if %{with ceph_mutex} + --enable-ceph-reclock \ +%endif +%if %{with etcd_mutex} + --enable-etcd-reclock \ %endif --with-profiling-data \ --with-systemd \ @@ -3995,6 +4043,20 @@ fi #endif with pcp_pmda %endif +%if %{with etcd_mutex} +%files -n ctdb-etcd-mutex +%{_libexecdir}/ctdb/ctdb_etcd_lock +%{_mandir}/man7/ctdb-etcd.7.gz +#endif with etcd_mutex +%endif + +%if %{with ceph_mutex} +%files -n ctdb-ceph-mutex +%{_libexecdir}/ctdb/ctdb_mutex_ceph_rados_helper +%{_mandir}/man7/ctdb_mutex_ceph_rados_helper.7.gz +#endif with ceph_mutex +%endif + #endif with clustering %endif @@ -4006,6 +4068,9 @@ fi %endif %changelog +* Wed Aug 25 2021 Guenther Deschner - 4.15.0-0.7.rc2 +- Add ceph and etcd mutex helpers for CTDB + * Mon Aug 16 2021 Anoop C S - 4.15.0-0.6.rc2 - Avoid removing PyDSDB library files from buildroot for non AD DC build From a184099345c3df2477106b25e1c223a7899b0a7c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 26 Aug 2021 13:16:50 +0200 Subject: [PATCH 012/295] Update to Samba 4.15.0rc3 resolves: #1998024 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index ba9b72a..d38fc2e 100644 --- a/.gitignore +++ b/.gitignore @@ -257,3 +257,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc1.tar.asc /samba-4.15.0rc2.tar.xz /samba-4.15.0rc2.tar.asc +/samba-4.15.0rc3.tar.xz +/samba-4.15.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index 9752b92..29513ba 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 7 +%global baserelease 8 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4068,6 +4068,10 @@ fi %endif %changelog +* Thu Aug 26 2021 Guenther Deschner - 4.15.0-0.8.rc3 +- Update to Samba 4.15.0rc3 +- resolves: #1998024 + * Wed Aug 25 2021 Guenther Deschner - 4.15.0-0.7.rc2 - Add ceph and etcd mutex helpers for CTDB diff --git a/sources b/sources index d31e6c6..a810c11 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc2.tar.xz) = 5ff2f44c068babd3e37751e4cb52fd73d7c4da8f8d11fb6952206bc970b1206b0af3705991493a0ce1dcbe61d2c9ef6625b6a9b601f77324d5faaa0a9ac4e7d3 -SHA512 (samba-4.15.0rc2.tar.asc) = 8ee5488a0d226d72ae8a84898715ca8f27e7f83dfbc712a52d52e740b08aabd66155c091f92c3ac1a4c58d489ffa6f91a7f293cccb5fba3b878f81fb11da40ff +SHA512 (samba-4.15.0rc3.tar.xz) = 4f3fd39b22cbc08001f1b9f4295a1acba22b6d0c82235704d35667329e608b844f5b793e39fd84e3b4bd7956ae7991c2958031531c673ddbde593799e6af5d47 +SHA512 (samba-4.15.0rc3.tar.asc) = 6f8d7a69d643208c2dbfd4423b5351319c4a8361cac2ea5fa378787a885d63794018ec96334a847a5aaf2e0ad494846164a2a13aab7ffe1b9f35afa671c531d8 From 0a04de2534dc192b9e7d57f60f83e7e0b231dde5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 1 Sep 2021 13:47:44 +0200 Subject: [PATCH 013/295] Update to Samba 4.15.0rc4 resolves: #2000079 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index d38fc2e..fcd6170 100644 --- a/.gitignore +++ b/.gitignore @@ -259,3 +259,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc2.tar.asc /samba-4.15.0rc3.tar.xz /samba-4.15.0rc3.tar.asc +/samba-4.15.0rc4.tar.xz +/samba-4.15.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index 29513ba..d9dd415 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 8 +%global baserelease 9 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4068,6 +4068,10 @@ fi %endif %changelog +* Wed Sep 01 2021 Guenther Deschner - 4.15.0-0.9.rc4 +- Update to Samba 4.15.0rc4 +- resolves: #2000079 + * Thu Aug 26 2021 Guenther Deschner - 4.15.0-0.8.rc3 - Update to Samba 4.15.0rc3 - resolves: #1998024 diff --git a/sources b/sources index a810c11..3aacdc3 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc3.tar.xz) = 4f3fd39b22cbc08001f1b9f4295a1acba22b6d0c82235704d35667329e608b844f5b793e39fd84e3b4bd7956ae7991c2958031531c673ddbde593799e6af5d47 -SHA512 (samba-4.15.0rc3.tar.asc) = 6f8d7a69d643208c2dbfd4423b5351319c4a8361cac2ea5fa378787a885d63794018ec96334a847a5aaf2e0ad494846164a2a13aab7ffe1b9f35afa671c531d8 +SHA512 (samba-4.15.0rc4.tar.xz) = 0fc9fce786b539dec7dd93e6403d5ff4e67e7cb17a4b064e6af23c98e4b122b1ce12653c5dcb7aa4317d91b729f98864988981456a8344e0ff7eb66bf8956104 +SHA512 (samba-4.15.0rc4.tar.asc) = dd2823db2b2b16d0a0c3cb61410320812eeae38f4a76b83951dec8d72e2821043af960aae3929d132a33aa7d7cf1f481446ed32738393192050b147d07116664 From a7a77b0af0670acd8571cc739915a3ca091553e3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 3 Sep 2021 09:07:20 +0200 Subject: [PATCH 014/295] We need python3-cryptography for krb5 tests --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index d9dd415..678fc7f 100644 --- a/samba.spec +++ b/samba.spec @@ -360,6 +360,7 @@ BuildRequires: ldb-tools BuildRequires: python3-gpg BuildRequires: python3-markdown BuildRequires: python3-setproctitle +BuildRequires: python3-cryptography BuildRequires: tdb-tools %endif From eae8b0478426d67af7df0400d10a2199e15c6881 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 3 Sep 2021 09:07:37 +0200 Subject: [PATCH 015/295] The testsuite requires lmdb-devel --- samba.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 678fc7f..fc4720c 100644 --- a/samba.spec +++ b/samba.spec @@ -346,7 +346,9 @@ BuildRequires: python3-tdb >= %{tdb_version} BuildRequires: libldb-devel >= %{ldb_version} BuildRequires: python3-ldb >= %{ldb_version} BuildRequires: python3-ldb-devel >= %{ldb_version} -%else +%endif + +%if %{with includelibs} || %{with testsuite} # lmdb-devel is required for the mdb ldb module, if samba is configured # to build includelibs we need lmdb-devel for building that module on our own BuildRequires: lmdb-devel From 29bd82541a69a2db6523385bf844cf051f30fb91 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 7 Sep 2021 12:21:08 +0200 Subject: [PATCH 016/295] Update to Samba 4.15.0rc5 resolves: #2001827 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index fcd6170..3ff73e5 100644 --- a/.gitignore +++ b/.gitignore @@ -261,3 +261,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc3.tar.asc /samba-4.15.0rc4.tar.xz /samba-4.15.0rc4.tar.asc +/samba-4.15.0rc5.tar.xz +/samba-4.15.0rc5.tar.asc diff --git a/samba.spec b/samba.spec index fc4720c..d0800f8 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 9 +%global baserelease 10 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc4 +%global pre_release rc5 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4071,6 +4071,10 @@ fi %endif %changelog +* Tue Sep 07 2021 Guenther Deschner - 4.15.0-0.10.rc5 +- Update to Samba 4.15.0rc5 +- resolves: #2001827 + * Wed Sep 01 2021 Guenther Deschner - 4.15.0-0.9.rc4 - Update to Samba 4.15.0rc4 - resolves: #2000079 diff --git a/sources b/sources index 3aacdc3..aa7540e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc4.tar.xz) = 0fc9fce786b539dec7dd93e6403d5ff4e67e7cb17a4b064e6af23c98e4b122b1ce12653c5dcb7aa4317d91b729f98864988981456a8344e0ff7eb66bf8956104 -SHA512 (samba-4.15.0rc4.tar.asc) = dd2823db2b2b16d0a0c3cb61410320812eeae38f4a76b83951dec8d72e2821043af960aae3929d132a33aa7d7cf1f481446ed32738393192050b147d07116664 +SHA512 (samba-4.15.0rc5.tar.xz) = 53b79354a441e4a29ed7e807e0f18d4249b8ee0f99bf034947dd4c4674f68eb2b795832130025ab214cc3ad2deaa771b202131addc0b563a2d4310b7809e698d +SHA512 (samba-4.15.0rc5.tar.asc) = 0eea9c233c98bd52ad91a2c7bcf384d3dbe5b7017bf76dd29b083256ed95e78b6538d25d93b04710c4684d077755179a813dda82470301b8f87f63b61a6f2461 From c6ac21963a2245eccbaa9140bb228423a7d7b27a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 9 Sep 2021 09:58:04 +0200 Subject: [PATCH 017/295] Update to Samba 4.15.0rc6 resolves: #2002546 Guenther --- .gitignore | 2 ++ samba-s4u.patch | 69 ++++++++++++++++++++++++------------------------- samba.spec | 12 +++++++-- sources | 4 +-- 4 files changed, 48 insertions(+), 39 deletions(-) diff --git a/.gitignore b/.gitignore index 3ff73e5..3b7fe64 100644 --- a/.gitignore +++ b/.gitignore @@ -263,3 +263,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc4.tar.asc /samba-4.15.0rc5.tar.xz /samba-4.15.0rc5.tar.asc +/samba-4.15.0rc6.tar.xz +/samba-4.15.0rc6.tar.asc diff --git a/samba-s4u.patch b/samba-s4u.patch index 83ed873..bb323f3 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,22 +1,21 @@ -From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001 +From 7c4125deb1e03917f0a2353740f2c0e9e6cf87c5 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 -Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support +Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider --- - source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++--------- - source4/kdc/mit_samba.c | 47 ++---- - source4/kdc/mit_samba.h | 6 +- - wscript_configure_system_mitkrb5 | 3 + - 6 files changed, 91 insertions(+), 115 deletions(-) + source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++++------------ + source4/kdc/mit_samba.c | 47 ++----- + source4/kdc/mit_samba.h | 6 +- + 3 files changed, 86 insertions(+), 115 deletions(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index 9197551ed61..944324d9a2f 100644 +index ac9865aac60..17d4c4028b9 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, krb5_keyblock *krbtgt_key, krb5_timestamp authtime, krb5_authdata **tgt_auth_data, @@ -37,7 +36,7 @@ index 9197551ed61..944324d9a2f 100644 mit_ctx = ks_get_context(context); if (mit_ctx == NULL) { -@@ -230,41 +234,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -233,41 +237,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = krb5_pac_parse(context, authdata[0]->contents, authdata[0]->length, @@ -107,7 +106,7 @@ index 9197551ed61..944324d9a2f 100644 if (code != 0) { goto done; } -@@ -272,17 +278,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -275,17 +281,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = mit_samba_reget_pac(mit_ctx, context, flags, @@ -134,18 +133,18 @@ index 9197551ed61..944324d9a2f 100644 return code; } -@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -310,7 +321,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krb5_authdata ***signed_auth_data) { - #endif krb5_authdata **authdata = NULL; - krb5_boolean is_as_req; + krb5_const_principal pac_client; krb5_error_code code; krb5_pac pac = NULL; krb5_data pac_data; -@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -318,24 +329,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; - #endif - /* FIXME: We don't support S4U yet */ - if (flags & KRB5_KDB_FLAGS_S4U) { @@ -179,7 +178,7 @@ index 9197551ed61..944324d9a2f 100644 client, server, krbtgt, -@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -347,14 +355,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, if (code != 0) { goto done; } @@ -209,7 +208,7 @@ index 9197551ed61..944324d9a2f 100644 } if (pac == NULL) { -@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -363,7 +385,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, } code = krb5_pac_sign(context, pac, authtime, client_princ, @@ -218,7 +217,7 @@ index 9197551ed61..944324d9a2f 100644 if (code != 0) { DBG_ERR("krb5_pac_sign failed: %d\n", code); goto done; -@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -389,11 +411,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, KRB5_AUTHDATA_IF_RELEVANT, authdata, signed_auth_data); @@ -230,7 +229,7 @@ index 9197551ed61..944324d9a2f 100644 done: krb5_pac_free(context, pac); -@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, +@@ -416,32 +433,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, * server; -> delegating service * proxy; -> target principal */ @@ -265,10 +264,10 @@ index 9197551ed61..944324d9a2f 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 54dcd545ea1..f23327c9613 100644 +index 0a0d3a98315..5f35c6025bf 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -493,7 +493,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -276,7 +275,7 @@ index 54dcd545ea1..f23327c9613 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -641,7 +640,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -285,7 +284,7 @@ index 54dcd545ea1..f23327c9613 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -963,41 +962,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -362,12 +361,13 @@ index ba824557bd5..5aadf206443 100644 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, char *pwd, -- -2.25.4 +2.31.1 -From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001 + +From b2ada81ed9f89f6b38fb0a9e54811408676671d0 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 -Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build +Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -375,7 +375,7 @@ Pair-Programmed-With: Andreas Schneider lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++ lib/krb5_wrap/krb5_samba.h | 2 - source4/auth/kerberos/kerberos_util.c | 11 -- - 4 files changed, 185 insertions(+), 14 deletions(-) + 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c index 20ce86c708d..e72ab3c30f7 100644 @@ -574,7 +574,7 @@ index 20ce86c708d..e72ab3c30f7 100644 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index ca9a893e4f7..3264ce5eb3b 100644 +index 9550447b2c5..ee3931c7544 100644 --- a/lib/krb5_wrap/krb5_samba.h +++ b/lib/krb5_wrap/krb5_samba.h @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, @@ -639,14 +639,13 @@ index 544d9d853cc..c14d8c72d8c 100644 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ccache, -- -2.25.4 +2.31.1 - -From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001 +From bc5e97074739d29320a3e890575353fbfd452047 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 -Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code +Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code --- source4/heimdal/lib/hdb/hdb.h | 1 + @@ -696,10 +695,10 @@ index a560a1cd84b..c27b6a8ef4c 100644 ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); if (ret) { diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index f23327c9613..4084e893cc2 100644 +index 5f35c6025bf..20ee2c2b89e 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, +@@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { sflags |= SDB_F_CANON; } @@ -722,5 +721,5 @@ index c929acccce6..a9115ec23d7 100644 void sdb_free_entry(struct sdb_entry_ex *e); void free_sdb_entry(struct sdb_entry *s); -- -2.25.4 +2.31.1 diff --git a/samba.spec b/samba.spec index d0800f8..9a183c7 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 10 +%global baserelease 11 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc5 +%global pre_release rc6 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -2813,6 +2813,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc @@ -2832,6 +2833,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py +%{python3_sitearch}/samba/tests/dcerpc/lsa.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py %{python3_sitearch}/samba/tests/dcerpc/misc.py %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py @@ -2901,6 +2903,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc @@ -2919,6 +2922,7 @@ fi %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py @@ -4071,6 +4075,10 @@ fi %endif %changelog +* Thu Sep 09 2021 Guenther Deschner - 4.15.0-0.11.rc6 +- Update to Samba 4.15.0rc6 +- resolves: #2002546 + * Tue Sep 07 2021 Guenther Deschner - 4.15.0-0.10.rc5 - Update to Samba 4.15.0rc5 - resolves: #2001827 diff --git a/sources b/sources index aa7540e..944c241 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc5.tar.xz) = 53b79354a441e4a29ed7e807e0f18d4249b8ee0f99bf034947dd4c4674f68eb2b795832130025ab214cc3ad2deaa771b202131addc0b563a2d4310b7809e698d -SHA512 (samba-4.15.0rc5.tar.asc) = 0eea9c233c98bd52ad91a2c7bcf384d3dbe5b7017bf76dd29b083256ed95e78b6538d25d93b04710c4684d077755179a813dda82470301b8f87f63b61a6f2461 +SHA512 (samba-4.15.0rc6.tar.xz) = 9b3c7e2f34e672072da9fcfc5613079f884ab7120d19f09f18c74262eddc342bff00796ed1b0c30ba1a8b8dc2b22cdba9909baca82da91bd9352de334c1ef271 +SHA512 (samba-4.15.0rc6.tar.asc) = 5aa243b3dc68890feef77d44d2beae2401a9827219fe84a53d564e1e6b56175e46282c7e0c6ac932fd535bc1bf4b8a5403da4281a0bb7919543e2a464b9e8c89 From 2efb445c94ae2cb4eb72b6d83b02bf46eb036c0a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 13 Sep 2021 17:31:33 +0200 Subject: [PATCH 018/295] Update to Samba 4.15.0rc7 resolves: #2003740 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 3b7fe64..9c56e55 100644 --- a/.gitignore +++ b/.gitignore @@ -265,3 +265,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc5.tar.asc /samba-4.15.0rc6.tar.xz /samba-4.15.0rc6.tar.asc +/samba-4.15.0rc7.tar.xz +/samba-4.15.0rc7.tar.asc diff --git a/samba.spec b/samba.spec index 9a183c7..36cfb7a 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 11 +%global baserelease 12 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc6 +%global pre_release rc7 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4075,6 +4075,10 @@ fi %endif %changelog +* Mon Sep 13 2021 Guenther Deschner - 4.15.0-0.12.rc7 +- Update to Samba 4.15.0rc7 +- resolves: #2003740 + * Thu Sep 09 2021 Guenther Deschner - 4.15.0-0.11.rc6 - Update to Samba 4.15.0rc6 - resolves: #2002546 diff --git a/sources b/sources index 944c241..ec69424 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc6.tar.xz) = 9b3c7e2f34e672072da9fcfc5613079f884ab7120d19f09f18c74262eddc342bff00796ed1b0c30ba1a8b8dc2b22cdba9909baca82da91bd9352de334c1ef271 -SHA512 (samba-4.15.0rc6.tar.asc) = 5aa243b3dc68890feef77d44d2beae2401a9827219fe84a53d564e1e6b56175e46282c7e0c6ac932fd535bc1bf4b8a5403da4281a0bb7919543e2a464b9e8c89 +SHA512 (samba-4.15.0rc7.tar.xz) = 0c99c56b0f335f0def3cc7b5fd75509284644c77f4c61b783887251d622c6aa65ed15bf6093a012e5119915f5d85f85bd970562b5f5f124b4d08729a3f80cab2 +SHA512 (samba-4.15.0rc7.tar.asc) = 4847ab608122c71330ee694e66b7ceb54342458f292d0541356c4756705f465d64233408fc6400b04b312c688df352a4ec469e25f1aefac6d19fe284963e978f From bc51ea8a5e6ab645e38f6282dd1a668c3f555567 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 20 Sep 2021 11:30:25 +0200 Subject: [PATCH 019/295] Update to Samba 4.15.0 resolves: #2005817 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 9c56e55..1738d1e 100644 --- a/.gitignore +++ b/.gitignore @@ -267,3 +267,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc6.tar.asc /samba-4.15.0rc7.tar.xz /samba-4.15.0rc7.tar.asc +/samba-4.15.0.tar.xz +/samba-4.15.0.tar.asc diff --git a/samba.spec b/samba.spec index 36cfb7a..2077c18 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 12 +%global baserelease 13 %global samba_version 4.15.0 %global talloc_version 2.3.3 @@ -137,7 +137,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.4.0 # This should be rc1 or nil -%global pre_release rc7 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4075,6 +4075,10 @@ fi %endif %changelog +* Mon Sep 20 2021 Guenther Deschner - 4.15.0-13 +- Update to Samba 4.15.0 +- resolves: #2005817 + * Mon Sep 13 2021 Guenther Deschner - 4.15.0-0.12.rc7 - Update to Samba 4.15.0rc7 - resolves: #2003740 diff --git a/sources b/sources index ec69424..2e78289 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0rc7.tar.xz) = 0c99c56b0f335f0def3cc7b5fd75509284644c77f4c61b783887251d622c6aa65ed15bf6093a012e5119915f5d85f85bd970562b5f5f124b4d08729a3f80cab2 -SHA512 (samba-4.15.0rc7.tar.asc) = 4847ab608122c71330ee694e66b7ceb54342458f292d0541356c4756705f465d64233408fc6400b04b312c688df352a4ec469e25f1aefac6d19fe284963e978f +SHA512 (samba-4.15.0.tar.xz) = 2fe016ec75a2c788c648466a3bac13a6cdbc158c2f8c18e4fdf09f6ac48b376e6545ab264be92820582ae9fa778010bc639d0b00afacf47a42c002fa291aac5d +SHA512 (samba-4.15.0.tar.asc) = bf1a80c70869ef3c35dde774d5965b8aea4b8be01edc1fd46e1a3bdf972fd3ef17354de726d1d159cb54c92869fbb09b92814c41c3508de67694245aa93d5bc7 From 331ea7c567325a277e6e023e1b88f96c7ac45e27 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 27 Oct 2021 16:10:52 +0200 Subject: [PATCH 020/295] Update to Samba 4.15.1 resolves: #2017847 Guenther --- .gitignore | 2 ++ samba.spec | 14 +++++++++++--- sources | 4 ++-- 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 1738d1e..4140b12 100644 --- a/.gitignore +++ b/.gitignore @@ -269,3 +269,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0rc7.tar.asc /samba-4.15.0.tar.xz /samba-4.15.0.tar.asc +/samba-4.15.1.tar.xz +/samba-4.15.1.tar.asc diff --git a/samba.spec b/samba.spec index 2077c18..b04f8d0 100644 --- a/samba.spec +++ b/samba.spec @@ -129,13 +129,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 13 +%global baserelease 0 -%global samba_version 4.15.0 +%global samba_version 4.15.1 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 -%global ldb_version 2.4.0 +%global ldb_version 2.4.1 # This should be rc1 or nil %global pre_release %nil @@ -2912,6 +2912,8 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc @@ -2931,6 +2933,8 @@ fi %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py +%{python3_sitearch}/samba/tests/krb5/rodc_tests.py +%{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py @@ -4075,6 +4079,10 @@ fi %endif %changelog +* Wed Oct 27 2021 Guenther Deschner - 4.15.1-0 +- Update to Samba 4.15.1 +- resolves: #2017847 + * Mon Sep 20 2021 Guenther Deschner - 4.15.0-13 - Update to Samba 4.15.0 - resolves: #2005817 diff --git a/sources b/sources index 2e78289..ac5f2eb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.0.tar.xz) = 2fe016ec75a2c788c648466a3bac13a6cdbc158c2f8c18e4fdf09f6ac48b376e6545ab264be92820582ae9fa778010bc639d0b00afacf47a42c002fa291aac5d -SHA512 (samba-4.15.0.tar.asc) = bf1a80c70869ef3c35dde774d5965b8aea4b8be01edc1fd46e1a3bdf972fd3ef17354de726d1d159cb54c92869fbb09b92814c41c3508de67694245aa93d5bc7 +SHA512 (samba-4.15.1.tar.xz) = 7422c4ed625411f8a4765f8e21f3b8e0c9d68f259cc25ed9f47e6243e849722ad6fa907fad989f19715ca799bc249cda4ef8a8bb930120d61851143072ef7558 +SHA512 (samba-4.15.1.tar.asc) = 0fd0a9761b2dcbd43600490a32d462f50dcd42232a79e40c3a29df5630c9df412bdfac7aeb0eb34b8ce7a9a01ba8e0da612f5771fa9d45f12d77a4ae5c875d82 From 3c2c163325436c4b3b8113e255f133381a6d424f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 5 Nov 2021 15:00:31 +0100 Subject: [PATCH 021/295] Fix winexe core dump resolves: #2020376 Guenther --- samba-4.15.1-winexe.patch | 61 +++++++++++++++++++++++++++++++++++++++ samba.spec | 7 ++++- 2 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 samba-4.15.1-winexe.patch diff --git a/samba-4.15.1-winexe.patch b/samba-4.15.1-winexe.patch new file mode 100644 index 0000000..38460b3 --- /dev/null +++ b/samba-4.15.1-winexe.patch @@ -0,0 +1,61 @@ +From 3d02bf10d7738fe604b524863764de3ca1faa081 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?G=C3=BCnther=20Deschner?= +Date: Thu, 4 Nov 2021 22:22:44 +0100 +Subject: [PATCH] s3-winexe: Fix winexe core dump (use-after-free) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14893 + +Guenther + +Signed-off-by: Guenther Deschner +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Günther Deschner +Autobuild-Date(master): Fri Nov 5 11:43:57 UTC 2021 on sn-devel-184 + +(cherry picked from commit e9495d2ed28a26899dc3dd77bdfe56e284980218) +--- + examples/winexe/winexe.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c +index 3e0813a4091..59fb9dbdebb 100644 +--- a/examples/winexe/winexe.c ++++ b/examples/winexe/winexe.c +@@ -220,8 +220,6 @@ static void parse_args(int argc, const char *argv[], + *port_str = '\0'; + } + +- poptFreeContext(pc); +- + if (options->runas == NULL && options->runas_file != NULL) { + struct cli_credentials *runas_cred; + const char *user; +@@ -253,9 +251,19 @@ static void parse_args(int argc, const char *argv[], + + options->credentials = samba_cmdline_get_creds(); + +- options->hostname = argv_new[0] + 2; ++ options->hostname = talloc_strdup(mem_ctx, argv_new[0] + 2); ++ if (options->hostname == NULL) { ++ DBG_ERR("Out of memory\n"); ++ exit(1); ++ } + options->port = port; +- options->cmd = argv_new[1]; ++ options->cmd = talloc_strdup(mem_ctx, argv_new[1]); ++ if (options->cmd == NULL) { ++ DBG_ERR("Out of memory\n"); ++ exit(1); ++ } ++ ++ poptFreeContext(pc); + + options->flags = flag_interactive; + if (flag_reinstall) { +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index b04f8d0..501250c 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.15.1 %global talloc_version 2.3.3 @@ -200,6 +200,7 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch +Patch2: samba-4.15.1-winexe.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4079,6 +4080,10 @@ fi %endif %changelog +* Fri Nov 05 2021 Guenther Deschner - 4.15.1-1 +- Fix winexe core dump +- resolves: #2020376 + * Wed Oct 27 2021 Guenther Deschner - 4.15.1-0 - Update to Samba 4.15.1 - resolves: #2017847 From 56ca6af06a71b8bbb0939e54290e9ab7307b2cd9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 9 Nov 2021 19:20:55 +0100 Subject: [PATCH 022/295] Update to Samba 4.15.2 resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 resolves: #2021625 Guenther --- .gitignore | 2 + samba-s4u.patch | 134 +++++++++++++++++++----------------------------- samba.spec | 28 +++++++++- sources | 4 +- 4 files changed, 83 insertions(+), 85 deletions(-) diff --git a/.gitignore b/.gitignore index 4140b12..b2f1c52 100644 --- a/.gitignore +++ b/.gitignore @@ -271,3 +271,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.0.tar.asc /samba-4.15.1.tar.xz /samba-4.15.1.tar.asc +/samba-4.15.2.tar.xz +/samba-4.15.2.tar.asc diff --git a/samba-s4u.patch b/samba-s4u.patch index bb323f3..8e84d96 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,4 +1,4 @@ -From 7c4125deb1e03917f0a2353740f2c0e9e6cf87c5 Mon Sep 17 00:00:00 2001 +From 0b196043f08ea4c025f19c4519175a3a73e1d185 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support @@ -6,13 +6,13 @@ Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider --- - source4/kdc/mit-kdb/kdb_samba_policies.c | 148 +++++++++++------------ - source4/kdc/mit_samba.c | 47 ++----- + source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------ + source4/kdc/mit_samba.c | 47 ++------- source4/kdc/mit_samba.h | 6 +- - 3 files changed, 86 insertions(+), 115 deletions(-) + 3 files changed, 71 insertions(+), 106 deletions(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index ac9865aac60..17d4c4028b9 100644 +index f35210669c2..b1c7c5dcc5e 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c @@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, @@ -133,16 +133,15 @@ index ac9865aac60..17d4c4028b9 100644 return code; } -@@ -310,7 +321,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krb5_authdata ***signed_auth_data) - { +@@ -314,6 +325,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + krb5_authdata **pac_auth_data = NULL; krb5_authdata **authdata = NULL; -- krb5_boolean is_as_req; + krb5_boolean is_as_req; + krb5_const_principal pac_client; krb5_error_code code; krb5_pac pac = NULL; krb5_data pac_data; -@@ -318,24 +329,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -325,11 +337,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; @@ -151,13 +150,13 @@ index ac9865aac60..17d4c4028b9 100644 - return KRB5_KDB_DBTYPE_NOSUP; - } - -- is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); -- -- if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) { -- code = ks_get_pac(context, client, client_key, &pac); -- if (code != 0) { -- goto done; -- } + is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); + + /* +@@ -390,6 +397,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + ks_client_princ = client->princ; + } + + /* In protocol transition, we are currently not provided with the tgt + * client name to verify the PAC, we could probably skip the name + * verification and just verify the signatures, but since we don't @@ -165,59 +164,31 @@ index ac9865aac60..17d4c4028b9 100644 + if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { + pac_client = server->princ; + } else { -+ pac_client = client_princ; - } - -- if (!is_as_req) { -+ /* TGS request */ -+ if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) { - code = ks_verify_pac(context, - flags, -- client_princ, -+ pac_client, - client, - server, - krbtgt, -@@ -347,14 +355,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (code != 0) { - goto done; - } -+ -+ /* We require PAC as we don't support LSA_TRUST_TYPE_MIT */ -+ if (pac == NULL) { -+ code = KRB5_KDB_DBTYPE_NOSUP; -+ goto done; -+ } - } - -- if (pac == NULL && client != NULL) { -+ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { -+ krb5_pac_free(context, pac); -+ pac = NULL; ++ pac_client = ks_client_princ; + } - -+ /* AS request or local realm protocol transition */ -+ if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) || -+ (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) { - code = ks_get_pac(context, client, client_key, &pac); - if (code != 0) { - goto done; - } -+ /* We require a pac! */ -+ SMB_ASSERT(pac != NULL); ++ + if (client_entry == NULL) { + client_entry = client; } +@@ -454,7 +471,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - if (pac == NULL) { -@@ -363,7 +385,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - } - - code = krb5_pac_sign(context, pac, authtime, client_princ, + code = ks_verify_pac(context, + flags, +- ks_client_princ, ++ pac_client, + client_entry, + server, + krbtgt, +@@ -494,7 +511,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, + is_as_req ? "AS-REQ" : "TGS-REQ", + client_name); + code = krb5_pac_sign(context, pac, authtime, ks_client_princ, - server_key, krbtgt_key, &pac_data); + server_key, krbtgt_key, &pac_data); if (code != 0) { DBG_ERR("krb5_pac_sign failed: %d\n", code); goto done; -@@ -389,11 +411,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -520,12 +537,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, KRB5_AUTHDATA_IF_RELEVANT, authdata, signed_auth_data); @@ -226,10 +197,11 @@ index ac9865aac60..17d4c4028b9 100644 - } - - code = 0; - +- done: - krb5_pac_free(context, pac); -@@ -416,32 +433,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, + if (client_entry != NULL && client_entry != client) { + ks_free_principal(context, client_entry); +@@ -551,32 +562,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, * server; -> delegating service * proxy; -> target principal */ @@ -264,10 +236,10 @@ index ac9865aac60..17d4c4028b9 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 0a0d3a98315..5f35c6025bf 100644 +index 4239332f0d9..acc3cba6254 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -493,7 +493,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -501,7 +501,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -275,7 +247,7 @@ index 0a0d3a98315..5f35c6025bf 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -641,7 +640,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -665,7 +664,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -284,7 +256,7 @@ index 0a0d3a98315..5f35c6025bf 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -963,41 +962,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -987,41 +986,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -337,7 +309,7 @@ index 0a0d3a98315..5f35c6025bf 100644 static krb5_error_code mit_samba_change_pwd_error(krb5_context context, diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h -index ba824557bd5..5aadf206443 100644 +index 636c77ec97c..9cb00c9610e 100644 --- a/source4/kdc/mit_samba.h +++ b/source4/kdc/mit_samba.h @@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, @@ -361,10 +333,10 @@ index ba824557bd5..5aadf206443 100644 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, char *pwd, -- -2.31.1 +2.33.1 -From b2ada81ed9f89f6b38fb0a9e54811408676671d0 Mon Sep 17 00:00:00 2001 +From 992d38fa35c01f2f0bdb39d387fa29e8eb8d3d37 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build @@ -378,10 +350,10 @@ Pair-Programmed-With: Andreas Schneider 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index 20ce86c708d..e72ab3c30f7 100644 +index fff5b4e2a22..791b417d5ba 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c -@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, +@@ -2694,6 +2694,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, return 0; } @@ -574,7 +546,7 @@ index 20ce86c708d..e72ab3c30f7 100644 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index 9550447b2c5..ee3931c7544 100644 +index eab67f6d969..b5385c69a33 100644 --- a/lib/krb5_wrap/krb5_samba.h +++ b/lib/krb5_wrap/krb5_samba.h @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, @@ -639,10 +611,10 @@ index 544d9d853cc..c14d8c72d8c 100644 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ccache, -- -2.31.1 +2.33.1 -From bc5e97074739d29320a3e890575353fbfd452047 Mon Sep 17 00:00:00 2001 +From f1951b501ca0fb3e613f04437c99dc1bbf204609 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code @@ -655,7 +627,7 @@ Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code 4 files changed, 11 insertions(+), 2 deletions(-) diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h -index 6a09ecb6fe1..bc5211fef35 100644 +index 5ef9d9565f3..dafaffc6c2d 100644 --- a/source4/heimdal/lib/hdb/hdb.h +++ b/source4/heimdal/lib/hdb/hdb.h @@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; @@ -667,7 +639,7 @@ index 6a09ecb6fe1..bc5211fef35 100644 /* hdb_capability_flags */ #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c -index a560a1cd84b..c27b6a8ef4c 100644 +index aff74f2ee71..d16b4c3329a 100644 --- a/source4/kdc/db-glue.c +++ b/source4/kdc/db-glue.c @@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, @@ -695,7 +667,7 @@ index a560a1cd84b..c27b6a8ef4c 100644 ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); if (ret) { diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 5f35c6025bf..20ee2c2b89e 100644 +index acc3cba6254..f0b9df8b613 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c @@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, @@ -721,5 +693,5 @@ index c929acccce6..a9115ec23d7 100644 void sdb_free_entry(struct sdb_entry_ex *e); void free_sdb_entry(struct sdb_entry *s); -- -2.31.1 +2.33.1 diff --git a/samba.spec b/samba.spec index 501250c..4817ea7 100644 --- a/samba.spec +++ b/samba.spec @@ -129,9 +129,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 0 -%global samba_version 4.15.1 +%global samba_version 4.15.2 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -2669,6 +2669,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc @@ -2690,6 +2691,8 @@ fi %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc @@ -2861,6 +2864,7 @@ fi %{python3_sitearch}/samba/tests/dns_tkey.py %{python3_sitearch}/samba/tests/dns_wildcard.py %{python3_sitearch}/samba/tests/dsdb.py +%{python3_sitearch}/samba/tests/dsdb_api.py %{python3_sitearch}/samba/tests/dsdb_dns.py %{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py @@ -2901,6 +2905,7 @@ fi %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ +%{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc @@ -2916,12 +2921,15 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/alias_tests.py %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py @@ -2937,8 +2945,10 @@ fi %{python3_sitearch}/samba/tests/krb5/rodc_tests.py %{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py +%{python3_sitearch}/samba/tests/krb5/spn_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py +%{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py %{python3_sitearch}/samba/tests/krb5/test_smb.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py @@ -2946,6 +2956,8 @@ fi %{python3_sitearch}/samba/tests/krb5_credentials.py %{python3_sitearch}/samba/tests/ldap_raw.py %{python3_sitearch}/samba/tests/ldap_referrals.py +%{python3_sitearch}/samba/tests/ldap_spn.py +%{python3_sitearch}/samba/tests/ldap_upn_sam_account.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py %{python3_sitearch}/samba/tests/lsa_string.py @@ -4080,6 +4092,18 @@ fi %endif %changelog +* Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 +- Update to Samba 4.15.2 +- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 +- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 +- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 +- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 +- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 +- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 +- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 +- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 +- resolves: #2021625 + * Fri Nov 05 2021 Guenther Deschner - 4.15.1-1 - Fix winexe core dump - resolves: #2020376 diff --git a/sources b/sources index ac5f2eb..0516493 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.1.tar.xz) = 7422c4ed625411f8a4765f8e21f3b8e0c9d68f259cc25ed9f47e6243e849722ad6fa907fad989f19715ca799bc249cda4ef8a8bb930120d61851143072ef7558 -SHA512 (samba-4.15.1.tar.asc) = 0fd0a9761b2dcbd43600490a32d462f50dcd42232a79e40c3a29df5630c9df412bdfac7aeb0eb34b8ce7a9a01ba8e0da612f5771fa9d45f12d77a4ae5c875d82 +SHA512 (samba-4.15.2.tar.xz) = d9aaabbf45ba0293dbda137a21f04d5fa533be07c3826de816513d8e2ae0ef6e6109ce4045dd74bcd5375364f6de5fa8ace6ae4b3c419bfffe55fa2bfeeb0d5d +SHA512 (samba-4.15.2.tar.asc) = 732cc215c047988d4bce3d2ea981474f0cca44dd5a22030f49343aa3a37f6003bb84b116f7cdb0c8c4fd492354c107350f78101d7186fcb6027906ab1c92cf31 From f0333fc6d6d35e2d240714bd05afc916e133e143 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Nov 2021 14:45:45 +0100 Subject: [PATCH 023/295] Fix winbind trusted domain regression related: #2021716 Guenther --- ...a-4.15-fix-winbind-no-trusted-domain.patch | 41 +++++++++++++++++++ samba.spec | 7 +++- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 samba-4.15-fix-winbind-no-trusted-domain.patch diff --git a/samba-4.15-fix-winbind-no-trusted-domain.patch b/samba-4.15-fix-winbind-no-trusted-domain.patch new file mode 100644 index 0000000..4924872 --- /dev/null +++ b/samba-4.15-fix-winbind-no-trusted-domain.patch @@ -0,0 +1,41 @@ +From 2edaf32b4204b9fe363c441c25b6989fe76911a4 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Tue, 9 Nov 2021 20:50:20 +0100 +Subject: [PATCH] s3:winbindd: fix "allow trusted domains = no" regression + +add_trusted_domain() should only reject domains +based on is_allowed_domain(), which now also +checks "allow trusted domains = no", if we don't +have an explicit trust to the domain (SEC_CHAN_NULL). + +We use at least SEC_CHAN_LOCAL for local domains like +BUILTIN. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14899 + +Signed-off-by: Stefan Metzmacher + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Wed Nov 10 11:21:31 UTC 2021 on sn-devel-184 + +(cherry picked from commit a7f6c60cb037b4bc9eee276236539b8282213935) +--- + source3/winbindd/winbindd_util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c +index 42ddbfd2f44..9d54e462c42 100644 +--- a/source3/winbindd/winbindd_util.c ++++ b/source3/winbindd/winbindd_util.c +@@ -134,7 +134,7 @@ static NTSTATUS add_trusted_domain(const char *domain_name, + return NT_STATUS_INVALID_PARAMETER; + } + +- if (!is_allowed_domain(domain_name)) { ++ if (secure_channel_type == SEC_CHAN_NULL && !is_allowed_domain(domain_name)) { + return NT_STATUS_NO_SUCH_DOMAIN; + } + +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 4817ea7..dd53d8c 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.15.2 %global talloc_version 2.3.3 @@ -201,6 +201,7 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch Patch2: samba-4.15.1-winexe.patch +Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4092,6 +4093,10 @@ fi %endif %changelog +* Thu Nov 11 2021 Guenther Deschner - 4.15.2-1 +- Fix winbind trusted domain regression +- related: #2021716 + * Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 - Update to Samba 4.15.2 - resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 From af2d47413b17c4354ed476811001ae8e6de7d8c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Nov 2021 16:01:38 +0100 Subject: [PATCH 024/295] Fix logfile handling Guenther --- samba-4.15-logfile.patch | 981 +++++++++++++++++++++++++++++++++++++++ samba.spec | 2 + 2 files changed, 983 insertions(+) create mode 100644 samba-4.15-logfile.patch diff --git a/samba-4.15-logfile.patch b/samba-4.15-logfile.patch new file mode 100644 index 0000000..6300639 --- /dev/null +++ b/samba-4.15-logfile.patch @@ -0,0 +1,981 @@ +From 96d6bd4feb27b9b003aac44ef2ab7ef0a288272d Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Wed, 10 Nov 2021 20:18:07 +0100 +Subject: [PATCH 1/8] source3: move lib/substitute.c functions out of proto.h + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + source3/auth/auth_generic.c | 1 + + source3/auth/auth_ntlmssp.c | 1 + + source3/auth/auth_util.c | 1 + + source3/include/proto.h | 33 ----------- + source3/lib/substitute.c | 1 + + source3/lib/substitute.h | 63 +++++++++++++++++++++ + source3/modules/vfs_expand_msdfs.c | 1 + + source3/modules/vfs_full_audit.c | 1 + + source3/modules/vfs_recycle.c | 1 + + source3/modules/vfs_unityed_media.c | 1 + + source3/modules/vfs_virusfilter_utils.c | 1 + + source3/nmbd/nmbd.c | 1 + + source3/nmbd/nmbd_synclists.c | 1 + + source3/param/loadparm.c | 1 + + source3/passdb/passdb.c | 1 + + source3/passdb/pdb_ldap.c | 1 + + source3/printing/print_generic.c | 1 + + source3/printing/printing.c | 1 + + source3/rpc_server/lsa/srv_lsa_nt.c | 1 + + source3/rpc_server/netlogon/srv_netlog_nt.c | 1 + + source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 1 + + source3/smbd/ipc.c | 1 + + source3/smbd/lanman.c | 1 + + source3/smbd/message.c | 1 + + source3/smbd/msdfs.c | 1 + + source3/smbd/process.c | 1 + + source3/smbd/reply.c | 1 + + source3/smbd/server.c | 1 + + source3/smbd/service.c | 1 + + source3/smbd/sesssetup.c | 1 + + source3/smbd/share_access.c | 1 + + source3/smbd/smb2_server.c | 1 + + source3/smbd/smb2_sesssetup.c | 1 + + source3/smbd/trans2.c | 1 + + source3/smbd/uid.c | 1 + + source3/torture/torture.c | 1 + + source3/utils/net_sam.c | 1 + + source3/winbindd/wb_getpwsid.c | 1 + + source3/winbindd/winbindd.c | 1 + + 39 files changed, 100 insertions(+), 33 deletions(-) + create mode 100644 source3/lib/substitute.h + +diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c +index fc7a7549e8e..ff51307e43a 100644 +--- a/source3/auth/auth_generic.c ++++ b/source3/auth/auth_generic.c +@@ -36,6 +36,7 @@ + #include "auth/credentials/credentials.h" + #include "lib/param/loadparm.h" + #include "librpc/gen_ndr/dcerpc.h" ++#include "source3/lib/substitute.h" + + static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx, + TALLOC_CTX *mem_ctx, +diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c +index 676aa9d892c..f2deca09aa6 100644 +--- a/source3/auth/auth_ntlmssp.c ++++ b/source3/auth/auth_ntlmssp.c +@@ -25,6 +25,7 @@ + #include "auth.h" + #include "libcli/security/security.h" + #include "lib/util/tevent_ntstatus.h" ++#include "source3/lib/substitute.h" + + NTSTATUS auth3_generate_session_info(struct auth4_context *auth_context, + TALLOC_CTX *mem_ctx, +diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c +index dec854d85c3..4527dedc49d 100644 +--- a/source3/auth/auth_util.c ++++ b/source3/auth/auth_util.c +@@ -38,6 +38,7 @@ + #include "rpc_client/util_netlogon.h" + #include "source4/auth/auth.h" + #include "auth/auth_util.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_AUTH +diff --git a/source3/include/proto.h b/source3/include/proto.h +index eb45179aebb..a96c2c8d110 100644 +--- a/source3/include/proto.h ++++ b/source3/include/proto.h +@@ -139,39 +139,6 @@ int smbrun_no_sanitize(const char *cmd, int *outfd, char * const *env); + int smbrun(const char *cmd, int *outfd, char * const *env); + int smbrunsecret(const char *cmd, const char *secret); + +-/* The following definitions come from lib/substitute.c */ +- +-bool set_local_machine_name(const char *local_name, bool perm); +-const char *get_local_machine_name(void); +-bool set_remote_machine_name(const char *remote_name, bool perm); +-const char *get_remote_machine_name(void); +-void sub_set_smb_name(const char *name); +-void set_current_user_info(const char *smb_name, const char *unix_name, +- const char *domain); +-void sub_set_socket_ids(const char *peeraddr, const char *peername, +- const char *sockaddr); +-const char *get_current_username(void); +-void standard_sub_basic(const char *smb_name, const char *domain_name, +- char *str, size_t len); +-char *talloc_sub_basic(TALLOC_CTX *mem_ctx, const char *smb_name, +- const char *domain_name, const char *str); +-char *talloc_sub_specified(TALLOC_CTX *mem_ctx, +- const char *input_string, +- const char *username, +- const char *grpname, +- const char *domain, +- uid_t uid, +- gid_t gid); +-char *talloc_sub_advanced(TALLOC_CTX *mem_ctx, +- const char *servicename, const char *user, +- const char *connectpath, gid_t gid, +- const char *str); +-char *talloc_sub_full(TALLOC_CTX *mem_ctx, +- const char *servicename, const char *user, +- const char *connectpath, gid_t gid, +- const char *smb_name, const char *domain_name, +- const char *str); +- + /* The following definitions come from lib/sysquotas.c */ + + int sys_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp); +diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c +index b98a0acf1cb..a941b89f82a 100644 +--- a/source3/lib/substitute.c ++++ b/source3/lib/substitute.c +@@ -20,6 +20,7 @@ + + + #include "includes.h" ++#include "substitute.h" + #include "system/passwd.h" + #include "secrets.h" + #include "auth.h" +diff --git a/source3/lib/substitute.h b/source3/lib/substitute.h +new file mode 100644 +index 00000000000..2056d163dd7 +--- /dev/null ++++ b/source3/lib/substitute.h +@@ -0,0 +1,63 @@ ++/* ++ Unix SMB/CIFS implementation. ++ string substitution functions ++ Copyright (C) Andrew Tridgell 1992-2000 ++ Copyright (C) Gerald Carter 2006 ++ ++ This program is free software; you can redistribute it and/or modify ++ it under the terms of the GNU General Public License as published by ++ the Free Software Foundation; either version 3 of the License, or ++ (at your option) any later version. ++ ++ This program is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ GNU General Public License for more details. ++ ++ You should have received a copy of the GNU General Public License ++ along with this program. If not, see . ++*/ ++ ++#ifndef SUBSTITUTE_H ++#define SUBSTITUTE_H ++ ++bool set_local_machine_name(const char *local_name, bool perm); ++const char *get_local_machine_name(void); ++bool set_remote_machine_name(const char *remote_name, bool perm); ++const char *get_remote_machine_name(void); ++void sub_set_socket_ids(const char *peeraddr, const char *peername, ++ const char *sockaddr); ++void set_current_user_info(const char *smb_name, ++ const char *unix_name, ++ const char *domain); ++const char *get_current_username(void); ++void standard_sub_basic(const char *smb_name, ++ const char *domain_name, ++ char *str, ++ size_t len); ++char *talloc_sub_basic(TALLOC_CTX *mem_ctx, ++ const char *smb_name, ++ const char *domain_name, ++ const char *str); ++char *talloc_sub_specified(TALLOC_CTX *mem_ctx, ++ const char *input_string, ++ const char *username, ++ const char *grpname, ++ const char *domain, ++ uid_t uid, ++ gid_t gid); ++char *talloc_sub_advanced(TALLOC_CTX *ctx, ++ const char *servicename, ++ const char *user, ++ const char *connectpath, ++ gid_t gid, ++ const char *str); ++char *talloc_sub_full(TALLOC_CTX *ctx, ++ const char *servicename, ++ const char *user, ++ const char *connectpath, ++ gid_t gid, ++ const char *smb_name, ++ const char *domain_name, ++ const char *str); ++#endif +diff --git a/source3/modules/vfs_expand_msdfs.c b/source3/modules/vfs_expand_msdfs.c +index 34e7051dca5..fe3c6f47462 100644 +--- a/source3/modules/vfs_expand_msdfs.c ++++ b/source3/modules/vfs_expand_msdfs.c +@@ -25,6 +25,7 @@ + #include "auth.h" + #include "../lib/tsocket/tsocket.h" + #include "msdfs.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_VFS +diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c +index ceda99d4568..c8dbc8c07bb 100644 +--- a/source3/modules/vfs_full_audit.c ++++ b/source3/modules/vfs_full_audit.c +@@ -73,6 +73,7 @@ + #include "passdb/machine_sid.h" + #include "lib/util/tevent_ntstatus.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + static int vfs_full_audit_debug_level = DBGC_VFS; + +diff --git a/source3/modules/vfs_recycle.c b/source3/modules/vfs_recycle.c +index 1c18f232c32..7cbc938a57c 100644 +--- a/source3/modules/vfs_recycle.c ++++ b/source3/modules/vfs_recycle.c +@@ -27,6 +27,7 @@ + #include "system/filesys.h" + #include "../librpc/gen_ndr/ndr_netlogon.h" + #include "auth.h" ++#include "source3/lib/substitute.h" + + #define ALLOC_CHECK(ptr, label) do { if ((ptr) == NULL) { DEBUG(0, ("recycle.bin: out of memory!\n")); errno = ENOMEM; goto label; } } while(0) + +diff --git a/source3/modules/vfs_unityed_media.c b/source3/modules/vfs_unityed_media.c +index 62a1456b996..fbd4d968172 100644 +--- a/source3/modules/vfs_unityed_media.c ++++ b/source3/modules/vfs_unityed_media.c +@@ -62,6 +62,7 @@ + #include "../lib/tsocket/tsocket.h" + #include "lib/util/smb_strtox.h" + #include ++#include "source3/lib/substitute.h" + + #define UM_PARAM_TYPE_NAME "unityed_media" + +diff --git a/source3/modules/vfs_virusfilter_utils.c b/source3/modules/vfs_virusfilter_utils.c +index c7f8089ffc7..b8b44eb203b 100644 +--- a/source3/modules/vfs_virusfilter_utils.c ++++ b/source3/modules/vfs_virusfilter_utils.c +@@ -25,6 +25,7 @@ struct iovec; + #include "lib/util/iov_buf.h" + #include + #include "lib/tsocket/tsocket.h" ++#include "source3/lib/substitute.h" + + int virusfilter_debug_class = DBGC_VFS; + +diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c +index 44121e9915c..7470897587e 100644 +--- a/source3/nmbd/nmbd.c ++++ b/source3/nmbd/nmbd.c +@@ -29,6 +29,7 @@ + #include "util_cluster.h" + #include "lib/gencache.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + int ClientNMB = -1; + int ClientDGRAM = -1; +diff --git a/source3/nmbd/nmbd_synclists.c b/source3/nmbd/nmbd_synclists.c +index a65cbb87e0e..d291927fbc8 100644 +--- a/source3/nmbd/nmbd_synclists.c ++++ b/source3/nmbd/nmbd_synclists.c +@@ -33,6 +33,7 @@ + #include "libsmb/clirap.h" + #include "../libcli/smb/smbXcli_base.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + struct sync_record { + struct sync_record *next, *prev; +diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c +index f54c08cc4a5..b56fd20e410 100644 +--- a/source3/param/loadparm.c ++++ b/source3/param/loadparm.c +@@ -76,6 +76,7 @@ + #include "lib/crypto/gnutls_helpers.h" + #include "lib/util/string_wrappers.h" + #include "auth/credentials/credentials.h" ++#include "source3/lib/substitute.h" + + #ifdef HAVE_SYS_SYSCTL_H + #include +diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c +index 068c5a5ea70..863f260ea90 100644 +--- a/source3/passdb/passdb.c ++++ b/source3/passdb/passdb.c +@@ -33,6 +33,7 @@ + #include "auth/credentials/credentials.h" + #include "lib/param/param.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_PASSDB +diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c +index e6d8a84c60f..93da28b1941 100644 +--- a/source3/passdb/pdb_ldap.c ++++ b/source3/passdb/pdb_ldap.c +@@ -56,6 +56,7 @@ + #include "lib/util_sid_passdb.h" + #include "lib/util/smb_strtox.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_PASSDB +diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c +index 743c311bbd5..8798a4cf34a 100644 +--- a/source3/printing/print_generic.c ++++ b/source3/printing/print_generic.c +@@ -20,6 +20,7 @@ + #include "includes.h" + #include "printing.h" + #include "smbd/proto.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/printing/printing.c b/source3/printing/printing.c +index 499334df03f..67d798fbb21 100644 +--- a/source3/printing/printing.c ++++ b/source3/printing/printing.c +@@ -40,6 +40,7 @@ + #include "lib/util/string_wrappers.h" + #include "lib/global_contexts.h" + #include "source3/printing/rap_jobid.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index d6d606ddeca..57f981cb358 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -53,6 +53,7 @@ + #include "librpc/rpc/dcesrv_core.h" + #include "librpc/rpc/dcerpc_helper.h" + #include "lib/param/loadparm.h" ++#include "source3/lib/substitute.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c +index eaacd8dbc6a..2906fa3f30f 100644 +--- a/source3/rpc_server/netlogon/srv_netlog_nt.c ++++ b/source3/rpc_server/netlogon/srv_netlog_nt.c +@@ -49,6 +49,7 @@ + #include "lib/param/param.h" + #include "libsmb/dsgetdcname.h" + #include "lib/util/util_str_escape.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c +index 8576e9d2ce2..fc27a459634 100644 +--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c ++++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c +@@ -42,6 +42,7 @@ + #include "messages.h" + #include "serverid.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + extern const struct generic_mapping file_generic_mapping; + +diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c +index f1c8ea0c2ed..cf3b7c91c22 100644 +--- a/source3/smbd/ipc.c ++++ b/source3/smbd/ipc.c +@@ -29,6 +29,7 @@ + #include "smbd/globals.h" + #include "smbprofile.h" + #include "rpc_server/srv_pipe_hnd.h" ++#include "source3/lib/substitute.h" + + #define NERR_notsupported 50 + +diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c +index 9194113e768..eb8148753b9 100644 +--- a/source3/smbd/lanman.c ++++ b/source3/smbd/lanman.c +@@ -45,6 +45,7 @@ + #include "rpc_server/rpc_ncacn_np.h" + #include "lib/util/string_wrappers.h" + #include "source3/printing/rap_jobid.h" ++#include "source3/lib/substitute.h" + + #ifdef CHECK_TYPES + #undef CHECK_TYPES +diff --git a/source3/smbd/message.c b/source3/smbd/message.c +index b9728946889..7185bec1289 100644 +--- a/source3/smbd/message.c ++++ b/source3/smbd/message.c +@@ -27,6 +27,7 @@ + #include "smbd/smbd.h" + #include "smbd/globals.h" + #include "smbprofile.h" ++#include "source3/lib/substitute.h" + + extern userdom_struct current_user_info; + +diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c +index 995ed815d90..fd002e98071 100644 +--- a/source3/smbd/msdfs.c ++++ b/source3/smbd/msdfs.c +@@ -34,6 +34,7 @@ + #include "librpc/gen_ndr/ndr_dfsblobs.h" + #include "lib/tsocket/tsocket.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + /********************************************************************** + Parse a DFS pathname of the form \hostname\service\reqpath +diff --git a/source3/smbd/process.c b/source3/smbd/process.c +index 03409742752..5015c143a04 100644 +--- a/source3/smbd/process.c ++++ b/source3/smbd/process.c +@@ -46,6 +46,7 @@ + #include "libcli/smb/smbXcli_base.h" + #include "lib/util/time_basic.h" + #include "smb1_utils.h" ++#include "source3/lib/substitute.h" + + /* Internal message queue for deferred opens. */ + struct pending_message_list { +diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c +index 042e7f2329e..f85d1122a07 100644 +--- a/source3/smbd/reply.c ++++ b/source3/smbd/reply.c +@@ -50,6 +50,7 @@ + #include "libcli/smb/smb2_posix.h" + #include "lib/util/string_wrappers.h" + #include "source3/printing/rap_jobid.h" ++#include "source3/lib/substitute.h" + + /**************************************************************************** + Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext +diff --git a/source3/smbd/server.c b/source3/smbd/server.c +index d7f5b4b73c0..d02ff1bd883 100644 +--- a/source3/smbd/server.c ++++ b/source3/smbd/server.c +@@ -60,6 +60,7 @@ + #include "rpc_server/fssd.h" + #include "rpc_server/mdssd.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + #ifdef CLUSTER_SUPPORT + #include "ctdb_protocol.h" +diff --git a/source3/smbd/service.c b/source3/smbd/service.c +index afdea38b016..ef7c14d92d0 100644 +--- a/source3/smbd/service.c ++++ b/source3/smbd/service.c +@@ -34,6 +34,7 @@ + #include "lib/afs/afs_funcs.h" + #include "lib/util_path.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + bool canonicalize_connect_path(connection_struct *conn) + { +diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c +index 2bd527ce80e..1705b8920b6 100644 +--- a/source3/smbd/sesssetup.c ++++ b/source3/smbd/sesssetup.c +@@ -34,6 +34,7 @@ + #include "auth/gensec/gensec.h" + #include "../libcli/smb/smb_signing.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + /**************************************************************************** + Add the standard 'Samba' signature to the end of the session setup. +diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c +index debe4fc6385..c44c4bd8c69 100644 +--- a/source3/smbd/share_access.c ++++ b/source3/smbd/share_access.c +@@ -23,6 +23,7 @@ + #include "../libcli/security/security.h" + #include "passdb/lookup_sid.h" + #include "auth.h" ++#include "source3/lib/substitute.h" + + /* + * We dropped NIS support in 2021, but need to keep configs working. +diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c +index f359db0729d..f6b376e5a07 100644 +--- a/source3/smbd/smb2_server.c ++++ b/source3/smbd/smb2_server.c +@@ -33,6 +33,7 @@ + #include "lib/util/iov_buf.h" + #include "auth.h" + #include "libcli/smb/smbXcli_base.h" ++#include "source3/lib/substitute.h" + + #if defined(LINUX) + /* SIOCOUTQ TIOCOUTQ are the same */ +diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c +index 38049e8535f..14b806bc007 100644 +--- a/source3/smbd/smb2_sesssetup.c ++++ b/source3/smbd/smb2_sesssetup.c +@@ -28,6 +28,7 @@ + #include "../lib/tsocket/tsocket.h" + #include "../libcli/security/security.h" + #include "../lib/util/tevent_ntstatus.h" ++#include "source3/lib/substitute.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c +index cd6b61429c5..a86ac3228e3 100644 +--- a/source3/smbd/trans2.c ++++ b/source3/smbd/trans2.c +@@ -45,6 +45,7 @@ + #include "smb1_utils.h" + #include "libcli/smb/smb2_posix.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #define DIR_ENTRY_SAFETY_MARGIN 4096 + +diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c +index b0d7f21c200..52918c4f181 100644 +--- a/source3/smbd/uid.c ++++ b/source3/smbd/uid.c +@@ -26,6 +26,7 @@ + #include "passdb/lookup_sid.h" + #include "auth.h" + #include "../auth/auth_util.h" ++#include "source3/lib/substitute.h" + + /* what user is current? */ + extern struct current_user current_user; +diff --git a/source3/torture/torture.c b/source3/torture/torture.c +index 79a9c65073c..d3e0e3cf095 100644 +--- a/source3/torture/torture.c ++++ b/source3/torture/torture.c +@@ -51,6 +51,7 @@ + #include "lib/param/param.h" + #include "auth/gensec/gensec.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + #include + #include +diff --git a/source3/utils/net_sam.c b/source3/utils/net_sam.c +index 6a2c6c861f9..17cc47b2ddd 100644 +--- a/source3/utils/net_sam.c ++++ b/source3/utils/net_sam.c +@@ -33,6 +33,7 @@ + #include "idmap.h" + #include "lib/util/smb_strtox.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + /* + * Set a user's data +diff --git a/source3/winbindd/wb_getpwsid.c b/source3/winbindd/wb_getpwsid.c +index fb0351ec201..7f168bdda7a 100644 +--- a/source3/winbindd/wb_getpwsid.c ++++ b/source3/winbindd/wb_getpwsid.c +@@ -22,6 +22,7 @@ + #include "librpc/gen_ndr/ndr_winbind_c.h" + #include "../libcli/security/security.h" + #include "lib/util/string_wrappers.h" ++#include "source3/lib/substitute.h" + + struct wb_getpwsid_state { + struct tevent_context *ev; +diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c +index 25d8b723010..290454619a4 100644 +--- a/source3/winbindd/winbindd.c ++++ b/source3/winbindd/winbindd.c +@@ -51,6 +51,7 @@ + #include "lib/gencache.h" + #include "rpc_server/rpc_config.h" + #include "lib/global_contexts.h" ++#include "source3/lib/substitute.h" + + #undef DBGC_CLASS + #define DBGC_CLASS DBGC_WINBIND +-- +2.33.1 + + +From 1184733a1628c1187a215956195ca806419db16d Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Thu, 11 Nov 2021 05:23:09 +0100 +Subject: [PATCH 2/8] samba-bgqd: fix startup and logging + +Let samba-bgqd use the new POPT_COMMON_DAEMON infrastructure. + +The calls to setup_logging() can safely be removed as this is already taken care +of by samba_cmdline_init(). + +To avoid a logfile basename of ".log" when using "%m", we add a call to +set_remote_machine_name(). + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + source3/printing/samba-bgqd.c | 35 ++++++++++------------------------- + 1 file changed, 10 insertions(+), 25 deletions(-) + +diff --git a/source3/printing/samba-bgqd.c b/source3/printing/samba-bgqd.c +index 8ac6ec525b2..2cd6a8e007a 100644 +--- a/source3/printing/samba-bgqd.c ++++ b/source3/printing/samba-bgqd.c +@@ -40,6 +40,7 @@ + #include "source3/lib/util_procid.h" + #include "source3/auth/proto.h" + #include "source3/printing/queue_process.h" ++#include "source3/lib/substitute.h" + + static void watch_handler(struct tevent_req *req) + { +@@ -235,6 +236,7 @@ static int closeall_except_fd_params( + + int main(int argc, const char *argv[]) + { ++ struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = NULL; + const struct loadparm_substitution *lp_sub = + loadparm_s3_global_substitution(); + const char *progname = getprogname(); +@@ -245,8 +247,6 @@ int main(int argc, const char *argv[]) + struct tevent_req *watch_req = NULL; + struct tevent_signal *sigterm_handler = NULL; + struct bq_state *bq = NULL; +- int foreground = 0; +- int no_process_group = 0; + int log_stdout = 0; + int ready_signal_fd = -1; + int watch_fd = -1; +@@ -259,21 +259,7 @@ int main(int argc, const char *argv[]) + struct poptOption long_options[] = { + POPT_AUTOHELP + POPT_COMMON_SAMBA +- { +- .longName = "foreground", +- .shortName = 'F', +- .argInfo = POPT_ARG_NONE, +- .arg = &foreground, +- .descrip = "Run daemon in foreground " +- "(for daemontools, etc.)", +- }, +- { +- .longName = "no-process-group", +- .shortName = '\0', +- .argInfo = POPT_ARG_NONE, +- .arg = &no_process_group, +- .descrip = "Don't create a new process group" , +- }, ++ POPT_COMMON_DAEMON + + /* + * File descriptor to write the PID of the helper +@@ -311,6 +297,7 @@ int main(int argc, const char *argv[]) + frame = talloc_stackframe(); + + umask(0); ++ set_remote_machine_name("smbd-bgqd", true); + + ok = samba_cmdline_init(frame, + SAMBA_CMDLINE_CONFIG_SERVER, +@@ -320,6 +307,8 @@ int main(int argc, const char *argv[]) + exit(ENOMEM); + } + ++ cmdline_daemon_cfg = samba_cmdline_get_daemon_cfg(); ++ + pc = samba_popt_get_context(progname, + argc, + argv, +@@ -340,16 +329,12 @@ int main(int argc, const char *argv[]) + + log_stdout = (debug_get_log_type() == DEBUG_STDOUT); + +- if (foreground) { ++ if (!cmdline_daemon_cfg->fork) { + daemon_status(progname, "Starting process ... "); + } else { +- become_daemon(true, no_process_group, log_stdout); +- } +- +- if (log_stdout) { +- setup_logging(progname, DEBUG_STDOUT); +- } else { +- setup_logging(progname, DEBUG_FILE); ++ become_daemon(true, ++ cmdline_daemon_cfg->no_process_group, ++ log_stdout); + } + + BlockSignals(true, SIGPIPE); +-- +2.33.1 + + +From 1a0a1ccbe888332ea134b16bfac0d0d011bf1f4c Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Wed, 10 Nov 2021 18:27:08 +0100 +Subject: [PATCH 3/8] winbindd: remove is_default_dyn_LOGFILEBASE() logic + +Handling of -l commandline parameter is already implemented by lib/cmdline/. + +is_default_dyn_LOGFILEBASE() == true is the default case and this causes us to +temporarily overwrite the configured logfile with LOGFILEBASE/log.winbindd until +winbindd_reload_services_file() restores it. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + source3/winbindd/winbindd.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c +index 290454619a4..58c5ffbced4 100644 +--- a/source3/winbindd/winbindd.c ++++ b/source3/winbindd/winbindd.c +@@ -1717,15 +1717,6 @@ int main(int argc, const char **argv) + + poptFreeContext(pc); + +- if (is_default_dyn_LOGFILEBASE()) { +- char *lfile = NULL; +- if (asprintf(&lfile,"%s/log.winbindd", +- get_dyn_LOGFILEBASE()) > 0) { +- lp_set_logfile(lfile); +- SAFE_FREE(lfile); +- } +- } +- + reopen_logs(); + + DEBUG(0,("winbindd version %s started.\n", samba_version_string())); +-- +2.33.1 + + +From bcbf9fb6669933cc3dcf1f615d2885c542a08035 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Wed, 10 Nov 2021 14:13:11 +0100 +Subject: [PATCH 4/8] lib/debug: fix fd check before dup'ing to stderr + +Before I added per-class logfile and we had only one fd for the logfile the code +looked like this: + + /* Take over stderr to catch output into logs */ + if (state.fd > 0) { + if (dup2(state.fd, 2) == -1) { + /* Close stderr too, if dup2 can't point it - + at the logfile. There really isn't much + that can be done on such a fundamental + failure... */ + close_low_fd(2); + } + } + +In the current code the equivalent to state.fd is dbgc_config[DBGC_ALL].fd. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/util/debug.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/lib/util/debug.c b/lib/util/debug.c +index 4fd17679227..b271608621a 100644 +--- a/lib/util/debug.c ++++ b/lib/util/debug.c +@@ -1125,7 +1125,6 @@ bool reopen_logs_internal(void) + { + struct debug_backend *b = NULL; + mode_t oldumask; +- int new_fd = 0; + size_t i; + bool ok; + +@@ -1190,7 +1189,7 @@ bool reopen_logs_internal(void) + * If log file was opened or created successfully, take over stderr to + * catch output into logs. + */ +- if (new_fd != -1) { ++ if (dbgc_config[DBGC_ALL].fd > 0) { + if (dup2(dbgc_config[DBGC_ALL].fd, 2) == -1) { + /* Close stderr too, if dup2 can't point it - + at the logfile. There really isn't much +-- +2.33.1 + + +From 9f76bd48d87eb03c66dfe942b4a84e997a8fe8ba Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 19:41:50 +0100 +Subject: [PATCH 5/8] lib/debug: in debug_set_logfile() call + reopen_logs_internal() + +This simplifies the logging API for callers that typically would want to set +logging by just setup_logging() once without bothering that typically +configuration is loaded (via some lpcfg_load*() or lp_load*() varient) which +will only then pick up the configured logfile from smb.conf without actually +applying the new logifle to the logging subsytem. + +Therefor our daemons will additionally call reopen_logs() explicitly in their +startup code after config is loaded, eg + + setup_logging(getprogname(), DEBUG_FILE); + ... + lpcfg_load(lp_ctx, config_file); + ... + reopen_logs(); + +By calling reopen_logs_internal() implicitly from debug_set_logfile() there's no +need to call reopen_logs() explicitly anymore to apply the logfile. + +As reopen_logs() will also apply other logging configuration options, we have to +keep the explicit calls in the daemon code. But at least this allows consistent +logging setup wrt to the logfile in the new cmdline library. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/util/debug.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/util/debug.c b/lib/util/debug.c +index b271608621a..171b5e15008 100644 +--- a/lib/util/debug.c ++++ b/lib/util/debug.c +@@ -1018,6 +1018,8 @@ void debug_set_logfile(const char *name) + } + TALLOC_FREE(dbgc_config[DBGC_ALL].logfile); + dbgc_config[DBGC_ALL].logfile = talloc_strdup(NULL, name); ++ ++ reopen_logs_internal(); + } + + static void debug_close_fd(int fd) +-- +2.33.1 + + +From b80911bc1a306cac479ee3feabdcea124946cdde Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 12:08:47 +0100 +Subject: [PATCH 6/8] lib/cmdline: fix indentation + +s/whitespace/tab/ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/cmdline/cmdline_s3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/cmdline/cmdline_s3.c b/lib/cmdline/cmdline_s3.c +index 1f8d9ed5eb5..639d403aed3 100644 +--- a/lib/cmdline/cmdline_s3.c ++++ b/lib/cmdline/cmdline_s3.c +@@ -55,7 +55,7 @@ static bool _samba_cmdline_load_config_s3(void) + case SAMBA_CMDLINE_CONFIG_CLIENT: + ok = lp_load_client(config_file); + break; +- case SAMBA_CMDLINE_CONFIG_SERVER: ++ case SAMBA_CMDLINE_CONFIG_SERVER: + { + const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = + samba_cmdline_get_daemon_cfg(); +-- +2.33.1 + + +From a6b6b0b6e6dfcd2c8e2c2085d20cd16c51e3b379 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 12:09:16 +0100 +Subject: [PATCH 7/8] lib/cmdline: remember config_type in samba_cmdline_init() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 + +Signed-off-by: Ralph Boehme +--- + lib/cmdline/cmdline_s4.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c +index 61c1b96ba8d..6ef6f59db49 100644 +--- a/lib/cmdline/cmdline_s4.c ++++ b/lib/cmdline/cmdline_s4.c +@@ -25,6 +25,7 @@ + #include "cmdline_private.h" + + static bool _require_smbconf; ++static enum samba_cmdline_config_type _config_type; + + static bool _samba_cmdline_load_config_s4(void) + { +@@ -81,6 +82,7 @@ bool samba_cmdline_init(TALLOC_CTX *mem_ctx, + return false; + } + _require_smbconf = require_smbconf; ++ _config_type = config_type; + + creds = cli_credentials_init(mem_ctx); + if (creds == NULL) { +-- +2.33.1 + + +From e1d6ab1b0dbd8ff30019edf804c4766b066db4b7 Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Mon, 8 Nov 2021 12:09:43 +0100 +Subject: [PATCH 8/8] lib/cmdline: setup default file logging for servers + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 +RN: samba process doesn't log to logfile + +Signed-off-by: Ralph Boehme +--- + lib/cmdline/cmdline_s4.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c +index 6ef6f59db49..29e9f34bbe2 100644 +--- a/lib/cmdline/cmdline_s4.c ++++ b/lib/cmdline/cmdline_s4.c +@@ -44,6 +44,20 @@ static bool _samba_cmdline_load_config_s4(void) + } + } + ++ switch (_config_type) { ++ case SAMBA_CMDLINE_CONFIG_SERVER: { ++ const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = ++ samba_cmdline_get_daemon_cfg(); ++ ++ if (!cmdline_daemon_cfg->interactive) { ++ setup_logging(getprogname(), DEBUG_FILE); ++ } ++ break; ++ } ++ default: ++ break; ++ } ++ + config_file = get_dyn_CONFIGFILE(); + ok = lpcfg_load(lp_ctx, config_file); + if (!ok) { +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index dd53d8c..334c508 100644 --- a/samba.spec +++ b/samba.spec @@ -202,6 +202,7 @@ Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch Patch2: samba-4.15.1-winexe.patch Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch +Patch4: samba-4.15-logfile.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4096,6 +4097,7 @@ fi * Thu Nov 11 2021 Guenther Deschner - 4.15.2-1 - Fix winbind trusted domain regression - related: #2021716 +- Fix logfile handling * Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 - Update to Samba 4.15.2 From 2eedc4de19dac68faa251f684fb3104b299ca7a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 11 Nov 2021 18:53:23 +0100 Subject: [PATCH 025/295] Fix smbclient -N failures in container setups Guenther --- samba-4.15.2-smbclient_anonymous.patch | 58 ++++++++++++++++++++++++++ samba.spec | 6 ++- 2 files changed, 62 insertions(+), 2 deletions(-) create mode 100644 samba-4.15.2-smbclient_anonymous.patch diff --git a/samba-4.15.2-smbclient_anonymous.patch b/samba-4.15.2-smbclient_anonymous.patch new file mode 100644 index 0000000..477ddef --- /dev/null +++ b/samba-4.15.2-smbclient_anonymous.patch @@ -0,0 +1,58 @@ +From 61fd63d70578043de9f3bff1c3267c499dbf50a0 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 10 Nov 2021 12:06:51 +0100 +Subject: [PATCH] auth:creds: Guess the username first via getpwuid(my_id) + +If we have a container, we often don't have USER or LOGNAME set. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14883 + +Tested-by: Anoop C S +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit c28be4067463e582e378df402f812e510883d606) +--- + auth/credentials/credentials.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c +index 02a3cf3b354..c5a6ba6940c 100644 +--- a/auth/credentials/credentials.c ++++ b/auth/credentials/credentials.c +@@ -30,6 +30,7 @@ + #include "tevent.h" + #include "param/param.h" + #include "system/filesys.h" ++#include "system/passwd.h" + + /** + * Create a new credentials structure +@@ -1159,6 +1160,7 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, + { + const char *error_string; + const char *env = NULL; ++ struct passwd *pwd = NULL; + bool ok; + + if (lp_ctx != NULL) { +@@ -1168,6 +1170,17 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, + } + } + ++ pwd = getpwuid(getuid()); ++ if (pwd != NULL) { ++ size_t len = strlen(pwd->pw_name); ++ ++ if (len > 0 && len <= 1024) { ++ (void)cli_credentials_parse_string(cred, ++ pwd->pw_name, ++ CRED_GUESS_ENV); ++ } ++ } ++ + env = getenv("LOGNAME"); + if (env != NULL) { + size_t len = strlen(env); +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 334c508..3915d5a 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 2 %global samba_version 4.15.2 %global talloc_version 2.3.3 @@ -203,6 +203,7 @@ Patch1: samba-ctdb-etcd-reclock.patch Patch2: samba-4.15.1-winexe.patch Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch Patch4: samba-4.15-logfile.patch +Patch5: samba-4.15.2-smbclient_anonymous.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4094,10 +4095,11 @@ fi %endif %changelog -* Thu Nov 11 2021 Guenther Deschner - 4.15.2-1 +* Thu Nov 11 2021 Guenther Deschner - 4.15.2-2 - Fix winbind trusted domain regression - related: #2021716 - Fix logfile handling +- Fix smbclient -N failures in container setups * Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 - Update to Samba 4.15.2 From 2ee30bad8f6008e2d425d502b9004b6777992409 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 13 Nov 2021 00:15:32 +0100 Subject: [PATCH 026/295] Fix IPA DC schannel support Guenther --- samba-4.15-ipa-dc-schannel.patch | 45 ++++++++++++++++++++++++++++++++ samba.spec | 6 ++++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 samba-4.15-ipa-dc-schannel.patch diff --git a/samba-4.15-ipa-dc-schannel.patch b/samba-4.15-ipa-dc-schannel.patch new file mode 100644 index 0000000..d315a5d --- /dev/null +++ b/samba-4.15-ipa-dc-schannel.patch @@ -0,0 +1,45 @@ +From 3fc4d1d3998f3956a84c855cb60a9dcb335e1f59 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Fri, 12 Nov 2021 19:06:01 +0200 +Subject: [PATCH] IPA DC: add missing checks + +When introducing FreeIPA support, two places were forgotten: + + - schannel gensec module needs to be aware of IPA DC + - _lsa_QueryInfoPolicy should treat IPA DC as PDC + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14903 + +Signed-off-by: Alexander Bokovoy +--- + auth/gensec/schannel.c | 1 + + source3/rpc_server/lsa/srv_lsa_nt.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c +index 0cdae141ead..6ebbe8f3179 100644 +--- a/auth/gensec/schannel.c ++++ b/auth/gensec/schannel.c +@@ -1080,6 +1080,7 @@ static NTSTATUS schannel_server_start(struct gensec_security *gensec_security) + case ROLE_DOMAIN_BDC: + case ROLE_DOMAIN_PDC: + case ROLE_ACTIVE_DIRECTORY_DC: ++ case ROLE_IPA_DC: + return NT_STATUS_OK; + default: + return NT_STATUS_NOT_IMPLEMENTED; +diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c +index 8d71b5252ab..ea92a22cbc9 100644 +--- a/source3/rpc_server/lsa/srv_lsa_nt.c ++++ b/source3/rpc_server/lsa/srv_lsa_nt.c +@@ -683,6 +683,7 @@ NTSTATUS _lsa_QueryInfoPolicy(struct pipes_struct *p, + switch (lp_server_role()) { + case ROLE_DOMAIN_PDC: + case ROLE_DOMAIN_BDC: ++ case ROLE_IPA_DC: + name = get_global_sam_name(); + sid = dom_sid_dup(p->mem_ctx, get_global_sam_sid()); + if (!sid) { +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 3915d5a..a5a3106 100644 --- a/samba.spec +++ b/samba.spec @@ -129,7 +129,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 3 %global samba_version 4.15.2 %global talloc_version 2.3.3 @@ -204,6 +204,7 @@ Patch2: samba-4.15.1-winexe.patch Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch Patch4: samba-4.15-logfile.patch Patch5: samba-4.15.2-smbclient_anonymous.patch +Patch6: samba-4.15-ipa-dc-schannel.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4095,6 +4096,9 @@ fi %endif %changelog +* Sat Nov 13 2021 Guenther Deschner - 4.15.2-3 +- Fix IPA DC schannel support + * Thu Nov 11 2021 Guenther Deschner - 4.15.2-2 - Fix winbind trusted domain regression - related: #2021716 From 6f2c200320d3753389181bb588a7661f0f84fadc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 15 Nov 2021 11:14:50 +0100 Subject: [PATCH 027/295] Always build with quota support We want that the build fails, if we don't have quota support. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index a5a3106..6c0c8b9 100644 --- a/samba.spec +++ b/samba.spec @@ -1149,6 +1149,7 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" %endif --with-profiling-data \ --with-systemd \ + --with-quotas \ --systemd-install-services \ --with-systemddir=/usr/lib/systemd/system \ --systemd-smb-extra=%{_systemd_extra} \ From 73757dc8a31204cec0bd97133b79b731ad71ceb9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 25 Nov 2021 14:58:29 +0100 Subject: [PATCH 028/295] Define _make_verbose in if it doesn't exits This is needed to build for RHEL8. --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index 6c0c8b9..01a887b 100644 --- a/samba.spec +++ b/samba.spec @@ -19,6 +19,9 @@ # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering +# Define _make_verbose if it doesn't exist (RHEL8) +%{!?_make_verbose:%define _make_verbose V=1 VERBOSE=1} + # Build with Active Directory Domain Controller support by default on Fedora %if 0%{?fedora} %bcond_without dc From a4093f41f0cc344f1ba9da3876ab0b54359c88ec Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 3 Dec 2021 13:53:38 +0100 Subject: [PATCH 029/295] Remove unneeded lmdb dependency for samba-tool if we don't have a DC --- samba.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 01a887b..a1b91fe 100644 --- a/samba.spec +++ b/samba.spec @@ -493,8 +493,10 @@ Requires: libwbclient = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools -# samba-tool needs mdb_copy +%if %{with dc} +# samba-tool needs mdb_copy for domain backup or upgrade provision Requires: lmdb +%endif Provides: bundled(libreplace) From 6bc60bb396b4c95385735bfc26549342fd7db627 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 8 Dec 2021 17:57:04 +0100 Subject: [PATCH 030/295] Update to Samba 4.15.3 resolves: #2030382 pfilipen --- .gitignore | 2 + ...a-4.15-fix-winbind-no-trusted-domain.patch | 41 - samba-4.15-ipa-dc-schannel.patch | 45 - samba-4.15-logfile.patch | 981 ------------------ samba-4.15.1-winexe.patch | 61 -- samba-4.15.2-smbclient_anonymous.patch | 58 -- samba.spec | 15 +- sources | 4 +- 8 files changed, 12 insertions(+), 1195 deletions(-) delete mode 100644 samba-4.15-fix-winbind-no-trusted-domain.patch delete mode 100644 samba-4.15-ipa-dc-schannel.patch delete mode 100644 samba-4.15-logfile.patch delete mode 100644 samba-4.15.1-winexe.patch delete mode 100644 samba-4.15.2-smbclient_anonymous.patch diff --git a/.gitignore b/.gitignore index b2f1c52..23cef85 100644 --- a/.gitignore +++ b/.gitignore @@ -273,3 +273,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.1.tar.asc /samba-4.15.2.tar.xz /samba-4.15.2.tar.asc +/samba-4.15.3.tar.xz +/samba-4.15.3.tar.asc diff --git a/samba-4.15-fix-winbind-no-trusted-domain.patch b/samba-4.15-fix-winbind-no-trusted-domain.patch deleted file mode 100644 index 4924872..0000000 --- a/samba-4.15-fix-winbind-no-trusted-domain.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 2edaf32b4204b9fe363c441c25b6989fe76911a4 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Tue, 9 Nov 2021 20:50:20 +0100 -Subject: [PATCH] s3:winbindd: fix "allow trusted domains = no" regression - -add_trusted_domain() should only reject domains -based on is_allowed_domain(), which now also -checks "allow trusted domains = no", if we don't -have an explicit trust to the domain (SEC_CHAN_NULL). - -We use at least SEC_CHAN_LOCAL for local domains like -BUILTIN. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14899 - -Signed-off-by: Stefan Metzmacher - -Autobuild-User(master): Stefan Metzmacher -Autobuild-Date(master): Wed Nov 10 11:21:31 UTC 2021 on sn-devel-184 - -(cherry picked from commit a7f6c60cb037b4bc9eee276236539b8282213935) ---- - source3/winbindd/winbindd_util.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c -index 42ddbfd2f44..9d54e462c42 100644 ---- a/source3/winbindd/winbindd_util.c -+++ b/source3/winbindd/winbindd_util.c -@@ -134,7 +134,7 @@ static NTSTATUS add_trusted_domain(const char *domain_name, - return NT_STATUS_INVALID_PARAMETER; - } - -- if (!is_allowed_domain(domain_name)) { -+ if (secure_channel_type == SEC_CHAN_NULL && !is_allowed_domain(domain_name)) { - return NT_STATUS_NO_SUCH_DOMAIN; - } - --- -2.33.1 - diff --git a/samba-4.15-ipa-dc-schannel.patch b/samba-4.15-ipa-dc-schannel.patch deleted file mode 100644 index d315a5d..0000000 --- a/samba-4.15-ipa-dc-schannel.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 3fc4d1d3998f3956a84c855cb60a9dcb335e1f59 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Fri, 12 Nov 2021 19:06:01 +0200 -Subject: [PATCH] IPA DC: add missing checks - -When introducing FreeIPA support, two places were forgotten: - - - schannel gensec module needs to be aware of IPA DC - - _lsa_QueryInfoPolicy should treat IPA DC as PDC - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14903 - -Signed-off-by: Alexander Bokovoy ---- - auth/gensec/schannel.c | 1 + - source3/rpc_server/lsa/srv_lsa_nt.c | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c -index 0cdae141ead..6ebbe8f3179 100644 ---- a/auth/gensec/schannel.c -+++ b/auth/gensec/schannel.c -@@ -1080,6 +1080,7 @@ static NTSTATUS schannel_server_start(struct gensec_security *gensec_security) - case ROLE_DOMAIN_BDC: - case ROLE_DOMAIN_PDC: - case ROLE_ACTIVE_DIRECTORY_DC: -+ case ROLE_IPA_DC: - return NT_STATUS_OK; - default: - return NT_STATUS_NOT_IMPLEMENTED; -diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c -index 8d71b5252ab..ea92a22cbc9 100644 ---- a/source3/rpc_server/lsa/srv_lsa_nt.c -+++ b/source3/rpc_server/lsa/srv_lsa_nt.c -@@ -683,6 +683,7 @@ NTSTATUS _lsa_QueryInfoPolicy(struct pipes_struct *p, - switch (lp_server_role()) { - case ROLE_DOMAIN_PDC: - case ROLE_DOMAIN_BDC: -+ case ROLE_IPA_DC: - name = get_global_sam_name(); - sid = dom_sid_dup(p->mem_ctx, get_global_sam_sid()); - if (!sid) { --- -2.33.1 - diff --git a/samba-4.15-logfile.patch b/samba-4.15-logfile.patch deleted file mode 100644 index 6300639..0000000 --- a/samba-4.15-logfile.patch +++ /dev/null @@ -1,981 +0,0 @@ -From 96d6bd4feb27b9b003aac44ef2ab7ef0a288272d Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Wed, 10 Nov 2021 20:18:07 +0100 -Subject: [PATCH 1/8] source3: move lib/substitute.c functions out of proto.h - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - source3/auth/auth_generic.c | 1 + - source3/auth/auth_ntlmssp.c | 1 + - source3/auth/auth_util.c | 1 + - source3/include/proto.h | 33 ----------- - source3/lib/substitute.c | 1 + - source3/lib/substitute.h | 63 +++++++++++++++++++++ - source3/modules/vfs_expand_msdfs.c | 1 + - source3/modules/vfs_full_audit.c | 1 + - source3/modules/vfs_recycle.c | 1 + - source3/modules/vfs_unityed_media.c | 1 + - source3/modules/vfs_virusfilter_utils.c | 1 + - source3/nmbd/nmbd.c | 1 + - source3/nmbd/nmbd_synclists.c | 1 + - source3/param/loadparm.c | 1 + - source3/passdb/passdb.c | 1 + - source3/passdb/pdb_ldap.c | 1 + - source3/printing/print_generic.c | 1 + - source3/printing/printing.c | 1 + - source3/rpc_server/lsa/srv_lsa_nt.c | 1 + - source3/rpc_server/netlogon/srv_netlog_nt.c | 1 + - source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 1 + - source3/smbd/ipc.c | 1 + - source3/smbd/lanman.c | 1 + - source3/smbd/message.c | 1 + - source3/smbd/msdfs.c | 1 + - source3/smbd/process.c | 1 + - source3/smbd/reply.c | 1 + - source3/smbd/server.c | 1 + - source3/smbd/service.c | 1 + - source3/smbd/sesssetup.c | 1 + - source3/smbd/share_access.c | 1 + - source3/smbd/smb2_server.c | 1 + - source3/smbd/smb2_sesssetup.c | 1 + - source3/smbd/trans2.c | 1 + - source3/smbd/uid.c | 1 + - source3/torture/torture.c | 1 + - source3/utils/net_sam.c | 1 + - source3/winbindd/wb_getpwsid.c | 1 + - source3/winbindd/winbindd.c | 1 + - 39 files changed, 100 insertions(+), 33 deletions(-) - create mode 100644 source3/lib/substitute.h - -diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c -index fc7a7549e8e..ff51307e43a 100644 ---- a/source3/auth/auth_generic.c -+++ b/source3/auth/auth_generic.c -@@ -36,6 +36,7 @@ - #include "auth/credentials/credentials.h" - #include "lib/param/loadparm.h" - #include "librpc/gen_ndr/dcerpc.h" -+#include "source3/lib/substitute.h" - - static NTSTATUS auth3_generate_session_info_pac(struct auth4_context *auth_ctx, - TALLOC_CTX *mem_ctx, -diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c -index 676aa9d892c..f2deca09aa6 100644 ---- a/source3/auth/auth_ntlmssp.c -+++ b/source3/auth/auth_ntlmssp.c -@@ -25,6 +25,7 @@ - #include "auth.h" - #include "libcli/security/security.h" - #include "lib/util/tevent_ntstatus.h" -+#include "source3/lib/substitute.h" - - NTSTATUS auth3_generate_session_info(struct auth4_context *auth_context, - TALLOC_CTX *mem_ctx, -diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c -index dec854d85c3..4527dedc49d 100644 ---- a/source3/auth/auth_util.c -+++ b/source3/auth/auth_util.c -@@ -38,6 +38,7 @@ - #include "rpc_client/util_netlogon.h" - #include "source4/auth/auth.h" - #include "auth/auth_util.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_AUTH -diff --git a/source3/include/proto.h b/source3/include/proto.h -index eb45179aebb..a96c2c8d110 100644 ---- a/source3/include/proto.h -+++ b/source3/include/proto.h -@@ -139,39 +139,6 @@ int smbrun_no_sanitize(const char *cmd, int *outfd, char * const *env); - int smbrun(const char *cmd, int *outfd, char * const *env); - int smbrunsecret(const char *cmd, const char *secret); - --/* The following definitions come from lib/substitute.c */ -- --bool set_local_machine_name(const char *local_name, bool perm); --const char *get_local_machine_name(void); --bool set_remote_machine_name(const char *remote_name, bool perm); --const char *get_remote_machine_name(void); --void sub_set_smb_name(const char *name); --void set_current_user_info(const char *smb_name, const char *unix_name, -- const char *domain); --void sub_set_socket_ids(const char *peeraddr, const char *peername, -- const char *sockaddr); --const char *get_current_username(void); --void standard_sub_basic(const char *smb_name, const char *domain_name, -- char *str, size_t len); --char *talloc_sub_basic(TALLOC_CTX *mem_ctx, const char *smb_name, -- const char *domain_name, const char *str); --char *talloc_sub_specified(TALLOC_CTX *mem_ctx, -- const char *input_string, -- const char *username, -- const char *grpname, -- const char *domain, -- uid_t uid, -- gid_t gid); --char *talloc_sub_advanced(TALLOC_CTX *mem_ctx, -- const char *servicename, const char *user, -- const char *connectpath, gid_t gid, -- const char *str); --char *talloc_sub_full(TALLOC_CTX *mem_ctx, -- const char *servicename, const char *user, -- const char *connectpath, gid_t gid, -- const char *smb_name, const char *domain_name, -- const char *str); -- - /* The following definitions come from lib/sysquotas.c */ - - int sys_get_quota(const char *path, enum SMB_QUOTA_TYPE qtype, unid_t id, SMB_DISK_QUOTA *dp); -diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c -index b98a0acf1cb..a941b89f82a 100644 ---- a/source3/lib/substitute.c -+++ b/source3/lib/substitute.c -@@ -20,6 +20,7 @@ - - - #include "includes.h" -+#include "substitute.h" - #include "system/passwd.h" - #include "secrets.h" - #include "auth.h" -diff --git a/source3/lib/substitute.h b/source3/lib/substitute.h -new file mode 100644 -index 00000000000..2056d163dd7 ---- /dev/null -+++ b/source3/lib/substitute.h -@@ -0,0 +1,63 @@ -+/* -+ Unix SMB/CIFS implementation. -+ string substitution functions -+ Copyright (C) Andrew Tridgell 1992-2000 -+ Copyright (C) Gerald Carter 2006 -+ -+ This program is free software; you can redistribute it and/or modify -+ it under the terms of the GNU General Public License as published by -+ the Free Software Foundation; either version 3 of the License, or -+ (at your option) any later version. -+ -+ This program is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ GNU General Public License for more details. -+ -+ You should have received a copy of the GNU General Public License -+ along with this program. If not, see . -+*/ -+ -+#ifndef SUBSTITUTE_H -+#define SUBSTITUTE_H -+ -+bool set_local_machine_name(const char *local_name, bool perm); -+const char *get_local_machine_name(void); -+bool set_remote_machine_name(const char *remote_name, bool perm); -+const char *get_remote_machine_name(void); -+void sub_set_socket_ids(const char *peeraddr, const char *peername, -+ const char *sockaddr); -+void set_current_user_info(const char *smb_name, -+ const char *unix_name, -+ const char *domain); -+const char *get_current_username(void); -+void standard_sub_basic(const char *smb_name, -+ const char *domain_name, -+ char *str, -+ size_t len); -+char *talloc_sub_basic(TALLOC_CTX *mem_ctx, -+ const char *smb_name, -+ const char *domain_name, -+ const char *str); -+char *talloc_sub_specified(TALLOC_CTX *mem_ctx, -+ const char *input_string, -+ const char *username, -+ const char *grpname, -+ const char *domain, -+ uid_t uid, -+ gid_t gid); -+char *talloc_sub_advanced(TALLOC_CTX *ctx, -+ const char *servicename, -+ const char *user, -+ const char *connectpath, -+ gid_t gid, -+ const char *str); -+char *talloc_sub_full(TALLOC_CTX *ctx, -+ const char *servicename, -+ const char *user, -+ const char *connectpath, -+ gid_t gid, -+ const char *smb_name, -+ const char *domain_name, -+ const char *str); -+#endif -diff --git a/source3/modules/vfs_expand_msdfs.c b/source3/modules/vfs_expand_msdfs.c -index 34e7051dca5..fe3c6f47462 100644 ---- a/source3/modules/vfs_expand_msdfs.c -+++ b/source3/modules/vfs_expand_msdfs.c -@@ -25,6 +25,7 @@ - #include "auth.h" - #include "../lib/tsocket/tsocket.h" - #include "msdfs.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_VFS -diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c -index ceda99d4568..c8dbc8c07bb 100644 ---- a/source3/modules/vfs_full_audit.c -+++ b/source3/modules/vfs_full_audit.c -@@ -73,6 +73,7 @@ - #include "passdb/machine_sid.h" - #include "lib/util/tevent_ntstatus.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - static int vfs_full_audit_debug_level = DBGC_VFS; - -diff --git a/source3/modules/vfs_recycle.c b/source3/modules/vfs_recycle.c -index 1c18f232c32..7cbc938a57c 100644 ---- a/source3/modules/vfs_recycle.c -+++ b/source3/modules/vfs_recycle.c -@@ -27,6 +27,7 @@ - #include "system/filesys.h" - #include "../librpc/gen_ndr/ndr_netlogon.h" - #include "auth.h" -+#include "source3/lib/substitute.h" - - #define ALLOC_CHECK(ptr, label) do { if ((ptr) == NULL) { DEBUG(0, ("recycle.bin: out of memory!\n")); errno = ENOMEM; goto label; } } while(0) - -diff --git a/source3/modules/vfs_unityed_media.c b/source3/modules/vfs_unityed_media.c -index 62a1456b996..fbd4d968172 100644 ---- a/source3/modules/vfs_unityed_media.c -+++ b/source3/modules/vfs_unityed_media.c -@@ -62,6 +62,7 @@ - #include "../lib/tsocket/tsocket.h" - #include "lib/util/smb_strtox.h" - #include -+#include "source3/lib/substitute.h" - - #define UM_PARAM_TYPE_NAME "unityed_media" - -diff --git a/source3/modules/vfs_virusfilter_utils.c b/source3/modules/vfs_virusfilter_utils.c -index c7f8089ffc7..b8b44eb203b 100644 ---- a/source3/modules/vfs_virusfilter_utils.c -+++ b/source3/modules/vfs_virusfilter_utils.c -@@ -25,6 +25,7 @@ struct iovec; - #include "lib/util/iov_buf.h" - #include - #include "lib/tsocket/tsocket.h" -+#include "source3/lib/substitute.h" - - int virusfilter_debug_class = DBGC_VFS; - -diff --git a/source3/nmbd/nmbd.c b/source3/nmbd/nmbd.c -index 44121e9915c..7470897587e 100644 ---- a/source3/nmbd/nmbd.c -+++ b/source3/nmbd/nmbd.c -@@ -29,6 +29,7 @@ - #include "util_cluster.h" - #include "lib/gencache.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - int ClientNMB = -1; - int ClientDGRAM = -1; -diff --git a/source3/nmbd/nmbd_synclists.c b/source3/nmbd/nmbd_synclists.c -index a65cbb87e0e..d291927fbc8 100644 ---- a/source3/nmbd/nmbd_synclists.c -+++ b/source3/nmbd/nmbd_synclists.c -@@ -33,6 +33,7 @@ - #include "libsmb/clirap.h" - #include "../libcli/smb/smbXcli_base.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - struct sync_record { - struct sync_record *next, *prev; -diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c -index f54c08cc4a5..b56fd20e410 100644 ---- a/source3/param/loadparm.c -+++ b/source3/param/loadparm.c -@@ -76,6 +76,7 @@ - #include "lib/crypto/gnutls_helpers.h" - #include "lib/util/string_wrappers.h" - #include "auth/credentials/credentials.h" -+#include "source3/lib/substitute.h" - - #ifdef HAVE_SYS_SYSCTL_H - #include -diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c -index 068c5a5ea70..863f260ea90 100644 ---- a/source3/passdb/passdb.c -+++ b/source3/passdb/passdb.c -@@ -33,6 +33,7 @@ - #include "auth/credentials/credentials.h" - #include "lib/param/param.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_PASSDB -diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c -index e6d8a84c60f..93da28b1941 100644 ---- a/source3/passdb/pdb_ldap.c -+++ b/source3/passdb/pdb_ldap.c -@@ -56,6 +56,7 @@ - #include "lib/util_sid_passdb.h" - #include "lib/util/smb_strtox.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_PASSDB -diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c -index 743c311bbd5..8798a4cf34a 100644 ---- a/source3/printing/print_generic.c -+++ b/source3/printing/print_generic.c -@@ -20,6 +20,7 @@ - #include "includes.h" - #include "printing.h" - #include "smbd/proto.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/printing/printing.c b/source3/printing/printing.c -index 499334df03f..67d798fbb21 100644 ---- a/source3/printing/printing.c -+++ b/source3/printing/printing.c -@@ -40,6 +40,7 @@ - #include "lib/util/string_wrappers.h" - #include "lib/global_contexts.h" - #include "source3/printing/rap_jobid.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c -index d6d606ddeca..57f981cb358 100644 ---- a/source3/rpc_server/lsa/srv_lsa_nt.c -+++ b/source3/rpc_server/lsa/srv_lsa_nt.c -@@ -53,6 +53,7 @@ - #include "librpc/rpc/dcesrv_core.h" - #include "librpc/rpc/dcerpc_helper.h" - #include "lib/param/loadparm.h" -+#include "source3/lib/substitute.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c -index eaacd8dbc6a..2906fa3f30f 100644 ---- a/source3/rpc_server/netlogon/srv_netlog_nt.c -+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c -@@ -49,6 +49,7 @@ - #include "lib/param/param.h" - #include "libsmb/dsgetdcname.h" - #include "lib/util/util_str_escape.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c -index 8576e9d2ce2..fc27a459634 100644 ---- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c -+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c -@@ -42,6 +42,7 @@ - #include "messages.h" - #include "serverid.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - extern const struct generic_mapping file_generic_mapping; - -diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c -index f1c8ea0c2ed..cf3b7c91c22 100644 ---- a/source3/smbd/ipc.c -+++ b/source3/smbd/ipc.c -@@ -29,6 +29,7 @@ - #include "smbd/globals.h" - #include "smbprofile.h" - #include "rpc_server/srv_pipe_hnd.h" -+#include "source3/lib/substitute.h" - - #define NERR_notsupported 50 - -diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c -index 9194113e768..eb8148753b9 100644 ---- a/source3/smbd/lanman.c -+++ b/source3/smbd/lanman.c -@@ -45,6 +45,7 @@ - #include "rpc_server/rpc_ncacn_np.h" - #include "lib/util/string_wrappers.h" - #include "source3/printing/rap_jobid.h" -+#include "source3/lib/substitute.h" - - #ifdef CHECK_TYPES - #undef CHECK_TYPES -diff --git a/source3/smbd/message.c b/source3/smbd/message.c -index b9728946889..7185bec1289 100644 ---- a/source3/smbd/message.c -+++ b/source3/smbd/message.c -@@ -27,6 +27,7 @@ - #include "smbd/smbd.h" - #include "smbd/globals.h" - #include "smbprofile.h" -+#include "source3/lib/substitute.h" - - extern userdom_struct current_user_info; - -diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c -index 995ed815d90..fd002e98071 100644 ---- a/source3/smbd/msdfs.c -+++ b/source3/smbd/msdfs.c -@@ -34,6 +34,7 @@ - #include "librpc/gen_ndr/ndr_dfsblobs.h" - #include "lib/tsocket/tsocket.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - /********************************************************************** - Parse a DFS pathname of the form \hostname\service\reqpath -diff --git a/source3/smbd/process.c b/source3/smbd/process.c -index 03409742752..5015c143a04 100644 ---- a/source3/smbd/process.c -+++ b/source3/smbd/process.c -@@ -46,6 +46,7 @@ - #include "libcli/smb/smbXcli_base.h" - #include "lib/util/time_basic.h" - #include "smb1_utils.h" -+#include "source3/lib/substitute.h" - - /* Internal message queue for deferred opens. */ - struct pending_message_list { -diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c -index 042e7f2329e..f85d1122a07 100644 ---- a/source3/smbd/reply.c -+++ b/source3/smbd/reply.c -@@ -50,6 +50,7 @@ - #include "libcli/smb/smb2_posix.h" - #include "lib/util/string_wrappers.h" - #include "source3/printing/rap_jobid.h" -+#include "source3/lib/substitute.h" - - /**************************************************************************** - Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext -diff --git a/source3/smbd/server.c b/source3/smbd/server.c -index d7f5b4b73c0..d02ff1bd883 100644 ---- a/source3/smbd/server.c -+++ b/source3/smbd/server.c -@@ -60,6 +60,7 @@ - #include "rpc_server/fssd.h" - #include "rpc_server/mdssd.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - #ifdef CLUSTER_SUPPORT - #include "ctdb_protocol.h" -diff --git a/source3/smbd/service.c b/source3/smbd/service.c -index afdea38b016..ef7c14d92d0 100644 ---- a/source3/smbd/service.c -+++ b/source3/smbd/service.c -@@ -34,6 +34,7 @@ - #include "lib/afs/afs_funcs.h" - #include "lib/util_path.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - bool canonicalize_connect_path(connection_struct *conn) - { -diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c -index 2bd527ce80e..1705b8920b6 100644 ---- a/source3/smbd/sesssetup.c -+++ b/source3/smbd/sesssetup.c -@@ -34,6 +34,7 @@ - #include "auth/gensec/gensec.h" - #include "../libcli/smb/smb_signing.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - /**************************************************************************** - Add the standard 'Samba' signature to the end of the session setup. -diff --git a/source3/smbd/share_access.c b/source3/smbd/share_access.c -index debe4fc6385..c44c4bd8c69 100644 ---- a/source3/smbd/share_access.c -+++ b/source3/smbd/share_access.c -@@ -23,6 +23,7 @@ - #include "../libcli/security/security.h" - #include "passdb/lookup_sid.h" - #include "auth.h" -+#include "source3/lib/substitute.h" - - /* - * We dropped NIS support in 2021, but need to keep configs working. -diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c -index f359db0729d..f6b376e5a07 100644 ---- a/source3/smbd/smb2_server.c -+++ b/source3/smbd/smb2_server.c -@@ -33,6 +33,7 @@ - #include "lib/util/iov_buf.h" - #include "auth.h" - #include "libcli/smb/smbXcli_base.h" -+#include "source3/lib/substitute.h" - - #if defined(LINUX) - /* SIOCOUTQ TIOCOUTQ are the same */ -diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c -index 38049e8535f..14b806bc007 100644 ---- a/source3/smbd/smb2_sesssetup.c -+++ b/source3/smbd/smb2_sesssetup.c -@@ -28,6 +28,7 @@ - #include "../lib/tsocket/tsocket.h" - #include "../libcli/security/security.h" - #include "../lib/util/tevent_ntstatus.h" -+#include "source3/lib/substitute.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c -index cd6b61429c5..a86ac3228e3 100644 ---- a/source3/smbd/trans2.c -+++ b/source3/smbd/trans2.c -@@ -45,6 +45,7 @@ - #include "smb1_utils.h" - #include "libcli/smb/smb2_posix.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #define DIR_ENTRY_SAFETY_MARGIN 4096 - -diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c -index b0d7f21c200..52918c4f181 100644 ---- a/source3/smbd/uid.c -+++ b/source3/smbd/uid.c -@@ -26,6 +26,7 @@ - #include "passdb/lookup_sid.h" - #include "auth.h" - #include "../auth/auth_util.h" -+#include "source3/lib/substitute.h" - - /* what user is current? */ - extern struct current_user current_user; -diff --git a/source3/torture/torture.c b/source3/torture/torture.c -index 79a9c65073c..d3e0e3cf095 100644 ---- a/source3/torture/torture.c -+++ b/source3/torture/torture.c -@@ -51,6 +51,7 @@ - #include "lib/param/param.h" - #include "auth/gensec/gensec.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - #include - #include -diff --git a/source3/utils/net_sam.c b/source3/utils/net_sam.c -index 6a2c6c861f9..17cc47b2ddd 100644 ---- a/source3/utils/net_sam.c -+++ b/source3/utils/net_sam.c -@@ -33,6 +33,7 @@ - #include "idmap.h" - #include "lib/util/smb_strtox.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - /* - * Set a user's data -diff --git a/source3/winbindd/wb_getpwsid.c b/source3/winbindd/wb_getpwsid.c -index fb0351ec201..7f168bdda7a 100644 ---- a/source3/winbindd/wb_getpwsid.c -+++ b/source3/winbindd/wb_getpwsid.c -@@ -22,6 +22,7 @@ - #include "librpc/gen_ndr/ndr_winbind_c.h" - #include "../libcli/security/security.h" - #include "lib/util/string_wrappers.h" -+#include "source3/lib/substitute.h" - - struct wb_getpwsid_state { - struct tevent_context *ev; -diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c -index 25d8b723010..290454619a4 100644 ---- a/source3/winbindd/winbindd.c -+++ b/source3/winbindd/winbindd.c -@@ -51,6 +51,7 @@ - #include "lib/gencache.h" - #include "rpc_server/rpc_config.h" - #include "lib/global_contexts.h" -+#include "source3/lib/substitute.h" - - #undef DBGC_CLASS - #define DBGC_CLASS DBGC_WINBIND --- -2.33.1 - - -From 1184733a1628c1187a215956195ca806419db16d Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Thu, 11 Nov 2021 05:23:09 +0100 -Subject: [PATCH 2/8] samba-bgqd: fix startup and logging - -Let samba-bgqd use the new POPT_COMMON_DAEMON infrastructure. - -The calls to setup_logging() can safely be removed as this is already taken care -of by samba_cmdline_init(). - -To avoid a logfile basename of ".log" when using "%m", we add a call to -set_remote_machine_name(). - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - source3/printing/samba-bgqd.c | 35 ++++++++++------------------------- - 1 file changed, 10 insertions(+), 25 deletions(-) - -diff --git a/source3/printing/samba-bgqd.c b/source3/printing/samba-bgqd.c -index 8ac6ec525b2..2cd6a8e007a 100644 ---- a/source3/printing/samba-bgqd.c -+++ b/source3/printing/samba-bgqd.c -@@ -40,6 +40,7 @@ - #include "source3/lib/util_procid.h" - #include "source3/auth/proto.h" - #include "source3/printing/queue_process.h" -+#include "source3/lib/substitute.h" - - static void watch_handler(struct tevent_req *req) - { -@@ -235,6 +236,7 @@ static int closeall_except_fd_params( - - int main(int argc, const char *argv[]) - { -+ struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = NULL; - const struct loadparm_substitution *lp_sub = - loadparm_s3_global_substitution(); - const char *progname = getprogname(); -@@ -245,8 +247,6 @@ int main(int argc, const char *argv[]) - struct tevent_req *watch_req = NULL; - struct tevent_signal *sigterm_handler = NULL; - struct bq_state *bq = NULL; -- int foreground = 0; -- int no_process_group = 0; - int log_stdout = 0; - int ready_signal_fd = -1; - int watch_fd = -1; -@@ -259,21 +259,7 @@ int main(int argc, const char *argv[]) - struct poptOption long_options[] = { - POPT_AUTOHELP - POPT_COMMON_SAMBA -- { -- .longName = "foreground", -- .shortName = 'F', -- .argInfo = POPT_ARG_NONE, -- .arg = &foreground, -- .descrip = "Run daemon in foreground " -- "(for daemontools, etc.)", -- }, -- { -- .longName = "no-process-group", -- .shortName = '\0', -- .argInfo = POPT_ARG_NONE, -- .arg = &no_process_group, -- .descrip = "Don't create a new process group" , -- }, -+ POPT_COMMON_DAEMON - - /* - * File descriptor to write the PID of the helper -@@ -311,6 +297,7 @@ int main(int argc, const char *argv[]) - frame = talloc_stackframe(); - - umask(0); -+ set_remote_machine_name("smbd-bgqd", true); - - ok = samba_cmdline_init(frame, - SAMBA_CMDLINE_CONFIG_SERVER, -@@ -320,6 +307,8 @@ int main(int argc, const char *argv[]) - exit(ENOMEM); - } - -+ cmdline_daemon_cfg = samba_cmdline_get_daemon_cfg(); -+ - pc = samba_popt_get_context(progname, - argc, - argv, -@@ -340,16 +329,12 @@ int main(int argc, const char *argv[]) - - log_stdout = (debug_get_log_type() == DEBUG_STDOUT); - -- if (foreground) { -+ if (!cmdline_daemon_cfg->fork) { - daemon_status(progname, "Starting process ... "); - } else { -- become_daemon(true, no_process_group, log_stdout); -- } -- -- if (log_stdout) { -- setup_logging(progname, DEBUG_STDOUT); -- } else { -- setup_logging(progname, DEBUG_FILE); -+ become_daemon(true, -+ cmdline_daemon_cfg->no_process_group, -+ log_stdout); - } - - BlockSignals(true, SIGPIPE); --- -2.33.1 - - -From 1a0a1ccbe888332ea134b16bfac0d0d011bf1f4c Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Wed, 10 Nov 2021 18:27:08 +0100 -Subject: [PATCH 3/8] winbindd: remove is_default_dyn_LOGFILEBASE() logic - -Handling of -l commandline parameter is already implemented by lib/cmdline/. - -is_default_dyn_LOGFILEBASE() == true is the default case and this causes us to -temporarily overwrite the configured logfile with LOGFILEBASE/log.winbindd until -winbindd_reload_services_file() restores it. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - source3/winbindd/winbindd.c | 9 --------- - 1 file changed, 9 deletions(-) - -diff --git a/source3/winbindd/winbindd.c b/source3/winbindd/winbindd.c -index 290454619a4..58c5ffbced4 100644 ---- a/source3/winbindd/winbindd.c -+++ b/source3/winbindd/winbindd.c -@@ -1717,15 +1717,6 @@ int main(int argc, const char **argv) - - poptFreeContext(pc); - -- if (is_default_dyn_LOGFILEBASE()) { -- char *lfile = NULL; -- if (asprintf(&lfile,"%s/log.winbindd", -- get_dyn_LOGFILEBASE()) > 0) { -- lp_set_logfile(lfile); -- SAFE_FREE(lfile); -- } -- } -- - reopen_logs(); - - DEBUG(0,("winbindd version %s started.\n", samba_version_string())); --- -2.33.1 - - -From bcbf9fb6669933cc3dcf1f615d2885c542a08035 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Wed, 10 Nov 2021 14:13:11 +0100 -Subject: [PATCH 4/8] lib/debug: fix fd check before dup'ing to stderr - -Before I added per-class logfile and we had only one fd for the logfile the code -looked like this: - - /* Take over stderr to catch output into logs */ - if (state.fd > 0) { - if (dup2(state.fd, 2) == -1) { - /* Close stderr too, if dup2 can't point it - - at the logfile. There really isn't much - that can be done on such a fundamental - failure... */ - close_low_fd(2); - } - } - -In the current code the equivalent to state.fd is dbgc_config[DBGC_ALL].fd. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/util/debug.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/lib/util/debug.c b/lib/util/debug.c -index 4fd17679227..b271608621a 100644 ---- a/lib/util/debug.c -+++ b/lib/util/debug.c -@@ -1125,7 +1125,6 @@ bool reopen_logs_internal(void) - { - struct debug_backend *b = NULL; - mode_t oldumask; -- int new_fd = 0; - size_t i; - bool ok; - -@@ -1190,7 +1189,7 @@ bool reopen_logs_internal(void) - * If log file was opened or created successfully, take over stderr to - * catch output into logs. - */ -- if (new_fd != -1) { -+ if (dbgc_config[DBGC_ALL].fd > 0) { - if (dup2(dbgc_config[DBGC_ALL].fd, 2) == -1) { - /* Close stderr too, if dup2 can't point it - - at the logfile. There really isn't much --- -2.33.1 - - -From 9f76bd48d87eb03c66dfe942b4a84e997a8fe8ba Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 19:41:50 +0100 -Subject: [PATCH 5/8] lib/debug: in debug_set_logfile() call - reopen_logs_internal() - -This simplifies the logging API for callers that typically would want to set -logging by just setup_logging() once without bothering that typically -configuration is loaded (via some lpcfg_load*() or lp_load*() varient) which -will only then pick up the configured logfile from smb.conf without actually -applying the new logifle to the logging subsytem. - -Therefor our daemons will additionally call reopen_logs() explicitly in their -startup code after config is loaded, eg - - setup_logging(getprogname(), DEBUG_FILE); - ... - lpcfg_load(lp_ctx, config_file); - ... - reopen_logs(); - -By calling reopen_logs_internal() implicitly from debug_set_logfile() there's no -need to call reopen_logs() explicitly anymore to apply the logfile. - -As reopen_logs() will also apply other logging configuration options, we have to -keep the explicit calls in the daemon code. But at least this allows consistent -logging setup wrt to the logfile in the new cmdline library. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/util/debug.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/lib/util/debug.c b/lib/util/debug.c -index b271608621a..171b5e15008 100644 ---- a/lib/util/debug.c -+++ b/lib/util/debug.c -@@ -1018,6 +1018,8 @@ void debug_set_logfile(const char *name) - } - TALLOC_FREE(dbgc_config[DBGC_ALL].logfile); - dbgc_config[DBGC_ALL].logfile = talloc_strdup(NULL, name); -+ -+ reopen_logs_internal(); - } - - static void debug_close_fd(int fd) --- -2.33.1 - - -From b80911bc1a306cac479ee3feabdcea124946cdde Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 12:08:47 +0100 -Subject: [PATCH 6/8] lib/cmdline: fix indentation - -s/whitespace/tab/ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/cmdline/cmdline_s3.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/cmdline/cmdline_s3.c b/lib/cmdline/cmdline_s3.c -index 1f8d9ed5eb5..639d403aed3 100644 ---- a/lib/cmdline/cmdline_s3.c -+++ b/lib/cmdline/cmdline_s3.c -@@ -55,7 +55,7 @@ static bool _samba_cmdline_load_config_s3(void) - case SAMBA_CMDLINE_CONFIG_CLIENT: - ok = lp_load_client(config_file); - break; -- case SAMBA_CMDLINE_CONFIG_SERVER: -+ case SAMBA_CMDLINE_CONFIG_SERVER: - { - const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = - samba_cmdline_get_daemon_cfg(); --- -2.33.1 - - -From a6b6b0b6e6dfcd2c8e2c2085d20cd16c51e3b379 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 12:09:16 +0100 -Subject: [PATCH 7/8] lib/cmdline: remember config_type in samba_cmdline_init() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 - -Signed-off-by: Ralph Boehme ---- - lib/cmdline/cmdline_s4.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c -index 61c1b96ba8d..6ef6f59db49 100644 ---- a/lib/cmdline/cmdline_s4.c -+++ b/lib/cmdline/cmdline_s4.c -@@ -25,6 +25,7 @@ - #include "cmdline_private.h" - - static bool _require_smbconf; -+static enum samba_cmdline_config_type _config_type; - - static bool _samba_cmdline_load_config_s4(void) - { -@@ -81,6 +82,7 @@ bool samba_cmdline_init(TALLOC_CTX *mem_ctx, - return false; - } - _require_smbconf = require_smbconf; -+ _config_type = config_type; - - creds = cli_credentials_init(mem_ctx); - if (creds == NULL) { --- -2.33.1 - - -From e1d6ab1b0dbd8ff30019edf804c4766b066db4b7 Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Mon, 8 Nov 2021 12:09:43 +0100 -Subject: [PATCH 8/8] lib/cmdline: setup default file logging for servers - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14897 -RN: samba process doesn't log to logfile - -Signed-off-by: Ralph Boehme ---- - lib/cmdline/cmdline_s4.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/lib/cmdline/cmdline_s4.c b/lib/cmdline/cmdline_s4.c -index 6ef6f59db49..29e9f34bbe2 100644 ---- a/lib/cmdline/cmdline_s4.c -+++ b/lib/cmdline/cmdline_s4.c -@@ -44,6 +44,20 @@ static bool _samba_cmdline_load_config_s4(void) - } - } - -+ switch (_config_type) { -+ case SAMBA_CMDLINE_CONFIG_SERVER: { -+ const struct samba_cmdline_daemon_cfg *cmdline_daemon_cfg = -+ samba_cmdline_get_daemon_cfg(); -+ -+ if (!cmdline_daemon_cfg->interactive) { -+ setup_logging(getprogname(), DEBUG_FILE); -+ } -+ break; -+ } -+ default: -+ break; -+ } -+ - config_file = get_dyn_CONFIGFILE(); - ok = lpcfg_load(lp_ctx, config_file); - if (!ok) { --- -2.33.1 - diff --git a/samba-4.15.1-winexe.patch b/samba-4.15.1-winexe.patch deleted file mode 100644 index 38460b3..0000000 --- a/samba-4.15.1-winexe.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 3d02bf10d7738fe604b524863764de3ca1faa081 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?G=C3=BCnther=20Deschner?= -Date: Thu, 4 Nov 2021 22:22:44 +0100 -Subject: [PATCH] s3-winexe: Fix winexe core dump (use-after-free) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14893 - -Guenther - -Signed-off-by: Guenther Deschner -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Günther Deschner -Autobuild-Date(master): Fri Nov 5 11:43:57 UTC 2021 on sn-devel-184 - -(cherry picked from commit e9495d2ed28a26899dc3dd77bdfe56e284980218) ---- - examples/winexe/winexe.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c -index 3e0813a4091..59fb9dbdebb 100644 ---- a/examples/winexe/winexe.c -+++ b/examples/winexe/winexe.c -@@ -220,8 +220,6 @@ static void parse_args(int argc, const char *argv[], - *port_str = '\0'; - } - -- poptFreeContext(pc); -- - if (options->runas == NULL && options->runas_file != NULL) { - struct cli_credentials *runas_cred; - const char *user; -@@ -253,9 +251,19 @@ static void parse_args(int argc, const char *argv[], - - options->credentials = samba_cmdline_get_creds(); - -- options->hostname = argv_new[0] + 2; -+ options->hostname = talloc_strdup(mem_ctx, argv_new[0] + 2); -+ if (options->hostname == NULL) { -+ DBG_ERR("Out of memory\n"); -+ exit(1); -+ } - options->port = port; -- options->cmd = argv_new[1]; -+ options->cmd = talloc_strdup(mem_ctx, argv_new[1]); -+ if (options->cmd == NULL) { -+ DBG_ERR("Out of memory\n"); -+ exit(1); -+ } -+ -+ poptFreeContext(pc); - - options->flags = flag_interactive; - if (flag_reinstall) { --- -2.33.1 - diff --git a/samba-4.15.2-smbclient_anonymous.patch b/samba-4.15.2-smbclient_anonymous.patch deleted file mode 100644 index 477ddef..0000000 --- a/samba-4.15.2-smbclient_anonymous.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 61fd63d70578043de9f3bff1c3267c499dbf50a0 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 10 Nov 2021 12:06:51 +0100 -Subject: [PATCH] auth:creds: Guess the username first via getpwuid(my_id) - -If we have a container, we often don't have USER or LOGNAME set. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14883 - -Tested-by: Anoop C S -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit c28be4067463e582e378df402f812e510883d606) ---- - auth/credentials/credentials.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c -index 02a3cf3b354..c5a6ba6940c 100644 ---- a/auth/credentials/credentials.c -+++ b/auth/credentials/credentials.c -@@ -30,6 +30,7 @@ - #include "tevent.h" - #include "param/param.h" - #include "system/filesys.h" -+#include "system/passwd.h" - - /** - * Create a new credentials structure -@@ -1159,6 +1160,7 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, - { - const char *error_string; - const char *env = NULL; -+ struct passwd *pwd = NULL; - bool ok; - - if (lp_ctx != NULL) { -@@ -1168,6 +1170,17 @@ _PUBLIC_ bool cli_credentials_guess(struct cli_credentials *cred, - } - } - -+ pwd = getpwuid(getuid()); -+ if (pwd != NULL) { -+ size_t len = strlen(pwd->pw_name); -+ -+ if (len > 0 && len <= 1024) { -+ (void)cli_credentials_parse_string(cred, -+ pwd->pw_name, -+ CRED_GUESS_ENV); -+ } -+ } -+ - env = getenv("LOGNAME"); - if (env != NULL) { - size_t len = strlen(env); --- -2.33.1 - diff --git a/samba.spec b/samba.spec index a1b91fe..9f40278 100644 --- a/samba.spec +++ b/samba.spec @@ -132,9 +132,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 0 -%global samba_version 4.15.2 +%global samba_version 4.15.3 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -203,11 +203,6 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch -Patch2: samba-4.15.1-winexe.patch -Patch3: samba-4.15-fix-winbind-no-trusted-domain.patch -Patch4: samba-4.15-logfile.patch -Patch5: samba-4.15.2-smbclient_anonymous.patch -Patch6: samba-4.15-ipa-dc-schannel.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -2934,6 +2929,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/test_idmap_nss.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc @@ -2957,6 +2953,7 @@ fi %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/spn_tests.py %{python3_sitearch}/samba/tests/krb5/test_ccache.py +%{python3_sitearch}/samba/tests/krb5/test_idmap_nss.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py %{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py @@ -4102,6 +4099,10 @@ fi %endif %changelog +* Wed Dec 08 2021 Pavel Filipenský - 4.15.3-0 +- Update to Samba 4.15.3 +- resolves: #2030382 + * Sat Nov 13 2021 Guenther Deschner - 4.15.2-3 - Fix IPA DC schannel support diff --git a/sources b/sources index 0516493..4f508a2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.2.tar.xz) = d9aaabbf45ba0293dbda137a21f04d5fa533be07c3826de816513d8e2ae0ef6e6109ce4045dd74bcd5375364f6de5fa8ace6ae4b3c419bfffe55fa2bfeeb0d5d -SHA512 (samba-4.15.2.tar.asc) = 732cc215c047988d4bce3d2ea981474f0cca44dd5a22030f49343aa3a37f6003bb84b116f7cdb0c8c4fd492354c107350f78101d7186fcb6027906ab1c92cf31 +SHA512 (samba-4.15.3.tar.xz) = c8bf3dd25a79e90bb01a8f74e1961ab5892a62a7a4556a42880911aeb4120b7645b91a20438f98652c1f870b7c699038b745565bcf5f4dba634ce400b5fbe167 +SHA512 (samba-4.15.3.tar.asc) = 9af712fdfd01e701b6a2f7e903c1d750b4697282b00b2b150d4e3014e70a09733910291b7e44abeefd0ce7ad393d500c338145a2a00638d9191777a90be8636c From 3314e8e15a3555de291c03e1f6d996ad6b732d30 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 9 Dec 2021 19:11:22 +0100 Subject: [PATCH 031/295] Add missing Requires --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 9f40278..186d651 100644 --- a/samba.spec +++ b/samba.spec @@ -606,6 +606,7 @@ Samba VFS module for Ceph distributed storage system integration. Summary: Samba VFS module for io_uring Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-client-libs = %{samba_depver} Provides: bundled(libreplace) @@ -942,6 +943,7 @@ necessary to communicate to the Winbind Daemon Summary: Samba Winexe Windows Binary License: GPLv3 Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-common-libs = %{samba_depver} Provides: bundled(libreplace) From 8a81633e9ac9c806a0c8072daad5fd4ff2644b81 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 15 Dec 2021 12:33:50 +0100 Subject: [PATCH 032/295] Fix resolv_wrapper with glibc 2.34 resolves: #2019669 pfilipen --- samba-glibc-dns.patch | 64 +++++++++++++++++++++++++++++++++++++++++++ samba.spec | 7 ++++- 2 files changed, 70 insertions(+), 1 deletion(-) create mode 100644 samba-glibc-dns.patch diff --git a/samba-glibc-dns.patch b/samba-glibc-dns.patch new file mode 100644 index 0000000..c01d481 --- /dev/null +++ b/samba-glibc-dns.patch @@ -0,0 +1,64 @@ +From e556b4067e0c4036e20fc26523e3b4d6d5c6be42 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Thu, 7 Oct 2021 15:55:37 +0200 +Subject: [PATCH] waf: Fix resolv_wrapper with glibc 2.34 + +With glibc 2.34 we are not able to talk to the DNS server via socket_wrapper +anymore. The res_* symbols have been moved from libresolv to libc. We are not +able to intercept any traffic inside of libc. + +Signed-off-by: Andreas Schneider +Reviewed-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +--- + selftest/wscript | 2 +- + third_party/resolv_wrapper/wscript | 13 +++++++++++++ + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/selftest/wscript b/selftest/wscript +index a6be06c2ae9..85d9338489a 100644 +--- a/selftest/wscript ++++ b/selftest/wscript +@@ -252,7 +252,7 @@ def cmd_testonly(opt): + if os.environ.get('USE_NAMESPACES') is None: + env.OPTIONS += " --socket_wrapper_so_path=" + CONFIG_GET(opt, 'LIBSOCKET_WRAPPER_SO_PATH') + +- if Utils.unversioned_sys_platform() in ('netbsd', 'openbsd', 'sunos'): ++ if not CONFIG_SET(opt, 'HAVE_RESOLV_CONF_SUPPORT'): + env.OPTIONS += " --use-dns-faking" + + if CONFIG_GET(opt, 'USING_SYSTEM_KRB5') and CONFIG_GET(opt, 'MIT_KDC_PATH'): +diff --git a/third_party/resolv_wrapper/wscript b/third_party/resolv_wrapper/wscript +index a7f18389b0f..7e369bd90b5 100644 +--- a/third_party/resolv_wrapper/wscript ++++ b/third_party/resolv_wrapper/wscript +@@ -1,6 +1,7 @@ + #!/usr/bin/env python + + import os ++from waflib import Logs + + VERSION="1.1.7" + +@@ -49,6 +50,18 @@ def configure(conf): + if conf.CONFIG_SET('HAVE_RES_NCLOSE'): + conf.DEFINE('HAVE_RES_NCLOSE_IN_LIBRESOLV', 1) + ++ # If we find res_nquery in libc, we can't do resolv.conf redirect ++ conf.CHECK_FUNCS('res_nquery __res_nquery') ++ if (conf.CONFIG_SET('HAVE_RES_NQUERY') ++ or conf.CONFIG_SET('HAVE___RES_NQUERY')): ++ Logs.warn("Detection for resolv_wrapper: " ++ "Only dns faking will be available") ++ else: ++ if conf.CHECK_FUNCS('res_nquery', lib='resolv'): ++ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) ++ if conf.CHECK_FUNCS('__res_nquery', lib='resolv'): ++ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) ++ + conf.CHECK_FUNCS_IN('res_init __res_init', 'resolv', checklibc=True) + conf.CHECK_FUNCS_IN('res_ninit __res_ninit', 'resolv', checklibc=True) + conf.CHECK_FUNCS_IN('res_close __res_close', 'resolv', checklibc=True) +-- +2.33.1 + diff --git a/samba.spec b/samba.spec index 186d651..21de1ec 100644 --- a/samba.spec +++ b/samba.spec @@ -132,7 +132,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.15.3 %global talloc_version 2.3.3 @@ -203,6 +203,7 @@ Source201: README.downgrade Patch0: samba-s4u.patch Patch1: samba-ctdb-etcd-reclock.patch +Patch2: samba-glibc-dns.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -4101,6 +4102,10 @@ fi %endif %changelog +* Wed Dec 15 2021 Pavel Filipenský - 4.15.3-1 +- Fix resolv_wrapper with glibc 2.34 +- resolves: #2019669 + * Wed Dec 08 2021 Pavel Filipenský - 4.15.3-0 - Update to Samba 4.15.3 - resolves: #2030382 From 13dfbb0767d59816324735397c03f66bc5bbd4ae Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Jan 2022 15:08:40 +0100 Subject: [PATCH 033/295] Require python3-pyasn1 >= 0.4.8 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 21de1ec..ed14fa2 100644 --- a/samba.spec +++ b/samba.spec @@ -325,7 +325,7 @@ BuildRequires: python3-etcd # Add python3-iso8601 to avoid that the # version in Samba is being packaged BuildRequires: python3-iso8601 -BuildRequires: python3-pyasn1 +BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} From 6da37eb4caf55a03cb6fc1b3c2f01167a99c71ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 19 Jan 2022 20:49:26 +0100 Subject: [PATCH 034/295] Update to Samba 4.15.4 resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 resolves: #2042518 pfilipen --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 23cef85..2fc9487 100644 --- a/.gitignore +++ b/.gitignore @@ -275,3 +275,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.2.tar.asc /samba-4.15.3.tar.xz /samba-4.15.3.tar.asc +/samba-4.15.4.tar.xz +/samba-4.15.4.tar.asc diff --git a/samba.spec b/samba.spec index ed14fa2..b7a0cc7 100644 --- a/samba.spec +++ b/samba.spec @@ -132,9 +132,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 0 -%global samba_version 4.15.3 +%global samba_version 4.15.4 %global talloc_version 2.3.3 %global tdb_version 1.4.4 %global tevent_version 0.11.0 @@ -4102,6 +4102,11 @@ fi %endif %changelog +* Thu Jan 20 2022 Pavel Filipenský - 4.15.4-0 +- Update to Samba 4.15.4 +- resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 +- resolves: #2042518 + * Wed Dec 15 2021 Pavel Filipenský - 4.15.3-1 - Fix resolv_wrapper with glibc 2.34 - resolves: #2019669 diff --git a/sources b/sources index 4f508a2..343898f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.3.tar.xz) = c8bf3dd25a79e90bb01a8f74e1961ab5892a62a7a4556a42880911aeb4120b7645b91a20438f98652c1f870b7c699038b745565bcf5f4dba634ce400b5fbe167 -SHA512 (samba-4.15.3.tar.asc) = 9af712fdfd01e701b6a2f7e903c1d750b4697282b00b2b150d4e3014e70a09733910291b7e44abeefd0ce7ad393d500c338145a2a00638d9191777a90be8636c +SHA512 (samba-4.15.4.tar.xz) = 19aa7edc55d545c42ba9c2d2bb987df63a825c5a1a6fa2a350d6bca41f04fde6f63b643f6e38d32f4d4067c24420e1ca62ef28dc285c70105ca78487e80ee2dc +SHA512 (samba-4.15.4.tar.asc) = 6878efc500f423e7061966954163ef3503e4ab43a527b370a3e26e6992bc9b6a3161e296800b6cd78d5e0d99ac7f1db249d52c2475d035973e2121bc67df6fab From c1f9bec1db866b6ca644f1fe143868e126703b8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 21 Jan 2022 11:46:51 +0100 Subject: [PATCH 035/295] Switch off ld.gold --- samba.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index b7a0cc7..2851bcc 100644 --- a/samba.spec +++ b/samba.spec @@ -1106,7 +1106,8 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" # Use the gold linker -export LDFLAGS="%{__global_ldflags} -fuse-ld=gold" +# See https://bugzilla.redhat.com/show_bug.cgi?id=2043178 ; For f36 do not use ld.gold till it is fixed +#export LDFLAGS="%%{__global_ldflags} -fuse-ld=gold" %configure \ --enable-fhs \ From c8ac21e6f141f89c7aa2977048351c10c64efa47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 25 Jan 2022 11:55:29 +0100 Subject: [PATCH 036/295] Update to Samba 4.16.0rc1 --- .gitignore | 2 + samba-ctdb-etcd-reclock.patch | 30 ------- samba-glibc-dns.patch | 64 --------------- samba-s4u.patch | 145 ++++++++++++++-------------------- samba.spec | 66 +++++++++++----- sources | 4 +- 6 files changed, 111 insertions(+), 200 deletions(-) delete mode 100644 samba-ctdb-etcd-reclock.patch delete mode 100644 samba-glibc-dns.patch diff --git a/.gitignore b/.gitignore index 2fc9487..a5d7ee7 100644 --- a/.gitignore +++ b/.gitignore @@ -277,3 +277,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.3.tar.asc /samba-4.15.4.tar.xz /samba-4.15.4.tar.asc +/samba-4.16.0rc1.tar.xz +/samba-4.16.0rc1.tar.asc diff --git a/samba-ctdb-etcd-reclock.patch b/samba-ctdb-etcd-reclock.patch deleted file mode 100644 index 2a55408..0000000 --- a/samba-ctdb-etcd-reclock.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 939aed0498269df3c1e012f3b68c314b583f25bd Mon Sep 17 00:00:00 2001 -From: Martin Schwenke -Date: Tue, 27 Apr 2021 15:46:14 +1000 -Subject: [PATCH] utils: Use Python 3 - -Due to the number of flake8 and pylint warnings it is unclear if the -source has Python 3 incompatibilities. These will be cleaned up in -subsequent commits. - -Signed-off-by: "L.P.H. van Belle" -Reviewed-by: Martin Schwenke -Reviewed-by: David Disseldorp -Reviewed-by: Jose A. Rivera ---- - ctdb/utils/etcd/ctdb_etcd_lock | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/ctdb/utils/etcd/ctdb_etcd_lock b/ctdb/utils/etcd/ctdb_etcd_lock -index 000c6bb7208..7f5194eff0a 100755 ---- a/ctdb/utils/etcd/ctdb_etcd_lock -+++ b/ctdb/utils/etcd/ctdb_etcd_lock -@@ -1,4 +1,4 @@ --#!/usr/bin/python -+#!/usr/bin/env python3 - # - # This program is free software: you can redistribute it and/or modify - # it under the terms of the GNU General Public License as published by --- -2.31.1 - diff --git a/samba-glibc-dns.patch b/samba-glibc-dns.patch deleted file mode 100644 index c01d481..0000000 --- a/samba-glibc-dns.patch +++ /dev/null @@ -1,64 +0,0 @@ -From e556b4067e0c4036e20fc26523e3b4d6d5c6be42 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Thu, 7 Oct 2021 15:55:37 +0200 -Subject: [PATCH] waf: Fix resolv_wrapper with glibc 2.34 - -With glibc 2.34 we are not able to talk to the DNS server via socket_wrapper -anymore. The res_* symbols have been moved from libresolv to libc. We are not -able to intercept any traffic inside of libc. - -Signed-off-by: Andreas Schneider -Reviewed-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy ---- - selftest/wscript | 2 +- - third_party/resolv_wrapper/wscript | 13 +++++++++++++ - 2 files changed, 14 insertions(+), 1 deletion(-) - -diff --git a/selftest/wscript b/selftest/wscript -index a6be06c2ae9..85d9338489a 100644 ---- a/selftest/wscript -+++ b/selftest/wscript -@@ -252,7 +252,7 @@ def cmd_testonly(opt): - if os.environ.get('USE_NAMESPACES') is None: - env.OPTIONS += " --socket_wrapper_so_path=" + CONFIG_GET(opt, 'LIBSOCKET_WRAPPER_SO_PATH') - -- if Utils.unversioned_sys_platform() in ('netbsd', 'openbsd', 'sunos'): -+ if not CONFIG_SET(opt, 'HAVE_RESOLV_CONF_SUPPORT'): - env.OPTIONS += " --use-dns-faking" - - if CONFIG_GET(opt, 'USING_SYSTEM_KRB5') and CONFIG_GET(opt, 'MIT_KDC_PATH'): -diff --git a/third_party/resolv_wrapper/wscript b/third_party/resolv_wrapper/wscript -index a7f18389b0f..7e369bd90b5 100644 ---- a/third_party/resolv_wrapper/wscript -+++ b/third_party/resolv_wrapper/wscript -@@ -1,6 +1,7 @@ - #!/usr/bin/env python - - import os -+from waflib import Logs - - VERSION="1.1.7" - -@@ -49,6 +50,18 @@ def configure(conf): - if conf.CONFIG_SET('HAVE_RES_NCLOSE'): - conf.DEFINE('HAVE_RES_NCLOSE_IN_LIBRESOLV', 1) - -+ # If we find res_nquery in libc, we can't do resolv.conf redirect -+ conf.CHECK_FUNCS('res_nquery __res_nquery') -+ if (conf.CONFIG_SET('HAVE_RES_NQUERY') -+ or conf.CONFIG_SET('HAVE___RES_NQUERY')): -+ Logs.warn("Detection for resolv_wrapper: " -+ "Only dns faking will be available") -+ else: -+ if conf.CHECK_FUNCS('res_nquery', lib='resolv'): -+ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) -+ if conf.CHECK_FUNCS('__res_nquery', lib='resolv'): -+ conf.DEFINE('HAVE_RESOLV_CONF_SUPPORT', 1) -+ - conf.CHECK_FUNCS_IN('res_init __res_init', 'resolv', checklibc=True) - conf.CHECK_FUNCS_IN('res_ninit __res_ninit', 'resolv', checklibc=True) - conf.CHECK_FUNCS_IN('res_close __res_close', 'resolv', checklibc=True) --- -2.33.1 - diff --git a/samba-s4u.patch b/samba-s4u.patch index 8e84d96..f447b86 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,7 +1,7 @@ -From 0b196043f08ea4c025f19c4519175a3a73e1d185 Mon Sep 17 00:00:00 2001 +From 17eb98d3f8ebd0fe48e218bb03a3c0165b9b6e95 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 -Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support +Subject: [PATCH 1/4] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -12,10 +12,10 @@ Pair-Programmed-With: Andreas Schneider 3 files changed, 71 insertions(+), 106 deletions(-) diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index f35210669c2..b1c7c5dcc5e 100644 +index 793fe366c35..22534c09974 100644 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -200,13 +200,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, krb5_keyblock *krbtgt_key, krb5_timestamp authtime, krb5_authdata **tgt_auth_data, @@ -36,7 +36,7 @@ index f35210669c2..b1c7c5dcc5e 100644 mit_ctx = ks_get_context(context); if (mit_ctx == NULL) { -@@ -233,41 +237,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -238,41 +242,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = krb5_pac_parse(context, authdata[0]->contents, authdata[0]->length, @@ -106,7 +106,7 @@ index f35210669c2..b1c7c5dcc5e 100644 if (code != 0) { goto done; } -@@ -275,17 +281,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, +@@ -280,17 +286,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, code = mit_samba_reget_pac(mit_ctx, context, flags, @@ -133,7 +133,7 @@ index f35210669c2..b1c7c5dcc5e 100644 return code; } -@@ -314,6 +325,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -319,6 +330,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, krb5_authdata **pac_auth_data = NULL; krb5_authdata **authdata = NULL; krb5_boolean is_as_req; @@ -141,7 +141,7 @@ index f35210669c2..b1c7c5dcc5e 100644 krb5_error_code code; krb5_pac pac = NULL; krb5_data pac_data; -@@ -325,11 +337,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -330,11 +342,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; @@ -153,7 +153,7 @@ index f35210669c2..b1c7c5dcc5e 100644 is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); /* -@@ -390,6 +397,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -395,6 +402,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, ks_client_princ = client->princ; } @@ -170,7 +170,7 @@ index f35210669c2..b1c7c5dcc5e 100644 if (client_entry == NULL) { client_entry = client; } -@@ -454,7 +471,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -469,7 +486,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, code = ks_verify_pac(context, flags, @@ -179,7 +179,7 @@ index f35210669c2..b1c7c5dcc5e 100644 client_entry, server, krbtgt, -@@ -494,7 +511,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -515,7 +532,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, is_as_req ? "AS-REQ" : "TGS-REQ", client_name); code = krb5_pac_sign(context, pac, authtime, ks_client_princ, @@ -188,7 +188,7 @@ index f35210669c2..b1c7c5dcc5e 100644 if (code != 0) { DBG_ERR("krb5_pac_sign failed: %d\n", code); goto done; -@@ -520,12 +537,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, +@@ -541,12 +558,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, KRB5_AUTHDATA_IF_RELEVANT, authdata, signed_auth_data); @@ -201,7 +201,7 @@ index f35210669c2..b1c7c5dcc5e 100644 done: if (client_entry != NULL && client_entry != client) { ks_free_principal(context, client_entry); -@@ -551,32 +562,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, +@@ -572,32 +583,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, * server; -> delegating service * proxy; -> target principal */ @@ -236,10 +236,10 @@ index f35210669c2..b1c7c5dcc5e 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 4239332f0d9..acc3cba6254 100644 +index 27b15828468..994dfed312b 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -501,7 +501,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -517,7 +517,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -247,7 +247,7 @@ index 4239332f0d9..acc3cba6254 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -665,7 +664,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -682,7 +681,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -256,7 +256,7 @@ index 4239332f0d9..acc3cba6254 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -987,41 +986,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -1004,41 +1003,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -309,10 +309,10 @@ index 4239332f0d9..acc3cba6254 100644 static krb5_error_code mit_samba_change_pwd_error(krb5_context context, diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h -index 636c77ec97c..9cb00c9610e 100644 +index 4431e82a1b2..9370ab533af 100644 --- a/source4/kdc/mit_samba.h +++ b/source4/kdc/mit_samba.h -@@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, +@@ -57,7 +57,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, krb5_context context, int flags, @@ -320,7 +320,7 @@ index 636c77ec97c..9cb00c9610e 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -73,9 +72,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -74,9 +73,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, DATA_BLOB *e_data); int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -336,10 +336,10 @@ index 636c77ec97c..9cb00c9610e 100644 2.33.1 -From 992d38fa35c01f2f0bdb39d387fa29e8eb8d3d37 Mon Sep 17 00:00:00 2001 +From f4fc23103f47b712baf3b4b0ebcb42d0f3f3fd42 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 -Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build +Subject: [PATCH 2/4] krb5-mit: enable S4U client support for MIT build Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -350,10 +350,10 @@ Pair-Programmed-With: Andreas Schneider 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index fff5b4e2a22..791b417d5ba 100644 +index 61d651b4d5f..462acec90b6 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c -@@ -2694,6 +2694,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, +@@ -2699,6 +2699,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, return 0; } @@ -546,7 +546,7 @@ index fff5b4e2a22..791b417d5ba 100644 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index eab67f6d969..b5385c69a33 100644 +index a66b7465530..c8573f52bd9 100644 --- a/lib/krb5_wrap/krb5_samba.h +++ b/lib/krb5_wrap/krb5_samba.h @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, @@ -614,63 +614,20 @@ index 544d9d853cc..c14d8c72d8c 100644 2.33.1 -From f1951b501ca0fb3e613f04437c99dc1bbf204609 Mon Sep 17 00:00:00 2001 +From 48d73d552f2fbbdb07bd9aff4d0294883b70417f Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 -Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code +Subject: [PATCH 3/4] wip: for canonicalization with new MIT kdc code --- - source4/heimdal/lib/hdb/hdb.h | 1 + - source4/kdc/db-glue.c | 8 ++++++-- - source4/kdc/mit_samba.c | 3 +++ - source4/kdc/sdb.h | 1 + - 4 files changed, 11 insertions(+), 2 deletions(-) + source4/kdc/mit_samba.c | 3 +++ + 1 file changed, 3 insertions(+) -diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h -index 5ef9d9565f3..dafaffc6c2d 100644 ---- a/source4/heimdal/lib/hdb/hdb.h -+++ b/source4/heimdal/lib/hdb/hdb.h -@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK }; - #define HDB_F_ALL_KVNOS 2048 /* we want all the keys, live or not */ - #define HDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ - #define HDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ -+#define HDB_F_FORCE_CANON 16384 /* force canonicalition */ - - /* hdb_capability_flags */ - #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1 -diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c -index aff74f2ee71..d16b4c3329a 100644 ---- a/source4/kdc/db-glue.c -+++ b/source4/kdc/db-glue.c -@@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, - } - } - -- } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { -+ } else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { // was this supposed to be || ? - ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); - if (ret) { - krb5_clear_error_message(context); - goto out; - } -- } else if ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) { -+ } else if (((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) || (flags & SDB_F_FORCE_CANON)){ - /* - * SDB_F_CANON maps from the canonicalize flag in the - * packet, and has a different meaning between AS-REQ - * and TGS-REQ. We only change the principal in the AS-REQ case -+ * -+ * The SDB_F_FORCE_CANON if for the new MIT kdc code that wants -+ * the canonical name in all lookups, and takes care to canonicalize -+ * only when appropriate. - */ - ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL); - if (ret) { diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index acc3cba6254..f0b9df8b613 100644 +index 994dfed312b..9d039e5601b 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c -@@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, +@@ -232,6 +232,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { sflags |= SDB_F_CANON; } @@ -680,18 +637,34 @@ index acc3cba6254..f0b9df8b613 100644 if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY | KRB5_KDB_FLAG_INCLUDE_PAC)) { /* -diff --git a/source4/kdc/sdb.h b/source4/kdc/sdb.h -index c929acccce6..a9115ec23d7 100644 ---- a/source4/kdc/sdb.h -+++ b/source4/kdc/sdb.h -@@ -116,6 +116,7 @@ struct sdb_entry_ex { - #define SDB_F_KVNO_SPECIFIED 128 /* we want a particular KVNO */ - #define SDB_F_FOR_AS_REQ 4096 /* fetch is for a AS REQ */ - #define SDB_F_FOR_TGS_REQ 8192 /* fetch is for a TGS REQ */ -+#define SDB_F_FORCE_CANON 16384 /* force canonicalition */ - - void sdb_free_entry(struct sdb_entry_ex *e); - void free_sdb_entry(struct sdb_entry *s); +-- +2.33.1 + + +From f5f54026d151f6d899e8ff52d8829a2f9cf57f25 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 21 Dec 2021 12:17:11 +0100 +Subject: [PATCH 4/4] s4:kdc: Also cannoicalize krbtgt principals when + enforcing canonicalization + +Signed-off-by: Andreas Schneider +--- + source4/kdc/db-glue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c +index 8d17038cfe6..77c0c0e4746 100644 +--- a/source4/kdc/db-glue.c ++++ b/source4/kdc/db-glue.c +@@ -946,7 +946,7 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, + if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) { + p->is_krbtgt = true; + +- if (flags & (SDB_F_CANON)) { ++ if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) { + /* + * When requested to do so, ensure that the + * both realm values in the principal are set -- 2.33.1 diff --git a/samba.spec b/samba.spec index 2851bcc..dc8a9ab 100644 --- a/samba.spec +++ b/samba.spec @@ -134,13 +134,13 @@ %global baserelease 0 -%global samba_version 4.15.4 +%global samba_version 4.16.0 %global talloc_version 2.3.3 -%global tdb_version 1.4.4 +%global tdb_version 1.4.6 %global tevent_version 0.11.0 -%global ldb_version 2.4.1 +%global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -202,8 +202,6 @@ Source14: samba.pamd Source201: README.downgrade Patch0: samba-s4u.patch -Patch1: samba-ctdb-etcd-reclock.patch -Patch2: samba-glibc-dns.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -1614,11 +1612,21 @@ fi %{_libdir}/samba/vfs/nfs4acl_xattr.so %endif +%dir %{_libexecdir}/samba %{_libexecdir}/samba/samba-bgqd +%{_libexecdir}/samba/samba-dcerpcd +%{_libexecdir}/samba/rpcd_classic +%{_libexecdir}/samba/rpcd_epmapper +%{_libexecdir}/samba/rpcd_fsrvp +%{_libexecdir}/samba/rpcd_lsad +%{_libexecdir}/samba/rpcd_mdssvc +%{_libexecdir}/samba/rpcd_rpcecho +%{_libexecdir}/samba/rpcd_spoolss +%{_libexecdir}/samba/rpcd_winreg %dir %{_datadir}/samba -%dir %{_datadir}/samba/mdssvc -%{_datadir}/samba/mdssvc/elasticsearch_mappings.json +#%%dir %%{_datadir}/samba/mdssvc +#%%{_datadir}/samba/mdssvc/elasticsearch_mappings.json %{_unitdir}/nmb.service %{_unitdir}/smb.service @@ -1628,6 +1636,7 @@ fi %{_mandir}/man1/smbstatus.1* %{_mandir}/man8/eventlogadm.8* %{_mandir}/man8/samba-bgqd.8* +%{_mandir}/man8/samba-dcerpcd.8* %{_mandir}/man8/smbd.8* %{_mandir}/man8/nmbd.8* %{_mandir}/man8/vfs_acl_tdb.8* @@ -1642,6 +1651,7 @@ fi %{_mandir}/man8/vfs_crossrename.8* %{_mandir}/man8/vfs_default_quota.8* %{_mandir}/man8/vfs_dirsort.8* +%{_mandir}/man8/vfs_expand_msdfs.8* %{_mandir}/man8/vfs_extd_audit.8* %{_mandir}/man8/vfs_fake_perms.8* %{_mandir}/man8/vfs_fileid.8* @@ -1852,7 +1862,7 @@ fi %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* -%{_libdir}/samba/libwinbind-client-samba4.so +#%%{_libdir}/samba/libwinbind-client-samba4.so #endif without libwbclient %endif @@ -2232,6 +2242,9 @@ fi %{_libdir}/samba/libshares-samba4.so %{_libdir}/samba/libsmbpasswdparser-samba4.so %{_libdir}/samba/libxattr-tdb-samba4.so +%{_libdir}/samba/libREG-FULL-samba4.so +%{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so +%{_libdir}/samba/libRPC-WORKER-samba4.so ### LIBSMBCLIENT %if %{with libsmbclient} @@ -2251,7 +2264,7 @@ fi %if %{with libwbclient} %files -n libwbclient %{_libdir}/samba/wbclient/libwbclient.so.* -%{_libdir}/samba/libwinbind-client-samba4.so +#%%{_libdir}/samba/libwinbind-client-samba4.so ### LIBWBCLIENT-DEVEL %files -n libwbclient-devel @@ -2322,7 +2335,11 @@ fi %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc %{python3_sitearch}/samba/__pycache__/getopt.*.pyc %{python3_sitearch}/samba/__pycache__/gpclass.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_cert_auto_enroll_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_chromium_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_ext_loader.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_firefox_ext.*.pyc +%{python3_sitearch}/samba/__pycache__/gp_firewalld_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_gnome_settings_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_msgs_ext.*.pyc %{python3_sitearch}/samba/__pycache__/gp_scripts_ext.*.pyc @@ -2438,7 +2455,11 @@ fi %{python3_sitearch}/samba/emulate/__init__.py %{python3_sitearch}/samba/emulate/traffic.py %{python3_sitearch}/samba/emulate/traffic_packets.py +%{python3_sitearch}/samba/gp_cert_auto_enroll_ext.py +%{python3_sitearch}/samba/gp_chromium_ext.py %{python3_sitearch}/samba/gp_ext_loader.py +%{python3_sitearch}/samba/gp_firefox_ext.py +%{python3_sitearch}/samba/gp_firewalld_ext.py %{python3_sitearch}/samba/gp_msgs_ext.py %{python3_sitearch}/samba/gp_smb_conf_ext.py %{python3_sitearch}/samba/gp_sudoers_ext.py @@ -2755,6 +2776,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/smbd_base.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_fuzztest.*.pyc %{python3_sitearch}/samba/tests/__pycache__/source.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/source_chars.*.pyc %{python3_sitearch}/samba/tests/__pycache__/strings.*.pyc %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc %{python3_sitearch}/samba/tests/__pycache__/tdb_util.*.pyc @@ -2924,14 +2946,15 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc -%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc -%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc -%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_idmap_nss.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc @@ -2949,25 +2972,26 @@ fi %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py +%{python3_sitearch}/samba/tests/krb5/pac_align_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py %{python3_sitearch}/samba/tests/krb5/rodc_tests.py -%{python3_sitearch}/samba/tests/krb5/salt_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py -%{python3_sitearch}/samba/tests/krb5/spn_tests.py -%{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_idmap_nss.py +%{python3_sitearch}/samba/tests/krb5/test_ccache.py %{python3_sitearch}/samba/tests/krb5/test_ldap.py %{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py %{python3_sitearch}/samba/tests/krb5/test_rpc.py %{python3_sitearch}/samba/tests/krb5/test_smb.py %{python3_sitearch}/samba/tests/krb5/s4u_tests.py +%{python3_sitearch}/samba/tests/krb5/salt_tests.py +%{python3_sitearch}/samba/tests/krb5/spn_tests.py %{python3_sitearch}/samba/tests/krb5/xrealm_tests.py %{python3_sitearch}/samba/tests/krb5_credentials.py %{python3_sitearch}/samba/tests/ldap_raw.py -%{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/ldap_spn.py +%{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/ldap_upn_sam_account.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py @@ -3031,6 +3055,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/help.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/join.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/join_lmdb_size.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/join_member.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/ntacl.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/ou.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/passwordsettings.*.pyc @@ -3067,6 +3092,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/help.py %{python3_sitearch}/samba/tests/samba_tool/join.py %{python3_sitearch}/samba/tests/samba_tool/join_lmdb_size.py +%{python3_sitearch}/samba/tests/samba_tool/join_member.py %{python3_sitearch}/samba/tests/samba_tool/ntacl.py %{python3_sitearch}/samba/tests/samba_tool/ou.py %{python3_sitearch}/samba/tests/samba_tool/passwordsettings.py @@ -3098,6 +3124,7 @@ fi %{python3_sitearch}/samba/tests/smbd_base.py %{python3_sitearch}/samba/tests/smbd_fuzztest.py %{python3_sitearch}/samba/tests/source.py +%{python3_sitearch}/samba/tests/source_chars.py %{python3_sitearch}/samba/tests/strings.py %{python3_sitearch}/samba/tests/subunitrun.py %{python3_sitearch}/samba/tests/tdb_util.py @@ -3119,7 +3146,6 @@ fi %{_mandir}/man1/masktest.1* %{_mandir}/man1/ndrdump.1* %{_mandir}/man1/smbtorture.1* -%{_mandir}/man1/vfstest.1* %if %{with testsuite} # files to ignore in testsuite mode @@ -4103,6 +4129,10 @@ fi %endif %changelog +* Tue Jan 25 2022 Pavel Filipenský - 4.16.0rc1 +- Update to Samba 4.16.0rc1 +- resolves: #2042518 + * Thu Jan 20 2022 Pavel Filipenský - 4.15.4-0 - Update to Samba 4.15.4 - resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 diff --git a/sources b/sources index 343898f..5c60965 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.15.4.tar.xz) = 19aa7edc55d545c42ba9c2d2bb987df63a825c5a1a6fa2a350d6bca41f04fde6f63b643f6e38d32f4d4067c24420e1ca62ef28dc285c70105ca78487e80ee2dc -SHA512 (samba-4.15.4.tar.asc) = 6878efc500f423e7061966954163ef3503e4ab43a527b370a3e26e6992bc9b6a3161e296800b6cd78d5e0d99ac7f1db249d52c2475d035973e2121bc67df6fab +SHA512 (samba-4.16.0rc1.tar.asc) = 07aebb0d76834a1a56021d3a9004d6eefae8fb1426aabaca89c9df3572cbcb09dfc0c649c5e28e1844ce53dfd1e94cc828915df26e63268ce883045e4f3c3548 +SHA512 (samba-4.16.0rc1.tar.xz) = dd7711c998e6d33056d913af64ef33957badf09fb59ba21921f81676b96a939bbf491bfb1362d2625ba30d08526abc6c889376b4e1e439e266bd9b2e9864bcbc From b935fbcb7d1c7034132e7b87495ad8b7283e8c63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 26 Jan 2022 10:30:59 +0100 Subject: [PATCH 037/295] vfs_cephfs on ppc64le is excluded till ceph is fixed on ppc64le --- samba.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index dc8a9ab..c37413b 100644 --- a/samba.spec +++ b/samba.spec @@ -52,7 +52,9 @@ # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} -%ifarch aarch64 ppc64le s390x x86_64 +# ppc64le excluded pending resolution of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 +#%%ifarch aarch64 ppc64le s390x x86_64 +%ifarch aarch64 s390x x86_64 %bcond_without vfs_cephfs %bcond_without ceph_mutex %else @@ -4129,6 +4131,9 @@ fi %endif %changelog +* Wed Jan 26 2022 Pavel Filipenský - 4.16.0rc1 +- Exclude temporarily ceph on ppc64le to fix failing build + * Tue Jan 25 2022 Pavel Filipenský - 4.16.0rc1 - Update to Samba 4.16.0rc1 - resolves: #2042518 From fae36af2f385d1891ae40cf98b9cbba902ca8224 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 1 Feb 2022 08:05:40 +0100 Subject: [PATCH 038/295] Update to Samba 4.16.0rc2 resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142 resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336 resolves: #2042518 pfilipen --- .gitignore | 2 ++ samba.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index a5d7ee7..9cb3e5a 100644 --- a/.gitignore +++ b/.gitignore @@ -279,3 +279,5 @@ samba-3.6.0pre1.tar.gz /samba-4.15.4.tar.asc /samba-4.16.0rc1.tar.xz /samba-4.16.0rc1.tar.asc +/samba-4.16.0rc2.tar.xz +/samba-4.16.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index c37413b..8e5bf1c 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -142,7 +142,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4131,6 +4131,13 @@ fi %endif %changelog +* Tue Feb 01 2022 Pavel Filipenský - 4.16.0rc2 +- Update to Samba 4.16.0rc2 +- resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 +- resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142 +- resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336 +- resolves: #2042518 + * Wed Jan 26 2022 Pavel Filipenský - 4.16.0rc1 - Exclude temporarily ceph on ppc64le to fix failing build diff --git a/sources b/sources index 5c60965..1877757 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0rc1.tar.asc) = 07aebb0d76834a1a56021d3a9004d6eefae8fb1426aabaca89c9df3572cbcb09dfc0c649c5e28e1844ce53dfd1e94cc828915df26e63268ce883045e4f3c3548 -SHA512 (samba-4.16.0rc1.tar.xz) = dd7711c998e6d33056d913af64ef33957badf09fb59ba21921f81676b96a939bbf491bfb1362d2625ba30d08526abc6c889376b4e1e439e266bd9b2e9864bcbc +SHA512 (samba-4.16.0rc2.tar.asc) = ee4fd216f0ea6851c089e6ea0959638a5d62d403303b2a2a7a3e8cf97924969607fae0c520156c4076d41a6ccc52630364497c134ea547e950465a96b66532a1 +SHA512 (samba-4.16.0rc2.tar.xz) = 6b6326d4ae962a01f699a6cc144bac8847281fc85ae1a5d77c71be3f59630c7864832297a9369a5ff83bff0d0c80d03ebfecfdd5d706ec86fc400112ecd6f657 From 4ee87cc214717b18d6a58afa051a2847b1533a3c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 1 Feb 2022 11:13:21 +0100 Subject: [PATCH 039/295] Fix missing mdssvc/elasticsearch_mappings.json pfilipen --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 8e5bf1c..2c2d272 100644 --- a/samba.spec +++ b/samba.spec @@ -1627,8 +1627,8 @@ fi %{_libexecdir}/samba/rpcd_winreg %dir %{_datadir}/samba -#%%dir %%{_datadir}/samba/mdssvc -#%%{_datadir}/samba/mdssvc/elasticsearch_mappings.json +%dir %{_datadir}/samba/mdssvc +%{_datadir}/samba/mdssvc/elasticsearch_mappings.json %{_unitdir}/nmb.service %{_unitdir}/smb.service From 626bbcbaaca2ba0370ef2685ad4bbcdad654616a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 2 Feb 2022 14:36:43 +0100 Subject: [PATCH 040/295] There is no such thing like .el9rhgs Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 2c2d272..2ed6b5c 100644 --- a/samba.spec +++ b/samba.spec @@ -71,7 +71,7 @@ # Build vfs_gluster module by default on 64bit Fedora %global is_rhgs 0 -%if "%{dist}" == ".el8rhgs" || "%{dist}" == ".el9rhgs" +%if "%{dist}" == ".el7rhgs" || "%{dist}" == ".el8rhgs" %global is_rhgs 1 %endif From 08f90048f540471456edc7b07b9fc9f022c115a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 15 Feb 2022 08:57:37 +0100 Subject: [PATCH 041/295] Update to Samba 4.16.0rc3 resolves: #2042518 pfilipen --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 9cb3e5a..33ed91b 100644 --- a/.gitignore +++ b/.gitignore @@ -281,3 +281,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0rc1.tar.asc /samba-4.16.0rc2.tar.xz /samba-4.16.0rc2.tar.asc +/samba-4.16.0rc3.tar.xz +/samba-4.16.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index 2ed6b5c..2bb8381 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 2 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -142,7 +142,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4131,6 +4131,10 @@ fi %endif %changelog +* Tue Feb 15 2022 Pavel Filipenský - 4.16.0rc3 +- Update to Samba 4.16.0rc3 +- resolves: #2042518 + * Tue Feb 01 2022 Pavel Filipenský - 4.16.0rc2 - Update to Samba 4.16.0rc2 - resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 diff --git a/sources b/sources index 1877757..311b8ae 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0rc2.tar.asc) = ee4fd216f0ea6851c089e6ea0959638a5d62d403303b2a2a7a3e8cf97924969607fae0c520156c4076d41a6ccc52630364497c134ea547e950465a96b66532a1 -SHA512 (samba-4.16.0rc2.tar.xz) = 6b6326d4ae962a01f699a6cc144bac8847281fc85ae1a5d77c71be3f59630c7864832297a9369a5ff83bff0d0c80d03ebfecfdd5d706ec86fc400112ecd6f657 +SHA512 (samba-4.16.0rc3.tar.xz) = 797153d362d5bcfe3678a7870dce13a6d4770c8c8165ba64caf30195321448b2f35e2c0f51554648f1d7dd5413e22727dd53d3c378fcd0985c4c297ab2ad4a52 +SHA512 (samba-4.16.0rc3.tar.asc) = 6f4d0e81e2c2e2aec2d0418ae56790dde315c5ebeea45b17195e82d463ca22c601c28d188b1bc37969bc9496f4a951d65fed0c6283886c1ee60bac4504e8fbf4 From 0d2a366cce93d0ff80036cbd0c95d545a654363b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 23 Feb 2022 11:49:53 +0100 Subject: [PATCH 042/295] Fix samba-tool on builds with samba-dc resolves: rhbz#2036443 --- samba.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 2bb8381..a88b18f 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 3 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -490,6 +490,8 @@ Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools %if %{with dc} +# samba-tool needs python3-samba-dc on a full build +Requires: python3-%{name}-dc = %{samba_depver} # samba-tool needs mdb_copy for domain backup or upgrade provision Requires: lmdb %endif @@ -4131,6 +4133,9 @@ fi %endif %changelog +* Wed Feb 23 2022 Andreas Schneider - 4.16.0-0.3.rc3 +- resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc + * Tue Feb 15 2022 Pavel Filipenský - 4.16.0rc3 - Update to Samba 4.16.0rc3 - resolves: #2042518 From 48556cdf371e795b468321f0b338f1e5fd46a473 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 1 Mar 2022 12:37:00 +0100 Subject: [PATCH 043/295] Update to Samba 4.16.0rc4 resolves: #2042518 pfilipen --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 33ed91b..9589b5f 100644 --- a/.gitignore +++ b/.gitignore @@ -283,3 +283,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0rc2.tar.asc /samba-4.16.0rc3.tar.xz /samba-4.16.0rc3.tar.asc +/samba-4.16.0rc4.tar.xz +/samba-4.16.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index a88b18f..97a4640 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 4 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -142,7 +142,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4133,6 +4133,10 @@ fi %endif %changelog +* Tue Mar 01 2022 Pavel Filipenský - 4.16.0-0.4.rc4 +- Update to Samba 4.16.0rc4 +- resolves: #2042518 + * Wed Feb 23 2022 Andreas Schneider - 4.16.0-0.3.rc3 - resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc diff --git a/sources b/sources index 311b8ae..fc0f4e5 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0rc3.tar.xz) = 797153d362d5bcfe3678a7870dce13a6d4770c8c8165ba64caf30195321448b2f35e2c0f51554648f1d7dd5413e22727dd53d3c378fcd0985c4c297ab2ad4a52 -SHA512 (samba-4.16.0rc3.tar.asc) = 6f4d0e81e2c2e2aec2d0418ae56790dde315c5ebeea45b17195e82d463ca22c601c28d188b1bc37969bc9496f4a951d65fed0c6283886c1ee60bac4504e8fbf4 +SHA512 (samba-4.16.0rc4.tar.xz) = 7326c9690309eadff7fe01d914105e9cd7e225ba0cce57855e0ad308b35404a384519e383d279c26430eae796df46f1431a8b0b142c7a3c8c474f1977dd3e150 +SHA512 (samba-4.16.0rc4.tar.asc) = 5914d3108ed65fa5e9a68efefae5ca8da48cda4ca7b29c876b89d9c18d994a7dc11876c66cb7e011ad4a5c59650ec9511353a9b0eba7a19c0c56042c6cf734cd From da81e5cf5b0db127d4d5c18b6bc899b8f060445d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 9 Mar 2022 14:21:48 +0100 Subject: [PATCH 044/295] Update to Samba 4.16.0rc5 resolves: #2042518 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 9589b5f..d7625b4 100644 --- a/.gitignore +++ b/.gitignore @@ -285,3 +285,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0rc3.tar.asc /samba-4.16.0rc4.tar.xz /samba-4.16.0rc4.tar.asc +/samba-4.16.0rc5.tar.xz +/samba-4.16.0rc5.tar.asc diff --git a/samba.spec b/samba.spec index 97a4640..7046999 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 4 +%global baserelease 5 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -142,7 +142,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release rc4 +%global pre_release rc5 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4133,6 +4133,10 @@ fi %endif %changelog +* Wed Mar 09 2022 Guenther Deschner - 4.16.0-0.5.rc5 +- Update to Samba 4.16.0rc5 +- resolves: #2042518 + * Tue Mar 01 2022 Pavel Filipenský - 4.16.0-0.4.rc4 - Update to Samba 4.16.0rc4 - resolves: #2042518 diff --git a/sources b/sources index fc0f4e5..b0b6528 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0rc4.tar.xz) = 7326c9690309eadff7fe01d914105e9cd7e225ba0cce57855e0ad308b35404a384519e383d279c26430eae796df46f1431a8b0b142c7a3c8c474f1977dd3e150 -SHA512 (samba-4.16.0rc4.tar.asc) = 5914d3108ed65fa5e9a68efefae5ca8da48cda4ca7b29c876b89d9c18d994a7dc11876c66cb7e011ad4a5c59650ec9511353a9b0eba7a19c0c56042c6cf734cd +SHA512 (samba-4.16.0rc5.tar.xz) = 6d29f852613a46f23e95630b0b7236240155698e7a057953d4a7cb9de015b30c279e95fe084c2a0e448bab30df50789b8629a05bba1b1c8e2f6d8e9e4d3d56c6 +SHA512 (samba-4.16.0rc5.tar.asc) = f1448bf87a02e5207199358418138d48cc726425167adcd900c02c95bdbaa7692079c75f7db9df683b07fd83594d3a0b544c202c55a10ce368ca2747c34f1702 From d6e74e716fe343e297addf5e34986e18010cc1f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 22 Mar 2022 10:27:37 +0100 Subject: [PATCH 045/295] Update to Samba 4.16.0 resolves: #2066290 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index d7625b4..aa6195d 100644 --- a/.gitignore +++ b/.gitignore @@ -287,3 +287,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0rc4.tar.asc /samba-4.16.0rc5.tar.xz /samba-4.16.0rc5.tar.asc +/samba-4.16.0.tar.xz +/samba-4.16.0.tar.asc diff --git a/samba.spec b/samba.spec index 7046999..56c7d74 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 5 +%global baserelease 6 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -142,7 +142,7 @@ %global tevent_version 0.11.0 %global ldb_version 2.5.0 # This should be rc1 or nil -%global pre_release rc5 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4133,6 +4133,10 @@ fi %endif %changelog +* Tue Mar 22 2022 Guenther Deschner - 4.16.0-6 +- Update to Samba 4.16.0 +- resolves: #2066290 + * Wed Mar 09 2022 Guenther Deschner - 4.16.0-0.5.rc5 - Update to Samba 4.16.0rc5 - resolves: #2042518 diff --git a/sources b/sources index b0b6528..f23b12e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0rc5.tar.xz) = 6d29f852613a46f23e95630b0b7236240155698e7a057953d4a7cb9de015b30c279e95fe084c2a0e448bab30df50789b8629a05bba1b1c8e2f6d8e9e4d3d56c6 -SHA512 (samba-4.16.0rc5.tar.asc) = f1448bf87a02e5207199358418138d48cc726425167adcd900c02c95bdbaa7692079c75f7db9df683b07fd83594d3a0b544c202c55a10ce368ca2747c34f1702 +SHA512 (samba-4.16.0.tar.xz) = e824906f7c1e01e84c306967f6bc31ca7600851b8bd5998454a2f987483ec25dcf78b4fc1201bfe28d8bdc6f2533ab2c8a2f3dee938eba21c3bb8ad50aedaf24 +SHA512 (samba-4.16.0.tar.asc) = d3f5b0f2f338826348b723c646a254ecab87205aaa97d8b22ca37f7babd0e86382e709c8ee4820c9b11609bb6b8e4f3de9ae78ab664ad30260bb0f42ee75e5e1 From 92f6ae3986c2fd844d8705535fe5040a79f3e763 Mon Sep 17 00:00:00 2001 From: Sandro Mani Date: Fri, 25 Mar 2022 14:58:37 +0100 Subject: [PATCH 046/295] Rebuild with mingw-gcc-12 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 56c7d74..e3a5d28 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 6 +%global baserelease 7 %global samba_version 4.16.0 %global talloc_version 2.3.3 @@ -4133,6 +4133,9 @@ fi %endif %changelog +* Fri Mar 25 2022 Sandro Mani - 2:4.16.0-7 +- Rebuild with mingw-gcc-12 + * Tue Mar 22 2022 Guenther Deschner - 4.16.0-6 - Update to Samba 4.16.0 - resolves: #2066290 From 5533ff7a7cdc304b30f46d896c6e708449270406 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 4 Apr 2022 11:32:12 +0200 Subject: [PATCH 047/295] Make sure we do not build Heimdal or crypto code As we need to rely on GnuTLS for FIPS, remove heimdal and other unused crypto code to ensure we do not build it! --- samba-4.16-waf-crypto.patch | 77 +++++++++++++++++++++++++++++++++++++ samba.spec | 7 ++++ 2 files changed, 84 insertions(+) create mode 100644 samba-4.16-waf-crypto.patch diff --git a/samba-4.16-waf-crypto.patch b/samba-4.16-waf-crypto.patch new file mode 100644 index 0000000..337be97 --- /dev/null +++ b/samba-4.16-waf-crypto.patch @@ -0,0 +1,77 @@ +From 41d3efebcf6abab9119f9b0f97c86c1c48739fee Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 4 Apr 2022 11:24:04 +0200 +Subject: [PATCH 1/2] waf: Check for GnuTLS earlier + +As GnuTLS is an essential part we need to check for it early so we can react on +GnuTLS features in other wscripts. + +Signed-off-by: Andreas Schneider +--- + wscript | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/wscript b/wscript +index d8220b35095..5b85d9a1682 100644 +--- a/wscript ++++ b/wscript +@@ -189,6 +189,8 @@ def configure(conf): + conf.RECURSE('dynconfig') + conf.RECURSE('selftest') + ++ conf.PROCESS_SEPARATE_RULE('system_gnutls') ++ + conf.CHECK_CFG(package='zlib', minversion='1.2.3', + args='--cflags --libs', + mandatory=True) +@@ -297,8 +299,6 @@ def configure(conf): + if not conf.CONFIG_GET('KRB5_VENDOR'): + conf.PROCESS_SEPARATE_RULE('embedded_heimdal') + +- conf.PROCESS_SEPARATE_RULE('system_gnutls') +- + conf.RECURSE('source4/dsdb/samdb/ldb_modules') + conf.RECURSE('source4/ntvfs/sysdep') + conf.RECURSE('lib/util') +-- +2.35.1 + + +From 63701a28116afc1550c23cb5f7b9d6e366fd1270 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 4 Apr 2022 11:25:31 +0200 +Subject: [PATCH 2/2] third_party:waf: Do not recurse in aesni-intel if GnuTLS + provides the cipher + +Signed-off-by: Andreas Schneider +--- + third_party/wscript | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/third_party/wscript b/third_party/wscript +index 1f4bc1ce1d7..a17c15bcaa7 100644 +--- a/third_party/wscript ++++ b/third_party/wscript +@@ -5,7 +5,8 @@ from waflib import Options + def configure(conf): + conf.RECURSE('cmocka') + conf.RECURSE('popt') +- conf.RECURSE('aesni-intel') ++ if not conf.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'): ++ conf.RECURSE('aesni-intel') + if conf.CONFIG_GET('ENABLE_SELFTEST'): + conf.RECURSE('socket_wrapper') + conf.RECURSE('nss_wrapper') +@@ -18,7 +19,8 @@ def configure(conf): + def build(bld): + bld.RECURSE('cmocka') + bld.RECURSE('popt') +- bld.RECURSE('aesni-intel') ++ if not bld.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'): ++ bld.RECURSE('aesni-intel') + if bld.CONFIG_GET('SOCKET_WRAPPER'): + bld.RECURSE('socket_wrapper') + if bld.CONFIG_GET('NSS_WRAPPER'): +-- +2.35.1 + diff --git a/samba.spec b/samba.spec index e3a5d28..889a960 100644 --- a/samba.spec +++ b/samba.spec @@ -204,6 +204,8 @@ Source14: samba.pamd Source201: README.downgrade Patch0: samba-s4u.patch +# https://gitlab.com/samba-team/samba/-/merge_requests/2477 +Patch1: samba-4.16-waf-crypto.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -1062,6 +1064,11 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - %autosetup -n samba-%{version}%{pre_release} -p1 +# Ensure we rely on GnuTLS and do not build any other crypto code shipping with +# the sources. +rm -rf third_party/{aesni-intel,heimdal} +rm -f lib/crypto/{aes,rijndael}*.c + %build %if %{with includelibs} %global _talloc_lib ,talloc,pytalloc,pytalloc-util From 766f1be02d0d2a1fbedb9106cefe5222d2afe10b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 2 May 2022 13:16:49 +0200 Subject: [PATCH 048/295] Update to Samba 4.16.1 resolves: #2080915 pfilipen --- .gitignore | 2 ++ samba.spec | 10 +++++++--- sources | 4 ++-- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index aa6195d..f49bf1c 100644 --- a/.gitignore +++ b/.gitignore @@ -289,3 +289,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0rc5.tar.asc /samba-4.16.0.tar.xz /samba-4.16.0.tar.asc +/samba-4.16.1.tar.xz +/samba-4.16.1.tar.asc diff --git a/samba.spec b/samba.spec index 889a960..03bea4b 100644 --- a/samba.spec +++ b/samba.spec @@ -134,12 +134,12 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 7 +%global baserelease 0 -%global samba_version 4.16.0 +%global samba_version 4.16.1 %global talloc_version 2.3.3 %global tdb_version 1.4.6 -%global tevent_version 0.11.0 +%global tevent_version 0.12.0 %global ldb_version 2.5.0 # This should be rc1 or nil %global pre_release %nil @@ -4140,6 +4140,10 @@ fi %endif %changelog +* Mon May 02 2022 Pavel Filipenský - 4.16.1-0 +- Update to Samba 4.16.1 +- resolves: #2080915 + * Fri Mar 25 2022 Sandro Mani - 2:4.16.0-7 - Rebuild with mingw-gcc-12 diff --git a/sources b/sources index f23b12e..f094ef6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.0.tar.xz) = e824906f7c1e01e84c306967f6bc31ca7600851b8bd5998454a2f987483ec25dcf78b4fc1201bfe28d8bdc6f2533ab2c8a2f3dee938eba21c3bb8ad50aedaf24 -SHA512 (samba-4.16.0.tar.asc) = d3f5b0f2f338826348b723c646a254ecab87205aaa97d8b22ca37f7babd0e86382e709c8ee4820c9b11609bb6b8e4f3de9ae78ab664ad30260bb0f42ee75e5e1 +SHA512 (samba-4.16.1.tar.xz) = a6c54d5f8796b353fce1467a81293491fd2a1c221eba1271a4ee0b9020ff5137d5dba68c8de5e65ab127ab908a403a0b59102def1f675f26f0322a2f7bc41c6f +SHA512 (samba-4.16.1.tar.asc) = 71895a0626dce7fe42f0370190dd4b5f7eb5ce0359bacfe779642c5915a6290d8d4f841f3c258a774829a03fa59be6353863494d2f0cf6bc7640a98af7e928e8 From 93ea8c0806f141307d5bf807ededf8ccd7af61a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 3 May 2022 13:08:58 +0200 Subject: [PATCH 049/295] Delete no longer needed comments pfilipen --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index 03bea4b..5c50728 100644 --- a/samba.spec +++ b/samba.spec @@ -1873,7 +1873,6 @@ fi %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* -#%%{_libdir}/samba/libwinbind-client-samba4.so #endif without libwbclient %endif @@ -2275,7 +2274,6 @@ fi %if %{with libwbclient} %files -n libwbclient %{_libdir}/samba/wbclient/libwbclient.so.* -#%%{_libdir}/samba/libwinbind-client-samba4.so ### LIBWBCLIENT-DEVEL %files -n libwbclient-devel From bec19658c49c68ca4855b2b9a4671bca43bdc976 Mon Sep 17 00:00:00 2001 From: Tomas Popela Date: Thu, 5 May 2022 14:41:17 +0200 Subject: [PATCH 050/295] Don't require full systemd for tmp file handling in samba-common Otherwise the full systemd is being pulled into Fedora Flatpak runtime, but this change benefits other uses as well. --- samba.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 5c50728..7570717 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.16.1 %global talloc_version 2.3.3 @@ -428,7 +428,7 @@ SMB/CIFS clients. Summary: Files used by both Samba servers and clients BuildArch: noarch -Requires(post): systemd +Requires(post): (systemd-standalone-tmpfiles or systemd) Recommends: logrotate Provides: samba4-common = %{samba_depver} @@ -4138,6 +4138,9 @@ fi %endif %changelog +* Thu May 05 2022 Tomas Popela - 4.16.1-1 +- Don't require full systemd for tmp files handling in samba-common + * Mon May 02 2022 Pavel Filipenský - 4.16.1-0 - Update to Samba 4.16.1 - resolves: #2080915 From 331fe971e651b8216fb241bdfbaa5c4e436a8a40 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 5 May 2022 19:45:16 +0200 Subject: [PATCH 051/295] Add .abignore file for abidiff abidiff complains: abidiff: failed to read input file /usr/lib/libdcerpc-samr.so.0.0.1 abidiff: could not find the debug info This is a grouping library which doesn't have any source code, so just ignore it with a suppression file (.abignore). Example for .abignore: https://sourceware.org/git/?p=libabigail.git;a=blob;f=default.abignore --- .abignore | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .abignore diff --git a/.abignore b/.abignore new file mode 100644 index 0000000..466d190 --- /dev/null +++ b/.abignore @@ -0,0 +1,5 @@ +################################################# +# This is a grouping library without any code +################################################# +[suppress_file] + file_name_regexp = libdcerpc-samr\\.so.* From 1fa286fd0092c420003157ea5679f52cdc7dc956 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 5 May 2022 16:48:23 +0200 Subject: [PATCH 052/295] rpminspect: ignore inet_ntoa() from /usr/lib*/samba/service/nbtd.so --- rpminspect.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 6de38d7..ff0361f 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -7,6 +7,7 @@ badfuncs: - /usr/lib*/libsmbconf.so.* - /usr/lib*/samba/libgse-samba4.so - /usr/lib*/samba/libsamba-sockets-samba4.so + - /usr/lib*/samba/service/nbtd.so - /usr/libexec/ctdb/smnotify - /usr/sbin/nmbd From 0b31575a45a5e679eda0818fb69b5bac73eeb580 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 6 May 2022 10:10:06 +0200 Subject: [PATCH 053/295] Update requires for packages pfilipen --- samba.spec | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 7570717..1bb5987 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 2 %global samba_version 4.16.1 %global talloc_version 2.3.3 @@ -509,6 +509,8 @@ SMB/CIFS clients. %package dc Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} +Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} @@ -549,6 +551,7 @@ The samba-dc-provision package provides files to setup a domain controller ### DC-LIBS %package dc-libs Summary: Samba AD Domain Controller Libraries +Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -564,9 +567,11 @@ link against the SMB, RPC and other protocols. ### DC-BIND %package dc-bind-dlz Summary: Bind DLZ module for Samba AD +Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: %{name}-dc = %{samba_depver} +Requires: %{name}-libs = %{samba_depver} Requires: bind Provides: bundled(libreplace) @@ -582,6 +587,9 @@ name server related details of Samba AD. Summary: Developer tools for Samba libraries Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +%if %{with dc} +Requires: %{name}-dc-libs = %{samba_depver} +%endif Provides: samba4-devel = %{samba_depver} Obsoletes: samba4-devel < %{samba_depver} @@ -596,6 +604,7 @@ libraries in the Samba suite. %package vfs-cephfs Summary: Samba VFS module for Ceph distributed storage system Requires: %{name} = %{samba_depver} +Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Provides: bundled(libreplace) @@ -732,6 +741,9 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +%if %{with dc} +Requires: %{name}-dc-libs = %{samba_depver} +%endif Requires: python3-talloc Requires: python3-tevent Requires: python3-tdb @@ -770,6 +782,8 @@ If you want to run full set of Samba tests, you need to install this package. %if %{with dc} || %{with testsuite} %package -n python3-samba-dc Summary: Samba Python libraries for Samba AD +Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-%{name} = %{samba_depver} %description -n python3-samba-dc @@ -1023,6 +1037,7 @@ and use CTDB instead. Summary: CTDB PCP pmda support Requires: ctdb = %{samba_depver} Requires: pcp-libs +Requires: %{name}-client-libs = %{samba_depver} %description -n ctdb-pcp-pmda Performance Co-Pilot (PCP) support for CTDB @@ -4138,6 +4153,9 @@ fi %endif %changelog +* Fri May 06 2022 Pavel Filipenský - 4.16.1-2 +- Update requires for packages + * Thu May 05 2022 Tomas Popela - 4.16.1-1 - Don't require full systemd for tmp files handling in samba-common From 737293fe2b3b533418023e02f513c3000499237c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 6 May 2022 14:31:07 +0200 Subject: [PATCH 054/295] Rename from .abignore to samba.abignore --- .abignore => samba.abignore | 0 samba.spec | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename .abignore => samba.abignore (100%) diff --git a/.abignore b/samba.abignore similarity index 100% rename from .abignore rename to samba.abignore diff --git a/samba.spec b/samba.spec index 1bb5987..c51bee7 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 3 %global samba_version 4.16.1 %global talloc_version 2.3.3 From 1d4eb827d1f08ddcf91286372956f1497df5b854 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 6 May 2022 17:05:02 +0200 Subject: [PATCH 055/295] Fix samba.abignore --- samba.abignore | 2 +- samba.spec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.abignore b/samba.abignore index 466d190..718059d 100644 --- a/samba.abignore +++ b/samba.abignore @@ -2,4 +2,4 @@ # This is a grouping library without any code ################################################# [suppress_file] - file_name_regexp = libdcerpc-samr\\.so.* +file_name_regexp=.*libdcerpc-samr\\.so.* diff --git a/samba.spec b/samba.spec index c51bee7..ccfc60e 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 3 +%global baserelease 4 %global samba_version 4.16.1 %global talloc_version 2.3.3 From 8ccc18dc1361299580b8312b86dfd6b3517c56ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 13 May 2022 09:04:45 +0200 Subject: [PATCH 056/295] Fix rpminspect abidiff pfilipen --- rpminspect.yaml | 3 +++ samba.spec | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/rpminspect.yaml b/rpminspect.yaml index ff0361f..9c56e6c 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -15,3 +15,6 @@ runpath: allowed_paths: - /usr/lib/samba - /usr/lib64/samba + +abidiff: + suppression_file: samba.abignore diff --git a/samba.spec b/samba.spec index ccfc60e..7a3222e 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 4 +%global baserelease 5 %global samba_version 4.16.1 %global talloc_version 2.3.3 @@ -200,6 +200,7 @@ Source11: smb.conf.vendor Source12: smb.conf.example Source13: pam_winbind.conf Source14: samba.pamd +Source15: samba.abignore Source201: README.downgrade @@ -4153,6 +4154,9 @@ fi %endif %changelog +* Fri May 13 2022 Pavel Filipenský - 4.16.1-5 +- Fix rpminspect abidiff + * Fri May 06 2022 Pavel Filipenský - 4.16.1-2 - Update requires for packages From 035f4717ddb752b240bb38e1fd63f12ac9b365cf Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 31 May 2022 08:15:08 +0200 Subject: [PATCH 057/295] Perl 5.36 rebuild --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 7a3222e..ce1cb45 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 5 +%global baserelease 6 %global samba_version 4.16.1 %global talloc_version 2.3.3 @@ -4154,6 +4154,9 @@ fi %endif %changelog +* Tue May 31 2022 Jitka Plesnikova - 2:4.16.1-6 +- Perl 5.36 rebuild + * Fri May 13 2022 Pavel Filipenský - 4.16.1-5 - Fix rpminspect abidiff From ae63a4dca115771bcaf260215ba638649e1f1af5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 7 Jun 2022 15:39:57 +0200 Subject: [PATCH 058/295] Drop zlib from bundled libraries as we don't have a copy anymore --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index ce1cb45..1b9bed3 100644 --- a/samba.spec +++ b/samba.spec @@ -1099,7 +1099,7 @@ rm -f lib/crypto/{aes,rijndael}*.c #endif with includelibs %endif -%global _samba_libraries !zlib,!popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib}%{_ldb_lib} +%global _samba_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib}%{_ldb_lib} %global _samba_idmap_modules idmap_ad,idmap_rid,idmap_ldap,idmap_hash,idmap_tdb2 %global _samba_pdb_modules pdb_tdbsam,pdb_ldap,pdb_smbpasswd,pdb_wbc_sam,pdb_samba4 From dfb88d92d46ca96b2a5802105f68972dd94c5d53 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 8 Jun 2022 11:25:43 +0200 Subject: [PATCH 059/295] Remove weak dependency for logrotate for CentOS/RHEL resolves: rhbz#2093833 --- samba.spec | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/samba.spec b/samba.spec index 1b9bed3..6c1c103 100644 --- a/samba.spec +++ b/samba.spec @@ -430,7 +430,9 @@ Summary: Files used by both Samba servers and clients BuildArch: noarch Requires(post): (systemd-standalone-tmpfiles or systemd) +%if 0%{?fedora} Recommends: logrotate +%endif Provides: samba4-common = %{samba_depver} Obsoletes: samba4-common < %{samba_depver} @@ -4154,6 +4156,9 @@ fi %endif %changelog +* Wed Jun 08 2022 Andreas Schneider - 4.16.1-7 +- resolves: rhbz#2093833 - Remove weak dependency for logrotate for CentOS/RHEL + * Tue May 31 2022 Jitka Plesnikova - 2:4.16.1-6 - Perl 5.36 rebuild From 85e1d4b7c6207bfbc334bb77487ec447d62756dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 13 Jun 2022 12:42:08 +0200 Subject: [PATCH 060/295] Update to Samba 4.16.2 resolves: #2096167 Guenther --- .gitignore | 2 ++ samba.spec | 10 +++++++--- sources | 4 ++-- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index f49bf1c..18704d2 100644 --- a/.gitignore +++ b/.gitignore @@ -291,3 +291,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.0.tar.asc /samba-4.16.1.tar.xz /samba-4.16.1.tar.asc +/samba-4.16.2.tar.xz +/samba-4.16.2.tar.asc diff --git a/samba.spec b/samba.spec index 6c1c103..e7fef22 100644 --- a/samba.spec +++ b/samba.spec @@ -134,13 +134,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 6 +%global baserelease 0 -%global samba_version 4.16.1 +%global samba_version 4.16.2 %global talloc_version 2.3.3 %global tdb_version 1.4.6 %global tevent_version 0.12.0 -%global ldb_version 2.5.0 +%global ldb_version 2.5.1 # This should be rc1 or nil %global pre_release %nil @@ -4156,6 +4156,10 @@ fi %endif %changelog +* Mon Jun 13 2022 Guenther Deschner - 4.16.2-0 +- Update to Samba 4.16.2 +- resolves: #2096167 + * Wed Jun 08 2022 Andreas Schneider - 4.16.1-7 - resolves: rhbz#2093833 - Remove weak dependency for logrotate for CentOS/RHEL diff --git a/sources b/sources index f094ef6..f34d266 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.1.tar.xz) = a6c54d5f8796b353fce1467a81293491fd2a1c221eba1271a4ee0b9020ff5137d5dba68c8de5e65ab127ab908a403a0b59102def1f675f26f0322a2f7bc41c6f -SHA512 (samba-4.16.1.tar.asc) = 71895a0626dce7fe42f0370190dd4b5f7eb5ce0359bacfe779642c5915a6290d8d4f841f3c258a774829a03fa59be6353863494d2f0cf6bc7640a98af7e928e8 +SHA512 (samba-4.16.2.tar.xz) = f29a49b119b55db063bf69a6df57fd29667bb3ee7a22f3af7ea9cafa88b05ce21cae11464de073c1f0c963e46b571c94a5ccaed3f364f851fe8a4b5d5064e794 +SHA512 (samba-4.16.2.tar.asc) = bb22bb3da89bffdc213ed240204f8f801291db4ee0df73aa814e222355da5f774997a7a4f0a0685743a660bb4540e4b168dc2d3cd00bc22b9735caf140a3bfa0 From 58b6aadb0f9ad00ae65a959d3a98a553f45c55af Mon Sep 17 00:00:00 2001 From: Python Maint Date: Wed, 15 Jun 2022 18:06:15 +0200 Subject: [PATCH 061/295] Rebuilt for Python 3.11 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index e7fef22..55ef9e5 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.16.2 %global talloc_version 2.3.3 @@ -4156,6 +4156,9 @@ fi %endif %changelog +* Wed Jun 15 2022 Python Maint - 2:4.16.2-1 +- Rebuilt for Python 3.11 + * Mon Jun 13 2022 Guenther Deschner - 4.16.2-0 - Update to Samba 4.16.2 - resolves: #2096167 From 33e4d192980f56233c4f2cf82c0480887330cf95 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 24 Jun 2022 07:30:58 +0200 Subject: [PATCH 062/295] Fix BR with includelibs --- samba.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 55ef9e5..18d9b97 100644 --- a/samba.spec +++ b/samba.spec @@ -365,12 +365,18 @@ BuildRequires: lmdb-devel %if %{with dc} || %{with testsuite} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} -BuildRequires: ldb-tools BuildRequires: python3-gpg BuildRequires: python3-markdown BuildRequires: python3-setproctitle BuildRequires: python3-cryptography + +%if %{without includelibs} BuildRequires: tdb-tools +BuildRequires: ldb-tools +#endif without includelibs +%endif + +#endif with dc || with testsuite %endif # filter out perl requirements pulled in from examples in the docdir. From 9a15eb02f24c5a90e5aa4fce0f377823a0c44651 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 18 Jul 2022 17:37:37 +0200 Subject: [PATCH 063/295] Update to version 4.16.3 --- .gitignore | 2 ++ samba.spec | 6 +++++- sources | 4 ++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 18704d2..b916f33 100644 --- a/.gitignore +++ b/.gitignore @@ -293,3 +293,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.1.tar.asc /samba-4.16.2.tar.xz /samba-4.16.2.tar.asc +/samba-4.16.3.tar.xz +/samba-4.16.3.tar.asc diff --git a/samba.spec b/samba.spec index 18d9b97..5647e47 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ %global baserelease 1 -%global samba_version 4.16.2 +%global samba_version 4.16.3 %global talloc_version 2.3.3 %global tdb_version 1.4.6 %global tevent_version 0.12.0 @@ -2104,6 +2104,7 @@ fi %{_libdir}/samba/bind9/dlz_bind9_12.so %{_libdir}/samba/bind9/dlz_bind9_14.so %{_libdir}/samba/bind9/dlz_bind9_16.so +%{_libdir}/samba/bind9/dlz_bind9_18.so #endif with dc %endif @@ -4162,6 +4163,9 @@ fi %endif %changelog +* Mon Jul 18 2022 Andreas Schneider - 4.16.3-1 +- Update to version 4.16.3 + * Wed Jun 15 2022 Python Maint - 2:4.16.2-1 - Rebuilt for Python 3.11 diff --git a/sources b/sources index f34d266..433dbb4 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.2.tar.xz) = f29a49b119b55db063bf69a6df57fd29667bb3ee7a22f3af7ea9cafa88b05ce21cae11464de073c1f0c963e46b571c94a5ccaed3f364f851fe8a4b5d5064e794 -SHA512 (samba-4.16.2.tar.asc) = bb22bb3da89bffdc213ed240204f8f801291db4ee0df73aa814e222355da5f774997a7a4f0a0685743a660bb4540e4b168dc2d3cd00bc22b9735caf140a3bfa0 +SHA512 (samba-4.16.3.tar.xz) = aa11e65e52f57fd940d6b381fff7bac77bf94b421c1980b3731b36b815d27b6218f3192a7a8a1b9c7d27f80e381c9a7c8b7a0f76a2ec6cfad6b8748bbfd958cc +SHA512 (samba-4.16.3.tar.asc) = 98f07c312263e3ff4594fa1204184f15212f0c4771d45b349ab48981caefaa94aa7ae5223922d1cbaac9f423554b7a5c4107cb3a3599041cf38af6f665a9289a From 8939f84a48d5d770f53a791b7c15e55c78c36464 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 07:57:26 +0000 Subject: [PATCH 064/295] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 5647e47..45a80e5 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 2 %global samba_version 4.16.3 %global talloc_version 2.3.3 @@ -4163,6 +4163,9 @@ fi %endif %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 2:4.16.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Mon Jul 18 2022 Andreas Schneider - 4.16.3-1 - Update to version 4.16.3 From b41f002876d4edc137a6dd73737d3eceaf285909 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 27 Jul 2022 14:36:13 +0200 Subject: [PATCH 065/295] Update to version 4.16.4 resolves: #2111490 resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744 resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745 resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746 Guenther --- .gitignore | 2 ++ samba-mount_h.patch | 36 ++++++++++++++++++++++++++++ samba-s4u.patch | 58 ++++++++++++--------------------------------- samba.spec | 17 ++++++++++--- sources | 4 ++-- 5 files changed, 69 insertions(+), 48 deletions(-) create mode 100644 samba-mount_h.patch diff --git a/.gitignore b/.gitignore index b916f33..477e1dc 100644 --- a/.gitignore +++ b/.gitignore @@ -295,3 +295,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.2.tar.asc /samba-4.16.3.tar.xz /samba-4.16.3.tar.asc +/samba-4.16.4.tar.xz +/samba-4.16.4.tar.asc diff --git a/samba-mount_h.patch b/samba-mount_h.patch new file mode 100644 index 0000000..9b3ead2 --- /dev/null +++ b/samba-mount_h.patch @@ -0,0 +1,36 @@ +From 37b1f282d1b549063d2fca07caca812292be1d3b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 29 Jul 2022 10:08:24 +0200 +Subject: [PATCH] lib:replace: Remove from filesys.h + +You need to be careful if you include or +at least since glibc 2.36. + +Details at: +https://sourceware.org/glibc/wiki/Release/2.36#Usage_of_.3Clinux.2Fmount.h.3E_and_.3Csys.2Fmount.h.3E + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15132 + +Signed-off-by: Andreas Schneider +--- + lib/replace/system/filesys.h | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/lib/replace/system/filesys.h b/lib/replace/system/filesys.h +index 034e5d5886c..190c6b90f93 100644 +--- a/lib/replace/system/filesys.h ++++ b/lib/replace/system/filesys.h +@@ -36,10 +36,6 @@ + #include + #endif + +-#ifdef HAVE_SYS_MOUNT_H +-#include +-#endif +- + #ifdef HAVE_MNTENT_H + #include + #endif +-- +2.37.1 + diff --git a/samba-s4u.patch b/samba-s4u.patch index f447b86..5d3cb55 100644 --- a/samba-s4u.patch +++ b/samba-s4u.patch @@ -1,7 +1,7 @@ -From 17eb98d3f8ebd0fe48e218bb03a3c0165b9b6e95 Mon Sep 17 00:00:00 2001 +From 5d7ec9a00b6f4c6768c606d37d235415f2006445 Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:25:03 +0300 -Subject: [PATCH 1/4] mit-kdc: add basic loacl realm S4U support +Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -236,7 +236,7 @@ index 793fe366c35..22534c09974 100644 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 27b15828468..994dfed312b 100644 +index cb72b5de294..03c2c2ea1de 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c @@ -517,7 +517,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, @@ -247,7 +247,7 @@ index 27b15828468..994dfed312b 100644 krb5_db_entry *client, krb5_db_entry *server, krb5_db_entry *krbtgt, -@@ -682,7 +681,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, +@@ -689,7 +688,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, context, *pac, server->princ, @@ -256,7 +256,7 @@ index 27b15828468..994dfed312b 100644 deleg_blob); if (!NT_STATUS_IS_OK(nt_status)) { DEBUG(0, ("Update delegation info failed: %s\n", -@@ -1004,41 +1003,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, +@@ -1081,41 +1080,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, } int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, @@ -333,13 +333,13 @@ index 4431e82a1b2..9370ab533af 100644 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, char *pwd, -- -2.33.1 +2.37.1 -From f4fc23103f47b712baf3b4b0ebcb42d0f3f3fd42 Mon Sep 17 00:00:00 2001 +From 325912375cf54743ab8ea557172a72b870002e9f Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Fri, 27 Sep 2019 18:35:30 +0300 -Subject: [PATCH 2/4] krb5-mit: enable S4U client support for MIT build +Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build Signed-off-by: Isaac Boukris Pair-Programmed-With: Andreas Schneider @@ -350,10 +350,10 @@ Pair-Programmed-With: Andreas Schneider 3 files changed, 185 insertions(+), 13 deletions(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index 61d651b4d5f..462acec90b6 100644 +index 4321f07ca09..3fd95e47fca 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c -@@ -2699,6 +2699,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, +@@ -2702,6 +2702,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, return 0; } @@ -611,20 +611,20 @@ index 544d9d853cc..c14d8c72d8c 100644 ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, ccache, -- -2.33.1 +2.37.1 -From 48d73d552f2fbbdb07bd9aff4d0294883b70417f Mon Sep 17 00:00:00 2001 +From a5713b1558192f24348f7794da84bf65cf78e6ec Mon Sep 17 00:00:00 2001 From: Isaac Boukris Date: Sat, 19 Sep 2020 14:16:20 +0200 -Subject: [PATCH 3/4] wip: for canonicalization with new MIT kdc code +Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code --- source4/kdc/mit_samba.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 994dfed312b..9d039e5601b 100644 +index 03c2c2ea1de..30fade56531 100644 --- a/source4/kdc/mit_samba.c +++ b/source4/kdc/mit_samba.c @@ -232,6 +232,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, @@ -638,33 +638,5 @@ index 994dfed312b..9d039e5601b 100644 KRB5_KDB_FLAG_INCLUDE_PAC)) { /* -- -2.33.1 - - -From f5f54026d151f6d899e8ff52d8829a2f9cf57f25 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Dec 2021 12:17:11 +0100 -Subject: [PATCH 4/4] s4:kdc: Also cannoicalize krbtgt principals when - enforcing canonicalization - -Signed-off-by: Andreas Schneider ---- - source4/kdc/db-glue.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c -index 8d17038cfe6..77c0c0e4746 100644 ---- a/source4/kdc/db-glue.c -+++ b/source4/kdc/db-glue.c -@@ -946,7 +946,7 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context, - if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) { - p->is_krbtgt = true; - -- if (flags & (SDB_F_CANON)) { -+ if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) { - /* - * When requested to do so, ensure that the - * both realm values in the principal are set --- -2.33.1 +2.37.1 diff --git a/samba.spec b/samba.spec index 45a80e5..54c3317 100644 --- a/samba.spec +++ b/samba.spec @@ -134,13 +134,13 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 2 +%global baserelease 0 -%global samba_version 4.16.3 +%global samba_version 4.16.4 %global talloc_version 2.3.3 %global tdb_version 1.4.6 %global tevent_version 0.12.0 -%global ldb_version 2.5.1 +%global ldb_version 2.5.2 # This should be rc1 or nil %global pre_release %nil @@ -207,6 +207,8 @@ Source201: README.downgrade Patch0: samba-s4u.patch # https://gitlab.com/samba-team/samba/-/merge_requests/2477 Patch1: samba-4.16-waf-crypto.patch +# https://gitlab.com/samba-team/samba/-/merge_requests/2647 +Patch2: samba-mount_h.patch Requires(pre): /usr/sbin/groupadd Requires(post): systemd @@ -2979,6 +2981,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc @@ -3005,6 +3008,7 @@ fi %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py +%{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py @@ -4163,6 +4167,13 @@ fi %endif %changelog +* Wed Jul 27 2022 Guenther Deschner - 4.16.4-0 +- resolves: #2111490 - Update to version 4.16.4 +- resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 +- resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744 +- resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745 +- resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746 + * Sat Jul 23 2022 Fedora Release Engineering - 2:4.16.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 433dbb4..851386b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.3.tar.xz) = aa11e65e52f57fd940d6b381fff7bac77bf94b421c1980b3731b36b815d27b6218f3192a7a8a1b9c7d27f80e381c9a7c8b7a0f76a2ec6cfad6b8748bbfd958cc -SHA512 (samba-4.16.3.tar.asc) = 98f07c312263e3ff4594fa1204184f15212f0c4771d45b349ab48981caefaa94aa7ae5223922d1cbaac9f423554b7a5c4107cb3a3599041cf38af6f665a9289a +SHA512 (samba-4.16.4.tar.xz) = 263c33f202462c50ba9205232cc59f17eef6526bbe97cc1c6be6606e5e2fa8e235f24693da5ef00106ed126c5e2e1d83e2cfc0d2a690303ac94a8737e6760e95 +SHA512 (samba-4.16.4.tar.asc) = aec1d0dc15169dfa0f68776cff083b8a9ecfeb348d20cde02e236eda3548e1df13f6df3e9275ede6e8fdc6193b2fd304d2f493507b49f5877dbb6b7181d90367 From a74bd638b7842dfeaf48a1890db083d32c00a956 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20Zatloukal?= Date: Mon, 1 Aug 2022 15:10:39 +0200 Subject: [PATCH 066/295] Rebuilt for ICU 71.1 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 54c3317..e915388 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 +%global baserelease 1 %global samba_version 4.16.4 %global talloc_version 2.3.3 @@ -4167,6 +4167,9 @@ fi %endif %changelog +* Mon Aug 01 2022 Frantisek Zatloukal - 2:4.16.4-1 +- Rebuilt for ICU 71.1 + * Wed Jul 27 2022 Guenther Deschner - 4.16.4-0 - resolves: #2111490 - Update to version 4.16.4 - resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 From 8380904ad81171eb3f8bd2841bd4070f1efc91a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 8 Aug 2022 22:32:54 +0200 Subject: [PATCH 067/295] Update to version 4.17.0rc1 resolves: #2116503 Guenther --- .gitignore | 2 + samba-4.16-waf-crypto.patch | 77 ----- samba-mount_h.patch | 36 -- samba-s4u.patch | 642 ------------------------------------ samba.spec | 140 ++++---- sources | 4 +- 6 files changed, 84 insertions(+), 817 deletions(-) delete mode 100644 samba-4.16-waf-crypto.patch delete mode 100644 samba-mount_h.patch delete mode 100644 samba-s4u.patch diff --git a/.gitignore b/.gitignore index 477e1dc..cb83d82 100644 --- a/.gitignore +++ b/.gitignore @@ -297,3 +297,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.3.tar.asc /samba-4.16.4.tar.xz /samba-4.16.4.tar.asc +/samba-4.17.0rc1.tar.xz +/samba-4.17.0rc1.tar.asc diff --git a/samba-4.16-waf-crypto.patch b/samba-4.16-waf-crypto.patch deleted file mode 100644 index 337be97..0000000 --- a/samba-4.16-waf-crypto.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 41d3efebcf6abab9119f9b0f97c86c1c48739fee Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 4 Apr 2022 11:24:04 +0200 -Subject: [PATCH 1/2] waf: Check for GnuTLS earlier - -As GnuTLS is an essential part we need to check for it early so we can react on -GnuTLS features in other wscripts. - -Signed-off-by: Andreas Schneider ---- - wscript | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/wscript b/wscript -index d8220b35095..5b85d9a1682 100644 ---- a/wscript -+++ b/wscript -@@ -189,6 +189,8 @@ def configure(conf): - conf.RECURSE('dynconfig') - conf.RECURSE('selftest') - -+ conf.PROCESS_SEPARATE_RULE('system_gnutls') -+ - conf.CHECK_CFG(package='zlib', minversion='1.2.3', - args='--cflags --libs', - mandatory=True) -@@ -297,8 +299,6 @@ def configure(conf): - if not conf.CONFIG_GET('KRB5_VENDOR'): - conf.PROCESS_SEPARATE_RULE('embedded_heimdal') - -- conf.PROCESS_SEPARATE_RULE('system_gnutls') -- - conf.RECURSE('source4/dsdb/samdb/ldb_modules') - conf.RECURSE('source4/ntvfs/sysdep') - conf.RECURSE('lib/util') --- -2.35.1 - - -From 63701a28116afc1550c23cb5f7b9d6e366fd1270 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 4 Apr 2022 11:25:31 +0200 -Subject: [PATCH 2/2] third_party:waf: Do not recurse in aesni-intel if GnuTLS - provides the cipher - -Signed-off-by: Andreas Schneider ---- - third_party/wscript | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/third_party/wscript b/third_party/wscript -index 1f4bc1ce1d7..a17c15bcaa7 100644 ---- a/third_party/wscript -+++ b/third_party/wscript -@@ -5,7 +5,8 @@ from waflib import Options - def configure(conf): - conf.RECURSE('cmocka') - conf.RECURSE('popt') -- conf.RECURSE('aesni-intel') -+ if not conf.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'): -+ conf.RECURSE('aesni-intel') - if conf.CONFIG_GET('ENABLE_SELFTEST'): - conf.RECURSE('socket_wrapper') - conf.RECURSE('nss_wrapper') -@@ -18,7 +19,8 @@ def configure(conf): - def build(bld): - bld.RECURSE('cmocka') - bld.RECURSE('popt') -- bld.RECURSE('aesni-intel') -+ if not bld.CONFIG_SET('HAVE_GNUTLS_AES_CMAC'): -+ bld.RECURSE('aesni-intel') - if bld.CONFIG_GET('SOCKET_WRAPPER'): - bld.RECURSE('socket_wrapper') - if bld.CONFIG_GET('NSS_WRAPPER'): --- -2.35.1 - diff --git a/samba-mount_h.patch b/samba-mount_h.patch deleted file mode 100644 index 9b3ead2..0000000 --- a/samba-mount_h.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 37b1f282d1b549063d2fca07caca812292be1d3b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 29 Jul 2022 10:08:24 +0200 -Subject: [PATCH] lib:replace: Remove from filesys.h - -You need to be careful if you include or -at least since glibc 2.36. - -Details at: -https://sourceware.org/glibc/wiki/Release/2.36#Usage_of_.3Clinux.2Fmount.h.3E_and_.3Csys.2Fmount.h.3E - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15132 - -Signed-off-by: Andreas Schneider ---- - lib/replace/system/filesys.h | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/lib/replace/system/filesys.h b/lib/replace/system/filesys.h -index 034e5d5886c..190c6b90f93 100644 ---- a/lib/replace/system/filesys.h -+++ b/lib/replace/system/filesys.h -@@ -36,10 +36,6 @@ - #include - #endif - --#ifdef HAVE_SYS_MOUNT_H --#include --#endif -- - #ifdef HAVE_MNTENT_H - #include - #endif --- -2.37.1 - diff --git a/samba-s4u.patch b/samba-s4u.patch deleted file mode 100644 index 5d3cb55..0000000 --- a/samba-s4u.patch +++ /dev/null @@ -1,642 +0,0 @@ -From 5d7ec9a00b6f4c6768c606d37d235415f2006445 Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Fri, 27 Sep 2019 18:25:03 +0300 -Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support - -Signed-off-by: Isaac Boukris -Pair-Programmed-With: Andreas Schneider ---- - source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------ - source4/kdc/mit_samba.c | 47 ++------- - source4/kdc/mit_samba.h | 6 +- - 3 files changed, 71 insertions(+), 106 deletions(-) - -diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c -index 793fe366c35..22534c09974 100644 ---- a/source4/kdc/mit-kdb/kdb_samba_policies.c -+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c -@@ -200,13 +200,17 @@ static krb5_error_code ks_verify_pac(krb5_context context, - krb5_keyblock *krbtgt_key, - krb5_timestamp authtime, - krb5_authdata **tgt_auth_data, -- krb5_pac *pac) -+ krb5_pac *out_pac) - { - struct mit_samba_context *mit_ctx; - krb5_authdata **authdata = NULL; -- krb5_pac ipac = NULL; -- DATA_BLOB logon_data = { NULL, 0 }; -+ krb5_keyblock *header_server_key = NULL; -+ krb5_key_data *impersonator_kd = NULL; -+ krb5_keyblock impersonator_key = {0}; - krb5_error_code code; -+ krb5_pac pac; -+ -+ *out_pac = NULL; - - mit_ctx = ks_get_context(context); - if (mit_ctx == NULL) { -@@ -238,41 +242,43 @@ static krb5_error_code ks_verify_pac(krb5_context context, - code = krb5_pac_parse(context, - authdata[0]->contents, - authdata[0]->length, -- &ipac); -+ &pac); - if (code != 0) { - goto done; - } - -- /* TODO: verify this is correct -- * -- * In the constrained delegation case, the PAC is from a service -- * ticket rather than a TGT; we must verify the server and KDC -- * signatures to assert that the server did not forge the PAC. -+ /* -+ * For constrained delegation in MIT version < 1.18 we aren't provided -+ * with the 2nd ticket server key to verify the PAC. -+ * We can workaround that by fetching the key from the client db entry, -+ * which is the impersonator account in that version. -+ * TODO: use the provided entry in the new 1.18 version. - */ - if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) { -- code = krb5_pac_verify(context, -- ipac, -- authtime, -- client_princ, -- server_key, -- krbtgt_key); -+ /* The impersonator must be local. */ -+ if (client == NULL) { -+ code = KRB5KDC_ERR_BADOPTION; -+ goto done; -+ } -+ /* Fetch and decrypt 2nd ticket server's current key. */ -+ code = krb5_dbe_find_enctype(context, client, -1, -1, 0, -+ &impersonator_kd); -+ if (code != 0) { -+ goto done; -+ } -+ code = krb5_dbe_decrypt_key_data(context, NULL, -+ impersonator_kd, -+ &impersonator_key, NULL); -+ if (code != 0) { -+ goto done; -+ } -+ header_server_key = &impersonator_key; - } else { -- code = krb5_pac_verify(context, -- ipac, -- authtime, -- client_princ, -- krbtgt_key, -- NULL); -- } -- if (code != 0) { -- goto done; -+ header_server_key = krbtgt_key; - } - -- /* check and update PAC */ -- code = krb5_pac_parse(context, -- authdata[0]->contents, -- authdata[0]->length, -- pac); -+ code = krb5_pac_verify(context, pac, authtime, client_princ, -+ header_server_key, NULL); - if (code != 0) { - goto done; - } -@@ -280,17 +286,22 @@ static krb5_error_code ks_verify_pac(krb5_context context, - code = mit_samba_reget_pac(mit_ctx, - context, - flags, -- client_princ, - client, - server, - krbtgt, - krbtgt_key, -- pac); -+ &pac); -+ if (code != 0) { -+ goto done; -+ } -+ -+ *out_pac = pac; -+ pac = NULL; - - done: -+ krb5_free_keyblock_contents(context, &impersonator_key); - krb5_free_authdata(context, authdata); -- krb5_pac_free(context, ipac); -- free(logon_data.data); -+ krb5_pac_free(context, pac); - - return code; - } -@@ -319,6 +330,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krb5_authdata **pac_auth_data = NULL; - krb5_authdata **authdata = NULL; - krb5_boolean is_as_req; -+ krb5_const_principal pac_client; - krb5_error_code code; - krb5_pac pac = NULL; - krb5_data pac_data; -@@ -330,11 +342,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt; - krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key; - -- /* FIXME: We don't support S4U yet */ -- if (flags & KRB5_KDB_FLAGS_S4U) { -- return KRB5_KDB_DBTYPE_NOSUP; -- } -- - is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0); - - /* -@@ -395,6 +402,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - ks_client_princ = client->princ; - } - -+ /* In protocol transition, we are currently not provided with the tgt -+ * client name to verify the PAC, we could probably skip the name -+ * verification and just verify the signatures, but since we don't -+ * support cross-realm nor aliases, we can just use server->princ */ -+ if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) { -+ pac_client = server->princ; -+ } else { -+ pac_client = ks_client_princ; -+ } -+ - if (client_entry == NULL) { - client_entry = client; - } -@@ -469,7 +486,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - - code = ks_verify_pac(context, - flags, -- ks_client_princ, -+ pac_client, - client_entry, - server, - krbtgt, -@@ -515,7 +532,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - is_as_req ? "AS-REQ" : "TGS-REQ", - client_name); - code = krb5_pac_sign(context, pac, authtime, ks_client_princ, -- server_key, krbtgt_key, &pac_data); -+ server_key, krbtgt_key, &pac_data); - if (code != 0) { - DBG_ERR("krb5_pac_sign failed: %d\n", code); - goto done; -@@ -541,12 +558,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context, - KRB5_AUTHDATA_IF_RELEVANT, - authdata, - signed_auth_data); -- if (code != 0) { -- goto done; -- } -- -- code = 0; -- - done: - if (client_entry != NULL && client_entry != client) { - ks_free_principal(context, client_entry); -@@ -572,32 +583,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context, - * server; -> delegating service - * proxy; -> target principal - */ -- krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server); -- -- char *target_name = NULL; -- bool is_enterprise; -- krb5_error_code code; - - mit_ctx = ks_get_context(context); - if (mit_ctx == NULL) { - return KRB5_KDB_DBNOTINITED; - } - -- code = krb5_unparse_name(context, proxy, &target_name); -- if (code) { -- goto done; -- } -- -- is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL); -- -- code = mit_samba_check_s4u2proxy(mit_ctx, -- delegating_service, -- target_name, -- is_enterprise); -- --done: -- free(target_name); -- return code; -+ return mit_samba_check_s4u2proxy(mit_ctx, server, proxy); - } - - -diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index cb72b5de294..03c2c2ea1de 100644 ---- a/source4/kdc/mit_samba.c -+++ b/source4/kdc/mit_samba.c -@@ -517,7 +517,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, - krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, - krb5_context context, - int flags, -- krb5_const_principal client_principal, - krb5_db_entry *client, - krb5_db_entry *server, - krb5_db_entry *krbtgt, -@@ -689,7 +688,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, - context, - *pac, - server->princ, -- discard_const(client_principal), -+ client->princ, - deleg_blob); - if (!NT_STATUS_IS_OK(nt_status)) { - DEBUG(0, ("Update delegation info failed: %s\n", -@@ -1081,41 +1080,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, - } - - int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, -- krb5_db_entry *kentry, -- const char *target_name, -- bool is_nt_enterprise_name) -+ const krb5_db_entry *server, -+ krb5_const_principal target_principal) - { --#if 1 -- /* -- * This is disabled because mit_samba_update_pac_data() does not handle -- * S4U_DELEGATION_INFO -- */ -- -- return KRB5KDC_ERR_BADOPTION; --#else -- krb5_principal target_principal; -- int flags = 0; -- int ret; -- -- if (is_nt_enterprise_name) { -- flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE; -- } -- -- ret = krb5_parse_name_flags(ctx->context, target_name, -- flags, &target_principal); -- if (ret) { -- return ret; -- } -- -- ret = samba_kdc_check_s4u2proxy(ctx->context, -- ctx->db_ctx, -- skdc_entry, -- target_principal); -- -- krb5_free_principal(ctx->context, target_principal); -- -- return ret; --#endif -+ struct samba_kdc_entry *server_skdc_entry = -+ talloc_get_type_abort(server->e_data, -+ struct samba_kdc_entry); -+ -+ return samba_kdc_check_s4u2proxy(ctx->context, -+ ctx->db_ctx, -+ server_skdc_entry, -+ target_principal); - } - - static krb5_error_code mit_samba_change_pwd_error(krb5_context context, -diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h -index 4431e82a1b2..9370ab533af 100644 ---- a/source4/kdc/mit_samba.h -+++ b/source4/kdc/mit_samba.h -@@ -57,7 +57,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx, - krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx, - krb5_context context, - int flags, -- krb5_const_principal client_principal, - krb5_db_entry *client, - krb5_db_entry *server, - krb5_db_entry *krbtgt, -@@ -74,9 +73,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx, - DATA_BLOB *e_data); - - int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx, -- krb5_db_entry *kentry, -- const char *target_name, -- bool is_nt_enterprise_name); -+ const krb5_db_entry *server, -+ krb5_const_principal target_principal); - - int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx, - char *pwd, --- -2.37.1 - - -From 325912375cf54743ab8ea557172a72b870002e9f Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Fri, 27 Sep 2019 18:35:30 +0300 -Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build - -Signed-off-by: Isaac Boukris -Pair-Programmed-With: Andreas Schneider ---- - lib/krb5_wrap/krb5_samba.c | 185 ++++++++++++++++++++++++++ - lib/krb5_wrap/krb5_samba.h | 2 - - source4/auth/kerberos/kerberos_util.c | 11 -- - 3 files changed, 185 insertions(+), 13 deletions(-) - -diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index 4321f07ca09..3fd95e47fca 100644 ---- a/lib/krb5_wrap/krb5_samba.c -+++ b/lib/krb5_wrap/krb5_samba.c -@@ -2702,6 +2702,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, - - return 0; - } -+ -+#else /* MIT */ -+ -+static bool princ_compare_no_dollar(krb5_context ctx, -+ krb5_principal a, -+ krb5_principal b) -+{ -+ bool cmp; -+ krb5_principal mod = NULL; -+ -+ if (a->length == 1 && b->length == 1 && -+ a->data[0].length != 0 && b->data[0].length != 0 && -+ a->data[0].data[a->data[0].length -1] != -+ b->data[0].data[b->data[0].length -1]) { -+ if (a->data[0].data[a->data[0].length -1] == '$') { -+ mod = a; -+ mod->data[0].length--; -+ } else if (b->data[0].data[b->data[0].length -1] == '$') { -+ mod = b; -+ mod->data[0].length--; -+ } -+ } -+ -+ cmp = krb5_principal_compare_flags(ctx, a, b, -+ KRB5_PRINCIPAL_COMPARE_CASEFOLD); -+ -+ if (mod != NULL) { -+ mod->data[0].length++; -+ } -+ -+ return cmp; -+} -+ -+krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, -+ krb5_ccache store_cc, -+ krb5_principal init_principal, -+ const char *init_password, -+ krb5_principal impersonate_principal, -+ const char *self_service, -+ const char *target_service, -+ krb5_get_init_creds_opt *krb_options, -+ time_t *expire_time, -+ time_t *kdc_time) -+{ -+ krb5_error_code code; -+ krb5_principal self_princ = NULL; -+ krb5_principal target_princ = NULL; -+ krb5_creds *store_creds; -+ krb5_creds *s4u2self_creds = NULL; -+ krb5_creds *s4u2proxy_creds = NULL; -+ krb5_creds init_creds = {0}; -+ krb5_creds mcreds = {0}; -+ krb5_flags options = KRB5_GC_NO_STORE; -+ krb5_ccache tmp_cc; -+ bool s4u2proxy; -+ -+ code = krb5_cc_new_unique(ctx, "MEMORY", NULL, &tmp_cc); -+ if (code != 0) { -+ return code; -+ } -+ -+ code = krb5_get_init_creds_password(ctx, &init_creds, -+ init_principal, -+ init_password, -+ NULL, NULL, -+ 0, -+ NULL, -+ krb_options); -+ if (code != 0) { -+ goto done; -+ } -+ -+ code = krb5_cc_initialize(ctx, tmp_cc, init_creds.client); -+ if (code != 0) { -+ goto done; -+ } -+ -+ code = krb5_cc_store_cred(ctx, tmp_cc, &init_creds); -+ if (code != 0) { -+ goto done; -+ } -+ -+ /* -+ * Check if we also need S4U2Proxy or if S4U2Self is -+ * enough in order to get a ticket for the target. -+ */ -+ if (target_service == NULL) { -+ s4u2proxy = false; -+ } else if (strcmp(target_service, self_service) == 0) { -+ s4u2proxy = false; -+ } else { -+ s4u2proxy = true; -+ } -+ -+ code = krb5_parse_name(ctx, self_service, &self_princ); -+ if (code != 0) { -+ goto done; -+ } -+ -+ /* MIT lacks aliases support in S4U, for S4U2Self we require the tgt -+ * client and the request server to be the same principal name. */ -+ if (!princ_compare_no_dollar(ctx, init_creds.client, self_princ)) { -+ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; -+ goto done; -+ } -+ -+ mcreds.client = impersonate_principal; -+ mcreds.server = init_creds.client; -+ -+ code = krb5_get_credentials_for_user(ctx, options, tmp_cc, &mcreds, -+ NULL, &s4u2self_creds); -+ if (code != 0) { -+ goto done; -+ } -+ -+ if (s4u2proxy) { -+ code = krb5_parse_name(ctx, target_service, &target_princ); -+ if (code != 0) { -+ goto done; -+ } -+ -+ mcreds.client = init_creds.client; -+ mcreds.server = target_princ; -+ mcreds.second_ticket = s4u2self_creds->ticket; -+ -+ code = krb5_get_credentials(ctx, options | -+ KRB5_GC_CONSTRAINED_DELEGATION, -+ tmp_cc, &mcreds, &s4u2proxy_creds); -+ if (code != 0) { -+ goto done; -+ } -+ -+ /* Check KDC support of S4U2Proxy extension */ -+ if (!krb5_principal_compare(ctx, s4u2self_creds->client, -+ s4u2proxy_creds->client)) { -+ code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP; -+ goto done; -+ } -+ -+ store_creds = s4u2proxy_creds; -+ } else { -+ store_creds = s4u2self_creds;; -+ -+ /* We need to save the ticket with the requested server name -+ * or the caller won't be able to find it in cache. */ -+ if (!krb5_principal_compare(ctx, self_princ, -+ store_creds->server)) { -+ krb5_free_principal(ctx, store_creds->server); -+ store_creds->server = NULL; -+ code = krb5_copy_principal(ctx, self_princ, -+ &store_creds->server); -+ if (code != 0) { -+ goto done; -+ } -+ } -+ } -+ -+ code = krb5_cc_initialize(ctx, store_cc, store_creds->client); -+ if (code != 0) { -+ goto done; -+ } -+ -+ code = krb5_cc_store_cred(ctx, store_cc, store_creds); -+ if (code != 0) { -+ goto done; -+ } -+ -+ if (expire_time) { -+ *expire_time = (time_t) store_creds->times.endtime; -+ } -+ -+ if (kdc_time) { -+ *kdc_time = (time_t) store_creds->times.starttime; -+ } -+ -+done: -+ krb5_cc_destroy(ctx, tmp_cc); -+ krb5_free_cred_contents(ctx, &init_creds); -+ krb5_free_creds(ctx, s4u2self_creds); -+ krb5_free_creds(ctx, s4u2proxy_creds); -+ krb5_free_principal(ctx, self_princ); -+ krb5_free_principal(ctx, target_princ); -+ -+ return code; -+} - #endif - - #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA) -diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h -index a66b7465530..c8573f52bd9 100644 ---- a/lib/krb5_wrap/krb5_samba.h -+++ b/lib/krb5_wrap/krb5_samba.h -@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx, - krb5_get_init_creds_opt *krb_options, - time_t *expire_time, - time_t *kdc_time); --#ifdef SAMBA4_USES_HEIMDAL - krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, - krb5_ccache store_cc, - krb5_principal init_principal, -@@ -263,7 +262,6 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx, - krb5_get_init_creds_opt *krb_options, - time_t *expire_time, - time_t *kdc_time); --#endif - - #if defined(HAVE_KRB5_MAKE_PRINCIPAL) - #define smb_krb5_make_principal krb5_make_principal -diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c -index 544d9d853cc..c14d8c72d8c 100644 ---- a/source4/auth/kerberos/kerberos_util.c -+++ b/source4/auth/kerberos/kerberos_util.c -@@ -234,9 +234,7 @@ done: - { - krb5_error_code ret; - const char *password; --#ifdef SAMBA4_USES_HEIMDAL - const char *self_service; --#endif - const char *target_service; - time_t kdc_time = 0; - krb5_principal princ; -@@ -268,9 +266,7 @@ done: - return ret; - } - --#ifdef SAMBA4_USES_HEIMDAL - self_service = cli_credentials_get_self_service(credentials); --#endif - target_service = cli_credentials_get_target_service(credentials); - - password = cli_credentials_get_password(credentials); -@@ -331,7 +327,6 @@ done: - #endif - if (password) { - if (impersonate_principal) { --#ifdef SAMBA4_USES_HEIMDAL - ret = smb_krb5_kinit_s4u2_ccache(smb_krb5_context->krb5_context, - ccache, - princ, -@@ -342,12 +337,6 @@ done: - krb_options, - NULL, - &kdc_time); --#else -- talloc_free(mem_ctx); -- (*error_string) = "INTERNAL error: s4u2 ops " -- "are not supported with MIT build yet"; -- return EINVAL; --#endif - } else { - ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context, - ccache, --- -2.37.1 - - -From a5713b1558192f24348f7794da84bf65cf78e6ec Mon Sep 17 00:00:00 2001 -From: Isaac Boukris -Date: Sat, 19 Sep 2020 14:16:20 +0200 -Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code - ---- - source4/kdc/mit_samba.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c -index 03c2c2ea1de..30fade56531 100644 ---- a/source4/kdc/mit_samba.c -+++ b/source4/kdc/mit_samba.c -@@ -232,6 +232,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx, - if (kflags & KRB5_KDB_FLAG_CANONICALIZE) { - sflags |= SDB_F_CANON; - } -+#if KRB5_KDB_API_VERSION >= 10 -+ sflags |= SDB_F_FORCE_CANON; -+#endif - if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY | - KRB5_KDB_FLAG_INCLUDE_PAC)) { - /* --- -2.37.1 - diff --git a/samba.spec b/samba.spec index e915388..e4029cc 100644 --- a/samba.spec +++ b/samba.spec @@ -134,15 +134,15 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 1 +%global baserelease 0 -%global samba_version 4.16.4 -%global talloc_version 2.3.3 -%global tdb_version 1.4.6 -%global tevent_version 0.12.0 -%global ldb_version 2.5.2 +%global samba_version 4.17.0 +%global talloc_version 2.3.4 +%global tdb_version 1.4.7 +%global tevent_version 0.13.0 +%global ldb_version 2.6.1 # This should be rc1 or nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -204,12 +204,6 @@ Source15: samba.abignore Source201: README.downgrade -Patch0: samba-s4u.patch -# https://gitlab.com/samba-team/samba/-/merge_requests/2477 -Patch1: samba-4.16-waf-crypto.patch -# https://gitlab.com/samba-team/samba/-/merge_requests/2647 -Patch2: samba-mount_h.patch - Requires(pre): /usr/sbin/groupadd Requires(post): systemd Requires(preun): systemd @@ -1194,6 +1188,9 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" --systemd-smb-extra=%{_systemd_extra} \ --systemd-nmb-extra=%{_systemd_extra} \ --systemd-winbind-extra=%{_systemd_extra} \ +%if %{with clustering} + --systemd-ctdb-extra=%{_systemd_extra} \ +%endif --systemd-samba-extra=%{_systemd_extra} # Do not use %%make_build, make is just a wrapper around waf in Samba! @@ -1279,10 +1276,6 @@ install -m 0644 ctdb/config/ctdb.conf %{buildroot}%{_sysconfdir}/ctdb/ctdb.conf install -m 0644 %{SOURCE201} packaging/README.downgrade -%if %{with clustering} -install -m 0644 ctdb/config/ctdb.service %{buildroot}%{_unitdir} -%endif - # NetworkManager online/offline script install -d -m 0755 %{buildroot}%{_prefix}/lib/NetworkManager/dispatcher.d/ install -m 0755 packaging/NetworkManager/30-winbind-systemd \ @@ -2370,18 +2363,6 @@ fi %{python3_sitearch}/samba/__pycache__/dnsresolver.*.pyc %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc %{python3_sitearch}/samba/__pycache__/getopt.*.pyc -%{python3_sitearch}/samba/__pycache__/gpclass.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_cert_auto_enroll_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_chromium_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_ext_loader.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_firefox_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_firewalld_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_gnome_settings_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_msgs_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_scripts_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_sec_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_smb_conf_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/gp_sudoers_ext.*.pyc %{python3_sitearch}/samba/__pycache__/graph.*.pyc %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/__pycache__/idmap.*.pyc @@ -2399,14 +2380,6 @@ fi %{python3_sitearch}/samba/__pycache__/trust_utils.*.pyc %{python3_sitearch}/samba/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/__pycache__/upgradehelpers.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_access_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_files_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_issue_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_motd_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_openssh_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_startup_scripts_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_sudoers_ext.*.pyc -%{python3_sitearch}/samba/__pycache__/vgp_symlink_ext.*.pyc %{python3_sitearch}/samba/__pycache__/xattr.*.pyc %{python3_sitearch}/samba/_glue.*.so %{python3_sitearch}/samba/_ldb.*.so @@ -2468,11 +2441,6 @@ fi %{python3_sitearch}/samba/dsdb_dns.*.so %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py -%{python3_sitearch}/samba/gpclass.py -%{python3_sitearch}/samba/gp_gnome_settings_ext.py -%{python3_sitearch}/samba/gp_scripts_ext.py -%{python3_sitearch}/samba/gp_sec_ext.py -%{python3_sitearch}/samba/gpo.*.so %{python3_sitearch}/samba/graph.py %{python3_sitearch}/samba/hostconfig.py %{python3_sitearch}/samba/idmap.py @@ -2491,14 +2459,57 @@ fi %{python3_sitearch}/samba/emulate/__init__.py %{python3_sitearch}/samba/emulate/traffic.py %{python3_sitearch}/samba/emulate/traffic_packets.py -%{python3_sitearch}/samba/gp_cert_auto_enroll_ext.py -%{python3_sitearch}/samba/gp_chromium_ext.py -%{python3_sitearch}/samba/gp_ext_loader.py -%{python3_sitearch}/samba/gp_firefox_ext.py -%{python3_sitearch}/samba/gp_firewalld_ext.py -%{python3_sitearch}/samba/gp_msgs_ext.py -%{python3_sitearch}/samba/gp_smb_conf_ext.py -%{python3_sitearch}/samba/gp_sudoers_ext.py +%dir %{python3_sitearch}/samba/gp +%dir %{python3_sitearch}/samba/gp/__pycache__ +%{python3_sitearch}/samba/gp/__pycache__/gpclass.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_centrify_crontab_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_centrify_sudoers_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_cert_auto_enroll_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_chromium_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_ext_loader.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_firefox_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_firewalld_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_gnome_settings_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_msgs_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_scripts_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_sec_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_smb_conf_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_sudoers_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_access_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_files_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_issue_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_motd_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_openssh_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_startup_scripts_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_sudoers_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/vgp_symlink_ext.*.pyc +%{python3_sitearch}/samba/gp/gpclass.py +%{python3_sitearch}/samba/gp/gp_gnome_settings_ext.py +%{python3_sitearch}/samba/gp/gp_scripts_ext.py +%{python3_sitearch}/samba/gp/gp_sec_ext.py +%{python3_sitearch}/samba/gp/gp_centrify_crontab_ext.py +%{python3_sitearch}/samba/gp/gp_centrify_sudoers_ext.py +%{python3_sitearch}/samba/gp/gp_cert_auto_enroll_ext.py +%{python3_sitearch}/samba/gp/gp_chromium_ext.py +%{python3_sitearch}/samba/gp/gp_ext_loader.py +%{python3_sitearch}/samba/gp/gp_firefox_ext.py +%{python3_sitearch}/samba/gp/gp_firewalld_ext.py +%{python3_sitearch}/samba/gp/gp_msgs_ext.py +%{python3_sitearch}/samba/gp/gp_smb_conf_ext.py +%{python3_sitearch}/samba/gp/gp_sudoers_ext.py +%dir %{python3_sitearch}/samba/gp/util +%dir %{python3_sitearch}/samba/gp/util/__pycache__ +%{python3_sitearch}/samba/gp/util/__pycache__/logging.*.pyc +%{python3_sitearch}/samba/gp/util/logging.py +%{python3_sitearch}/samba/gp/vgp_access_ext.py +%{python3_sitearch}/samba/gp/vgp_files_ext.py +%{python3_sitearch}/samba/gp/vgp_issue_ext.py +%{python3_sitearch}/samba/gp/vgp_motd_ext.py +%{python3_sitearch}/samba/gp/vgp_openssh_ext.py +%{python3_sitearch}/samba/gp/vgp_startup_scripts_ext.py +%{python3_sitearch}/samba/gp/vgp_sudoers_ext.py +%{python3_sitearch}/samba/gp/vgp_symlink_ext.py +%{python3_sitearch}/samba/gpo.*.so %dir %{python3_sitearch}/samba/gp_parse %{python3_sitearch}/samba/gp_parse/__init__.py %dir %{python3_sitearch}/samba/gp_parse/__pycache__ @@ -2593,9 +2604,11 @@ fi %{python3_sitearch}/samba/samba3/mdscli.*.so %{python3_sitearch}/samba/samba3/param.*.so %{python3_sitearch}/samba/samba3/passdb.*.so +%{python3_sitearch}/samba/samba3/smbconf.*.so %{python3_sitearch}/samba/samba3/smbd.*.so %{python3_sitearch}/samba/sd_utils.py %{python3_sitearch}/samba/sites.py +%{python3_sitearch}/samba/smbconf.*.so %{python3_sitearch}/samba/subnets.py %dir %{python3_sitearch}/samba/subunit %{python3_sitearch}/samba/subunit/__init__.py @@ -2607,14 +2620,6 @@ fi %{python3_sitearch}/samba/trust_utils.py %{python3_sitearch}/samba/upgrade.py %{python3_sitearch}/samba/upgradehelpers.py -%{python3_sitearch}/samba/vgp_access_ext.py -%{python3_sitearch}/samba/vgp_files_ext.py -%{python3_sitearch}/samba/vgp_issue_ext.py -%{python3_sitearch}/samba/vgp_motd_ext.py -%{python3_sitearch}/samba/vgp_openssh_ext.py -%{python3_sitearch}/samba/vgp_startup_scripts_ext.py -%{python3_sitearch}/samba/vgp_sudoers_ext.py -%{python3_sitearch}/samba/vgp_symlink_ext.py %{python3_sitearch}/samba/werror.*.so %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so @@ -2760,6 +2765,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/logfiles.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc %{python3_sitearch}/samba/tests/__pycache__/messaging.*.pyc @@ -2777,6 +2783,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/ntlm_auth_krb5.*.pyc %{python3_sitearch}/samba/tests/__pycache__/pam_winbind.*.pyc %{python3_sitearch}/samba/tests/__pycache__/pam_winbind_chauthtok.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/pam_winbind_setcred.*.pyc %{python3_sitearch}/samba/tests/__pycache__/pam_winbind_warn_pwd_expire.*.pyc %{python3_sitearch}/samba/tests/__pycache__/param.*.pyc %{python3_sitearch}/samba/tests/__pycache__/password_hash.*.pyc @@ -2807,7 +2814,9 @@ fi %{python3_sitearch}/samba/tests/__pycache__/sddl.*.pyc %{python3_sitearch}/samba/tests/__pycache__/security.*.pyc %{python3_sitearch}/samba/tests/__pycache__/segfault.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/sid_strings.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/smbconf.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb-notify.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_base.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_fuzztest.*.pyc @@ -2842,6 +2851,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_dns.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_json.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/samba_dnsupdate.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls.*.pyc @@ -2858,6 +2868,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py +%{python3_sitearch}/samba/tests/blackbox/netads_dns.py %{python3_sitearch}/samba/tests/blackbox/netads_json.py %{python3_sitearch}/samba/tests/blackbox/samba_dnsupdate.py %{python3_sitearch}/samba/tests/blackbox/smbcacls.py @@ -2983,7 +2994,9 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/protected_users_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc @@ -3010,7 +3023,9 @@ fi %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py +%{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py +%{python3_sitearch}/samba/tests/krb5/protected_users_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py @@ -3033,6 +3048,7 @@ fi %{python3_sitearch}/samba/tests/ldap_upn_sam_account.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/loadparm.py +%{python3_sitearch}/samba/tests/logfiles.py %{python3_sitearch}/samba/tests/lsa_string.py %{python3_sitearch}/samba/tests/messaging.py %{python3_sitearch}/samba/tests/ndr.py @@ -3049,6 +3065,7 @@ fi %{python3_sitearch}/samba/tests/ntlm_auth_krb5.py %{python3_sitearch}/samba/tests/pam_winbind.py %{python3_sitearch}/samba/tests/pam_winbind_chauthtok.py +%{python3_sitearch}/samba/tests/pam_winbind_setcred.py %{python3_sitearch}/samba/tests/pam_winbind_warn_pwd_expire.py %{python3_sitearch}/samba/tests/param.py %{python3_sitearch}/samba/tests/password_hash.py @@ -3157,7 +3174,9 @@ fi %{python3_sitearch}/samba/tests/sddl.py %{python3_sitearch}/samba/tests/security.py %{python3_sitearch}/samba/tests/segfault.py +%{python3_sitearch}/samba/tests/sid_strings.py %{python3_sitearch}/samba/tests/smb.py +%{python3_sitearch}/samba/tests/smbconf.py %{python3_sitearch}/samba/tests/smb-notify.py %{python3_sitearch}/samba/tests/smbd_base.py %{python3_sitearch}/samba/tests/smbd_fuzztest.py @@ -3278,7 +3297,6 @@ fi %config(noreplace) %{_sysconfdir}/ctdb/nfs-checks.d/50.rquotad.check %{_sbindir}/ctdbd -%{_sbindir}/ctdbd_wrapper %{_bindir}/ctdb %{_bindir}/ctdb_diagnostics %{_bindir}/ltdbtool @@ -3311,7 +3329,6 @@ fi %{_mandir}/man1/onnode.1.gz %{_mandir}/man1/ltdbtool.1.gz %{_mandir}/man1/ping_pong.1.gz -%{_mandir}/man1/ctdbd_wrapper.1.gz %{_mandir}/man5/ctdb.conf.5.gz %{_mandir}/man5/ctdb-script.options.5.gz %{_mandir}/man5/ctdb.sysconfig.5.gz @@ -4167,6 +4184,9 @@ fi %endif %changelog +* Mon Aug 08 2022 Guenther Deschner - 4.17.0rc1-0 +- resolves: #2116503 - Update to version 4.17.0rc1 + * Mon Aug 01 2022 Frantisek Zatloukal - 2:4.16.4-1 - Rebuilt for ICU 71.1 diff --git a/sources b/sources index 851386b..70773ab 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.16.4.tar.xz) = 263c33f202462c50ba9205232cc59f17eef6526bbe97cc1c6be6606e5e2fa8e235f24693da5ef00106ed126c5e2e1d83e2cfc0d2a690303ac94a8737e6760e95 -SHA512 (samba-4.16.4.tar.asc) = aec1d0dc15169dfa0f68776cff083b8a9ecfeb348d20cde02e236eda3548e1df13f6df3e9275ede6e8fdc6193b2fd304d2f493507b49f5877dbb6b7181d90367 +SHA512 (samba-4.17.0rc1.tar.xz) = e3ba692d9f8dd7e8c4d853b69a1fed2bdc1946610f62ec789018320ad666022aa07f52b80e8f3012d8a6de9373c2fc31f5c5758859eabe7e48b4f9f1b6aa302b +SHA512 (samba-4.17.0rc1.tar.asc) = 2df0e15af5e60f7baa4415bf1f086dd266256a34ceb57e21cec5656b45d95bb801ad42c87f8910b1a97f3b0b9a90fd21519b78eaa5a1a842a1464d97ce9e283c From ce3b414c6d93cb268671b6c95f037ae1f07afe63 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Aug 2022 13:14:01 +0200 Subject: [PATCH 068/295] Regroup variables for version definitions --- samba.spec | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/samba.spec b/samba.spec index e4029cc..ac642e2 100644 --- a/samba.spec +++ b/samba.spec @@ -134,14 +134,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global baserelease 0 - %global samba_version 4.17.0 -%global talloc_version 2.3.4 -%global tdb_version 1.4.7 -%global tevent_version 0.13.0 -%global ldb_version 2.6.1 -# This should be rc1 or nil +%global baserelease 0 +# This should be rc1 or %%nil %global pre_release rc1 %global samba_release %{baserelease} @@ -149,6 +144,13 @@ %global samba_release 0.%{baserelease}.%{pre_release} %endif +%global talloc_version 2.3.4 +%global tdb_version 1.4.7 +%global tevent_version 0.13.0 +%global ldb_version 2.6.1 + +%global required_mit_krb5 1.19 + # This is a network daemon, do a hardened build # Enables PIE and full RELRO protection %global _hardened_build 1 @@ -165,8 +167,6 @@ %global libwbc_alternatives_suffix -64 %endif -%global required_mit_krb5 1.19 - %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" Name: samba From 9c2239737959211cf9edbdb20666cd61b83e15a4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 11 Aug 2022 16:10:41 +0200 Subject: [PATCH 069/295] Make sure we detect if SO version numbers of public libraries change. --- samba.spec | 67 ++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 47 insertions(+), 20 deletions(-) diff --git a/samba.spec b/samba.spec index ac642e2..c803220 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release rc1 @@ -144,6 +144,30 @@ %global samba_release 0.%{baserelease}.%{pre_release} %endif + +# If one of those versions change, we need to make sure we rebuilt or adapt +# projects comsuming those. This is e.g. sssd, openchange, evolution-mapi, ... +%global libdcerpc_binding_so_version 0 +%global libdcerpc_server_core_so_version 0 +%global libdcerpc_so_version 0 +%global libndr_krb5pac_so_version 0 +%global libndr_nbt_so_version 0 +%global libndr_so_version 3 +%global libndr_standard_so_version 0 +%global libnetapi_so_version 1 +%global libsamba_credentials_so_version 1 +%global libsamba_errors_so_version 1 +%global libsamba_hostconfig_so_version 0 +%global libsamba_passdb_so_version 0 +%global libsamba_util_so_version 0 +%global libsamdb_so_version 0 +%global libsmbconf_so_version 0 +%global libsmbldap_so_version 2 +%global libtevent_util_so_version 0 + +%global libsmbclient_so_version 0 +%global libwbclient_so_version 0 + %global talloc_version 2.3.4 %global tdb_version 1.4.7 %global tevent_version 0.13.0 @@ -1791,23 +1815,23 @@ fi ### CLIENT-LIBS %files client-libs -%{_libdir}/libdcerpc-binding.so.* -%{_libdir}/libdcerpc-server-core.so.* -%{_libdir}/libdcerpc.so.* -%{_libdir}/libndr-krb5pac.so.* -%{_libdir}/libndr-nbt.so.* -%{_libdir}/libndr-standard.so.* -%{_libdir}/libndr.so.* -%{_libdir}/libnetapi.so.* -%{_libdir}/libsamba-credentials.so.* -%{_libdir}/libsamba-errors.so.* -%{_libdir}/libsamba-hostconfig.so.* -%{_libdir}/libsamba-passdb.so.* -%{_libdir}/libsamba-util.so.* -%{_libdir}/libsamdb.so.* -%{_libdir}/libsmbconf.so.* -%{_libdir}/libsmbldap.so.* -%{_libdir}/libtevent-util.so.* +%{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* +%{_libdir}/libdcerpc-server-core.so.%{libdcerpc_server_core_so_version}* +%{_libdir}/libdcerpc.so.%{libdcerpc_so_version}* +%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* +%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* +%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* +%{_libdir}/libndr.so.%{libndr_so_version}* +%{_libdir}/libnetapi.so.%{libnetapi_so_version}* +%{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* +%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* +%{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* +%{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* +%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* +%{_libdir}/libsamdb.so.%{libsamdb_so_version}* +%{_libdir}/libsmbconf.so.%{libsmbconf_so_version}* +%{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* +%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* %dir %{_libdir}/samba %{_libdir}/samba/libCHARSET3-samba4.so @@ -1896,7 +1920,7 @@ fi %endif %if %{without libsmbclient} -%{_libdir}/samba/libsmbclient.so.* +%{_libdir}/samba/libsmbclient.so.%{libsmbclient_so_version}* %{_mandir}/man7/libsmbclient.7* #endif without libsmbclient %endif @@ -2293,7 +2317,7 @@ fi ### LIBWBCLIENT %if %{with libwbclient} %files -n libwbclient -%{_libdir}/samba/wbclient/libwbclient.so.* +%{_libdir}/samba/wbclient/libwbclient.so.%{libwbclient_so_version}* ### LIBWBCLIENT-DEVEL %files -n libwbclient-devel @@ -4184,6 +4208,9 @@ fi %endif %changelog +* Wed Aug 10 2022 Andreas Schneider - 4.17.0rc1-1 +- Make sure we detect if SO version numbers of public libraries change. + * Mon Aug 08 2022 Guenther Deschner - 4.17.0rc1-0 - resolves: #2116503 - Update to version 4.17.0rc1 From 9f943749c7a60e9e6b3142ed08f50515d06cca8d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 17 Aug 2022 10:50:03 +0200 Subject: [PATCH 070/295] Update to version 4.17.0rc2 resolves: #2118818 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index cb83d82..aa5ec6b 100644 --- a/.gitignore +++ b/.gitignore @@ -299,3 +299,5 @@ samba-3.6.0pre1.tar.gz /samba-4.16.4.tar.asc /samba-4.17.0rc1.tar.xz /samba-4.17.0rc1.tar.asc +/samba-4.17.0rc2.tar.xz +/samba-4.17.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index c803220..925bcc1 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4208,6 +4208,9 @@ fi %endif %changelog +* Wed Aug 17 2022 Guenther Deschner - 4.17.0rc2-2 +- resolves: #2118818 - Update to version 4.17.0rc2 + * Wed Aug 10 2022 Andreas Schneider - 4.17.0rc1-1 - Make sure we detect if SO version numbers of public libraries change. diff --git a/sources b/sources index 70773ab..c7679e2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc1.tar.xz) = e3ba692d9f8dd7e8c4d853b69a1fed2bdc1946610f62ec789018320ad666022aa07f52b80e8f3012d8a6de9373c2fc31f5c5758859eabe7e48b4f9f1b6aa302b -SHA512 (samba-4.17.0rc1.tar.asc) = 2df0e15af5e60f7baa4415bf1f086dd266256a34ceb57e21cec5656b45d95bb801ad42c87f8910b1a97f3b0b9a90fd21519b78eaa5a1a842a1464d97ce9e283c +SHA512 (samba-4.17.0rc2.tar.xz) = cacdfff9f04eb584769045262e3bfc51c32f11f1fde8c25d30fb65ab19af98d7e4742b9eb519241954d252d2f921d784b70411e1bcaa04c31482e4f6bcee4a8c +SHA512 (samba-4.17.0rc2.tar.asc) = 3ad03e22726b3e7313be273ed1523c679237824f97788ab307cdf1b2219d5fabb021530c42cdbb10ed92cdfa7753d83a00ab9533047eeaec674b7043c70279d4 From ffcfd9ef88ba6cdc3f54480f217a60bad11bc79e Mon Sep 17 00:00:00 2001 From: Kalev Lember Date: Thu, 18 Aug 2022 17:11:07 +0200 Subject: [PATCH 071/295] Avoid requiring systemd as per updated packaging guidelines There is no need to require systemd for the systemd scriptlets as systemd correctly handles reloading depending on the transaction ordering (even if systemd is installed _after_ the package that installs the unit file). --- samba.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 925bcc1..8d092a3 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release rc2 @@ -229,9 +229,6 @@ Source15: samba.abignore Source201: README.downgrade Requires(pre): /usr/sbin/groupadd -Requires(post): systemd -Requires(preun): systemd -Requires(postun): systemd Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -4208,6 +4205,9 @@ fi %endif %changelog +* Thu Aug 18 2022 Kalev Lember - 2:4.17.0-0.3.rc2 +- Avoid requiring systemd as per updated packaging guidelines + * Wed Aug 17 2022 Guenther Deschner - 4.17.0rc2-2 - resolves: #2118818 - Update to version 4.17.0rc2 From 63377a1809b91147e204d74cc28d26c9fec4b745 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 18 Aug 2022 14:57:13 +0200 Subject: [PATCH 072/295] Split out a samba-ldb-ldap-modules subpackage --- samba.spec | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 8d092a3..26dc09e 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release rc2 @@ -509,6 +509,7 @@ Summary: Tools for Samba servers and clients Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} +Requires: samba-ldb-ldap-modules = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -537,6 +538,7 @@ Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} @@ -693,6 +695,15 @@ If you need Kerberos for print jobs to a printer connection to cups via the SMB backend, then you need to install that package. It will allow cups to access the Kerberos credentials cache of the user issuing the print job. +### LDB-LDAP-MODULES +%package ldb-ldap-modules +Summary: Samba ldap modules for ldb +Requires: %{name}-client-libs = %{samba_depver} + +%description ldb-ldap-modules +This package contains the ldb ldap modules required by samba-tool and +samba-gpupdate. + ### LIBS %package libs Summary: Samba libraries @@ -2026,10 +2037,8 @@ fi %{_libdir}/samba/ldb/extended_dn_out.so %{_libdir}/samba/ldb/extended_dn_store.so %{_libdir}/samba/ldb/group_audit_log.so -%{_libdir}/samba/ldb/ildap.so %{_libdir}/samba/ldb/instancetype.so %{_libdir}/samba/ldb/lazy_commit.so -%{_libdir}/samba/ldb/ldbsamba_extensions.so %{_libdir}/samba/ldb/linked_attributes.so %{_libdir}/samba/ldb/new_partition.so %{_libdir}/samba/ldb/objectclass.so @@ -2281,6 +2290,11 @@ fi %attr(0700,root,root) %{_libexecdir}/samba/smbspool_krb5_wrapper %{_mandir}/man8/smbspool_krb5_wrapper.8* +### LDB-LDAP-MODULES +%files ldb-ldap-modules +%{_libdir}/samba/ldb/ldbsamba_extensions.so +%{_libdir}/samba/ldb/ildap.so + ### LIBS %files libs %{_libdir}/libdcerpc-samr.so.* @@ -4205,6 +4219,9 @@ fi %endif %changelog +* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.4.rc2 +- Split out a samba-ldb-ldap-modules subpackage + * Thu Aug 18 2022 Kalev Lember - 2:4.17.0-0.3.rc2 - Avoid requiring systemd as per updated packaging guidelines From b6eef47cea9072f1585604d2274c790e069485f7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 19 Aug 2022 12:47:14 +0200 Subject: [PATCH 073/295] Create a samba-gpupdate sub-package for GPO client support --- samba.spec | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 26dc09e..b3e0f64 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil %global pre_release rc2 @@ -680,6 +680,22 @@ Provides: bundled(libreplace) Samba VFS module for GlusterFS integration. %endif +### GPUPDATE +%if %{with dc} +%package gpupdate +Summary: Samba GPO support for clients +Requires: cepces +Requires: certmonger +Requires: %{name}-ldb-ldap-modules = %{samba_depver} +Requires: python3-%{name} = %{samba_depver} + +%description gpupdate +This package provides the samba-gpupdate tool to apply Group Policy Objects +(GPO) on Samba clients. + +# /with dc +%endif + ### KRB5-PRINTING %package krb5-printing Summary: Samba CUPS backend for printing with Kerberos @@ -2012,7 +2028,6 @@ fi %{_sbindir}/samba %{_sbindir}/samba_dnsupdate %{_sbindir}/samba_downgrade_db -%{_sbindir}/samba-gpupdate %{_sbindir}/samba_kcc %{_sbindir}/samba_spnupdate %{_sbindir}/samba_upgradedns @@ -2073,7 +2088,6 @@ fi %dir /var/lib/samba/sysvol %{_mandir}/man8/samba.8* %{_mandir}/man8/samba_downgrade_db.8* -%{_mandir}/man8/samba-gpupdate.8* %dir %{_datadir}/samba/admx %{_datadir}/samba/admx/samba.admx %dir %{_datadir}/samba/admx/en-US @@ -2285,6 +2299,13 @@ fi %{_mandir}/man8/vfs_glusterfs.8* %endif +### GPUPDATE +%if %{with dc} +%files gpupdate +%{_mandir}/man8/samba-gpupdate.8* +%{_sbindir}/samba-gpupdate +%endif + ### KRB5-PRINTING %files krb5-printing %attr(0700,root,root) %{_libexecdir}/samba/smbspool_krb5_wrapper @@ -4219,6 +4240,9 @@ fi %endif %changelog +* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.5.rc2 +- Create a samba-gpupdate sub-package for GPO client support + * Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.4.rc2 - Split out a samba-ldb-ldap-modules subpackage From 040a14f0398ca1b32209d64706c10f2bd64c98b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 23 Aug 2022 21:10:48 +0200 Subject: [PATCH 074/295] Update to version 4.17.0rc3 resolves: #2118818 --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index aa5ec6b..de42e3e 100644 --- a/.gitignore +++ b/.gitignore @@ -301,3 +301,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc1.tar.asc /samba-4.17.0rc2.tar.xz /samba-4.17.0rc2.tar.asc +/samba-4.17.0rc3.tar.asc +/samba-4.17.0rc3.tar.xz diff --git a/samba.spec b/samba.spec index b3e0f64..040b0ed 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 5 +%global baserelease 6 # This should be rc1 or %%nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4240,6 +4240,9 @@ fi %endif %changelog +* Tue Aug 23 2022 Pavel Filipenský - 4.17.0-0.6.rc3 +- resolves: #2118818 - Update to version 4.17.0rc3 + * Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.5.rc2 - Create a samba-gpupdate sub-package for GPO client support diff --git a/sources b/sources index c7679e2..1f83a1a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc2.tar.xz) = cacdfff9f04eb584769045262e3bfc51c32f11f1fde8c25d30fb65ab19af98d7e4742b9eb519241954d252d2f921d784b70411e1bcaa04c31482e4f6bcee4a8c -SHA512 (samba-4.17.0rc2.tar.asc) = 3ad03e22726b3e7313be273ed1523c679237824f97788ab307cdf1b2219d5fabb021530c42cdbb10ed92cdfa7753d83a00ab9533047eeaec674b7043c70279d4 +SHA512 (samba-4.17.0rc3.tar.asc) = af105c471e7404044b1cb5658dfb0479db09d49967e20f35e121fc2f9b71a2bbd7d61ee0a048502b36319f59e3e79cef838082393cf816dfc079b9dcb6cd18bd +SHA512 (samba-4.17.0rc3.tar.xz) = 545a31318fc9ebcf2b327fd98a96f2ce131c6f3e0e66e3b5d4d8cd939f21b66f0ba354867507411d462407af4aa2a1c2bf7f366604e14752e5d1206ecf5c6731 From 57b6ce7d3c41fe0e88fbacfaf3322d9312fb3abe Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 25 Aug 2022 08:17:04 +0200 Subject: [PATCH 075/295] python3-samba package should not require the samba package --- samba.spec | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 040b0ed..c79b092 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 6 +%global baserelease 7 # This should be rc1 or %%nil %global pre_release rc3 @@ -790,7 +790,6 @@ library. ### PYTHON3 %package -n python3-%{name} Summary: Samba Python3 libraries -Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -1993,7 +1992,7 @@ fi %{_mandir}/man5/smbpasswd.5* %{_mandir}/man7/samba.7* -### COMMON-libs +### COMMON-LIBS %files common-libs # common libraries %{_libdir}/samba/libcmdline-samba4.so @@ -4240,6 +4239,9 @@ fi %endif %changelog +* Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.7.rc3 +- python3-samba package should not require the samba package + * Tue Aug 23 2022 Pavel Filipenský - 4.17.0-0.6.rc3 - resolves: #2118818 - Update to version 4.17.0rc3 From c6f208e111128fa5e3f6ec1e2f92694e5db7d160 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 25 Aug 2022 09:58:00 -0700 Subject: [PATCH 076/295] Rebuild with no changes to fix F37 update grouping --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index c79b092..5e5be1d 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 7 +%global baserelease 8 # This should be rc1 or %%nil %global pre_release rc3 @@ -4239,6 +4239,9 @@ fi %endif %changelog +* Thu Aug 25 2022 Adam Williamson - 4.17.0-0.8.rc3 +- Rebuild with no changes to fix F37 update grouping + * Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.7.rc3 - python3-samba package should not require the samba package From 949729550873ed9682d137df5f5d10a14160eb88 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 31 Aug 2022 10:51:49 +0200 Subject: [PATCH 077/295] Update to version 4.17.0rc4 resolves: #2118818 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index de42e3e..ea31b28 100644 --- a/.gitignore +++ b/.gitignore @@ -303,3 +303,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc2.tar.asc /samba-4.17.0rc3.tar.asc /samba-4.17.0rc3.tar.xz +/samba-4.17.0rc4.tar.xz +/samba-4.17.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index 5e5be1d..c444309 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 8 +%global baserelease 9 # This should be rc1 or %%nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4239,6 +4239,9 @@ fi %endif %changelog +* Wed Aug 31 2022 Guenther Deschner - 4.17.0-0.9.rc4 +- resolves: #2118818 - Update to version 4.17.0rc4 + * Thu Aug 25 2022 Adam Williamson - 4.17.0-0.8.rc3 - Rebuild with no changes to fix F37 update grouping diff --git a/sources b/sources index 1f83a1a..f1969c9 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc3.tar.asc) = af105c471e7404044b1cb5658dfb0479db09d49967e20f35e121fc2f9b71a2bbd7d61ee0a048502b36319f59e3e79cef838082393cf816dfc079b9dcb6cd18bd -SHA512 (samba-4.17.0rc3.tar.xz) = 545a31318fc9ebcf2b327fd98a96f2ce131c6f3e0e66e3b5d4d8cd939f21b66f0ba354867507411d462407af4aa2a1c2bf7f366604e14752e5d1206ecf5c6731 +SHA512 (samba-4.17.0rc4.tar.xz) = 0181f6250e8f542904d91f38eb69285e432b7da12cf970bff0f6a548ad76b2ec533d454b487023c5918359f5278789edc440e1cff9a7fb78b5cc2b93bb7f7f9d +SHA512 (samba-4.17.0rc4.tar.asc) = 60b4f06cf82d3d71dddcad216bc3329356e424d32db17d881d734069c0743266c764b931dc60b630afb0698629a0b5ab83b364ef85275e265d5240101be540ea From 8fd6f2abb9362b579fff11c5e313762bd05382a4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 6 Sep 2022 18:49:00 +0200 Subject: [PATCH 078/295] Update to version 4.17.0rc5 resolves: #2118818 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index ea31b28..349a42d 100644 --- a/.gitignore +++ b/.gitignore @@ -305,3 +305,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc3.tar.xz /samba-4.17.0rc4.tar.xz /samba-4.17.0rc4.tar.asc +/samba-4.17.0rc5.tar.xz +/samba-4.17.0rc5.tar.asc diff --git a/samba.spec b/samba.spec index c444309..dd21f72 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 9 +%global baserelease 10 # This should be rc1 or %%nil -%global pre_release rc4 +%global pre_release rc5 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4239,6 +4239,9 @@ fi %endif %changelog +* Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 +- resolves: #2118818 - Update to version 4.17.0rc5 + * Wed Aug 31 2022 Guenther Deschner - 4.17.0-0.9.rc4 - resolves: #2118818 - Update to version 4.17.0rc4 diff --git a/sources b/sources index f1969c9..8211f68 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc4.tar.xz) = 0181f6250e8f542904d91f38eb69285e432b7da12cf970bff0f6a548ad76b2ec533d454b487023c5918359f5278789edc440e1cff9a7fb78b5cc2b93bb7f7f9d -SHA512 (samba-4.17.0rc4.tar.asc) = 60b4f06cf82d3d71dddcad216bc3329356e424d32db17d881d734069c0743266c764b931dc60b630afb0698629a0b5ab83b364ef85275e265d5240101be540ea +SHA512 (samba-4.17.0rc5.tar.xz) = b3f0467ac03aa1ec20b430eb6a2a52f1608bc476f226f11dc174957e0d9d8532aec7b26a4330f48d6277efb09b5f9ebb879945513f346861b0e08c2b9d05517f +SHA512 (samba-4.17.0rc5.tar.asc) = c1cd83b0dd912a112aad88a7599141bd41450755a628fee372f841ef949ac14002d47242a65e1602b6f2b53bd97a7a02043c91b340858caddc2b6561e5e14ede From d041102422b0cb3e32d219c74f2a7a37f010f4cc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 13 Sep 2022 10:14:02 +0200 Subject: [PATCH 079/295] Split out libnetapi(-devel) sub-packages resolves: rhbz#2093656 --- samba.spec | 42 +++++++++++++++++++++++++++++++++++++----- 1 file changed, 37 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index dd21f72..0ddeb5b 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 10 +%global baserelease 11 # This should be rc1 or %%nil %global pre_release rc5 @@ -236,6 +236,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -510,6 +511,7 @@ Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} +Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -618,6 +620,7 @@ Requires: %{name}-client-libs = %{samba_depver} %if %{with dc} Requires: %{name}-dc-libs = %{samba_depver} %endif +Requires: libnetapi = %{samba_depver} Provides: samba4-devel = %{samba_depver} Obsoletes: samba4-devel < %{samba_depver} @@ -738,6 +741,25 @@ Provides: bundled(libreplace) The %{name}-libs package contains the libraries needed by programs that link against the SMB, RPC and other protocols provided by the Samba suite. +### LIBNETAPI +%package -n libnetapi +Summary: The NETAPI library +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-client-libs = %{samba_depver} + +%description -n libnetapi +This contains the NETAPI library from the Samba suite. + +%package -n libnetapi-devel +Summary: Developer tools for the NETAPI library +Requires: libnetapi = %{samba_depver} + +%description -n libnetapi-devel +The libnetapi-devel package contains the header files and libraries needed to +develop programs that link against the NETAPI library in the Samba suite. + ### LIBSMBCLIENT %if %{with libsmbclient} %package -n libsmbclient @@ -874,6 +896,7 @@ Requires: %{name}-test-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} %endif Requires: %{name}-libs = %{samba_depver} +Requires: libnetapi = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif @@ -1845,7 +1868,6 @@ fi %{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* %{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* %{_libdir}/libndr.so.%{libndr_so_version}* -%{_libdir}/libnetapi.so.%{libnetapi_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* %{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* @@ -2196,7 +2218,6 @@ fi %{_includedir}/samba-4.0/ndr/ndr_krb5pac.h %{_includedir}/samba-4.0/ndr/ndr_svcctl.h %{_includedir}/samba-4.0/ndr/ndr_nbt.h -%{_includedir}/samba-4.0/netapi.h %{_includedir}/samba-4.0/param.h %{_includedir}/samba-4.0/passdb.h %{_includedir}/samba-4.0/policy.h @@ -2237,7 +2258,6 @@ fi %{_libdir}/libndr-nbt.so %{_libdir}/libndr-standard.so %{_libdir}/libndr.so -%{_libdir}/libnetapi.so %{_libdir}/libsamba-credentials.so %{_libdir}/libsamba-errors.so %{_libdir}/libsamba-hostconfig.so @@ -2251,7 +2271,6 @@ fi %{_libdir}/pkgconfig/ndr_krb5pac.pc %{_libdir}/pkgconfig/ndr_nbt.pc %{_libdir}/pkgconfig/ndr_standard.pc -%{_libdir}/pkgconfig/netapi.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc %{_libdir}/pkgconfig/samba-util.pc @@ -2331,6 +2350,16 @@ fi %{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so %{_libdir}/samba/libRPC-WORKER-samba4.so +### LIBNETAPI +%files -n libnetapi +%{_libdir}/libnetapi.so.%{libnetapi_so_version}* + +### LIBNETAPI-DEVEL +%files -n libnetapi-devel +%{_includedir}/samba-4.0/netapi.h +%{_libdir}/libnetapi.so +%{_libdir}/pkgconfig/netapi.pc + ### LIBSMBCLIENT %if %{with libsmbclient} %files -n libsmbclient @@ -4239,6 +4268,9 @@ fi %endif %changelog +* Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 +- resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages + * Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 - resolves: #2118818 - Update to version 4.17.0rc5 From ca4228ea9f031d3763d4ba159512d17ef8ffebe0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 13 Sep 2022 10:25:22 +0200 Subject: [PATCH 080/295] Add samba-usershare package resolves: rhbz#2096405 --- samba.spec | 25 ++++++++++++++++++++++++- smb.conf.vendor | 3 +++ usershares.conf.vendor | 3 +++ 3 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 usershares.conf.vendor diff --git a/samba.spec b/samba.spec index 0ddeb5b..a919391 100644 --- a/samba.spec +++ b/samba.spec @@ -224,9 +224,10 @@ Source11: smb.conf.vendor Source12: smb.conf.example Source13: pam_winbind.conf Source14: samba.pamd -Source15: samba.abignore +Source15: usershares.conf.vendor Source201: README.downgrade +Source202: samba.abignore Requires(pre): /usr/sbin/groupadd @@ -933,6 +934,17 @@ Provides: bundled(libreplace) %description test-libs %{name}-test-libs provides libraries required by the testing tools. +### USERSHARES +%package usershares +Summary: Provides support for non-root user shares +Requires: %{name} = %{samba_depver} +Requires: %{name}-common-tools = %{samba_depver} + +%description usershares +Installing this package will provide a configuration file, group and +directories to support non-root user shares. You can configure them +as a user using the `net usershare` command. + ### WINBIND %package winbind Summary: Samba winbind @@ -1284,6 +1296,7 @@ install -d -m 0755 %{buildroot}/var/lib/samba/lock install -d -m 0755 %{buildroot}/var/lib/samba/private install -d -m 0755 %{buildroot}/var/lib/samba/scripts install -d -m 0755 %{buildroot}/var/lib/samba/sysvol +install -d -m 0755 %{buildroot}/var/lib/samba/usershares install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged install -d -m 0755 %{buildroot}/var/log/samba/old install -d -m 0755 %{buildroot}/run/samba @@ -1311,6 +1324,7 @@ install -m 0644 %{SOURCE10} %{buildroot}%{_sysconfdir}/logrotate.d/samba install -m 0644 %{SOURCE11} %{buildroot}%{_sysconfdir}/samba/smb.conf install -m 0644 %{SOURCE12} %{buildroot}%{_sysconfdir}/samba/smb.conf.example +install -m 0644 %{SOURCE15} %{buildroot}%{_sysconfdir}/samba/usershares.conf install -d -m 0755 %{buildroot}%{_sysconfdir}/security install -m 0644 %{SOURCE13} %{buildroot}%{_sysconfdir}/security/pam_winbind.conf @@ -1603,6 +1617,9 @@ fi %ldconfig_scriptlets test +%pre usershares +getent group usershares >/dev/null || groupadd -r usershares || : + %pre winbind /usr/sbin/groupadd -g 88 wbpriv >/dev/null 2>&1 || : @@ -3303,6 +3320,11 @@ fi %{_libdir}/samba/libdsdb-module-samba4.so %endif +### USERSHARES +%files usershares +%config(noreplace) %{_sysconfdir}/samba/usershares.conf +%attr(1770,root,usershares) %dir /var/lib/samba/usershares + ### WINBIND %files winbind %{_libdir}/samba/idmap @@ -4270,6 +4292,7 @@ fi %changelog * Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 - resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages +- resolves: rhbz#2096405 - Add samba-usershare package * Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 - resolves: #2118818 - Update to version 4.17.0rc5 diff --git a/smb.conf.vendor b/smb.conf.vendor index 32441aa..e45384d 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,6 +18,9 @@ load printers = yes cups options = raw + # Install samba-usershares package for support + include = /etc/samba/usershares.conf + [homes] comment = Home Directories valid users = %S, %D%w%S diff --git a/usershares.conf.vendor b/usershares.conf.vendor new file mode 100644 index 0000000..38a7885 --- /dev/null +++ b/usershares.conf.vendor @@ -0,0 +1,3 @@ +[global] + usershare max shares = 100 + usershare allow guests = yes From 473cc2b5a41bb28b21bc07300b0780c974048311 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 30 Aug 2022 13:49:37 +0200 Subject: [PATCH 081/295] Update to version 4.17.0 resolves: rhbz#2118818 - Update to version 4.17.0 resolves: rhbz#2121138 - Fix CVE-2022-32743 resolves: rhbz#2122650 - Fix CVE-2022-1615 --- .gitignore | 2 ++ samba.spec | 9 +++++++-- sources | 4 ++-- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 349a42d..b6891e1 100644 --- a/.gitignore +++ b/.gitignore @@ -307,3 +307,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc4.tar.asc /samba-4.17.0rc5.tar.xz /samba-4.17.0rc5.tar.asc +/samba-4.17.0.tar.xz +/samba-4.17.0.tar.asc diff --git a/samba.spec b/samba.spec index a919391..0c751a9 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 11 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release rc5 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4290,6 +4290,11 @@ fi %endif %changelog +* Tue Sep 13 2022 Andreas Schneider - 4.17.0-1 +- resolves: rhbz#2118818 - Update to version 4.17.0 +- resolves: rhbz#2121138 - Fix CVE-2022-32743 +- resolves: rhbz#2122650 - Fix CVE-2022-1615 + * Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 - resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages - resolves: rhbz#2096405 - Add samba-usershare package diff --git a/sources b/sources index 8211f68..85be74a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0rc5.tar.xz) = b3f0467ac03aa1ec20b430eb6a2a52f1608bc476f226f11dc174957e0d9d8532aec7b26a4330f48d6277efb09b5f9ebb879945513f346861b0e08c2b9d05517f -SHA512 (samba-4.17.0rc5.tar.asc) = c1cd83b0dd912a112aad88a7599141bd41450755a628fee372f841ef949ac14002d47242a65e1602b6f2b53bd97a7a02043c91b340858caddc2b6561e5e14ede +SHA512 (samba-4.17.0.tar.xz) = 3d2f2ea37cb1acadd1abef6a321b9bcc552daa8d734ae1e48cb9dd07ae95d7fc22ea34f026bb6dddf09fad8cb0a38cd43ccf16e5d966e21f2499d0da5d77973f +SHA512 (samba-4.17.0.tar.asc) = f07912eb373cb93e95ed7ea08cdd456fc977c7383eab093d2e3476bde59b871b1fce2dc075e5a940861d07646e4f459384e37a9b20f9e9d11b4c3785c8dec2c7 From ea9a21adf05bc28a6e05e45cb224ca3cd3c3df5d Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 14 Sep 2022 16:10:01 +0530 Subject: [PATCH 082/295] Do not remove ldb-ldap-modules files from buildroot New sub-package samba-ldb-ldap-modules requires corresponding files to be present in buildroot irrespective of whether DC components are enabled or not in the build process. Therefore refrain from removing those from the buildroot. --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index 0c751a9..c2ac924 100644 --- a/samba.spec +++ b/samba.spec @@ -1377,8 +1377,6 @@ for i in \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ %{_mandir}/man8/samba-gpupdate.8 \ - %{_libdir}/samba/ldb/ildap.so \ - %{_libdir}/samba/ldb/ldbsamba_extensions.so \ %{_unitdir}/samba.service \ %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ %{python3_sitearch}/samba/dnsserver.py \ From d54cbd1fbf85a76b8fd56f8c46669fd170fbe547 Mon Sep 17 00:00:00 2001 From: Troy Dawson Date: Tue, 27 Sep 2022 18:18:24 +0000 Subject: [PATCH 083/295] add BuildRequires: systemd-rpm-macros Although the spec requires systemd-rpm-macros for macros such as %{_unitdir} it was only getting pulled in as a dependency of other packages. Dependencies have changed, and systemd-rpm-macros is no longer getting pulled in. Add the BuildRequires so we always get it. Signed-off-by: Troy Dawson tdawson@redhat.com --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index c2ac924..61457fd 100644 --- a/samba.spec +++ b/samba.spec @@ -311,6 +311,7 @@ BuildRequires: readline-devel BuildRequires: rpcgen BuildRequires: rpcsvc-proto-devel BuildRequires: sed +BuildRequires: systemd-rpm-macros BuildRequires: libtasn1-devel # We need asn1Parser BuildRequires: libtasn1-tools From 93ae555a841585d369e18cc22469d0a345c9e0d4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 5 Oct 2022 11:37:23 +0200 Subject: [PATCH 084/295] Move group creation logic to sysusers.d fragment --- samba-systemd-sysusers.conf | 2 ++ samba-usershares-systemd-sysusers.conf | 2 ++ samba.spec | 21 ++++++++++++++++++++- 3 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 samba-systemd-sysusers.conf create mode 100644 samba-usershares-systemd-sysusers.conf diff --git a/samba-systemd-sysusers.conf b/samba-systemd-sysusers.conf new file mode 100644 index 0000000..60ad7a5 --- /dev/null +++ b/samba-systemd-sysusers.conf @@ -0,0 +1,2 @@ +#Type Name ID +g printadmin - diff --git a/samba-usershares-systemd-sysusers.conf b/samba-usershares-systemd-sysusers.conf new file mode 100644 index 0000000..33f8fcb --- /dev/null +++ b/samba-usershares-systemd-sysusers.conf @@ -0,0 +1,2 @@ +#Type Name ID +g usershares - diff --git a/samba.spec b/samba.spec index 61457fd..d938ac8 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.0 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -225,6 +225,8 @@ Source12: smb.conf.example Source13: pam_winbind.conf Source14: samba.pamd Source15: usershares.conf.vendor +Source16: samba-systemd-sysusers.conf +Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore @@ -1348,6 +1350,10 @@ echo "d /run/samba 755 root root" > %{buildroot}%{_tmpfilesdir}/samba.conf echo "d /run/ctdb 755 root root" > %{buildroot}%{_tmpfilesdir}/ctdb.conf %endif +install -d -m 0755 %{buildroot}%{_sysusersdir} +install -m 0644 %{SOURCE16} %{buildroot}%{_sysusersdir}/samba.conf +install -m 0644 %{SOURCE17} %{buildroot}%{_sysusersdir}/samba-usershares.conf + install -d -m 0755 %{buildroot}%{_sysconfdir}/sysconfig install -m 0644 packaging/systemd/samba.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/samba %if %{with clustering} @@ -1508,7 +1514,11 @@ export WINBINDD_DONT_LOG_STDOUT=1 %systemd_postun_with_restart nmb.service %pre common +%if 0%{?fedora} || 0%{?rhel} > 8 +%sysusers_create_compat %{SOURCE16} +%else getent group printadmin >/dev/null || groupadd -r printadmin || : +%endif %post common %{?ldconfig} @@ -1617,7 +1627,11 @@ fi %ldconfig_scriptlets test %pre usershares +%if 0%{?fedora} || 0%{?rhel} > 8 +%sysusers_create_compat %{SOURCE17} +%else getent group usershares >/dev/null || groupadd -r usershares || : +%endif %pre winbind /usr/sbin/groupadd -g 88 wbpriv >/dev/null 2>&1 || : @@ -2011,6 +2025,7 @@ fi ### COMMON %files common %{_tmpfilesdir}/samba.conf +%{_sysusersdir}/samba.conf %dir %{_sysconfdir}/logrotate.d/ %config(noreplace) %{_sysconfdir}/logrotate.d/samba %attr(0700,root,root) %dir /var/log/samba @@ -3323,6 +3338,7 @@ fi %files usershares %config(noreplace) %{_sysconfdir}/samba/usershares.conf %attr(1770,root,usershares) %dir /var/lib/samba/usershares +%{_sysusersdir}/samba-usershares.conf ### WINBIND %files winbind @@ -4289,6 +4305,9 @@ fi %endif %changelog +* Wed Oct 05 2022 Andreas Schneider - 4.17.0-2 +- Move group creation logic to sysusers.d fragment + * Tue Sep 13 2022 Andreas Schneider - 4.17.0-1 - resolves: rhbz#2118818 - Update to version 4.17.0 - resolves: rhbz#2121138 - Fix CVE-2022-32743 From 593cdb59632041ad6cc3e80b8203fbd4e85d9a9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 19 Oct 2022 15:55:11 +0200 Subject: [PATCH 085/295] Update to version 4.17.1 resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists resolves: rhbz#2133818 - rpcclient 4.17.0 unable to resolve server hostname --- .gitignore | 2 ++ samba.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index b6891e1..af251a8 100644 --- a/.gitignore +++ b/.gitignore @@ -309,3 +309,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0rc5.tar.asc /samba-4.17.0.tar.xz /samba-4.17.0.tar.asc +/samba-4.17.1.tar.xz +/samba-4.17.1.tar.asc diff --git a/samba.spec b/samba.spec index d938ac8..ce5de41 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.0 -%global baserelease 2 +%global samba_version 4.17.1 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -3108,6 +3108,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc @@ -3137,6 +3138,7 @@ fi %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py +%{python3_sitearch}/samba/tests/krb5/lockout_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py @@ -4305,6 +4307,11 @@ fi %endif %changelog +* Wed Oct 19 2022 Pavel Filipenský - 4.17.1-1 +- Update to version 4.17.1 +- resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists +- resolves: rhbz#2133818 - rpcclient 4.17.0 unable to resolve server hostname + * Wed Oct 05 2022 Andreas Schneider - 4.17.0-2 - Move group creation logic to sysusers.d fragment diff --git a/sources b/sources index 85be74a..f1afe23 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.0.tar.xz) = 3d2f2ea37cb1acadd1abef6a321b9bcc552daa8d734ae1e48cb9dd07ae95d7fc22ea34f026bb6dddf09fad8cb0a38cd43ccf16e5d966e21f2499d0da5d77973f -SHA512 (samba-4.17.0.tar.asc) = f07912eb373cb93e95ed7ea08cdd456fc977c7383eab093d2e3476bde59b871b1fce2dc075e5a940861d07646e4f459384e37a9b20f9e9d11b4c3785c8dec2c7 +SHA512 (samba-4.17.1.tar.xz) = fd1dd3059c484b550cfc694b14b32bb509c4e0b0e209e15b4ddc98ceba4bee8b4d94c5a488a98f75cafaf1d36dde912d738b6f79cba8bf14037c314ad9bfe4b9 +SHA512 (samba-4.17.1.tar.asc) = 921eec6894195d68922ef86c0c9d741cee17f98e7381f4e8ee99a8fe8168f569cb094b73a4e4094070f9b3ea677cf2db670dba55191fe8b417aa85b804f1fe03 From 5175b7717873da52775dd86c9654612640ed4f9b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 24 Oct 2022 16:58:29 +0200 Subject: [PATCH 086/295] Add missing dependency for wbinfo used by ctdb scripts --- samba.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index ce5de41..3114aa8 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.1 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -1067,6 +1067,7 @@ Summary: A Clustered Database based on Samba's Trivial Database (TDB) Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-winbind-clients = %{samba_depver} Requires: coreutils # for ps and killall @@ -4307,6 +4308,9 @@ fi %endif %changelog +* Mon Oct 24 2022 Andreas Schneider - 4.17.1-2 +- Add missing dependency for wbinfo used by ctdb scripts + * Wed Oct 19 2022 Pavel Filipenský - 4.17.1-1 - Update to version 4.17.1 - resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists From 9f35dd7b526d75eda23c181eb4cb1a99e3dc3e1a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 25 Oct 2022 13:15:13 +0200 Subject: [PATCH 087/295] Update to version 4.17.2 --- .gitignore | 2 + samba-4.17-fix-changeuserpassword4.patch | 540 +++++++++++++++++++++++ samba.spec | 11 +- sources | 4 +- 4 files changed, 554 insertions(+), 3 deletions(-) create mode 100644 samba-4.17-fix-changeuserpassword4.patch diff --git a/.gitignore b/.gitignore index af251a8..3dd6a6b 100644 --- a/.gitignore +++ b/.gitignore @@ -311,3 +311,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.0.tar.asc /samba-4.17.1.tar.xz /samba-4.17.1.tar.asc +/samba-4.17.2.tar.xz +/samba-4.17.2.tar.asc diff --git a/samba-4.17-fix-changeuserpassword4.patch b/samba-4.17-fix-changeuserpassword4.patch new file mode 100644 index 0000000..7f1b482 --- /dev/null +++ b/samba-4.17-fix-changeuserpassword4.patch @@ -0,0 +1,540 @@ +From a3e3d05f35d6082ea48450060b39084e3d0e4056 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 10 Oct 2022 15:15:20 +0200 +Subject: [PATCH 1/5] s3:librpc: Improve GSE error message + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 + +Signed-off-by: Andreas Schneider +Reviewed-by: Noel Power +--- + source3/librpc/crypto/gse.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c +index c50a8a036df..c2cac7abf82 100644 +--- a/source3/librpc/crypto/gse.c ++++ b/source3/librpc/crypto/gse.c +@@ -546,11 +546,28 @@ init_sec_context_done: + goto done; + case GSS_S_FAILURE: + switch (gss_min) { +- case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: +- DBG_NOTICE("Server principal not found\n"); ++ case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: { ++ gss_buffer_desc name_token = { ++ .length = 0, ++ }; ++ ++ gss_maj = gss_display_name(&gss_min, ++ gse_ctx->server_name, ++ &name_token, ++ NULL); ++ if (gss_maj == GSS_S_COMPLETE) { ++ DBG_NOTICE("Server principal %.*s not found\n", ++ (int)name_token.length, ++ (char *)name_token.value); ++ gss_release_buffer(&gss_maj, &name_token); ++ } else { ++ DBG_NOTICE("Server principal not found\n"); ++ } ++ + /* Make SPNEGO ignore us, we can't go any further here */ + status = NT_STATUS_INVALID_PARAMETER; + goto done; ++ } + case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED: + DBG_NOTICE("Ticket expired\n"); + /* Make SPNEGO ignore us, we can't go any further here */ +-- +2.37.3 + + +From d2e2e9acd717e45806f1b19378e09f39c8fe3da8 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 7 Oct 2022 14:35:15 +0200 +Subject: [PATCH 2/5] s3:rpcclient: Pass salt down to + init_samr_CryptPasswordAES() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 + +Signed-off-by: Andreas Schneider +Reviewed-by: Noel Power +--- + source3/rpc_client/init_samr.c | 15 ++++----------- + source3/rpc_client/init_samr.h | 1 + + source3/rpcclient/cmd_samr.c | 8 ++++++++ + source4/libnet/libnet_passwd.c | 13 +++++++------ + source4/torture/rpc/samr.c | 27 +++++++++++++++++++++++++++ + 5 files changed, 47 insertions(+), 17 deletions(-) + +diff --git a/source3/rpc_client/init_samr.c b/source3/rpc_client/init_samr.c +index 68f42b602b3..52fa2f90d6e 100644 +--- a/source3/rpc_client/init_samr.c ++++ b/source3/rpc_client/init_samr.c +@@ -79,6 +79,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, + + NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + const char *password, ++ DATA_BLOB *salt, + DATA_BLOB *session_key, + struct samr_EncryptedPasswordAES *ppwd_buf) + { +@@ -87,12 +88,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + .data = pw_data, + .length = sizeof(pw_data), + }; +- size_t iv_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_256_CBC); +- uint8_t iv_data[iv_size]; +- DATA_BLOB iv = { +- .data = iv_data, +- .length = iv_size, +- }; + DATA_BLOB ciphertext = data_blob_null; + NTSTATUS status = NT_STATUS_UNSUCCESSFUL; + bool ok; +@@ -101,8 +96,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + return NT_STATUS_INVALID_PARAMETER; + } + +- generate_nonce_buffer(iv.data, iv.length); +- + ok = encode_pwd_buffer514_from_str(pw_data, password, STR_UNICODE); + if (!ok) { + return NT_STATUS_INTERNAL_ERROR; +@@ -114,7 +107,7 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + session_key, + &samr_aes256_enc_key_salt, + &samr_aes256_mac_key_salt, +- &iv, ++ salt, + &ciphertext, + ppwd_buf->auth_data); + BURN_DATA(pw_data); +@@ -126,8 +119,8 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + ppwd_buf->cipher = ciphertext.data; + ppwd_buf->PBKDF2Iterations = 0; + +- SMB_ASSERT(iv.length == sizeof(ppwd_buf->salt)); +- memcpy(ppwd_buf->salt, iv.data, iv.length); ++ SMB_ASSERT(salt->length == sizeof(ppwd_buf->salt)); ++ memcpy(ppwd_buf->salt, salt->data, salt->length); + + return NT_STATUS_OK; + } +diff --git a/source3/rpc_client/init_samr.h b/source3/rpc_client/init_samr.h +index 940534e7168..71b4c0e573d 100644 +--- a/source3/rpc_client/init_samr.h ++++ b/source3/rpc_client/init_samr.h +@@ -47,6 +47,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, + */ + NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, + const char *password, ++ DATA_BLOB *salt, + DATA_BLOB *session_key, + struct samr_EncryptedPasswordAES *ppwd_buf); + +diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c +index 9ccd2f78a8d..8106ca90cf2 100644 +--- a/source3/rpcclient/cmd_samr.c ++++ b/source3/rpcclient/cmd_samr.c +@@ -3172,6 +3172,11 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, + uint8_t nt_hash[16]; + uint8_t lm_hash[16]; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + uint8_t password_expired = 0; + struct dcerpc_binding_handle *b = cli->binding_handle; + TALLOC_CTX *frame = NULL; +@@ -3198,6 +3203,8 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, + goto done; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + switch(level) { + case 18: + case 21: +@@ -3220,6 +3227,7 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, + case 31: + status = init_samr_CryptPasswordAES(frame, + param, ++ &salt, + &session_key, + &pwd_buf_aes); + if (!NT_STATUS_IS_OK(status)) { +diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c +index 4f662110e55..a1672104824 100644 +--- a/source4/libnet/libnet_passwd.c ++++ b/source4/libnet/libnet_passwd.c +@@ -57,13 +57,13 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + struct samr_EncryptedPasswordAES pwd_buf = { + .cipher_len = 0 + }; +- DATA_BLOB iv = { ++ DATA_BLOB salt = { + .data = pwd_buf.salt, + .length = sizeof(pwd_buf.salt), + }; +- gnutls_datum_t iv_datum = { +- .data = iv.data, +- .size = iv.length, ++ gnutls_datum_t salt_datum = { ++ .data = pwd_buf.salt, ++ .size = sizeof(pwd_buf.salt), + }; + uint64_t pbkdf2_iterations = generate_random_u64_range(5000, 1000000); + NTSTATUS status; +@@ -71,11 +71,11 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + + E_md4hash(old_password, old_nt_key_data); + +- generate_nonce_buffer(iv.data, iv.length); ++ generate_nonce_buffer(salt.data, salt.length); + + rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512, + &old_nt_key, +- &iv_datum, ++ &salt_datum, + pbkdf2_iterations, + cek.data, + cek.length); +@@ -86,6 +86,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + + status = init_samr_CryptPasswordAES(mem_ctx, + new_password, ++ &salt, + &cek, + &pwd_buf); + data_blob_clear(&cek); +diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c +index de354659067..0b1880efa18 100644 +--- a/source4/torture/rpc/samr.c ++++ b/source4/torture/rpc/samr.c +@@ -783,6 +783,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t + struct samr_SetUserInfo s; + union samr_UserInfo u; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + char *newpass = NULL; + struct dcerpc_binding_handle *b = p->binding_handle; + struct samr_GetUserPwInfo pwp; +@@ -818,8 +823,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t + return false; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info32.password); + torture_assert_ntstatus_ok(tctx, +@@ -852,6 +860,7 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t + + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info32.password); + torture_assert_ntstatus_ok(tctx, +@@ -896,6 +905,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t + union samr_UserInfo u; + bool ret = true; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + char *newpass; + struct dcerpc_binding_handle *b = p->binding_handle; + struct samr_GetUserPwInfo pwp; +@@ -931,8 +945,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t + return false; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info31.password); + torture_assert_ntstatus_ok(tctx, +@@ -959,6 +976,7 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t + + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info31.password); + torture_assert_ntstatus_ok(tctx, +@@ -1381,6 +1399,11 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + union samr_UserInfo u; + bool ret = true; + DATA_BLOB session_key; ++ uint8_t salt_data[16]; ++ DATA_BLOB salt = { ++ .data = salt_data, ++ .length = sizeof(salt_data), ++ }; + char *newpass; + struct dcerpc_binding_handle *b = p->binding_handle; + struct samr_GetUserPwInfo pwp; +@@ -1490,6 +1513,8 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + return false; + } + ++ generate_nonce_buffer(salt.data, salt.length); ++ + switch (level) { + case 18: + { +@@ -1561,6 +1586,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + case 31: + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info31.password); + +@@ -1568,6 +1594,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, + case 32: + status = init_samr_CryptPasswordAES(tctx, + newpass, ++ &salt, + &session_key, + &u.info32.password); + +-- +2.37.3 + + +From 1d630363c9b2497266e418aad89c55d5b51a63ad Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 17 Oct 2022 09:02:28 +0200 +Subject: [PATCH 3/5] s4:libnet: If we successfully changed the password we are + done + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 + +Signed-off-by: Andreas Schneider +Reviewed-by: Noel Power +--- + source4/libnet/libnet_passwd.c | 32 ++++++++++++++++++-------------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c +index a1672104824..b17614bcd97 100644 +--- a/source4/libnet/libnet_passwd.c ++++ b/source4/libnet/libnet_passwd.c +@@ -101,7 +101,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + r.in.password = &pwd_buf; + + status = dcerpc_samr_ChangePasswordUser4_r(h, mem_ctx, &r); +- if (NT_STATUS_IS_OK(status)) { ++ if (!NT_STATUS_IS_OK(status)) { + goto done; + } + if (!NT_STATUS_IS_OK(r.out.result)) { +@@ -112,6 +112,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, + account->string, + nt_errstr(status)); + status = r.out.result; ++ goto done; + } + + done: +@@ -424,20 +425,23 @@ static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CT + r->samr.in.oldpassword, + r->samr.in.newpassword, + &(r->samr.out.error_string)); +- if (!NT_STATUS_IS_OK(status)) { +- if (NT_STATUS_EQUAL(status, +- NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || +- NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || +- NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { +- /* +- * Don't fallback to RC4 based SAMR if weak crypto is not +- * allowed. +- */ +- if (lpcfg_weak_crypto(ctx->lp_ctx) == +- SAMBA_WEAK_CRYPTO_DISALLOWED) { +- goto disconnect; +- } ++ if (NT_STATUS_IS_OK(status)) { ++ goto disconnect; ++ } else if (NT_STATUS_EQUAL(status, ++ NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || ++ NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || ++ NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { ++ /* ++ * Don't fallback to RC4 based SAMR if weak crypto is not ++ * allowed. ++ */ ++ if (lpcfg_weak_crypto(ctx->lp_ctx) == ++ SAMBA_WEAK_CRYPTO_DISALLOWED) { ++ goto disconnect; + } ++ } else { ++ /* libnet_ChangePassword_samr_aes is implemented and failed */ ++ goto disconnect; + } + + status = libnet_ChangePassword_samr_rc4( +-- +2.37.3 + + +From 9a4a169ab34641afb87e7f81708c9a72b321879e Mon Sep 17 00:00:00 2001 +From: Noel Power +Date: Fri, 21 Oct 2022 17:40:36 +0100 +Subject: [PATCH 4/5] s4/rpc_server/sambr: don't mutate the return of + samdb_set_password_aes + +prior to this commit return of samdb_set_password_aes was set to +NT_STATUS_WRONG_PASSWORD on failure. Useful status that should be +returned such as NT_STATUS_PASSWORD_RESTRICTION are swallowed here +otherwise (and in this case can be partially responsible for failures +in test samba.tests.auth_log_pass_change (with later gnutls) + +Signed-off-by: Noel Power +Reviewed-by: Andreas Schneider +--- + source4/rpc_server/samr/samr_password.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c +index 4691f9a47a9..b581be6361c 100644 +--- a/source4/rpc_server/samr/samr_password.c ++++ b/source4/rpc_server/samr/samr_password.c +@@ -250,7 +250,6 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call, + + if (!NT_STATUS_IS_OK(status)) { + ldb_transaction_cancel(sam_ctx); +- status = NT_STATUS_WRONG_PASSWORD; + goto done; + } + +-- +2.37.3 + + +From b8b36ecba0f22dbc203c12627ebd629c2437c635 Mon Sep 17 00:00:00 2001 +From: Noel Power +Date: Fri, 21 Oct 2022 17:14:44 +0100 +Subject: [PATCH 5/5] python/samba/tests: fix samba.tests.auth_log_pass_change + for later gnutls + +later gnutls that support GNUTLS_PBKDF2 currently fail, +we need to conditionally switch test data to reflect use of +'samr_ChangePasswordUser3' or 'samr_ChangePasswordUser4' +depending on whether GNUTLS_PBKDF2 is supported or not + +Signed-off-by: Noel Power +Reviewed-by: Andreas Schneider +--- + python/samba/tests/auth_log_pass_change.py | 20 ++++++++++++++++---- + source4/selftest/tests.py | 9 ++++++--- + 2 files changed, 22 insertions(+), 7 deletions(-) + +diff --git a/python/samba/tests/auth_log_pass_change.py b/python/samba/tests/auth_log_pass_change.py +index 972af2158dd..1ca46c586b3 100644 +--- a/python/samba/tests/auth_log_pass_change.py ++++ b/python/samba/tests/auth_log_pass_change.py +@@ -72,6 +72,18 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + + # discard any auth log messages for the password setup + self.discardMessages() ++ gnutls_pbkdf2_support = samba.tests.env_get_var_value( ++ 'GNUTLS_PBKDF2_SUPPORT', ++ allow_missing=True) ++ if gnutls_pbkdf2_support is None: ++ gnutls_pbkdf2_support = '0' ++ self.gnutls_pbkdf2_support = bool(int(gnutls_pbkdf2_support)) ++ ++ def _authDescription(self): ++ if self.gnutls_pbkdf2_support: ++ return "samr_ChangePasswordUser4" ++ else: ++ return "samr_ChangePasswordUser3" + + def tearDown(self): + super(AuthLogPassChangeTests, self).tearDown() +@@ -83,7 +95,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_SUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +@@ -109,7 +121,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_UNSUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +@@ -141,7 +153,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_UNSUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +@@ -174,7 +186,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): + (msg["Authentication"]["serviceDescription"] == + "SAMR Password Change") and + (msg["Authentication"]["authDescription"] == +- "samr_ChangePasswordUser3") and ++ self._authDescription()) and + (msg["Authentication"]["eventId"] == + EVT_ID_UNSUCCESSFUL_LOGON) and + (msg["Authentication"]["logonType"] == +diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py +index a803d4704ea..c92105586a7 100755 +--- a/source4/selftest/tests.py ++++ b/source4/selftest/tests.py +@@ -1094,9 +1094,11 @@ if have_heimdal_support: + environ={'CLIENT_IP': '10.53.57.11', + 'SOCKET_WRAPPER_DEFAULT_IFACE': 11}) + planoldpythontestsuite("ad_dc_smb1", "samba.tests.auth_log_pass_change", +- extra_args=['-U"$USERNAME%$PASSWORD"']) ++ extra_args=['-U"$USERNAME%$PASSWORD"'], ++ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) + planoldpythontestsuite("ad_dc_ntvfs", "samba.tests.auth_log_pass_change", +- extra_args=['-U"$USERNAME%$PASSWORD"']) ++ extra_args=['-U"$USERNAME%$PASSWORD"'], ++ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) + + # these tests use a NCA local RPC connection, so always run on the + # :local testenv, and so don't need to fake a client connection +@@ -1113,7 +1115,8 @@ if have_heimdal_support: + "samba.tests.auth_log_winbind", + extra_args=['-U"$DC_USERNAME%$DC_PASSWORD"']) + planoldpythontestsuite("ad_dc", "samba.tests.audit_log_pass_change", +- extra_args=['-U"$USERNAME%$PASSWORD"']) ++ extra_args=['-U"$USERNAME%$PASSWORD"'], ++ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) + planoldpythontestsuite("ad_dc", "samba.tests.audit_log_dsdb", + extra_args=['-U"$USERNAME%$PASSWORD"']) + planoldpythontestsuite("ad_dc", "samba.tests.group_audit", +-- +2.37.3 + diff --git a/samba.spec b/samba.spec index 3114aa8..7b7411c 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.1 +%global samba_version 4.17.2 %global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -1167,7 +1167,11 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB %prep +%if 0%{?fedora} || 0%{?rhel} >= 9 +xzcat %{SOURCE0} | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data=- +%else xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - +%endif %autosetup -n samba-%{version}%{pre_release} -p1 # Ensure we rely on GnuTLS and do not build any other crypto code shipping with @@ -4308,6 +4312,11 @@ fi %endif %changelog +* Tue Oct 25 2022 Andreas Schneider - 4.17.2-1 +- Update to version 4.17.2 +- Fix CVE-2022-3592: A malicious client can use a symlink to escape the + exported + * Mon Oct 24 2022 Andreas Schneider - 4.17.1-2 - Add missing dependency for wbinfo used by ctdb scripts diff --git a/sources b/sources index f1afe23..7e71a49 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.1.tar.xz) = fd1dd3059c484b550cfc694b14b32bb509c4e0b0e209e15b4ddc98ceba4bee8b4d94c5a488a98f75cafaf1d36dde912d738b6f79cba8bf14037c314ad9bfe4b9 -SHA512 (samba-4.17.1.tar.asc) = 921eec6894195d68922ef86c0c9d741cee17f98e7381f4e8ee99a8fe8168f569cb094b73a4e4094070f9b3ea677cf2db670dba55191fe8b417aa85b804f1fe03 +SHA512 (samba-4.17.2.tar.xz) = 6450deb75ee0b0a6a8e814f62e71973fe4d3e04050a3af42d1c6a3fb3603f0b2b02fa2b86e9a2309f1141a7f2d4ddc32ec4f51457f3c6d735fd19c9750254e31 +SHA512 (samba-4.17.2.tar.asc) = 0cb78e234e812d853ea2e795dbd2dba13bdd45e484a206ecaa54fb353e5d55697bb4cddc5d6e46bf43fa6d5bbcc32d62324dc907d0d122f99bcb3c220ab7d1ef From eaa90f47190b8d6d911791883a77a4c691f9da54 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 26 Oct 2022 11:31:30 +0200 Subject: [PATCH 088/295] Add missing require for libcmdline from samba-common-libs --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 7b7411c..95f8160 100644 --- a/samba.spec +++ b/samba.spec @@ -722,6 +722,7 @@ the Kerberos credentials cache of the user issuing the print job. %package ldb-ldap-modules Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-common-libs = %{samba_depver} %description ldb-ldap-modules This package contains the ldb ldap modules required by samba-tool and From cc1c088518319f44f53100bb6b435daf8f4e9daf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 2 Nov 2022 15:56:16 +0100 Subject: [PATCH 089/295] Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional --- samba.spec | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/samba.spec b/samba.spec index 95f8160..7e1931f 100644 --- a/samba.spec +++ b/samba.spec @@ -197,17 +197,13 @@ Name: samba Version: %{samba_version} Release: %{samba_release}%{?dist} -%if 0%{?rhel} -Epoch: 0 -%else +%if 0%{?fedora} Epoch: 2 +%else +Epoch: 0 %endif -%if 0%{?epoch} > 0 %global samba_depver %{epoch}:%{version}-%{release} -%else -%global samba_depver %{version}-%{release} -%endif Summary: Server and Client software to interoperate with Windows machines License: GPLv3+ and LGPLv3+ @@ -4313,6 +4309,9 @@ fi %endif %changelog +* Wed Nov 02 2022 Pavel Filipenský - 4.17.2-1 +- Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional + * Tue Oct 25 2022 Andreas Schneider - 4.17.2-1 - Update to version 4.17.2 - Fix CVE-2022-3592: A malicious client can use a symlink to escape the From 3fcbe364b29d8a7cf37fdf06d564e258498af1f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 15 Nov 2022 18:39:46 +0100 Subject: [PATCH 090/295] Update to version 4.17.3 resolves: #2142959 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 3dd6a6b..de0b909 100644 --- a/.gitignore +++ b/.gitignore @@ -313,3 +313,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.1.tar.asc /samba-4.17.2.tar.xz /samba-4.17.2.tar.asc +/samba-4.17.3.tar.xz +/samba-4.17.3.tar.asc diff --git a/samba.spec b/samba.spec index 7e1931f..d6948ad 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.2 -%global baserelease 2 +%global samba_version 4.17.3 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4309,6 +4309,9 @@ fi %endif %changelog +* Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 +- resolves: #2142959 - Update to version 4.17.3 + * Wed Nov 02 2022 Pavel Filipenský - 4.17.2-1 - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional diff --git a/sources b/sources index 7e71a49..663dead 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.2.tar.xz) = 6450deb75ee0b0a6a8e814f62e71973fe4d3e04050a3af42d1c6a3fb3603f0b2b02fa2b86e9a2309f1141a7f2d4ddc32ec4f51457f3c6d735fd19c9750254e31 -SHA512 (samba-4.17.2.tar.asc) = 0cb78e234e812d853ea2e795dbd2dba13bdd45e484a206ecaa54fb353e5d55697bb4cddc5d6e46bf43fa6d5bbcc32d62324dc907d0d122f99bcb3c220ab7d1ef +SHA512 (samba-4.17.3.tar.xz) = e346460ab53a5ed1f534992e21bb53c790fa4ba50752f0cf31d46fb96d138e4723a0171705ef8bf4ce3354960ddacc5a82b75975b06dcbe3224a09951174a5e7 +SHA512 (samba-4.17.3.tar.asc) = 814976c76a43b46fe67bd9a904fe3846104680446dfaf5759989a60ce1a088adb264c0bf67eccf9634fe84b3eb7ac1b8dbd020fcabf5e586c1773a2edad86306 From 441bd49ffc16fb145531c2ee71c7c68fa834e56f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 16 Nov 2022 00:50:27 +0100 Subject: [PATCH 091/295] Security fixes for CVE-2022-42898 resolves: #2140960, #2143117 Guenther --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index d6948ad..d04f6e9 100644 --- a/samba.spec +++ b/samba.spec @@ -4311,6 +4311,7 @@ fi %changelog * Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 - resolves: #2142959 - Update to version 4.17.3 +- resolves: #2140960, #2143117 - Security fixes for CVE-2022-42898 * Wed Nov 02 2022 Pavel Filipenský - 4.17.2-1 - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional From 14cc94aae154c42623f6260a9ae472d173ae0e58 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Mon, 21 Nov 2022 15:28:44 +0100 Subject: [PATCH 092/295] Memoize python3_sitearch for faster RPM spec file processing This greatly speeds up the creation of source RPMs, among other things. --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index d04f6e9..6bfb75c 100644 --- a/samba.spec +++ b/samba.spec @@ -193,6 +193,10 @@ %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" +# Make a copy of this variable to prevent repeated evaluation of the +# embedded shell command. +%global python3_sitearch %{python3_sitearch} + Name: samba Version: %{samba_version} Release: %{samba_release}%{?dist} From c7d395b20cfa9799afc54565451607c25907abbb Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Mon, 21 Nov 2022 15:44:40 +0100 Subject: [PATCH 093/295] Avoid recursive python3_sitearch expansion even if undefined Fixes an error during SRPM construction if not enough dependencies are installed (e.g., during the first build stage in mock): error: /builddir/build/SPECS/samba.spec: line 2478: Too many levels of recursion in macro expansion. It is likely caused by recursive macro declaration. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 6bfb75c..b8ffdac 100644 --- a/samba.spec +++ b/samba.spec @@ -194,8 +194,8 @@ %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" # Make a copy of this variable to prevent repeated evaluation of the -# embedded shell command. -%global python3_sitearch %{python3_sitearch} +# embedded shell command. Avoid recursive macro definition if undefined. +%{?python3_sitearch: %global python3_sitearch %{python3_sitearch}} Name: samba Version: %{samba_version} From 22ec3a0a0d740ffe16f1d4013dbea9ff5aa24106 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Wed, 23 Nov 2022 15:20:50 +0100 Subject: [PATCH 094/295] Remove C89-specific language constructs from configure checks Fix feature detection for major/minor macros. Related to: --- samba-sysmacros.patch | 31 +++++++++++++++++++++++ samba-waf18.patch | 23 +++++++++++++++++ samba-wscript-c99.patch | 55 +++++++++++++++++++++++++++++++++++++++++ samba.spec | 9 ++++++- 4 files changed, 117 insertions(+), 1 deletion(-) create mode 100644 samba-sysmacros.patch create mode 100644 samba-waf18.patch create mode 100644 samba-wscript-c99.patch diff --git a/samba-sysmacros.patch b/samba-sysmacros.patch new file mode 100644 index 0000000..60f0489 --- /dev/null +++ b/samba-sysmacros.patch @@ -0,0 +1,31 @@ +source3/wscript: Fix detection of major/minor macros + +These macros are only available via as of glibc +commit e16deca62e16f645213dffd4ecd1153c37765f17 ("[BZ #19239] Don't +include sys/sysmacros.h from sys/types.h."), which went into +glibc 2.28. + +This is different from the usual C99 cleanups because it changes +the configure check result with existing compilers that usually +accept implicit function declarations. + +Submitted upstream: + +diff --git a/source3/wscript b/source3/wscript +index 22be17a1a6fd1126..ca27deaa54381446 100644 +--- a/source3/wscript ++++ b/source3/wscript +@@ -603,11 +603,11 @@ msg.msg_accrightslen = sizeof(fd); + conf.CHECK_HEADERS('asm/types.h') + + conf.CHECK_CODE('dev_t dev; int i = major(dev); return 0', "HAVE_DEVICE_MAJOR_FN", +- headers='unistd.h sys/types.h', ++ headers='sys/sysmacros.h unistd.h sys/types.h', + msg="Checking for major macro") + + conf.CHECK_CODE('dev_t dev; int i = minor(dev); return 0', "HAVE_DEVICE_MINOR_FN", +- headers='unistd.h sys/types.h', ++ headers='sys/sysmacros.h unistd.h sys/types.h', + msg="Checking for minor macro") + + conf.CHECK_STRUCTURE_MEMBER('struct dirent', 'd_off', diff --git a/samba-waf18.patch b/samba-waf18.patch new file mode 100644 index 0000000..84dcf7a --- /dev/null +++ b/samba-waf18.patch @@ -0,0 +1,23 @@ +Avoid calling lib_func without a prototype. + +This commit mirrors the change in commit f4c0a750d4adebcf2342a44e85f04526c34 +("WAF: Fix detection of linker features") +to buildtools/wafsamba/samba_conftests.py. It fixes the check for rpath +support with compilers in strict C99 mode. + +Submitted upstream: + +diff --git a/buildtools/wafsamba/samba_waf18.py b/buildtools/wafsamba/samba_waf18.py +index e2a078bd3a05fd78..cfdceea14ca4b706 100644 +--- a/buildtools/wafsamba/samba_waf18.py ++++ b/buildtools/wafsamba/samba_waf18.py +@@ -209,7 +209,8 @@ def CHECK_LIBRARY_SUPPORT(conf, rpath=False, version_script=False, msg=None): + lib_node.parent.mkdir() + lib_node.write('int lib_func(void) { return 42; }\n', 'w') + main_node = bld.srcnode.make_node('main.c') +- main_node.write('int main(void) {return !(lib_func() == 42);}', 'w') ++ main_node.write('int lib_func(void);\n' ++ 'int main(void) {return !(lib_func() == 42);}', 'w') + linkflags = [] + if version_script: + script = bld.srcnode.make_node('ldscript') diff --git a/samba-wscript-c99.patch b/samba-wscript-c99.patch new file mode 100644 index 0000000..11457cf --- /dev/null +++ b/samba-wscript-c99.patch @@ -0,0 +1,55 @@ +source3/wscript: Remove implict int and implicit function declarations + +This should fix the remaining C89isms in these configure checks. + +Submitted upstream: + +diff --git a/source3/wscript b/source3/wscript +index ca27deaa54381446..e77cd127e600f8c2 100644 +--- a/source3/wscript ++++ b/source3/wscript +@@ -1314,7 +1314,7 @@ syscall(SYS_initgroups, 16, NULL, NULL, 0); + + if conf.CHECK_CODE(''' + #include +-main() { ++int main() { + struct tm *tm; + if (sizeof(time_t) == 8) { + time_t max_time = 0x7fffffffffffffffll; +@@ -1345,7 +1345,7 @@ main() { + #if defined(HAVE_SYS_SYSMACROS_H) + #include + #endif +-main() { dev_t dev = makedev(1,2); return 0; } ++int main() { dev_t dev = makedev(1,2); return 0; } + ''', + 'HAVE_MAKEDEV', + addmain=False, +@@ -1355,12 +1355,13 @@ main() { dev_t dev = makedev(1,2); return 0; } + #include + #include + #include ++#include + + void exit_on_core(int ignored) { + exit(1); + } + +-main() { ++int main() { + char *newpath; + signal(SIGSEGV, exit_on_core); + newpath = realpath("/tmp", NULL); +@@ -1517,9 +1518,9 @@ main() { + # Check for getcwd allowing a NULL arg. + conf.CHECK_CODE(''' + #include +-main() { ++int main() { + char *s = getcwd(NULL,0); +- exit(s != NULL ? 0 : 1); ++ return s != NULL ? 0 : 1; + }''', 'GETCWD_TAKES_NULL', addmain=False, execute=True, + msg="getcwd takes a NULL argument") + diff --git a/samba.spec b/samba.spec index b8ffdac..888d783 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.3 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -230,6 +230,9 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-waf18.patch +Patch1: samba-sysmacros.patch +Patch2: samba-wscript-c99.patch Requires(pre): /usr/sbin/groupadd @@ -4313,6 +4316,10 @@ fi %endif %changelog +* Mon Nov 21 2022 Florian Weimer - 2:4.17.3-%{baserelease} +- Remove C89-specific language constructs from configure checks +- Fix feature detection for major/minor macros + * Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 - resolves: #2142959 - Update to version 4.17.3 - resolves: #2140960, #2143117 - Security fixes for CVE-2022-42898 From 8b52c1b03324c6e7eaa3393334b0b43529ddb4f1 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 1 Dec 2022 18:39:07 +0200 Subject: [PATCH 095/295] Rebuild against krb5 1.20.1 Signed-off-by: Alexander Bokovoy --- samba.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 888d783..9647aca 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.3 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -173,7 +173,7 @@ %global tevent_version 0.13.0 %global ldb_version 2.6.1 -%global required_mit_krb5 1.19 +%global required_mit_krb5 1.20.1 # This is a network daemon, do a hardened build # Enables PIE and full RELRO protection @@ -4316,7 +4316,10 @@ fi %endif %changelog -* Mon Nov 21 2022 Florian Weimer - 2:4.17.3-%{baserelease} +* Thu Dec 1 2022 Alexander Bokovoy - 2:4.17.3-2 +- Rebuild against krb5 1.20.1, new KDB interface + +* Mon Nov 21 2022 Florian Weimer - 2:4.17.3-1 - Remove C89-specific language constructs from configure checks - Fix feature detection for major/minor macros From 92dd9596a21fb4a9c5455062a0ef0b5d64216cbe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 16 Dec 2022 12:47:28 +0100 Subject: [PATCH 096/295] Update to version 4.17.4 resolves: #2153906 resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 resolves: #2154303, #2154304 - Security fixes for CVE-2022-37966 resolves: #2154320, #2154322 - Security fixes for CVE-2022-37967 Guenther --- .gitignore | 2 ++ samba.spec | 12 ++++++++++-- sources | 4 ++-- 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index de0b909..fe25028 100644 --- a/.gitignore +++ b/.gitignore @@ -315,3 +315,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.2.tar.asc /samba-4.17.3.tar.xz /samba-4.17.3.tar.asc +/samba-4.17.4.tar.xz +/samba-4.17.4.tar.asc diff --git a/samba.spec b/samba.spec index 9647aca..7f02e43 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.3 -%global baserelease 2 +%global samba_version 4.17.4 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -3111,6 +3111,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc @@ -3141,6 +3142,7 @@ fi %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py @@ -4316,6 +4318,12 @@ fi %endif %changelog +* Fri Dec 16 2022 Guenther Deschner - 4.17.4-0 +- resolves: #2153906 - Update to version 4.17.4 +- resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 +- resolves: #2154303, #2154304 - Security fixes for CVE-2022-37966 +- resolves: #2154320, #2154322 - Security fixes for CVE-2022-37967 + * Thu Dec 1 2022 Alexander Bokovoy - 2:4.17.3-2 - Rebuild against krb5 1.20.1, new KDB interface diff --git a/sources b/sources index 663dead..523fbd2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.3.tar.xz) = e346460ab53a5ed1f534992e21bb53c790fa4ba50752f0cf31d46fb96d138e4723a0171705ef8bf4ce3354960ddacc5a82b75975b06dcbe3224a09951174a5e7 -SHA512 (samba-4.17.3.tar.asc) = 814976c76a43b46fe67bd9a904fe3846104680446dfaf5759989a60ce1a088adb264c0bf67eccf9634fe84b3eb7ac1b8dbd020fcabf5e586c1773a2edad86306 +SHA512 (samba-4.17.4.tar.xz) = ffbde223ae324b6c0c779df75c926b09b77289f0ea4a6b6668d1bd758b621b3ed8ccdc4d101e6b153d1359c185b46d4baef5a7854dbc3864debbfa4696fa6bc8 +SHA512 (samba-4.17.4.tar.asc) = f69613c148453c57e83ba2bae45a316c19f80f9cceeab81a099d896e2dc578536175aa2278f85cf9e4899c8310a4eafeb1bfe365da16dd63195ffd099d6b6a6c From 874e260cc99e0adbbd55862b99ee5bbed63dbade Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 19 Dec 2022 10:22:17 +0100 Subject: [PATCH 097/295] Move libpac and libauth4 to dc-libs This allows us to not install the samba and samba-dc packages. They are not needed for domain member which just want to have samba-winbind related packages installed. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 7f02e43..55bd4b6 100644 --- a/samba.spec +++ b/samba.spec @@ -2096,7 +2096,6 @@ fi %{_libdir}/krb5/plugins/kdb/samba.so %{_libdir}/samba/auth/samba4.so -%{_libdir}/samba/libpac-samba4.so %dir %{_libdir}/samba/gensec %{_libdir}/samba/gensec/krb5.so %{_libdir}/samba/ldb/acl.so @@ -2160,7 +2159,9 @@ fi ### DC-LIBS %files dc-libs +%{_libdir}/samba/libauth4-samba4.so %{_libdir}/samba/libdb-glue-samba4.so +%{_libdir}/samba/libpac-samba4.so %{_libdir}/samba/libprocess-model-samba4.so %{_libdir}/samba/libservice-samba4.so @@ -2379,7 +2380,6 @@ fi %{_libdir}/libdcerpc-samr.so.* %{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so -%{_libdir}/samba/libauth4-samba4.so %{_libdir}/samba/libauth-unix-token-samba4.so %{_libdir}/samba/libdcerpc-samba4.so %{_libdir}/samba/libdnsserver-common-samba4.so From 0f08e77cfce41103cb16c3ad54fa6c30602077a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 14 Dec 2022 14:26:12 +0100 Subject: [PATCH 098/295] Create a new 'samba-dcerpc' sub-package for DCERPC services --- samba.spec | 46 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/samba.spec b/samba.spec index 55bd4b6..fc44fd0 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.4 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -242,6 +242,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-dcerpc = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -540,6 +541,20 @@ Provides: bundled(libreplace) The samba-common-tools package contains tools for Samba servers and SMB/CIFS clients. +### RPC +%package dcerpc +Summary: DCE RPC binaries +Requires: samba-common-libs = %{samba_depver} +Requires: samba-client-libs = %{samba_depver} +Requires: samba-libs = %{samba_depver} +Requires: libnetapi = %{samba_depver} +%if %{with libwbclient} +Requires: libwbclient = %{samba_depver} +%endif + +%description dcerpc +The samba-dcerpc package contains binaries that serve DCERPC over named pipes. + ### DC %if %{with dc} || %{with testsuite} %package dc @@ -970,6 +985,7 @@ Requires: %{name}-winbind-modules = %{samba_depver} Requires(post): libwbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Requires: %{name}-dcerpc = %{samba_depver} Provides: samba4-winbind = %{samba_depver} Obsoletes: samba4-winbind < %{samba_depver} @@ -1753,15 +1769,6 @@ fi %dir %{_libexecdir}/samba %{_libexecdir}/samba/samba-bgqd -%{_libexecdir}/samba/samba-dcerpcd -%{_libexecdir}/samba/rpcd_classic -%{_libexecdir}/samba/rpcd_epmapper -%{_libexecdir}/samba/rpcd_fsrvp -%{_libexecdir}/samba/rpcd_lsad -%{_libexecdir}/samba/rpcd_mdssvc -%{_libexecdir}/samba/rpcd_rpcecho -%{_libexecdir}/samba/rpcd_spoolss -%{_libexecdir}/samba/rpcd_winreg %dir %{_datadir}/samba %dir %{_datadir}/samba/mdssvc @@ -1775,7 +1782,6 @@ fi %{_mandir}/man1/smbstatus.1* %{_mandir}/man8/eventlogadm.8* %{_mandir}/man8/samba-bgqd.8* -%{_mandir}/man8/samba-dcerpcd.8* %{_mandir}/man8/smbd.8* %{_mandir}/man8/nmbd.8* %{_mandir}/man8/vfs_acl_tdb.8* @@ -2082,6 +2088,20 @@ fi %{_mandir}/man8/samba-tool.8* %{_mandir}/man8/smbpasswd.8* +### RPC +%files dcerpc +%dir %{_libexecdir}/samba +%{_libexecdir}/samba/samba-dcerpcd +%{_libexecdir}/samba/rpcd_classic +%{_libexecdir}/samba/rpcd_epmapper +%{_libexecdir}/samba/rpcd_fsrvp +%{_libexecdir}/samba/rpcd_lsad +%{_libexecdir}/samba/rpcd_mdssvc +%{_libexecdir}/samba/rpcd_rpcecho +%{_libexecdir}/samba/rpcd_spoolss +%{_libexecdir}/samba/rpcd_winreg +%{_mandir}/man8/samba-dcerpcd.8* + ### DC %if %{with dc} || %{with testsuite} %files dc @@ -4318,6 +4338,10 @@ fi %endif %changelog +* Mon Dec 19 2022 Pavel Filipenský - 4.17.4-1 +- Create a samba-dcerpc sub-package +- Fix package installation without samba and samba-dc package + * Fri Dec 16 2022 Guenther Deschner - 4.17.4-0 - resolves: #2153906 - Update to version 4.17.4 - resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 From 5471a3e692cdc97e783a0c4e0f7035f668e9aafe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 20 Dec 2022 11:01:45 +0100 Subject: [PATCH 099/295] Fix '--without dc' build: delete libauth4-samba4.so --- samba.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index fc44fd0..c2d174f 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.4 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -1403,6 +1403,7 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ + %{_libdir}/samba/libauth4-samba4.so \ %{_libdir}/samba/libdfs-server-ad-samba4.so \ %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ @@ -4338,6 +4339,9 @@ fi %endif %changelog +* Tue Dec 20 2022 Pavel Filipenský - 4.17.4-2 +- Fix '--without dc' build: delete libauth4-samba4.so + * Mon Dec 19 2022 Pavel Filipenský - 4.17.4-1 - Create a samba-dcerpc sub-package - Fix package installation without samba and samba-dc package From c3203becc0c86b581548b5335bf5ffc69c54e144 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 22 Dec 2022 15:06:03 +0100 Subject: [PATCH 100/295] Create package dc-libs also for 'non-dc' build --- samba.spec | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index c2d174f..b35ee2f 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.4 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release %nil @@ -600,6 +600,9 @@ BuildArch: noarch %description dc-provision The samba-dc-provision package provides files to setup a domain controller +#endif with dc || with testsuite +%endif + ### DC-LIBS %package dc-libs Summary: Samba AD Domain Controller Libraries @@ -616,6 +619,7 @@ Provides: bundled(libreplace) The %{name}-dc-libs package contains the libraries needed by the DC to link against the SMB, RPC and other protocols. +%if %{with dc} || %{with testsuite} ### DC-BIND %package dc-bind-dlz Summary: Bind DLZ module for Samba AD @@ -838,9 +842,7 @@ Summary: Samba Python3 libraries Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} -%if %{with dc} Requires: %{name}-dc-libs = %{samba_depver} -%endif Requires: python3-talloc Requires: python3-tevent Requires: python3-tdb @@ -1403,7 +1405,6 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ - %{_libdir}/samba/libauth4-samba4.so \ %{_libdir}/samba/libdfs-server-ad-samba4.so \ %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ %{_libdir}/samba/libscavenge-dns-records-samba4.so \ @@ -2178,9 +2179,13 @@ fi %license source4/setup/ad-schema/licence.txt %{_datadir}/samba/setup +#endif with dc || with testsuite +%endif ### DC-LIBS %files dc-libs %{_libdir}/samba/libauth4-samba4.so + +%if %{with dc} || %{with testsuite} %{_libdir}/samba/libdb-glue-samba4.so %{_libdir}/samba/libpac-samba4.so %{_libdir}/samba/libprocess-model-samba4.so @@ -4339,6 +4344,9 @@ fi %endif %changelog +* Thu Dec 22 2022 Pavel Filipenský - 4.17.4-3 +- Create package dc-libs also for 'non-dc build' + * Tue Dec 20 2022 Pavel Filipenský - 4.17.4-2 - Fix '--without dc' build: delete libauth4-samba4.so From c22466881ad38245c1068f2a0f5446deb7974a72 Mon Sep 17 00:00:00 2001 From: Pete Walter Date: Sat, 31 Dec 2022 03:19:18 +0000 Subject: [PATCH 101/295] Rebuild for ICU 72 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index b35ee2f..4da54ae 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.17.4 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release %nil @@ -4344,6 +4344,9 @@ fi %endif %changelog +* Sat Dec 31 2022 Pete Walter - 2:4.17.4-4 +- Rebuild for ICU 72 + * Thu Dec 22 2022 Pavel Filipenský - 4.17.4-3 - Create package dc-libs also for 'non-dc build' From 127f68766f3ca009d1cc1b04fb7668381194677b Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Fri, 13 Jan 2023 21:13:35 +0100 Subject: [PATCH 102/295] Remove perl(MODULE_COMPAT), it will be replaced by generators --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 4da54ae..96ab611 100644 --- a/samba.spec +++ b/samba.spec @@ -896,7 +896,6 @@ Summary: Perl IDL compiler Requires: perl-interpreter Requires: perl(FindBin) Requires: perl(Parse::Yapp) -Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) BuildArch: noarch Provides: samba4-pidl = %{samba_depver} From d5d42cde4f39f2b218c06e92bcd958efdcd664fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 19 Jan 2023 13:10:25 +0100 Subject: [PATCH 103/295] Update to version 4.18.0rc1 resolves: #2162097 Guenther --- .gitignore | 2 ++ samba-sysmacros.patch | 31 --------------------- samba-waf18.patch | 23 --------------- samba-wscript-c99.patch | 55 ------------------------------------ samba.spec | 62 ++++++++++++++++++++++++++++++----------- sources | 4 +-- 6 files changed, 49 insertions(+), 128 deletions(-) delete mode 100644 samba-sysmacros.patch delete mode 100644 samba-waf18.patch delete mode 100644 samba-wscript-c99.patch diff --git a/.gitignore b/.gitignore index fe25028..9d549cd 100644 --- a/.gitignore +++ b/.gitignore @@ -317,3 +317,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.3.tar.asc /samba-4.17.4.tar.xz /samba-4.17.4.tar.asc +/samba-4.18.0rc1.tar.xz +/samba-4.18.0rc1.tar.asc diff --git a/samba-sysmacros.patch b/samba-sysmacros.patch deleted file mode 100644 index 60f0489..0000000 --- a/samba-sysmacros.patch +++ /dev/null @@ -1,31 +0,0 @@ -source3/wscript: Fix detection of major/minor macros - -These macros are only available via as of glibc -commit e16deca62e16f645213dffd4ecd1153c37765f17 ("[BZ #19239] Don't -include sys/sysmacros.h from sys/types.h."), which went into -glibc 2.28. - -This is different from the usual C99 cleanups because it changes -the configure check result with existing compilers that usually -accept implicit function declarations. - -Submitted upstream: - -diff --git a/source3/wscript b/source3/wscript -index 22be17a1a6fd1126..ca27deaa54381446 100644 ---- a/source3/wscript -+++ b/source3/wscript -@@ -603,11 +603,11 @@ msg.msg_accrightslen = sizeof(fd); - conf.CHECK_HEADERS('asm/types.h') - - conf.CHECK_CODE('dev_t dev; int i = major(dev); return 0', "HAVE_DEVICE_MAJOR_FN", -- headers='unistd.h sys/types.h', -+ headers='sys/sysmacros.h unistd.h sys/types.h', - msg="Checking for major macro") - - conf.CHECK_CODE('dev_t dev; int i = minor(dev); return 0', "HAVE_DEVICE_MINOR_FN", -- headers='unistd.h sys/types.h', -+ headers='sys/sysmacros.h unistd.h sys/types.h', - msg="Checking for minor macro") - - conf.CHECK_STRUCTURE_MEMBER('struct dirent', 'd_off', diff --git a/samba-waf18.patch b/samba-waf18.patch deleted file mode 100644 index 84dcf7a..0000000 --- a/samba-waf18.patch +++ /dev/null @@ -1,23 +0,0 @@ -Avoid calling lib_func without a prototype. - -This commit mirrors the change in commit f4c0a750d4adebcf2342a44e85f04526c34 -("WAF: Fix detection of linker features") -to buildtools/wafsamba/samba_conftests.py. It fixes the check for rpath -support with compilers in strict C99 mode. - -Submitted upstream: - -diff --git a/buildtools/wafsamba/samba_waf18.py b/buildtools/wafsamba/samba_waf18.py -index e2a078bd3a05fd78..cfdceea14ca4b706 100644 ---- a/buildtools/wafsamba/samba_waf18.py -+++ b/buildtools/wafsamba/samba_waf18.py -@@ -209,7 +209,8 @@ def CHECK_LIBRARY_SUPPORT(conf, rpath=False, version_script=False, msg=None): - lib_node.parent.mkdir() - lib_node.write('int lib_func(void) { return 42; }\n', 'w') - main_node = bld.srcnode.make_node('main.c') -- main_node.write('int main(void) {return !(lib_func() == 42);}', 'w') -+ main_node.write('int lib_func(void);\n' -+ 'int main(void) {return !(lib_func() == 42);}', 'w') - linkflags = [] - if version_script: - script = bld.srcnode.make_node('ldscript') diff --git a/samba-wscript-c99.patch b/samba-wscript-c99.patch deleted file mode 100644 index 11457cf..0000000 --- a/samba-wscript-c99.patch +++ /dev/null @@ -1,55 +0,0 @@ -source3/wscript: Remove implict int and implicit function declarations - -This should fix the remaining C89isms in these configure checks. - -Submitted upstream: - -diff --git a/source3/wscript b/source3/wscript -index ca27deaa54381446..e77cd127e600f8c2 100644 ---- a/source3/wscript -+++ b/source3/wscript -@@ -1314,7 +1314,7 @@ syscall(SYS_initgroups, 16, NULL, NULL, 0); - - if conf.CHECK_CODE(''' - #include --main() { -+int main() { - struct tm *tm; - if (sizeof(time_t) == 8) { - time_t max_time = 0x7fffffffffffffffll; -@@ -1345,7 +1345,7 @@ main() { - #if defined(HAVE_SYS_SYSMACROS_H) - #include - #endif --main() { dev_t dev = makedev(1,2); return 0; } -+int main() { dev_t dev = makedev(1,2); return 0; } - ''', - 'HAVE_MAKEDEV', - addmain=False, -@@ -1355,12 +1355,13 @@ main() { dev_t dev = makedev(1,2); return 0; } - #include - #include - #include -+#include - - void exit_on_core(int ignored) { - exit(1); - } - --main() { -+int main() { - char *newpath; - signal(SIGSEGV, exit_on_core); - newpath = realpath("/tmp", NULL); -@@ -1517,9 +1518,9 @@ main() { - # Check for getcwd allowing a NULL arg. - conf.CHECK_CODE(''' - #include --main() { -+int main() { - char *s = getcwd(NULL,0); -- exit(s != NULL ? 0 : 1); -+ return s != NULL ? 0 : 1; - }''', 'GETCWD_TAKES_NULL', addmain=False, execute=True, - msg="getcwd takes a NULL argument") - diff --git a/samba.spec b/samba.spec index 96ab611..9928d27 100644 --- a/samba.spec +++ b/samba.spec @@ -134,10 +134,10 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.17.4 -%global baserelease 4 +%global samba_version 4.18.0 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -168,10 +168,10 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.3.4 -%global tdb_version 1.4.7 -%global tevent_version 0.13.0 -%global ldb_version 2.6.1 +%global talloc_version 2.4.0 +%global tdb_version 1.4.8 +%global tevent_version 0.14.0 +%global ldb_version 2.7.0 %global required_mit_krb5 1.20.1 @@ -185,7 +185,7 @@ # https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md %undefine _strict_symbol_defs_build -%global libwbc_alternatives_version 0.15 +%global libwbc_alternatives_version 0.16 %global libwbc_alternatives_suffix %nil %if 0%{?__isa_bits} == 64 %global libwbc_alternatives_suffix -64 @@ -230,9 +230,6 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-waf18.patch -Patch1: samba-sysmacros.patch -Patch2: samba-wscript-c99.patch Requires(pre): /usr/sbin/groupadd @@ -2018,10 +2015,9 @@ fi %if %{with includelibs} %{_libdir}/samba/libldb-*.so -%{_libdir}/samba/libldb.so.* -%{_libdir}/samba/libtalloc.so.* -%{_libdir}/samba/libtdb.so.* -%{_libdir}/samba/libtevent.so.* +%{_libdir}/samba/libtalloc-samba4.so +%{_libdir}/samba/libtdb-samba4.so +%{_libdir}/samba/libtevent-samba4.so %{_libdir}/samba/ldb/asq.so %{_libdir}/samba/ldb/ldb.so @@ -2170,9 +2166,13 @@ fi %{_mandir}/man8/samba.8* %{_mandir}/man8/samba_downgrade_db.8* %dir %{_datadir}/samba/admx +%{_datadir}/samba/admx/GNOME_Settings.admx %{_datadir}/samba/admx/samba.admx %dir %{_datadir}/samba/admx/en-US +%{_datadir}/samba/admx/en-US/GNOME_Settings.adml %{_datadir}/samba/admx/en-US/samba.adml +%dir %{_datadir}/samba/admx/ru-RU +%{_datadir}/samba/admx/ru-RU/GNOME_Settings.adml %files dc-provision %license source4/setup/ad-schema/licence.txt @@ -2250,6 +2250,7 @@ fi %{_includedir}/samba-4.0/domain_credentials.h %{_includedir}/samba-4.0/gen_ndr/atsvc.h %{_includedir}/samba-4.0/gen_ndr/auth.h +%{_includedir}/samba-4.0/gen_ndr/claims.h %{_includedir}/samba-4.0/gen_ndr/dcerpc.h %{_includedir}/samba-4.0/gen_ndr/krb5pac.h %{_includedir}/samba-4.0/gen_ndr/lsa.h @@ -2410,6 +2411,7 @@ fi %{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libshares-samba4.so %{_libdir}/samba/libsmbpasswdparser-samba4.so +%{_libdir}/samba/libstable-sort-samba4.so %{_libdir}/samba/libxattr-tdb-samba4.so %{_libdir}/samba/libREG-FULL-samba4.so %{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so @@ -2522,6 +2524,7 @@ fi %{python3_sitearch}/samba/__pycache__/ms_schema.*.pyc %{python3_sitearch}/samba/__pycache__/ndr.*.pyc %{python3_sitearch}/samba/__pycache__/ntacls.*.pyc +%{python3_sitearch}/samba/__pycache__/safe_tarfile.*.pyc %{python3_sitearch}/samba/__pycache__/sd_utils.*.pyc %{python3_sitearch}/samba/__pycache__/sites.*.pyc %{python3_sitearch}/samba/__pycache__/subnets.*.pyc @@ -2537,6 +2540,7 @@ fi %{python3_sitearch}/samba/dbchecker.py %{python3_sitearch}/samba/colour.py %{python3_sitearch}/samba/common.py +%{python3_sitearch}/samba/compression.*.so %{python3_sitearch}/samba/credentials.*.so %{python3_sitearch}/samba/crypto.*.so %dir %{python3_sitearch}/samba/dcerpc @@ -2546,6 +2550,7 @@ fi %{python3_sitearch}/samba/dcerpc/atsvc.*.so %{python3_sitearch}/samba/dcerpc/auth.*.so %{python3_sitearch}/samba/dcerpc/base.*.so +%{python3_sitearch}/samba/dcerpc/claims.*.so %{python3_sitearch}/samba/dcerpc/dcerpc.*.so %{python3_sitearch}/samba/dcerpc/dfs.*.so %{python3_sitearch}/samba/dcerpc/dns.*.so @@ -2742,7 +2747,9 @@ fi %{python3_sitearch}/samba/param.*.so %{python3_sitearch}/samba/policy.*.so %{python3_sitearch}/samba/registry.*.so +%{python3_sitearch}/samba/reparse_symlink.*.so %{python3_sitearch}/samba/security.*.so +%{python3_sitearch}/samba/safe_tarfile.py %dir %{python3_sitearch}/samba/samba3 %{python3_sitearch}/samba/samba3/__init__.py %dir %{python3_sitearch}/samba/samba3/__pycache__ @@ -2778,8 +2785,8 @@ fi %{_libdir}/samba/libsamba-python.cpython*.so %if %{with includelibs} -%{_libdir}/samba/libpyldb-util.cpython*.so.* -%{_libdir}/samba/libpytalloc-util.cpython*.so.* +%{_libdir}/samba/libpyldb-util.cpython*.so +%{_libdir}/samba/libpytalloc-util.cpython*.so %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -2876,6 +2883,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/auth_log_winbind.*.pyc %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/compression.*.pyc %{python3_sitearch}/samba/tests/__pycache__/core.*.pyc %{python3_sitearch}/samba/tests/__pycache__/credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/cred_opt.*.pyc @@ -2916,6 +2924,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/logfiles.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/libsmb-basic.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc %{python3_sitearch}/samba/tests/__pycache__/messaging.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ndr.*.pyc @@ -2950,12 +2959,14 @@ fi %{python3_sitearch}/samba/tests/__pycache__/pso.*.pyc %{python3_sitearch}/samba/tests/__pycache__/py_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/registry.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/reparsepoints.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3idmapdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3param.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3passdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3registry.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3windb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3_net_join.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/safe_tarfile.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samba_upgradedns_lmdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samba3sam.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb.*.pyc @@ -2965,6 +2976,9 @@ fi %{python3_sitearch}/samba/tests/__pycache__/segfault.*.pyc %{python3_sitearch}/samba/tests/__pycache__/sid_strings.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/smb1posix.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/smb2symlink.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/smb3unix.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbconf.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb-notify.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smbd_base.*.pyc @@ -3030,6 +3044,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/traffic_replay.py %{python3_sitearch}/samba/tests/blackbox/traffic_summary.py %{python3_sitearch}/samba/tests/common.py +%{python3_sitearch}/samba/tests/compression.py %{python3_sitearch}/samba/tests/complex_expressions.py %{python3_sitearch}/samba/tests/core.py %{python3_sitearch}/samba/tests/credentials.py @@ -3135,9 +3150,11 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/claims_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/group_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc @@ -3166,9 +3183,11 @@ fi %{python3_sitearch}/samba/tests/krb5/alias_tests.py %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py +%{python3_sitearch}/samba/tests/krb5/claims_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py %{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py +%{python3_sitearch}/samba/tests/krb5/group_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py @@ -3200,6 +3219,7 @@ fi %{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/ldap_upn_sam_account.py %{python3_sitearch}/samba/tests/libsmb.py +%{python3_sitearch}/samba/tests/libsmb-basic.py %{python3_sitearch}/samba/tests/loadparm.py %{python3_sitearch}/samba/tests/logfiles.py %{python3_sitearch}/samba/tests/lsa_string.py @@ -3236,12 +3256,14 @@ fi %{python3_sitearch}/samba/tests/pso.py %{python3_sitearch}/samba/tests/py_credentials.py %{python3_sitearch}/samba/tests/registry.py +%{python3_sitearch}/samba/tests/reparsepoints.py %{python3_sitearch}/samba/tests/s3idmapdb.py %{python3_sitearch}/samba/tests/s3param.py %{python3_sitearch}/samba/tests/s3passdb.py %{python3_sitearch}/samba/tests/s3registry.py %{python3_sitearch}/samba/tests/s3windb.py %{python3_sitearch}/samba/tests/s3_net_join.py +%{python3_sitearch}/samba/tests/safe_tarfile.py %{python3_sitearch}/samba/tests/samba3sam.py %{python3_sitearch}/samba/tests/samba_upgradedns_lmdb.py %dir %{python3_sitearch}/samba/tests/samba_tool @@ -3329,6 +3351,9 @@ fi %{python3_sitearch}/samba/tests/segfault.py %{python3_sitearch}/samba/tests/sid_strings.py %{python3_sitearch}/samba/tests/smb.py +%{python3_sitearch}/samba/tests/smb1posix.py +%{python3_sitearch}/samba/tests/smb2symlink.py +%{python3_sitearch}/samba/tests/smb3unix.py %{python3_sitearch}/samba/tests/smbconf.py %{python3_sitearch}/samba/tests/smb-notify.py %{python3_sitearch}/samba/tests/smbd_base.py @@ -4343,6 +4368,9 @@ fi %endif %changelog +* Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1 +- resolves: #2162097 - Update to version 4.18.0rc1 + * Sat Dec 31 2022 Pete Walter - 2:4.17.4-4 - Rebuild for ICU 72 diff --git a/sources b/sources index 523fbd2..0fd95b9 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.17.4.tar.xz) = ffbde223ae324b6c0c779df75c926b09b77289f0ea4a6b6668d1bd758b621b3ed8ccdc4d101e6b153d1359c185b46d4baef5a7854dbc3864debbfa4696fa6bc8 -SHA512 (samba-4.17.4.tar.asc) = f69613c148453c57e83ba2bae45a316c19f80f9cceeab81a099d896e2dc578536175aa2278f85cf9e4899c8310a4eafeb1bfe365da16dd63195ffd099d6b6a6c +SHA512 (samba-4.18.0rc1.tar.xz) = 1ceb0bef12766b079a73b2a517bb3ceb3a16d0c0383b0cabb8052d4e74663226870894f8b0065ec9852934359c08828d851739824f617c93d9d89816a03d0aa1 +SHA512 (samba-4.18.0rc1.tar.asc) = 987c6f7845e34d9e688beba15abb26f876299310bbfb79b6734d570b24741fec0482facd59c5c2aae6618782cb0b804aa230dad54eb1bd3f379289615b6e991c From fe7442c100e37957595f4f69b2b1e59f74aad093 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 02:35:44 +0000 Subject: [PATCH 104/295] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 9928d27..2544c07 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release rc1 @@ -4368,6 +4368,9 @@ fi %endif %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 2:4.18.0-0.2.rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1 - resolves: #2162097 - Update to version 4.18.0rc1 From 08e07cb8554d2de6a7f9af35f6e49a0cd5485692 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 07:24:09 +0100 Subject: [PATCH 105/295] Use mold linker on Fedora >= 37 This makes compilation of Samba a lot faster. --- samba.spec | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 2544c07..5122f0a 100644 --- a/samba.spec +++ b/samba.spec @@ -324,6 +324,10 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) +%if 0%{?fedora} >= 37 +BuildRequires: mold +%endif + %if %{with vfs_glusterfs} BuildRequires: glusterfs-api-devel >= 3.4.0.16 BuildRequires: glusterfs-devel >= 3.4.0.16 @@ -1242,9 +1246,13 @@ rm -f lib/crypto/{aes,rijndael}*.c # TODO: resolve underlinked python modules export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -# Use the gold linker -# See https://bugzilla.redhat.com/show_bug.cgi?id=2043178 ; For f36 do not use ld.gold till it is fixed -#export LDFLAGS="%%{__global_ldflags} -fuse-ld=gold" +# Use the mold linker +%if 0%{?fedora} >= 37 +export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" +export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" +%else +export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" +%endif %configure \ --enable-fhs \ From 3134f7f1d6fae745005ff0e580c7d216534d063a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 15:12:38 +0100 Subject: [PATCH 106/295] Use python3-dateutil instead of python3-iso8601 We don't have iso8601 in third_party/ anymore. --- samba.spec | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/samba.spec b/samba.spec index 5122f0a..673fa12 100644 --- a/samba.spec +++ b/samba.spec @@ -352,9 +352,6 @@ BuildRequires: python3-etcd %endif %if %{with dc} || %{with testsuite} -# Add python3-iso8601 to avoid that the -# version in Samba is being packaged -BuildRequires: python3-iso8601 BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: bind @@ -392,6 +389,11 @@ BuildRequires: lmdb-devel %if %{with dc} || %{with testsuite} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} +%if 0%{?fedora} || 0%{rhel} >= 9 +BuildRequires: python3-dateutil +%else +BuildRequires: python3-iso8601 +%endif BuildRequires: python3-gpg BuildRequires: python3-markdown BuildRequires: python3-setproctitle @@ -1456,12 +1458,6 @@ for i in \ %{python3_sitearch}/samba/remove_dc.py \ %{python3_sitearch}/samba/samdb.py \ %{python3_sitearch}/samba/schema.py \ - %{python3_sitearch}/samba/third_party/iso8601/__init__.py \ - %{python3_sitearch}/samba/third_party/iso8601/__pycache__/__init__.*.pyc \ - %{python3_sitearch}/samba/third_party/iso8601/__pycache__/iso8601.*.pyc \ - %{python3_sitearch}/samba/third_party/iso8601/__pycache__/test_iso8601.*.pyc \ - %{python3_sitearch}/samba/third_party/iso8601/iso8601.py \ - %{python3_sitearch}/samba/third_party/iso8601/test_iso8601.py \ %{python3_sitearch}/samba/uptodateness.py \ %{_sbindir}/samba-gpupdate \ ; do From d5a1366d2a2c288e26304937323ed9f65ed34448 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 15:13:10 +0100 Subject: [PATCH 107/295] Remove duplicate code --- samba.spec | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/samba.spec b/samba.spec index 673fa12..ecc4f40 100644 --- a/samba.spec +++ b/samba.spec @@ -351,14 +351,6 @@ BuildRequires: librados-devel BuildRequires: python3-etcd %endif -%if %{with dc} || %{with testsuite} -BuildRequires: python3-pyasn1 >= 0.4.8 - -BuildRequires: bind -BuildRequires: krb5-server >= %{required_mit_krb5} -#endif with dc -%endif - # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) BuildRequires: perl(FindBin) @@ -396,6 +388,7 @@ BuildRequires: python3-iso8601 %endif BuildRequires: python3-gpg BuildRequires: python3-markdown +BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: python3-setproctitle BuildRequires: python3-cryptography From 6320734465512e2358b49ab16af28f196562964d Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jan 2023 15:13:36 +0100 Subject: [PATCH 108/295] Add missing python requirements for python3-samba --- samba.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index ecc4f40..cd4360b 100644 --- a/samba.spec +++ b/samba.spec @@ -306,8 +306,10 @@ BuildRequires: perl-generators BuildRequires: perl(Archive::Tar) BuildRequires: perl(Test::More) BuildRequires: popt-devel +BuildRequires: python3-cryptography BuildRequires: python3-devel BuildRequires: python3-dns +BuildRequires: python3-requests BuildRequires: python3-setuptools BuildRequires: quota-devel BuildRequires: readline-devel @@ -390,7 +392,6 @@ BuildRequires: python3-gpg BuildRequires: python3-markdown BuildRequires: python3-pyasn1 >= 0.4.8 BuildRequires: python3-setproctitle -BuildRequires: python3-cryptography %if %{without includelibs} BuildRequires: tdb-tools @@ -839,11 +840,13 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} -Requires: python3-talloc -Requires: python3-tevent -Requires: python3-tdb -Requires: python3-ldb +Requires: python3-cryptography Requires: python3-dns +Requires: python3-ldb +Requires: python3-requests +Requires: python3-talloc +Requires: python3-tdb +Requires: python3-tevent %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif From 3937d0fbabf0d51dbe51c52c0607e99fcb4d1529 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 24 Jan 2023 08:59:00 +0100 Subject: [PATCH 109/295] Fix typo --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index cd4360b..b28f27a 100644 --- a/samba.spec +++ b/samba.spec @@ -383,7 +383,7 @@ BuildRequires: lmdb-devel %if %{with dc} || %{with testsuite} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} -%if 0%{?fedora} || 0%{rhel} >= 9 +%if 0%{?fedora} || 0%{?rhel} >= 9 BuildRequires: python3-dateutil %else BuildRequires: python3-iso8601 From 574391dda64fcbbf5625baaaf3684e3e09627951 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 31 Jan 2023 21:59:37 +0100 Subject: [PATCH 110/295] rpminspect: Avoid "Missing: .debug_info" libdcerpc-samr is a grouping library without .debug_info. See source4/librpc/wscript_build. There is an empty source list for bld.SAMBA_LIBRARY('dcerpc-samr' --- rpminspect.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 9c56e6c..4c2edfa 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -18,3 +18,7 @@ runpath: abidiff: suppression_file: samba.abignore + +debuginfo: + ignore: + - /usr/lib*/libdcerpc-samr.so.* From 36c4a399ca4be7a83cfc45cc1f6a8ec0dae2cdc5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 2 Feb 2023 14:47:10 +0100 Subject: [PATCH 111/295] Update to version 4.18.0rc2 resolves: #2166416 Guenther --- .gitignore | 2 ++ samba.spec | 9 ++++++--- sources | 4 ++-- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 9d549cd..1b867fd 100644 --- a/.gitignore +++ b/.gitignore @@ -319,3 +319,5 @@ samba-3.6.0pre1.tar.gz /samba-4.17.4.tar.asc /samba-4.18.0rc1.tar.xz /samba-4.18.0rc1.tar.asc +/samba-4.18.0rc2.tar.xz +/samba-4.18.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index b28f27a..562f5a2 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4368,10 +4368,13 @@ fi %endif %changelog +* Thu Feb 02 2023 Guenther Deschner - 4.18.0rc2-3 +- resolves: #2166416 - Update to version 4.18.0rc2 + * Sat Jan 21 2023 Fedora Release Engineering - 2:4.18.0-0.2.rc1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild -* Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1 +* Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1-0 - resolves: #2162097 - Update to version 4.18.0rc1 * Sat Dec 31 2022 Pete Walter - 2:4.17.4-4 diff --git a/sources b/sources index 0fd95b9..760bff2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0rc1.tar.xz) = 1ceb0bef12766b079a73b2a517bb3ceb3a16d0c0383b0cabb8052d4e74663226870894f8b0065ec9852934359c08828d851739824f617c93d9d89816a03d0aa1 -SHA512 (samba-4.18.0rc1.tar.asc) = 987c6f7845e34d9e688beba15abb26f876299310bbfb79b6734d570b24741fec0482facd59c5c2aae6618782cb0b804aa230dad54eb1bd3f379289615b6e991c +SHA512 (samba-4.18.0rc2.tar.xz) = 1467ee97c5861e7306d2bf96c0c600404212d9b241cc28e5fb649f8297bdb3bb86a774cb78ccfc82a70f7b715eff7eb0de9dc3563ba0300c6a069d9609fbdef4 +SHA512 (samba-4.18.0rc2.tar.asc) = 557eec6485669b172b16fd5032750d8cfa8058d1615316d7e539924d561d7d7e7d0990bcf62f96d0ec467c8fc5e59c0bb8ea1a963396055b6af8659e166073cd From 5704b04d6966871afdac7015a692544a19583bb4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 10 Feb 2023 20:55:16 +0100 Subject: [PATCH 112/295] Fix samba-tool dependencies on non-dc builds It has two steps: - Build python3-samba-dc also for non-dc builds - Require python3-samba-dc from common-tools also for non-dc builds --- samba.spec | 56 +++++------------------------------------------------- 1 file changed, 5 insertions(+), 51 deletions(-) diff --git a/samba.spec b/samba.spec index 562f5a2..8a4a574 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release rc2 @@ -525,9 +525,9 @@ Requires: libwbclient = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup Requires: tdb-tools -%if %{with dc} -# samba-tool needs python3-samba-dc on a full build +# samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} +%if %{with dc} # samba-tool needs mdb_copy for domain backup or upgrade provision Requires: lmdb %endif @@ -877,7 +877,6 @@ Requires: %{name}-libs = %{samba_depver} The python3-%{name}-test package contains the Python libraries used by the test suite of Samba. If you want to run full set of Samba tests, you need to install this package. -%if %{with dc} || %{with testsuite} %package -n python3-samba-dc Summary: Samba Python libraries for Samba AD Requires: %{name}-client-libs = %{samba_depver} @@ -887,7 +886,6 @@ Requires: python3-%{name} = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs to manage Samba AD. -%endif ### PIDL %package pidl @@ -1407,54 +1405,10 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so %if %{without dc} && %{without testsuite} for i in \ - %{_libdir}/samba/libdfs-server-ad-samba4.so \ - %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so \ - %{_libdir}/samba/libscavenge-dns-records-samba4.so \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ %{_mandir}/man8/samba-gpupdate.8 \ %{_unitdir}/samba.service \ - %{python3_sitearch}/samba/dcerpc/dnsserver.*.so \ - %{python3_sitearch}/samba/dnsserver.py \ - %{python3_sitearch}/samba/domain_update.py \ - %{python3_sitearch}/samba/forest_update.py \ - %{python3_sitearch}/samba/kcc/__init__.py \ - %{python3_sitearch}/samba/kcc/debug.py \ - %{python3_sitearch}/samba/kcc/graph.py \ - %{python3_sitearch}/samba/kcc/graph_utils.py \ - %{python3_sitearch}/samba/kcc/kcc_utils.py \ - %{python3_sitearch}/samba/kcc/ldif_import_export.py \ - %{python3_sitearch}/samba/kcc/__pycache__/__init__.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/debug.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/graph.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/graph_utils.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/kcc_utils.*.pyc \ - %{python3_sitearch}/samba/kcc/__pycache__/ldif_import_export.*.pyc \ - %{python3_sitearch}/samba/ms_forest_updates_markdown.py \ - %{python3_sitearch}/samba/ms_schema_markdown.py \ - %{python3_sitearch}/samba/provision/__init__.py \ - %{python3_sitearch}/samba/provision/backend.py \ - %{python3_sitearch}/samba/provision/common.py \ - %{python3_sitearch}/samba/provision/kerberos_implementation.py \ - %{python3_sitearch}/samba/provision/kerberos.py \ - %{python3_sitearch}/samba/provision/sambadns.py \ - %{python3_sitearch}/samba/provision/__pycache__/__init__.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/backend.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/common.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/kerberos_implementation.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/kerberos.*.pyc \ - %{python3_sitearch}/samba/provision/__pycache__/sambadns.*.pyc \ - %{python3_sitearch}/samba/__pycache__/domain_update.*.pyc \ - %{python3_sitearch}/samba/__pycache__/forest_update.*.pyc \ - %{python3_sitearch}/samba/__pycache__/ms_forest_updates_markdown.*.pyc \ - %{python3_sitearch}/samba/__pycache__/ms_schema_markdown.*.pyc \ - %{python3_sitearch}/samba/__pycache__/remove_dc.*.pyc \ - %{python3_sitearch}/samba/__pycache__/schema.*.pyc \ - %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc \ - %{python3_sitearch}/samba/remove_dc.py \ - %{python3_sitearch}/samba/samdb.py \ - %{python3_sitearch}/samba/schema.py \ - %{python3_sitearch}/samba/uptodateness.py \ %{_sbindir}/samba-gpupdate \ ; do rm -f %{buildroot}$i @@ -2805,7 +2759,6 @@ fi %{_libdir}/libsamba-policy.*.so %{_libdir}/pkgconfig/samba-policy.*.pc -%if %{with dc} || %{with testsuite} %files -n python3-%{name}-dc %{python3_sitearch}/samba/samdb.py %{python3_sitearch}/samba/schema.py @@ -2821,7 +2774,9 @@ fi %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc %{python3_sitearch}/samba/dcerpc/dnsserver.*.so +%if %{with dc} || %{with testsuite} %{python3_sitearch}/samba/dckeytab.*.so +%endif %{python3_sitearch}/samba/domain_update.py %{python3_sitearch}/samba/forest_update.py %{python3_sitearch}/samba/ms_forest_updates_markdown.py @@ -2862,7 +2817,6 @@ fi %{python3_sitearch}/samba/remove_dc.py %{python3_sitearch}/samba/uptodateness.py -%endif %files -n python3-%{name}-test %dir %{python3_sitearch}/samba/tests From 0a8a75e9d8a7c72e8752b18f8e382e538e859307 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 13 Feb 2023 11:54:42 +0100 Subject: [PATCH 113/295] Create samba-tools package for samba-tool. Avoids installation of many python3 pkgs on a simple file server. --- samba.spec | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/samba.spec b/samba.spec index 8a4a574..a97807f 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil %global pre_release rc2 @@ -511,7 +511,7 @@ SMB/CIFS clients. ### COMMON-TOOLS %package common-tools -Summary: Tools for Samba servers and clients +Summary: Tools for Samba clients Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} @@ -521,6 +521,14 @@ Requires: libnetapi = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif +Provides: bundled(libreplace) + +%description common-tools +The samba-common-tools package contains tools for SMB/CIFS clients. + +### SAMBA-TOOLS +%package tools +Summary: Tools for Samba servers # samba-tool needs python3-samba Requires: python3-%{name} = %{samba_depver} # samba-tool needs tdbbackup @@ -532,11 +540,9 @@ Requires: python3-%{name}-dc = %{samba_depver} Requires: lmdb %endif -Provides: bundled(libreplace) - -%description common-tools -The samba-common-tools package contains tools for Samba servers and -SMB/CIFS clients. +%description tools +The samba-tools package contains tools for Samba servers +and for GPO management on domain members. ### RPC %package dcerpc @@ -978,6 +984,7 @@ Requires(post): %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} +Recommends: %{name}-tools = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -2023,11 +2030,11 @@ fi %{_libdir}/samba/pdb/smbpasswd.so %{_libdir}/samba/pdb/tdbsam.so +### COMMON-TOOLS %files common-tools %{_bindir}/net %{_bindir}/pdbedit %{_bindir}/profiles -%{_bindir}/samba-tool %{_bindir}/smbcontrol %{_bindir}/smbpasswd %{_bindir}/testparm @@ -2036,9 +2043,13 @@ fi %{_mandir}/man1/testparm.1* %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* -%{_mandir}/man8/samba-tool.8* %{_mandir}/man8/smbpasswd.8* +### TOOLS +%files tools +%{_bindir}/samba-tool +%{_mandir}/man8/samba-tool.8* + ### RPC %files dcerpc %dir %{_libexecdir}/samba From 4b6c2a6e524a3508bc58fd1f76c4f4016a87f9c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 13 Feb 2023 16:57:39 +0100 Subject: [PATCH 114/295] Add changelog entry --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index a97807f..db13cda 100644 --- a/samba.spec +++ b/samba.spec @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Mon Feb 13 2023 Pavel Filipenský - 4.18.0rc2-5 +- Create package samba-tools, move there samba-tool binary + * Thu Feb 02 2023 Guenther Deschner - 4.18.0rc2-3 - resolves: #2166416 - Update to version 4.18.0rc2 From b4642ddce5df19bfdc2352b83975d2db3902481f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 16 Feb 2023 09:11:52 +0100 Subject: [PATCH 115/295] Fix samba-tool dependencies --- samba.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index db13cda..43cf5f8 100644 --- a/samba.spec +++ b/samba.spec @@ -531,13 +531,12 @@ The samba-common-tools package contains tools for SMB/CIFS clients. Summary: Tools for Samba servers # samba-tool needs python3-samba Requires: python3-%{name} = %{samba_depver} -# samba-tool needs tdbbackup -Requires: tdb-tools # samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} %if %{with dc} -# samba-tool needs mdb_copy for domain backup or upgrade provision +# samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision Requires: lmdb +Requires: tdb-tools %endif %description tools From 479c5d099f092a05560a2617e85cebe3a8e45224 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 16 Feb 2023 09:13:28 +0100 Subject: [PATCH 116/295] Add missing Requires for samba-tool on samba-dc --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 43cf5f8..ed73df4 100644 --- a/samba.spec +++ b/samba.spec @@ -565,6 +565,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} +Requires: %{name}-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-provision = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} From 90edcb757a1f56653c2fa7028d3ea1b19caff778 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 15 Feb 2023 16:47:35 +0100 Subject: [PATCH 117/295] Update to version 4.18.0rc3 resolves: #2166416 Guenther --- .gitignore | 2 ++ samba.spec | 11 +++++++---- sources | 4 ++-- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 1b867fd..f55b1d8 100644 --- a/.gitignore +++ b/.gitignore @@ -321,3 +321,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc1.tar.asc /samba-4.18.0rc2.tar.xz /samba-4.18.0rc2.tar.asc +/samba-4.18.0rc3.tar.xz +/samba-4.18.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index ed73df4..acc7c4a 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 5 +%global baserelease 6 # This should be rc1 or %%nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -170,8 +170,8 @@ %global talloc_version 2.4.0 %global tdb_version 1.4.8 -%global tevent_version 0.14.0 -%global ldb_version 2.7.0 +%global tevent_version 0.14.1 +%global ldb_version 2.7.1 %global required_mit_krb5 1.20.1 @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Wed Feb 15 2023 Guenther Deschner - 4.18.0rc3-6 +- resolves: #2166416 - Update to version 4.18.0rc3 + * Mon Feb 13 2023 Pavel Filipenský - 4.18.0rc2-5 - Create package samba-tools, move there samba-tool binary diff --git a/sources b/sources index 760bff2..bc6a0db 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0rc2.tar.xz) = 1467ee97c5861e7306d2bf96c0c600404212d9b241cc28e5fb649f8297bdb3bb86a774cb78ccfc82a70f7b715eff7eb0de9dc3563ba0300c6a069d9609fbdef4 -SHA512 (samba-4.18.0rc2.tar.asc) = 557eec6485669b172b16fd5032750d8cfa8058d1615316d7e539924d561d7d7e7d0990bcf62f96d0ec467c8fc5e59c0bb8ea1a963396055b6af8659e166073cd +SHA512 (samba-4.18.0rc3.tar.xz) = ebcb183e4e823a6f4c7d6d483d4efd1e6da8cf5bce1d685bba7c80c7d2392ed909ab8fc14dd7f74aa10c0d1ad1e96830413bb001b4c8add8ee70f073175aab81 +SHA512 (samba-4.18.0rc3.tar.asc) = 178959b7e361655037534fd3d11648c7b5636e65547d85d2b8090a1e79a7580ac61ff35553aff1054b6031f49ad48096538a49e26f714d3ea10c493303910b91 From 101d3c387f6932a566ac3442820db085eb6c79e4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 Feb 2023 14:26:16 +0100 Subject: [PATCH 118/295] Remove obsolete patch --- samba-4.17-fix-changeuserpassword4.patch | 540 ----------------------- 1 file changed, 540 deletions(-) delete mode 100644 samba-4.17-fix-changeuserpassword4.patch diff --git a/samba-4.17-fix-changeuserpassword4.patch b/samba-4.17-fix-changeuserpassword4.patch deleted file mode 100644 index 7f1b482..0000000 --- a/samba-4.17-fix-changeuserpassword4.patch +++ /dev/null @@ -1,540 +0,0 @@ -From a3e3d05f35d6082ea48450060b39084e3d0e4056 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 10 Oct 2022 15:15:20 +0200 -Subject: [PATCH 1/5] s3:librpc: Improve GSE error message - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 - -Signed-off-by: Andreas Schneider -Reviewed-by: Noel Power ---- - source3/librpc/crypto/gse.c | 21 +++++++++++++++++++-- - 1 file changed, 19 insertions(+), 2 deletions(-) - -diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c -index c50a8a036df..c2cac7abf82 100644 ---- a/source3/librpc/crypto/gse.c -+++ b/source3/librpc/crypto/gse.c -@@ -546,11 +546,28 @@ init_sec_context_done: - goto done; - case GSS_S_FAILURE: - switch (gss_min) { -- case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: -- DBG_NOTICE("Server principal not found\n"); -+ case (OM_uint32)KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN: { -+ gss_buffer_desc name_token = { -+ .length = 0, -+ }; -+ -+ gss_maj = gss_display_name(&gss_min, -+ gse_ctx->server_name, -+ &name_token, -+ NULL); -+ if (gss_maj == GSS_S_COMPLETE) { -+ DBG_NOTICE("Server principal %.*s not found\n", -+ (int)name_token.length, -+ (char *)name_token.value); -+ gss_release_buffer(&gss_maj, &name_token); -+ } else { -+ DBG_NOTICE("Server principal not found\n"); -+ } -+ - /* Make SPNEGO ignore us, we can't go any further here */ - status = NT_STATUS_INVALID_PARAMETER; - goto done; -+ } - case (OM_uint32)KRB5KRB_AP_ERR_TKT_EXPIRED: - DBG_NOTICE("Ticket expired\n"); - /* Make SPNEGO ignore us, we can't go any further here */ --- -2.37.3 - - -From d2e2e9acd717e45806f1b19378e09f39c8fe3da8 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 7 Oct 2022 14:35:15 +0200 -Subject: [PATCH 2/5] s3:rpcclient: Pass salt down to - init_samr_CryptPasswordAES() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 - -Signed-off-by: Andreas Schneider -Reviewed-by: Noel Power ---- - source3/rpc_client/init_samr.c | 15 ++++----------- - source3/rpc_client/init_samr.h | 1 + - source3/rpcclient/cmd_samr.c | 8 ++++++++ - source4/libnet/libnet_passwd.c | 13 +++++++------ - source4/torture/rpc/samr.c | 27 +++++++++++++++++++++++++++ - 5 files changed, 47 insertions(+), 17 deletions(-) - -diff --git a/source3/rpc_client/init_samr.c b/source3/rpc_client/init_samr.c -index 68f42b602b3..52fa2f90d6e 100644 ---- a/source3/rpc_client/init_samr.c -+++ b/source3/rpc_client/init_samr.c -@@ -79,6 +79,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, - - NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - const char *password, -+ DATA_BLOB *salt, - DATA_BLOB *session_key, - struct samr_EncryptedPasswordAES *ppwd_buf) - { -@@ -87,12 +88,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - .data = pw_data, - .length = sizeof(pw_data), - }; -- size_t iv_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_256_CBC); -- uint8_t iv_data[iv_size]; -- DATA_BLOB iv = { -- .data = iv_data, -- .length = iv_size, -- }; - DATA_BLOB ciphertext = data_blob_null; - NTSTATUS status = NT_STATUS_UNSUCCESSFUL; - bool ok; -@@ -101,8 +96,6 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - return NT_STATUS_INVALID_PARAMETER; - } - -- generate_nonce_buffer(iv.data, iv.length); -- - ok = encode_pwd_buffer514_from_str(pw_data, password, STR_UNICODE); - if (!ok) { - return NT_STATUS_INTERNAL_ERROR; -@@ -114,7 +107,7 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - session_key, - &samr_aes256_enc_key_salt, - &samr_aes256_mac_key_salt, -- &iv, -+ salt, - &ciphertext, - ppwd_buf->auth_data); - BURN_DATA(pw_data); -@@ -126,8 +119,8 @@ NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - ppwd_buf->cipher = ciphertext.data; - ppwd_buf->PBKDF2Iterations = 0; - -- SMB_ASSERT(iv.length == sizeof(ppwd_buf->salt)); -- memcpy(ppwd_buf->salt, iv.data, iv.length); -+ SMB_ASSERT(salt->length == sizeof(ppwd_buf->salt)); -+ memcpy(ppwd_buf->salt, salt->data, salt->length); - - return NT_STATUS_OK; - } -diff --git a/source3/rpc_client/init_samr.h b/source3/rpc_client/init_samr.h -index 940534e7168..71b4c0e573d 100644 ---- a/source3/rpc_client/init_samr.h -+++ b/source3/rpc_client/init_samr.h -@@ -47,6 +47,7 @@ NTSTATUS init_samr_CryptPassword(const char *pwd, - */ - NTSTATUS init_samr_CryptPasswordAES(TALLOC_CTX *mem_ctx, - const char *password, -+ DATA_BLOB *salt, - DATA_BLOB *session_key, - struct samr_EncryptedPasswordAES *ppwd_buf); - -diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c -index 9ccd2f78a8d..8106ca90cf2 100644 ---- a/source3/rpcclient/cmd_samr.c -+++ b/source3/rpcclient/cmd_samr.c -@@ -3172,6 +3172,11 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, - uint8_t nt_hash[16]; - uint8_t lm_hash[16]; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - uint8_t password_expired = 0; - struct dcerpc_binding_handle *b = cli->binding_handle; - TALLOC_CTX *frame = NULL; -@@ -3198,6 +3203,8 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, - goto done; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - switch(level) { - case 18: - case 21: -@@ -3220,6 +3227,7 @@ static NTSTATUS cmd_samr_setuserinfo_int(struct rpc_pipe_client *cli, - case 31: - status = init_samr_CryptPasswordAES(frame, - param, -+ &salt, - &session_key, - &pwd_buf_aes); - if (!NT_STATUS_IS_OK(status)) { -diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c -index 4f662110e55..a1672104824 100644 ---- a/source4/libnet/libnet_passwd.c -+++ b/source4/libnet/libnet_passwd.c -@@ -57,13 +57,13 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - struct samr_EncryptedPasswordAES pwd_buf = { - .cipher_len = 0 - }; -- DATA_BLOB iv = { -+ DATA_BLOB salt = { - .data = pwd_buf.salt, - .length = sizeof(pwd_buf.salt), - }; -- gnutls_datum_t iv_datum = { -- .data = iv.data, -- .size = iv.length, -+ gnutls_datum_t salt_datum = { -+ .data = pwd_buf.salt, -+ .size = sizeof(pwd_buf.salt), - }; - uint64_t pbkdf2_iterations = generate_random_u64_range(5000, 1000000); - NTSTATUS status; -@@ -71,11 +71,11 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - - E_md4hash(old_password, old_nt_key_data); - -- generate_nonce_buffer(iv.data, iv.length); -+ generate_nonce_buffer(salt.data, salt.length); - - rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512, - &old_nt_key, -- &iv_datum, -+ &salt_datum, - pbkdf2_iterations, - cek.data, - cek.length); -@@ -86,6 +86,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - - status = init_samr_CryptPasswordAES(mem_ctx, - new_password, -+ &salt, - &cek, - &pwd_buf); - data_blob_clear(&cek); -diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c -index de354659067..0b1880efa18 100644 ---- a/source4/torture/rpc/samr.c -+++ b/source4/torture/rpc/samr.c -@@ -783,6 +783,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t - struct samr_SetUserInfo s; - union samr_UserInfo u; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - char *newpass = NULL; - struct dcerpc_binding_handle *b = p->binding_handle; - struct samr_GetUserPwInfo pwp; -@@ -818,8 +823,11 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t - return false; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info32.password); - torture_assert_ntstatus_ok(tctx, -@@ -852,6 +860,7 @@ static bool test_SetUserPass_32(struct dcerpc_pipe *p, struct torture_context *t - - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info32.password); - torture_assert_ntstatus_ok(tctx, -@@ -896,6 +905,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t - union samr_UserInfo u; - bool ret = true; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - char *newpass; - struct dcerpc_binding_handle *b = p->binding_handle; - struct samr_GetUserPwInfo pwp; -@@ -931,8 +945,11 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t - return false; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info31.password); - torture_assert_ntstatus_ok(tctx, -@@ -959,6 +976,7 @@ static bool test_SetUserPass_31(struct dcerpc_pipe *p, struct torture_context *t - - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info31.password); - torture_assert_ntstatus_ok(tctx, -@@ -1381,6 +1399,11 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - union samr_UserInfo u; - bool ret = true; - DATA_BLOB session_key; -+ uint8_t salt_data[16]; -+ DATA_BLOB salt = { -+ .data = salt_data, -+ .length = sizeof(salt_data), -+ }; - char *newpass; - struct dcerpc_binding_handle *b = p->binding_handle; - struct samr_GetUserPwInfo pwp; -@@ -1490,6 +1513,8 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - return false; - } - -+ generate_nonce_buffer(salt.data, salt.length); -+ - switch (level) { - case 18: - { -@@ -1561,6 +1586,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - case 31: - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info31.password); - -@@ -1568,6 +1594,7 @@ static bool test_SetUserPass_level_ex(struct dcerpc_pipe *p, - case 32: - status = init_samr_CryptPasswordAES(tctx, - newpass, -+ &salt, - &session_key, - &u.info32.password); - --- -2.37.3 - - -From 1d630363c9b2497266e418aad89c55d5b51a63ad Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 17 Oct 2022 09:02:28 +0200 -Subject: [PATCH 3/5] s4:libnet: If we successfully changed the password we are - done - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15206 - -Signed-off-by: Andreas Schneider -Reviewed-by: Noel Power ---- - source4/libnet/libnet_passwd.c | 32 ++++++++++++++++++-------------- - 1 file changed, 18 insertions(+), 14 deletions(-) - -diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c -index a1672104824..b17614bcd97 100644 ---- a/source4/libnet/libnet_passwd.c -+++ b/source4/libnet/libnet_passwd.c -@@ -101,7 +101,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - r.in.password = &pwd_buf; - - status = dcerpc_samr_ChangePasswordUser4_r(h, mem_ctx, &r); -- if (NT_STATUS_IS_OK(status)) { -+ if (!NT_STATUS_IS_OK(status)) { - goto done; - } - if (!NT_STATUS_IS_OK(r.out.result)) { -@@ -112,6 +112,7 @@ static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx, - account->string, - nt_errstr(status)); - status = r.out.result; -+ goto done; - } - - done: -@@ -424,20 +425,23 @@ static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CT - r->samr.in.oldpassword, - r->samr.in.newpassword, - &(r->samr.out.error_string)); -- if (!NT_STATUS_IS_OK(status)) { -- if (NT_STATUS_EQUAL(status, -- NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || -- NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || -- NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { -- /* -- * Don't fallback to RC4 based SAMR if weak crypto is not -- * allowed. -- */ -- if (lpcfg_weak_crypto(ctx->lp_ctx) == -- SAMBA_WEAK_CRYPTO_DISALLOWED) { -- goto disconnect; -- } -+ if (NT_STATUS_IS_OK(status)) { -+ goto disconnect; -+ } else if (NT_STATUS_EQUAL(status, -+ NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) || -+ NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || -+ NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) { -+ /* -+ * Don't fallback to RC4 based SAMR if weak crypto is not -+ * allowed. -+ */ -+ if (lpcfg_weak_crypto(ctx->lp_ctx) == -+ SAMBA_WEAK_CRYPTO_DISALLOWED) { -+ goto disconnect; - } -+ } else { -+ /* libnet_ChangePassword_samr_aes is implemented and failed */ -+ goto disconnect; - } - - status = libnet_ChangePassword_samr_rc4( --- -2.37.3 - - -From 9a4a169ab34641afb87e7f81708c9a72b321879e Mon Sep 17 00:00:00 2001 -From: Noel Power -Date: Fri, 21 Oct 2022 17:40:36 +0100 -Subject: [PATCH 4/5] s4/rpc_server/sambr: don't mutate the return of - samdb_set_password_aes - -prior to this commit return of samdb_set_password_aes was set to -NT_STATUS_WRONG_PASSWORD on failure. Useful status that should be -returned such as NT_STATUS_PASSWORD_RESTRICTION are swallowed here -otherwise (and in this case can be partially responsible for failures -in test samba.tests.auth_log_pass_change (with later gnutls) - -Signed-off-by: Noel Power -Reviewed-by: Andreas Schneider ---- - source4/rpc_server/samr/samr_password.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c -index 4691f9a47a9..b581be6361c 100644 ---- a/source4/rpc_server/samr/samr_password.c -+++ b/source4/rpc_server/samr/samr_password.c -@@ -250,7 +250,6 @@ NTSTATUS dcesrv_samr_ChangePasswordUser4(struct dcesrv_call_state *dce_call, - - if (!NT_STATUS_IS_OK(status)) { - ldb_transaction_cancel(sam_ctx); -- status = NT_STATUS_WRONG_PASSWORD; - goto done; - } - --- -2.37.3 - - -From b8b36ecba0f22dbc203c12627ebd629c2437c635 Mon Sep 17 00:00:00 2001 -From: Noel Power -Date: Fri, 21 Oct 2022 17:14:44 +0100 -Subject: [PATCH 5/5] python/samba/tests: fix samba.tests.auth_log_pass_change - for later gnutls - -later gnutls that support GNUTLS_PBKDF2 currently fail, -we need to conditionally switch test data to reflect use of -'samr_ChangePasswordUser3' or 'samr_ChangePasswordUser4' -depending on whether GNUTLS_PBKDF2 is supported or not - -Signed-off-by: Noel Power -Reviewed-by: Andreas Schneider ---- - python/samba/tests/auth_log_pass_change.py | 20 ++++++++++++++++---- - source4/selftest/tests.py | 9 ++++++--- - 2 files changed, 22 insertions(+), 7 deletions(-) - -diff --git a/python/samba/tests/auth_log_pass_change.py b/python/samba/tests/auth_log_pass_change.py -index 972af2158dd..1ca46c586b3 100644 ---- a/python/samba/tests/auth_log_pass_change.py -+++ b/python/samba/tests/auth_log_pass_change.py -@@ -72,6 +72,18 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - - # discard any auth log messages for the password setup - self.discardMessages() -+ gnutls_pbkdf2_support = samba.tests.env_get_var_value( -+ 'GNUTLS_PBKDF2_SUPPORT', -+ allow_missing=True) -+ if gnutls_pbkdf2_support is None: -+ gnutls_pbkdf2_support = '0' -+ self.gnutls_pbkdf2_support = bool(int(gnutls_pbkdf2_support)) -+ -+ def _authDescription(self): -+ if self.gnutls_pbkdf2_support: -+ return "samr_ChangePasswordUser4" -+ else: -+ return "samr_ChangePasswordUser3" - - def tearDown(self): - super(AuthLogPassChangeTests, self).tearDown() -@@ -83,7 +95,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_SUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -@@ -109,7 +121,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_UNSUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -@@ -141,7 +153,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_UNSUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -@@ -174,7 +186,7 @@ class AuthLogPassChangeTests(samba.tests.auth_log_base.AuthLogTestBase): - (msg["Authentication"]["serviceDescription"] == - "SAMR Password Change") and - (msg["Authentication"]["authDescription"] == -- "samr_ChangePasswordUser3") and -+ self._authDescription()) and - (msg["Authentication"]["eventId"] == - EVT_ID_UNSUCCESSFUL_LOGON) and - (msg["Authentication"]["logonType"] == -diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py -index a803d4704ea..c92105586a7 100755 ---- a/source4/selftest/tests.py -+++ b/source4/selftest/tests.py -@@ -1094,9 +1094,11 @@ if have_heimdal_support: - environ={'CLIENT_IP': '10.53.57.11', - 'SOCKET_WRAPPER_DEFAULT_IFACE': 11}) - planoldpythontestsuite("ad_dc_smb1", "samba.tests.auth_log_pass_change", -- extra_args=['-U"$USERNAME%$PASSWORD"']) -+ extra_args=['-U"$USERNAME%$PASSWORD"'], -+ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) - planoldpythontestsuite("ad_dc_ntvfs", "samba.tests.auth_log_pass_change", -- extra_args=['-U"$USERNAME%$PASSWORD"']) -+ extra_args=['-U"$USERNAME%$PASSWORD"'], -+ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) - - # these tests use a NCA local RPC connection, so always run on the - # :local testenv, and so don't need to fake a client connection -@@ -1113,7 +1115,8 @@ if have_heimdal_support: - "samba.tests.auth_log_winbind", - extra_args=['-U"$DC_USERNAME%$DC_PASSWORD"']) - planoldpythontestsuite("ad_dc", "samba.tests.audit_log_pass_change", -- extra_args=['-U"$USERNAME%$PASSWORD"']) -+ extra_args=['-U"$USERNAME%$PASSWORD"'], -+ environ={'GNUTLS_PBKDF2_SUPPORT': gnutls_pbkdf2_support}) - planoldpythontestsuite("ad_dc", "samba.tests.audit_log_dsdb", - extra_args=['-U"$USERNAME%$PASSWORD"']) - planoldpythontestsuite("ad_dc", "samba.tests.group_audit", --- -2.37.3 - From 73705701f1ebfd5363748b7c60098080fb0fffa7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 23 Feb 2023 15:15:37 +0100 Subject: [PATCH 119/295] Update License to SPDX expressions https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index acc7c4a..dd624f4 100644 --- a/samba.spec +++ b/samba.spec @@ -210,7 +210,7 @@ Epoch: 0 %global samba_depver %{epoch}:%{version}-%{release} Summary: Server and Client software to interoperate with Windows machines -License: GPLv3+ and LGPLv3+ +License: GPL-3.0-or-later AND LGPL-3.0-or-later URL: https://www.samba.org # This is a xz recompressed file of https://ftp.samba.org/pub/samba/samba-%%{version}%%{pre_release}.tar.gz From 1348920d6f81e65d43f76f284c6f703825ddf131 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 23 Feb 2023 15:18:11 +0100 Subject: [PATCH 120/295] SPDX migration --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index dd624f4..bb6ffa4 100644 --- a/samba.spec +++ b/samba.spec @@ -1075,7 +1075,7 @@ necessary to communicate to the Winbind Daemon %if %{with winexe} %package winexe Summary: Samba Winexe Windows Binary -License: GPLv3 +License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Thu Feb 23 2023 Pavel Filipenský - 4.18.0-0.6.rc3 +- SPDX migration + * Wed Feb 15 2023 Guenther Deschner - 4.18.0rc3-6 - resolves: #2166416 - Update to version 4.18.0rc3 From 435e4d9b7b1d59ce130eb826cbc8519b2f228042 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Feb 2023 07:55:19 +0100 Subject: [PATCH 121/295] Add missing Requires for glibc-gconv-extra resolves: #2173619 --- samba.spec | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/samba.spec b/samba.spec index bb6ffa4..8264d44 100644 --- a/samba.spec +++ b/samba.spec @@ -270,6 +270,7 @@ Provides: bundled(libreplace) BuildRequires: make BuildRequires: gcc +BuildRequires: glibc-gconv-extra BuildRequires: avahi-devel BuildRequires: bison BuildRequires: cups-devel @@ -448,6 +449,8 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif Requires: krb5-libs >= %{required_mit_krb5} +# This is needed for charset conversion +Requires: glibc-gconv-extra %description client-libs The samba-client-libs package contains internal libraries needed by the @@ -4333,6 +4336,9 @@ fi %endif %changelog +* Tue Feb 28 2023 Andreas Schneider - 4.18.0-0.7.rc3 +- resolves: #2173619 - Add missing Requires for glibc-gconv-extra + * Thu Feb 23 2023 Pavel Filipenský - 4.18.0-0.6.rc3 - SPDX migration From b42ebb0a8458bd7d267f757cef8cc4a666b0b7c8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Feb 2023 07:59:18 +0100 Subject: [PATCH 122/295] Bump baserelease --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 8264d44..3ac9b33 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 6 +%global baserelease 7 # This should be rc1 or %%nil %global pre_release rc3 From c7734163fa9bc728aa50395c1a62294041ddc61e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 1 Mar 2023 15:38:16 +0100 Subject: [PATCH 123/295] Update to version 4.18.0rc4 resolves: #2174415 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index f55b1d8..dcf49fc 100644 --- a/.gitignore +++ b/.gitignore @@ -323,3 +323,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc2.tar.asc /samba-4.18.0rc3.tar.xz /samba-4.18.0rc3.tar.asc +/samba-4.18.0rc4.tar.xz +/samba-4.18.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index 3ac9b33..4873a25 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 7 +%global baserelease 8 # This should be rc1 or %%nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4336,6 +4336,9 @@ fi %endif %changelog +* Wed Mar 01 2023 Guenther Deschner - 4.18.0rc4-8 +- resolves: #2174415 - Update to version 4.18.0rc4 + * Tue Feb 28 2023 Andreas Schneider - 4.18.0-0.7.rc3 - resolves: #2173619 - Add missing Requires for glibc-gconv-extra diff --git a/sources b/sources index bc6a0db..f683831 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0rc3.tar.xz) = ebcb183e4e823a6f4c7d6d483d4efd1e6da8cf5bce1d685bba7c80c7d2392ed909ab8fc14dd7f74aa10c0d1ad1e96830413bb001b4c8add8ee70f073175aab81 -SHA512 (samba-4.18.0rc3.tar.asc) = 178959b7e361655037534fd3d11648c7b5636e65547d85d2b8090a1e79a7580ac61ff35553aff1054b6031f49ad48096538a49e26f714d3ea10c493303910b91 +SHA512 (samba-4.18.0rc4.tar.xz) = f0231ffaecc4264766d5bd8569fc7ca7c8821f31999931b4d94d4228955221567a14cf9df8cda9a2bf833f375b0a9b414ec3a804e2ca9f5088ef60e982f775fa +SHA512 (samba-4.18.0rc4.tar.asc) = 343b61f33381d026a724faf0f06110b5fa173f626db2e5263ad991ca97bcc1314aa2124694dda4e7f1aca31b8f7bcb3fd20222b42aad20b51a3579cdba194303 From daa78093426a2548212b154155ccdab362015be5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 8 Mar 2023 14:20:08 +0100 Subject: [PATCH 124/295] Update to version 4.18.0 resolves: #2176469 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index dcf49fc..550a6cc 100644 --- a/.gitignore +++ b/.gitignore @@ -325,3 +325,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc3.tar.asc /samba-4.18.0rc4.tar.xz /samba-4.18.0rc4.tar.asc +/samba-4.18.0.tar.xz +/samba-4.18.0.tar.asc diff --git a/samba.spec b/samba.spec index 4873a25..147a02c 100644 --- a/samba.spec +++ b/samba.spec @@ -135,9 +135,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 8 +%global baserelease 9 # This should be rc1 or %%nil -%global pre_release rc4 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4336,6 +4336,9 @@ fi %endif %changelog +* Wed Mar 08 2023 Guenther Deschner - 4.18.0-9 +- resolves: #2176469 - Update to version 4.18.0 + * Wed Mar 01 2023 Guenther Deschner - 4.18.0rc4-8 - resolves: #2174415 - Update to version 4.18.0rc4 diff --git a/sources b/sources index f683831..588b398 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0rc4.tar.xz) = f0231ffaecc4264766d5bd8569fc7ca7c8821f31999931b4d94d4228955221567a14cf9df8cda9a2bf833f375b0a9b414ec3a804e2ca9f5088ef60e982f775fa -SHA512 (samba-4.18.0rc4.tar.asc) = 343b61f33381d026a724faf0f06110b5fa173f626db2e5263ad991ca97bcc1314aa2124694dda4e7f1aca31b8f7bcb3fd20222b42aad20b51a3579cdba194303 +SHA512 (samba-4.18.0.tar.xz) = bb4947335bd1fc501c29a62b413a9c3a1bbaf162d6965a4b2eeb65bf74363c300234b5c73d09e826e596989cd8afdee41b2470647bfdf8f7c42b998e7d367a64 +SHA512 (samba-4.18.0.tar.asc) = 1a478fd0e863e6b6874b703e04f449872b4d581e4c32c853ee4111bc94d1addcf3047331a288e8115a20d9ea22d8e04aade918e8623bd3d08d5122baf4ef0f3d From 32b29ac6e94d78c8fa427730e33d72c49a14ef9c Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 10 Mar 2023 10:32:14 +0100 Subject: [PATCH 125/295] Add missing Requires for python3-gpg to samba-tools --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 147a02c..2fe7b27 100644 --- a/samba.spec +++ b/samba.spec @@ -540,6 +540,7 @@ Requires: python3-%{name}-dc = %{samba_depver} # samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision Requires: lmdb Requires: tdb-tools +Requires: python3-gpg %endif %description tools From 7ffc94f1bab091dfe0afa3dc20ff5e566c540ae6 Mon Sep 17 00:00:00 2001 From: Kalev Lember Date: Fri, 17 Mar 2023 21:07:11 +0100 Subject: [PATCH 126/295] Move libstable-sort-samba4.so to samba-client-libs subpackage libndr-samba-samba4.so that's already in -client-libs subpackage links with libstable-sort-samba4.so, which means that we need to put both in -client-libs to avoid -client-libs suddenly starting to depend on -libs. --- samba.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 2fe7b27..a07392f 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 9 +%global baserelease 10 # This should be rc1 or %%nil %global pre_release %nil @@ -1955,6 +1955,7 @@ fi %{_libdir}/samba/libsmbd-base-samba4.so %{_libdir}/samba/libsmbd-shim-samba4.so %{_libdir}/samba/libsmbldaphelper-samba4.so +%{_libdir}/samba/libstable-sort-samba4.so %{_libdir}/samba/libsys-rw-samba4.so %{_libdir}/samba/libsocket-blocking-samba4.so %{_libdir}/samba/libtalloc-report-printf-samba4.so @@ -2380,7 +2381,6 @@ fi %{_libdir}/samba/libdnsserver-common-samba4.so %{_libdir}/samba/libshares-samba4.so %{_libdir}/samba/libsmbpasswdparser-samba4.so -%{_libdir}/samba/libstable-sort-samba4.so %{_libdir}/samba/libxattr-tdb-samba4.so %{_libdir}/samba/libREG-FULL-samba4.so %{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so @@ -4337,6 +4337,9 @@ fi %endif %changelog +* Fri Mar 17 2023 Kalev Lember - 4.18.0-10 +- Move libstable-sort-samba4.so to samba-client-libs subpackage + * Wed Mar 08 2023 Guenther Deschner - 4.18.0-9 - resolves: #2176469 - Update to version 4.18.0 From d336264f645a03c8139d264ff2d4b51bcdeeb68a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 Mar 2023 11:01:43 +0100 Subject: [PATCH 127/295] Fix file list --- samba.spec | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/samba.spec b/samba.spec index a07392f..1afb2a4 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 10 +%global baserelease 11 # This should be rc1 or %%nil %global pre_release %nil @@ -3656,7 +3656,6 @@ fi %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.005.process_exists.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.010.statistics.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.011.statistics_reset.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.002.recmaster_yield.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.010.getrelock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.012.reclock_command.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.015.reclock_remove_lock.sh @@ -3793,10 +3792,6 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.007.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.008.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.setup.004.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.001.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.002.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.003.sh @@ -4071,7 +4066,6 @@ fi %{_datadir}/ctdb/tests/UNIT/onnode/stubs/ssh %dir %{_datadir}/ctdb/tests/UNIT/shellcheck %{_datadir}/ctdb/tests/UNIT/shellcheck/base_scripts.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/ctdbd_wrapper.sh %{_datadir}/ctdb/tests/UNIT/shellcheck/ctdb_helpers.sh %{_datadir}/ctdb/tests/UNIT/shellcheck/event_scripts.sh %{_datadir}/ctdb/tests/UNIT/shellcheck/functions.sh @@ -4242,8 +4236,6 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.pstore.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ptrans.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.readkey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.recmaster.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.recmaster.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.recover.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.002.sh @@ -4337,6 +4329,9 @@ fi %endif %changelog +* Tue Mar 21 2023 Andreas Schneider - 4.18.0-11 +- Fix file list + * Fri Mar 17 2023 Kalev Lember - 4.18.0-10 - Move libstable-sort-samba4.so to samba-client-libs subpackage From e5cb35effe6d98ed90a998d035318c6d2717ba45 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 Mar 2023 15:20:25 +0100 Subject: [PATCH 128/295] Fix ctdb file lists when built with test suite enabled --- samba.spec | 51 +++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 45 insertions(+), 6 deletions(-) diff --git a/samba.spec b/samba.spec index 1afb2a4..a417bf6 100644 --- a/samba.spec +++ b/samba.spec @@ -135,7 +135,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.0 -%global baserelease 11 +%global baserelease 12 # This should be rc1 or %%nil %global pre_release %nil @@ -3352,6 +3352,7 @@ fi %{_mandir}/man1/smbtorture.1* %if %{with testsuite} +%{_mandir}/man1/vfstest.1* # files to ignore in testsuite mode %{_libdir}/samba/libnss-wrapper.so %{_libdir}/samba/libsocket-wrapper.so @@ -3569,7 +3570,10 @@ fi %{_libexecdir}/ctdb/tests/sock_io_test %{_libexecdir}/ctdb/tests/srvid_test %{_libexecdir}/ctdb/tests/system_socket_test +%{_libexecdir}/ctdb/tests/tmon_ping_test +%{_libexecdir}/ctdb/tests/tmon_test %{_libexecdir}/ctdb/tests/transaction_loop +%{_libexecdir}/ctdb/tests/tunable_test %{_libexecdir}/ctdb/tests/tunnel_cmd %{_libexecdir}/ctdb/tests/tunnel_test %{_libexecdir}/ctdb/tests/update_record @@ -3656,12 +3660,19 @@ fi %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.005.process_exists.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.010.statistics.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/basics.011.statistics_reset.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.001.stop_leader_yield.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.002.ban_leader_yield.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.003.capability_leader_yield.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.006.stop_leader_yield_no_lock.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.007.ban_leader_yield_no_lock.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.008.capability_leader_yield_no_lock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.010.getrelock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.012.reclock_command.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.015.reclock_remove_lock.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.016.reclock_move_lock_dir.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.020.message_ring.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.021.tunnel_ring.sh +%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.030.node_stall_leader_timeout.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.090.unreachable.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.091.version_check.sh %{_datadir}/ctdb/tests/INTEGRATION/simple/debug.001.getdebug.sh @@ -3687,6 +3698,7 @@ fi %{_datadir}/ctdb/tests/UNIT/cunit/cmdline_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/comm_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/comm_test_002.sh +%{_datadir}/ctdb/tests/UNIT/cunit/conf_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_002.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_003.sh @@ -3694,7 +3706,6 @@ fi %{_datadir}/ctdb/tests/UNIT/cunit/config_test_005.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_006.sh %{_datadir}/ctdb/tests/UNIT/cunit/config_test_007.sh -%{_datadir}/ctdb/tests/UNIT/cunit/conf_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/ctdb_io_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/db_hash_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/event_protocol_test_001.sh @@ -3722,6 +3733,9 @@ fi %{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_001.sh %{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_002.sh %{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_003.sh +%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_001.sh +%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_002.sh +%{_datadir}/ctdb/tests/UNIT/cunit/tunable_test_001.sh %dir %{_datadir}/ctdb/tests/UNIT/eventd %dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/ctdb.conf @@ -3968,6 +3982,22 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.shutdown.002.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.001.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.002.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.001.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.002.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.003.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.004.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.005.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.006.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.007.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.008.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.021.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.022.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.023.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.024.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.025.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.026.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.027.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.028.sh %dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc %dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb %{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb/public_addresses @@ -3997,6 +4027,7 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/50.samba.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/60.nfs.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/91.lvs.sh +%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/debug_locks.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/local.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/statd-callout.sh %{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.001.sh @@ -4016,6 +4047,7 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/df %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ethtool %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/exportfs +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/gstack %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/id %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip6tables @@ -4024,21 +4056,24 @@ fi %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/kill %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/killall %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/multipath -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/net +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfs-fake-callout +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pidof %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pkill %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ps %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpcinfo %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.lockd %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.mountd %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.rquotad %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.statd +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpcinfo %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/service %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/sleep %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/smnotify %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ss +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/stat +%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdb_mutex_check %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbdump %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbtool %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/testparm @@ -4200,6 +4235,8 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.003.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.001.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.listvars.001.sh @@ -4227,6 +4264,7 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.004.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.005.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.006.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.007.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.pdelete.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.ping.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.pnn.001.sh @@ -4277,6 +4315,7 @@ fi %{_datadir}/ctdb/tests/UNIT/tool/ctdb.setvar.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.002.sh +%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.003.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.001.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.002.sh %{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.003.sh @@ -4329,8 +4368,8 @@ fi %endif %changelog -* Tue Mar 21 2023 Andreas Schneider - 4.18.0-11 -- Fix file list +* Tue Mar 21 2023 Andreas Schneider - 4.18.0-12 +- Fix ctdb file lists when built with test suite enabled * Fri Mar 17 2023 Kalev Lember - 4.18.0-10 - Move libstable-sort-samba4.so to samba-client-libs subpackage From 8d52163b673aeac4019a67b31374418667209335 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Mar 2023 09:01:24 +0200 Subject: [PATCH 129/295] Add missing Requires for bind-utils samba_dnsupdate uses nsupdate from bind-utils --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index a417bf6..6778147 100644 --- a/samba.spec +++ b/samba.spec @@ -590,6 +590,7 @@ Requires: python3-setproctitle Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} Requires: krb5-server >= %{required_mit_krb5} +Requires: bind-utils Provides: samba4-dc = %{samba_depver} Obsoletes: samba4-dc < %{samba_depver} From 6126e39c511547f7d90e44e368dc7423f577329f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 29 Mar 2023 16:12:36 +0200 Subject: [PATCH 130/295] Update to version 4.18.1 resolves: #2182787 - Update to version 4.18.1 resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 Guenther --- .gitignore | 2 ++ samba.spec | 12 +++++++++--- sources | 4 ++-- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 550a6cc..53a513a 100644 --- a/.gitignore +++ b/.gitignore @@ -327,3 +327,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0rc4.tar.asc /samba-4.18.0.tar.xz /samba-4.18.0.tar.asc +/samba-4.18.1.tar.xz +/samba-4.18.1.tar.asc diff --git a/samba.spec b/samba.spec index 6778147..35177de 100644 --- a/samba.spec +++ b/samba.spec @@ -134,8 +134,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.0 -%global baserelease 12 +%global samba_version 4.18.1 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -171,7 +171,7 @@ %global talloc_version 2.4.0 %global tdb_version 1.4.8 %global tevent_version 0.14.1 -%global ldb_version 2.7.1 +%global ldb_version 2.7.2 %global required_mit_krb5 1.20.1 @@ -4369,6 +4369,12 @@ fi %endif %changelog +* Wed Mar 29 2023 Guenther Deschner - 4.18.1-0 +- resolves: #2182787 - Update to version 4.18.1 +- resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 +- resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 +- resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 + * Tue Mar 21 2023 Andreas Schneider - 4.18.0-12 - Fix ctdb file lists when built with test suite enabled diff --git a/sources b/sources index 588b398..3681b3c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.0.tar.xz) = bb4947335bd1fc501c29a62b413a9c3a1bbaf162d6965a4b2eeb65bf74363c300234b5c73d09e826e596989cd8afdee41b2470647bfdf8f7c42b998e7d367a64 -SHA512 (samba-4.18.0.tar.asc) = 1a478fd0e863e6b6874b703e04f449872b4d581e4c32c853ee4111bc94d1addcf3047331a288e8115a20d9ea22d8e04aade918e8623bd3d08d5122baf4ef0f3d +SHA512 (samba-4.18.1.tar.xz) = 110c6c110277337d714c3636a060895a4c01f118f639a978dc71de18285a8fea3e9071c846dbadbd0a1e3f9fe3e2208ecb0065b007fafeb96f8746a1d691be35 +SHA512 (samba-4.18.1.tar.asc) = 0eb125d8ff20c08e42d18fe2d04467b8ee6ab8fe80cce381697fb09d56200873fa63e6eeb6fd9cdfcee457668feed68c0967d7141b0cc040e0e28a9606518a58 From a6fcf14600dc332871538a5fe4ebec01131d7c63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 19 Apr 2023 14:34:42 +0200 Subject: [PATCH 131/295] Update to version 4.18.2 resolves: #2187991 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 53a513a..c09c477 100644 --- a/.gitignore +++ b/.gitignore @@ -329,3 +329,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.0.tar.asc /samba-4.18.1.tar.xz /samba-4.18.1.tar.asc +/samba-4.18.2.tar.xz +/samba-4.18.2.tar.asc diff --git a/samba.spec b/samba.spec index 35177de..bb144fb 100644 --- a/samba.spec +++ b/samba.spec @@ -134,7 +134,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.1 +%global samba_version 4.18.2 %global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4369,6 +4369,9 @@ fi %endif %changelog +* Wed Apr 19 2023 Guenther Deschner - 4.18.2-0 +- resolves: #2187991 - Update to version 4.18.2 + * Wed Mar 29 2023 Guenther Deschner - 4.18.1-0 - resolves: #2182787 - Update to version 4.18.1 - resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 diff --git a/sources b/sources index 3681b3c..4111daa 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.1.tar.xz) = 110c6c110277337d714c3636a060895a4c01f118f639a978dc71de18285a8fea3e9071c846dbadbd0a1e3f9fe3e2208ecb0065b007fafeb96f8746a1d691be35 -SHA512 (samba-4.18.1.tar.asc) = 0eb125d8ff20c08e42d18fe2d04467b8ee6ab8fe80cce381697fb09d56200873fa63e6eeb6fd9cdfcee457668feed68c0967d7141b0cc040e0e28a9606518a58 +SHA512 (samba-4.18.2.tar.xz) = edb2e9b7faa25243c8434f08885aa92a7f55cb218d141892f595b1319e8ccb8f0e978b0ab37537a9290fa2721f7cc186f3f66a732c22cb6fecb3056027618693 +SHA512 (samba-4.18.2.tar.asc) = 0f718b12da5e6cc7c770e58cc415b62a3a4226ab93d72fc6e3315af2cc925e17a23b1d168c252b375a8520df24d6fed64730a2585bcac8259dc8c724edc463fb From 5caa412c6bc9729457ed36c16f8d3218cd4ac5c5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 28 Mar 2023 09:55:56 +0200 Subject: [PATCH 132/295] Add support for mock ccache plugin --- samba.spec | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/samba.spec b/samba.spec index bb144fb..bffef92 100644 --- a/samba.spec +++ b/samba.spec @@ -1262,6 +1262,13 @@ export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" %endif +# Add support for mock ccache plugin +CCACHE="$(command -v ccache)" +if [ -n "${CCACHE}" ]; then + ${CCACHE} -s + export CC="${CCACHE} gcc" +fi + %configure \ --enable-fhs \ --with-piddir=/run \ From dc949bd3c8a45a97253aa30a8dc8081bd7f374bf Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 20 Apr 2023 14:38:04 +0200 Subject: [PATCH 133/295] Let samba-winbind just suggest samba-tool --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index bffef92..48dfc41 100644 --- a/samba.spec +++ b/samba.spec @@ -989,7 +989,7 @@ Requires(post): %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} -Recommends: %{name}-tools = %{samba_depver} +Suggests: %{name}-tools = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} From a79fd33b58027a5883eb1056023c4d529b701766 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 5 May 2023 13:53:47 +0200 Subject: [PATCH 134/295] Fix ccache support --- samba.spec | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 48dfc41..29f9447 100644 --- a/samba.spec +++ b/samba.spec @@ -2,7 +2,7 @@ # # To build and run the tests use: # -# fedpkg local --with testsuite +# fedpkg mockbuild --with testsuite # or # rpmbuild --rebuild --with testsuite samba.src.rpm # @@ -10,12 +10,15 @@ # Build with internal talloc, tevent, tdb and ldb. # -# fedpkg local --with=testsuite --with=includelibs +# fedpkg mockbuild --with=testsuite --with=includelibs # or # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm # %bcond_with includelibs +# fedpkg mockbuild --with=ccache +%bcond_with ccache + # ctdb is enabled by default, you can disable it with: --without clustering %bcond_without clustering @@ -1263,11 +1266,13 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" %endif # Add support for mock ccache plugin +%if %{with ccache} CCACHE="$(command -v ccache)" if [ -n "${CCACHE}" ]; then ${CCACHE} -s export CC="${CCACHE} gcc" fi +%endif %configure \ --enable-fhs \ From 41c4c700067073cf41c389a730c5927865e900e0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 1 Jun 2023 10:45:55 +0200 Subject: [PATCH 135/295] Update to version 4.18.3 resolves: #2211453 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index c09c477..b8bc24c 100644 --- a/.gitignore +++ b/.gitignore @@ -331,3 +331,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.1.tar.asc /samba-4.18.2.tar.xz /samba-4.18.2.tar.asc +/samba-4.18.3.tar.xz +/samba-4.18.3.tar.asc diff --git a/samba.spec b/samba.spec index 29f9447..2a7e336 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.2 +%global samba_version 4.18.3 %global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4381,6 +4381,9 @@ fi %endif %changelog +* Thu Jun 01 2023 Guenther Deschner - 4.18.3-0 +- resolves: #2211453 - Update to version 4.18.3 + * Wed Apr 19 2023 Guenther Deschner - 4.18.2-0 - resolves: #2187991 - Update to version 4.18.2 diff --git a/sources b/sources index 4111daa..f7f8e3a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.2.tar.xz) = edb2e9b7faa25243c8434f08885aa92a7f55cb218d141892f595b1319e8ccb8f0e978b0ab37537a9290fa2721f7cc186f3f66a732c22cb6fecb3056027618693 -SHA512 (samba-4.18.2.tar.asc) = 0f718b12da5e6cc7c770e58cc415b62a3a4226ab93d72fc6e3315af2cc925e17a23b1d168c252b375a8520df24d6fed64730a2585bcac8259dc8c724edc463fb +SHA512 (samba-4.18.3.tar.xz) = 792d32d9d0ca61b1a2216709b24e31195ad7c695bfbb42d4b61734c3d801b4dbf984da586b6736f184708c53599db82f36a593444af9321d87005d2a1656418d +SHA512 (samba-4.18.3.tar.asc) = e3197a55f6ea7104ee22572dc559c9a0909513f445389121ac703d7273c6cb260ea715134a10a01e05505c16937a8919f0bd6a095187bf8b338229c07ece3fe2 From 8210a6cc4c8c2fd3739d03b65ffbbd2824fe1b5a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 15 Jun 2023 10:21:23 +0200 Subject: [PATCH 136/295] logrotate: Also cover mit_kdc.log resolves: rhbz#2203539 --- samba.logrotate | 2 +- samba.spec | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.logrotate b/samba.logrotate index 40f85aa..43bef68 100644 --- a/samba.logrotate +++ b/samba.logrotate @@ -1,4 +1,4 @@ -/var/log/samba/log.* { +/var/log/samba/*log* { compress dateext maxage 365 diff --git a/samba.spec b/samba.spec index 2a7e336..164a7ea 100644 --- a/samba.spec +++ b/samba.spec @@ -4381,6 +4381,9 @@ fi %endif %changelog +* Thu Jun 15 2023 Andreas Schneider - 4.18.3-1 +- resolves: #2203539 - Also cover mit_kdc.log by logrotate + * Thu Jun 01 2023 Guenther Deschner - 4.18.3-0 - resolves: #2211453 - Update to version 4.18.3 From f5d2701706ace8d556f28b3e16164f2f96a15e55 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 15 Jun 2023 12:32:01 +0200 Subject: [PATCH 137/295] Bump baserelease Forgotten in previous commit. --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 164a7ea..3d07db7 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil From 15cfaa7346d46007a86267807697524bc6afd9b8 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Thu, 15 Jun 2023 13:18:39 +0200 Subject: [PATCH 138/295] Rebuilt for Python 3.12 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 3d07db7..4f99a85 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -4381,6 +4381,9 @@ fi %endif %changelog +* Thu Jun 15 2023 Python Maint - 2:4.18.3-2 +- Rebuilt for Python 3.12 + * Thu Jun 15 2023 Andreas Schneider - 4.18.3-1 - resolves: #2203539 - Also cover mit_kdc.log by logrotate From efe3dd0ab17750ab1da30ddc180ac7f83b143595 Mon Sep 17 00:00:00 2001 From: "FeRD (Frank Dana)" Date: Sat, 17 Jun 2023 11:18:44 -0400 Subject: [PATCH 139/295] =?UTF-8?q?Remove=20=C2=AE=20symbol=20from=20winex?= =?UTF-8?q?e's=20description?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 4f99a85..e6ea486 100644 --- a/samba.spec +++ b/samba.spec @@ -1090,7 +1090,7 @@ Requires: %{name}-common-libs = %{samba_depver} Provides: bundled(libreplace) %description winexe -Winexe is a Remote Windows®-command executor +Winexe is a Remote Windows-command executor %endif ### CTDB From 7f3a842050130d8f8a375333438113a1aad7a86b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 23 Jun 2023 10:45:43 +0200 Subject: [PATCH 140/295] Fix libwbclient package upgrades resolves: rhbz#2211577 --- samba.spec | 71 +++++++++--------------------------------------------- 1 file changed, 12 insertions(+), 59 deletions(-) diff --git a/samba.spec b/samba.spec index e6ea486..4bb5af5 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release %nil @@ -829,6 +829,7 @@ suite. %package -n libwbclient Summary: The winbind client library Requires: %{name}-client-libs = %{samba_depver} +Conflicts: sssd-libwbclient %description -n libwbclient The libwbclient package contains the winbind client library from the Samba @@ -837,6 +838,7 @@ suite. %package -n libwbclient-devel Summary: Developer tools for the winbind library Requires: libwbclient = %{samba_depver} +Conflicts: sssd-libwbclient-devel Provides: samba-winbind-devel = %{samba_depver} Obsoletes: samba-winbind-devel < %{samba_depver} @@ -1359,17 +1361,6 @@ install -d -m 0755 %{buildroot}/%{_libdir}/samba install -d -m 0755 %{buildroot}/%{_libdir}/samba/ldb install -d -m 0755 %{buildroot}/%{_libdir}/pkgconfig -# Move libwbclient.so* into private directory, it cannot be just libdir/samba -# because samba uses rpath with this directory. -install -d -m 0755 %{buildroot}/%{_libdir}/samba/wbclient -mv %{buildroot}/%{_libdir}/libwbclient.so* %{buildroot}/%{_libdir}/samba/wbclient -if [ ! -f %{buildroot}/%{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version} ] -then - echo "Expected libwbclient version not found, please check if version has changed." - exit -1 -fi - - touch %{buildroot}%{_libexecdir}/samba/cups_backend_smb # Install other stuff @@ -1576,52 +1567,11 @@ fi %endif %if %{with libwbclient} -%posttrans -n libwbclient -# It has to be posttrans here to make sure all files of a previous version -# without alternatives support are removed -%{_sbindir}/update-alternatives \ - --install \ - %{_libdir}/libwbclient.so.%{libwbc_alternatives_version} \ - libwbclient.so.%{libwbc_alternatives_version}%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version} \ - 10 +%pre -n libwbclient +rm -rf %{_libdir}/samba/wbclient/ +rm -f /etc/alternatives/libwbclient.so* +rm -f /var/lib/alternatives/libwbclient.so* %{?ldconfig} - -%preun -n libwbclient -if [ $1 -eq 0 ]; then - %{_sbindir}/update-alternatives \ - --remove \ - libwbclient.so.%{libwbc_alternatives_version}%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so.%{libwbc_alternatives_version} -fi -/sbin/ldconfig - -%posttrans -n libwbclient-devel -%{_sbindir}/update-alternatives \ - --install %{_libdir}/libwbclient.so \ - libwbclient.so%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so \ - 10 - -%preun -n libwbclient-devel -# alternatives checks if the file which should be removed is a link or not, but -# not if it points to the /etc/alternatives directory or to some other place. -# When downgrading to a version where alternatives is not used and -# libwbclient.so is a link and not a file it will be removed. The following -# check removes the alternatives files manually if that is the case. -if [ $1 -eq 0 ]; then - if [ "`readlink %{_libdir}/libwbclient.so`" == "libwbclient.so.%{libwbc_alternatives_version}" ]; then - /bin/rm -f \ - /etc/alternatives/libwbclient.so%{libwbc_alternatives_suffix} \ - /var/lib/alternatives/libwbclient.so%{libwbc_alternatives_suffix} 2> /dev/null - else - %{_sbindir}/update-alternatives \ - --remove \ - libwbclient.so%{libwbc_alternatives_suffix} \ - %{_libdir}/samba/wbclient/libwbclient.so - fi -fi - #endif {with libwbclient} %endif @@ -2426,12 +2376,12 @@ fi ### LIBWBCLIENT %if %{with libwbclient} %files -n libwbclient -%{_libdir}/samba/wbclient/libwbclient.so.%{libwbclient_so_version}* +%{_libdir}/libwbclient.so.%{libwbclient_so_version}* ### LIBWBCLIENT-DEVEL %files -n libwbclient-devel %{_includedir}/samba-4.0/wbclient.h -%{_libdir}/samba/wbclient/libwbclient.so +%{_libdir}/libwbclient.so %{_libdir}/pkgconfig/wbclient.pc #endif {with libwbclient} %endif @@ -4381,6 +4331,9 @@ fi %endif %changelog +* Fri Jun 23 2023 Andreas Schneider - 4.18.3-3 +- resolves: rhbz#2211577 - Fix libwbclient package upgrades + * Thu Jun 15 2023 Python Maint - 2:4.18.3-2 - Rebuilt for Python 3.12 From c3a5a6aedeaa7ca1894abd44e9fc508cd3cf45ae Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Mon, 26 Jun 2023 01:02:08 +0200 Subject: [PATCH 141/295] Only run libwbclient %pre on upgrade, not fresh install This seems to be breaking live image build tests because the script is running before `rm` is installed. I do not know why it didn't fail the tests run *on the update itself*, but it's now causing tests of subsequent updates to fail, which is a problem. Probably an ordering issue. AFAIK, this script is meant to clean up stuff from earlier versions of the package, so it's not relevant on fresh installs, and we can just skip it and avoid any problems in the fresh install case. --- samba.spec | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 4bb5af5..f53f676 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release %nil @@ -1568,9 +1568,11 @@ fi %if %{with libwbclient} %pre -n libwbclient -rm -rf %{_libdir}/samba/wbclient/ -rm -f /etc/alternatives/libwbclient.so* -rm -f /var/lib/alternatives/libwbclient.so* +if [ $1 -gt 1 ] ; then + rm -rf %{_libdir}/samba/wbclient/ + rm -f /etc/alternatives/libwbclient.so* + rm -f /var/lib/alternatives/libwbclient.so* +fi %{?ldconfig} #endif {with libwbclient} %endif @@ -4331,6 +4333,9 @@ fi %endif %changelog +* Mon Jun 26 2023 Adam Williamson - 4.18.3-4 +- Only run libwbclient %pre on upgrade, not fresh install + * Fri Jun 23 2023 Andreas Schneider - 4.18.3-3 - resolves: rhbz#2211577 - Fix libwbclient package upgrades From f3b66c42cad2c923c84fe9144f5e7148b0f70188 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 26 Jun 2023 12:27:58 +0200 Subject: [PATCH 142/295] Rebuilt for Python 3.12 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index f53f676..65003fc 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.3 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil %global pre_release %nil @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Mon Jun 26 2023 Python Maint - 2:4.18.3-5 +- Rebuilt for Python 3.12 + * Mon Jun 26 2023 Adam Williamson - 4.18.3-4 - Only run libwbclient %pre on upgrade, not fresh install From ac8caa023eb94155b94b3bdf62b698aaefdf5ec4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 5 Jul 2023 14:10:53 +0200 Subject: [PATCH 143/295] Update to version 4.18.4 resolves: #2219799 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index b8bc24c..1849014 100644 --- a/.gitignore +++ b/.gitignore @@ -333,3 +333,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.2.tar.asc /samba-4.18.3.tar.xz /samba-4.18.3.tar.asc +/samba-4.18.4.tar.xz +/samba-4.18.4.tar.asc diff --git a/samba.spec b/samba.spec index 65003fc..843858c 100644 --- a/samba.spec +++ b/samba.spec @@ -137,8 +137,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.3 -%global baserelease 5 +%global samba_version 4.18.4 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Wed Jul 05 2023 Guenther Deschner - 4.18.4-0 +- resolves: #2219799 - Update to version 4.18.4 + * Mon Jun 26 2023 Python Maint - 2:4.18.3-5 - Rebuilt for Python 3.12 diff --git a/sources b/sources index f7f8e3a..e1b7b1c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.3.tar.xz) = 792d32d9d0ca61b1a2216709b24e31195ad7c695bfbb42d4b61734c3d801b4dbf984da586b6736f184708c53599db82f36a593444af9321d87005d2a1656418d -SHA512 (samba-4.18.3.tar.asc) = e3197a55f6ea7104ee22572dc559c9a0909513f445389121ac703d7273c6cb260ea715134a10a01e05505c16937a8919f0bd6a095187bf8b338229c07ece3fe2 +SHA512 (samba-4.18.4.tar.xz) = 9b9ed3111e8c1f8fbb990e2cf78bdd00bbe03e79247ec87a3ee51744acfbc6692f110dc88ccb1049b7d9c6aaa8fd6ba3ab4acd7ad0480dbb9df8b61980c0da83 +SHA512 (samba-4.18.4.tar.asc) = bc13d14b8da6a05494a79b8a8fb35fc27670f7ab8609eaeb3f3df49dd04bdb1389e77c2d571db5efcdd85532971c423eb977d46c2a5cbee3daadd6c6eca721ec From 3948e24a266dfda8efffb05e21a6746505c6139f Mon Sep 17 00:00:00 2001 From: Python Maint Date: Wed, 5 Jul 2023 18:27:08 +0200 Subject: [PATCH 144/295] Rebuilt for Python 3.12 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 843858c..236f59c 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.4 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Wed Jul 05 2023 Python Maint - 2:4.18.4-1 +- Rebuilt for Python 3.12 + * Wed Jul 05 2023 Guenther Deschner - 4.18.4-0 - resolves: #2219799 - Update to version 4.18.4 From a38fba05622f8ab17d6d9c2dc50e6a2ddfbcabfe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20Zatloukal?= Date: Tue, 11 Jul 2023 22:21:49 +0200 Subject: [PATCH 145/295] Rebuilt for ICU 73.2 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 236f59c..103ef04 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.4 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -4333,6 +4333,9 @@ fi %endif %changelog +* Tue Jul 11 2023 František Zatloukal - 2:4.18.4-2 +- Rebuilt for ICU 73.2 + * Wed Jul 05 2023 Python Maint - 2:4.18.4-1 - Rebuilt for Python 3.12 From 64ef2ec2d2cc5d47909984b72d2a0f7df902215e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 15 Jul 2023 15:17:52 +0200 Subject: [PATCH 146/295] Fix netlogon LogonGetCapabilities level 2 error handling resolves: #2223091 Guenther --- master-netlogongetcaps.patch | 351 +++++++++++++++++++++++++++++++++++ samba.spec | 7 +- 2 files changed, 357 insertions(+), 1 deletion(-) create mode 100644 master-netlogongetcaps.patch diff --git a/master-netlogongetcaps.patch b/master-netlogongetcaps.patch new file mode 100644 index 0000000..dd0f6b1 --- /dev/null +++ b/master-netlogongetcaps.patch @@ -0,0 +1,351 @@ +From 5f87888ed53320538cf773d64868390d8641a40e Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 17:20:32 +0200 +Subject: [PATCH 1/4] netlogon.idl: add support for netr_LogonGetCapabilities + response level 2 + +We don't have any documentation about this yet, but tests against +a Windows Server 2022 patched with KB5028166 revealed that +the response for query_level=2 is exactly the same as +for querey_level=1. + +Until we know the reason for query_level=2 we won't +use it as client nor support it in the server, but +we want ndrdump to work. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + librpc/idl/netlogon.idl | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/librpc/idl/netlogon.idl b/librpc/idl/netlogon.idl +index 48a8c8f9310..85dd73ee7e4 100644 +--- a/librpc/idl/netlogon.idl ++++ b/librpc/idl/netlogon.idl +@@ -1236,6 +1236,7 @@ interface netlogon + /* Function 0x15 */ + typedef [switch_type(uint32)] union { + [case(1)] netr_NegotiateFlags server_capabilities; ++ [case(2)] netr_NegotiateFlags server_capabilities; + } netr_Capabilities; + + NTSTATUS netr_LogonGetCapabilities( +-- +2.41.0 + + +From 404ce08e9088968311c714e756f5d58ce2cef715 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 17:25:05 +0200 +Subject: [PATCH 2/4] s4:torture/rpc: let rpc.schannel also check + netr_LogonGetCapabilities with different levels + +The important change it that we expect DCERPC_NCA_S_FAULT_INVALID_TAG +for unsupported query_levels, we allow it to work with servers +with or without support for query_level=2. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + .../knownfail.d/netr_LogonGetCapabilities | 3 + + source4/torture/rpc/netlogon.c | 77 ++++++++++++++++++- + 2 files changed, 79 insertions(+), 1 deletion(-) + create mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +new file mode 100644 +index 00000000000..30aadf3bb9d +--- /dev/null ++++ b/selftest/knownfail.d/netr_LogonGetCapabilities +@@ -0,0 +1,3 @@ ++^samba3.rpc.schannel.*\.schannel\(nt4_dc ++^samba3.rpc.schannel.*\.schannel\(ad_dc ++^samba4.rpc.schannel.*\.schannel\(ad_dc +diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c +index 1f068eb7826..a3d190f13dd 100644 +--- a/source4/torture/rpc/netlogon.c ++++ b/source4/torture/rpc/netlogon.c +@@ -2056,8 +2056,47 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t + r.out.capabilities = &capabilities; + r.out.return_authenticator = &return_auth; + +- torture_comment(tctx, "Testing LogonGetCapabilities\n"); ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=0\n"); + ++ r.in.query_level = 0; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, ++ "LogonGetCapabilities query_level=0 failed"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=3\n"); ++ ++ r.in.query_level = 3; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, ++ "LogonGetCapabilities query_level=0 failed"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=1\n"); ++ ++ r.in.query_level = 1; + ZERO_STRUCT(return_auth); + + /* +@@ -2077,6 +2116,42 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t + + *creds = tmp_creds; + ++ torture_assert(tctx, netlogon_creds_client_check(creds, ++ &r.out.return_authenticator->cred), ++ "Credential chaining failed"); ++ ++ torture_assert_int_equal(tctx, creds->negotiate_flags, ++ capabilities.server_capabilities, ++ "negotiate flags"); ++ ++ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=2\n"); ++ ++ r.in.query_level = 2; ++ ZERO_STRUCT(return_auth); ++ ++ /* ++ * we need to operate on a temporary copy of creds ++ * because dcerpc_netr_LogonGetCapabilities with ++ * an query level 2 may returns DCERPC_NCA_S_FAULT_INVALID_TAG ++ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ * without looking a the authenticator. ++ */ ++ tmp_creds = *creds; ++ netlogon_creds_client_authenticator(&tmp_creds, &auth); ++ ++ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); ++ if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) { ++ /* ++ * an server without KB5028166 returns ++ * DCERPC_NCA_S_FAULT_INVALID_TAG => ++ * NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE ++ */ ++ return true; ++ } ++ torture_assert_ntstatus_ok(tctx, status, "LogonGetCapabilities query_level=2 failed"); ++ ++ *creds = tmp_creds; ++ + torture_assert(tctx, netlogon_creds_client_check(creds, + &r.out.return_authenticator->cred), + "Credential chaining failed"); +-- +2.41.0 + + +From d5f1097b6220676d56ed5fc6707acf667b704518 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 16:11:48 +0200 +Subject: [PATCH 3/4] s4:rpc_server:netlogon: generate FAULT_INVALID_TAG for + invalid netr_LogonGetCapabilities levels + +This is important as Windows clients with KB5028166 seem to +call netr_LogonGetCapabilities with query_level=2 after +a call with query_level=1. + +An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG +for query_level values other than 1. +While Samba tries to return NT_STATUS_NOT_SUPPORTED, but +later fails to marshall the response, which results +in DCERPC_FAULT_BAD_STUB_DATA instead. + +Because we don't have any documentation for level 2 yet, +we just try to behave like an unpatched server and +generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of +DCERPC_FAULT_BAD_STUB_DATA. +Which allows patched Windows clients to keep working +against a Samba DC. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett +--- + .../knownfail.d/netr_LogonGetCapabilities | 2 -- + source4/rpc_server/netlogon/dcerpc_netlogon.c | 28 ++++++++++++++++--- + 2 files changed, 24 insertions(+), 6 deletions(-) + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +index 30aadf3bb9d..99c7ac711ed 100644 +--- a/selftest/knownfail.d/netr_LogonGetCapabilities ++++ b/selftest/knownfail.d/netr_LogonGetCapabilities +@@ -1,3 +1 @@ + ^samba3.rpc.schannel.*\.schannel\(nt4_dc +-^samba3.rpc.schannel.*\.schannel\(ad_dc +-^samba4.rpc.schannel.*\.schannel\(ad_dc +diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c +index 6ccba65d3bf..dc2167f08b2 100644 +--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c ++++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c +@@ -2364,6 +2364,30 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c + struct netlogon_creds_CredentialState *creds; + NTSTATUS status; + ++ switch (r->in.query_level) { ++ case 1: ++ break; ++ case 2: ++ /* ++ * Until we know the details behind KB5028166 ++ * just return DCERPC_NCA_S_FAULT_INVALID_TAG ++ * like an unpatched Windows Server. ++ */ ++ FALL_THROUGH; ++ default: ++ /* ++ * There would not be a way to marshall the ++ * the response. Which would mean our final ++ * ndr_push would fail an we would return ++ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. ++ * ++ * But it's important to match a Windows server ++ * especially before KB5028166, see also our bug #15418 ++ * Otherwise Windows client would stop talking to us. ++ */ ++ DCESRV_FAULT(DCERPC_NCA_S_FAULT_INVALID_TAG); ++ } ++ + status = dcesrv_netr_creds_server_step_check(dce_call, + mem_ctx, + r->in.computer_name, +@@ -2375,10 +2399,6 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c + } + NT_STATUS_NOT_OK_RETURN(status); + +- if (r->in.query_level != 1) { +- return NT_STATUS_NOT_SUPPORTED; +- } +- + r->out.capabilities->server_capabilities = creds->negotiate_flags; + + return NT_STATUS_OK; +-- +2.41.0 + + +From dfeabce44fbb78083fbbb2aa634fc4172cf83db9 Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Sat, 15 Jul 2023 16:11:48 +0200 +Subject: [PATCH 4/4] s3:rpc_server:netlogon: generate FAULT_INVALID_TAG for + invalid netr_LogonGetCapabilities levels + +This is important as Windows clients with KB5028166 seem to +call netr_LogonGetCapabilities with query_level=2 after +a call with query_level=1. + +An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG +for query_level values other than 1. +While Samba tries to return NT_STATUS_NOT_SUPPORTED, but +later fails to marshall the response, which results +in DCERPC_FAULT_BAD_STUB_DATA instead. + +Because we don't have any documentation for level 2 yet, +we just try to behave like an unpatched server and +generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of +DCERPC_FAULT_BAD_STUB_DATA. +Which allows patched Windows clients to keep working +against a Samba DC. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 + +Signed-off-by: Stefan Metzmacher +Reviewed-by: Andrew Bartlett + +Autobuild-User(master): Stefan Metzmacher +Autobuild-Date(master): Mon Jul 17 07:35:09 UTC 2023 on atb-devel-224 +--- + .../knownfail.d/netr_LogonGetCapabilities | 1 - + source3/rpc_server/netlogon/srv_netlog_nt.c | 29 ++++++++++++++++--- + 2 files changed, 25 insertions(+), 5 deletions(-) + delete mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities + +diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities +deleted file mode 100644 +index 99c7ac711ed..00000000000 +--- a/selftest/knownfail.d/netr_LogonGetCapabilities ++++ /dev/null +@@ -1 +0,0 @@ +-^samba3.rpc.schannel.*\.schannel\(nt4_dc +diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c +index 3ba58e61206..e8aa14167fc 100644 +--- a/source3/rpc_server/netlogon/srv_netlog_nt.c ++++ b/source3/rpc_server/netlogon/srv_netlog_nt.c +@@ -2284,6 +2284,31 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, + struct netlogon_creds_CredentialState *creds; + NTSTATUS status; + ++ switch (r->in.query_level) { ++ case 1: ++ break; ++ case 2: ++ /* ++ * Until we know the details behind KB5028166 ++ * just return DCERPC_NCA_S_FAULT_INVALID_TAG ++ * like an unpatched Windows Server. ++ */ ++ FALL_THROUGH; ++ default: ++ /* ++ * There would not be a way to marshall the ++ * the response. Which would mean our final ++ * ndr_push would fail an we would return ++ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. ++ * ++ * But it's important to match a Windows server ++ * especially before KB5028166, see also our bug #15418 ++ * Otherwise Windows client would stop talking to us. ++ */ ++ p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG; ++ return NT_STATUS_NOT_SUPPORTED; ++ } ++ + become_root(); + status = dcesrv_netr_creds_server_step_check(p->dce_call, + p->mem_ctx, +@@ -2296,10 +2321,6 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, + return status; + } + +- if (r->in.query_level != 1) { +- return NT_STATUS_NOT_SUPPORTED; +- } +- + r->out.capabilities->server_capabilities = creds->negotiate_flags; + + return NT_STATUS_OK; +-- +2.41.0 + diff --git a/samba.spec b/samba.spec index 103ef04..4bbddfc 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.18.4 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release %nil @@ -234,6 +234,8 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: master-netlogongetcaps.patch + Requires(pre): /usr/sbin/groupadd Requires(pre): %{name}-common = %{samba_depver} @@ -4333,6 +4335,9 @@ fi %endif %changelog +* Sat Jul 15 2023 Guenther Deschner - 4.18.4-3 +- resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling + * Tue Jul 11 2023 František Zatloukal - 2:4.18.4-2 - Rebuilt for ICU 73.2 From 9ae16cc49b17e71c781ae5b4e2493fac4a6120aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 20 Jul 2023 10:21:05 +0200 Subject: [PATCH 147/295] Update to version 4.18.5 resolves: #2224040 Security fix for CVE-2022-2127 resolves: #2222791, #2224254 Security fix for CVE-2023-3347 resolves: #2222792, #2224255 Security fix for CVE-2023-34966 resolves: #2222793, #2224253 Security fix for CVE-2023-34967 resolves: #2222794, #2224252 Security fix for CVE-2023-34968 resolves: #2222795, #2224250 Guenther --- .gitignore | 2 + master-netlogongetcaps.patch | 351 ----------------------------------- samba.spec | 14 +- sources | 4 +- 4 files changed, 14 insertions(+), 357 deletions(-) delete mode 100644 master-netlogongetcaps.patch diff --git a/.gitignore b/.gitignore index 1849014..7d7069f 100644 --- a/.gitignore +++ b/.gitignore @@ -335,3 +335,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.3.tar.asc /samba-4.18.4.tar.xz /samba-4.18.4.tar.asc +/samba-4.18.5.tar.xz +/samba-4.18.5.tar.asc diff --git a/master-netlogongetcaps.patch b/master-netlogongetcaps.patch deleted file mode 100644 index dd0f6b1..0000000 --- a/master-netlogongetcaps.patch +++ /dev/null @@ -1,351 +0,0 @@ -From 5f87888ed53320538cf773d64868390d8641a40e Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 17:20:32 +0200 -Subject: [PATCH 1/4] netlogon.idl: add support for netr_LogonGetCapabilities - response level 2 - -We don't have any documentation about this yet, but tests against -a Windows Server 2022 patched with KB5028166 revealed that -the response for query_level=2 is exactly the same as -for querey_level=1. - -Until we know the reason for query_level=2 we won't -use it as client nor support it in the server, but -we want ndrdump to work. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - librpc/idl/netlogon.idl | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/librpc/idl/netlogon.idl b/librpc/idl/netlogon.idl -index 48a8c8f9310..85dd73ee7e4 100644 ---- a/librpc/idl/netlogon.idl -+++ b/librpc/idl/netlogon.idl -@@ -1236,6 +1236,7 @@ interface netlogon - /* Function 0x15 */ - typedef [switch_type(uint32)] union { - [case(1)] netr_NegotiateFlags server_capabilities; -+ [case(2)] netr_NegotiateFlags server_capabilities; - } netr_Capabilities; - - NTSTATUS netr_LogonGetCapabilities( --- -2.41.0 - - -From 404ce08e9088968311c714e756f5d58ce2cef715 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 17:25:05 +0200 -Subject: [PATCH 2/4] s4:torture/rpc: let rpc.schannel also check - netr_LogonGetCapabilities with different levels - -The important change it that we expect DCERPC_NCA_S_FAULT_INVALID_TAG -for unsupported query_levels, we allow it to work with servers -with or without support for query_level=2. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - .../knownfail.d/netr_LogonGetCapabilities | 3 + - source4/torture/rpc/netlogon.c | 77 ++++++++++++++++++- - 2 files changed, 79 insertions(+), 1 deletion(-) - create mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -new file mode 100644 -index 00000000000..30aadf3bb9d ---- /dev/null -+++ b/selftest/knownfail.d/netr_LogonGetCapabilities -@@ -0,0 +1,3 @@ -+^samba3.rpc.schannel.*\.schannel\(nt4_dc -+^samba3.rpc.schannel.*\.schannel\(ad_dc -+^samba4.rpc.schannel.*\.schannel\(ad_dc -diff --git a/source4/torture/rpc/netlogon.c b/source4/torture/rpc/netlogon.c -index 1f068eb7826..a3d190f13dd 100644 ---- a/source4/torture/rpc/netlogon.c -+++ b/source4/torture/rpc/netlogon.c -@@ -2056,8 +2056,47 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t - r.out.capabilities = &capabilities; - r.out.return_authenticator = &return_auth; - -- torture_comment(tctx, "Testing LogonGetCapabilities\n"); -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=0\n"); - -+ r.in.query_level = 0; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, -+ "LogonGetCapabilities query_level=0 failed"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=3\n"); -+ -+ r.in.query_level = 3; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an unknown query level returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ torture_assert_ntstatus_equal(tctx, status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE, -+ "LogonGetCapabilities query_level=0 failed"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=1\n"); -+ -+ r.in.query_level = 1; - ZERO_STRUCT(return_auth); - - /* -@@ -2077,6 +2116,42 @@ bool test_netlogon_capabilities(struct dcerpc_pipe *p, struct torture_context *t - - *creds = tmp_creds; - -+ torture_assert(tctx, netlogon_creds_client_check(creds, -+ &r.out.return_authenticator->cred), -+ "Credential chaining failed"); -+ -+ torture_assert_int_equal(tctx, creds->negotiate_flags, -+ capabilities.server_capabilities, -+ "negotiate flags"); -+ -+ torture_comment(tctx, "Testing LogonGetCapabilities with query_level=2\n"); -+ -+ r.in.query_level = 2; -+ ZERO_STRUCT(return_auth); -+ -+ /* -+ * we need to operate on a temporary copy of creds -+ * because dcerpc_netr_LogonGetCapabilities with -+ * an query level 2 may returns DCERPC_NCA_S_FAULT_INVALID_TAG -+ * => NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ * without looking a the authenticator. -+ */ -+ tmp_creds = *creds; -+ netlogon_creds_client_authenticator(&tmp_creds, &auth); -+ -+ status = dcerpc_netr_LogonGetCapabilities_r(b, tctx, &r); -+ if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) { -+ /* -+ * an server without KB5028166 returns -+ * DCERPC_NCA_S_FAULT_INVALID_TAG => -+ * NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE -+ */ -+ return true; -+ } -+ torture_assert_ntstatus_ok(tctx, status, "LogonGetCapabilities query_level=2 failed"); -+ -+ *creds = tmp_creds; -+ - torture_assert(tctx, netlogon_creds_client_check(creds, - &r.out.return_authenticator->cred), - "Credential chaining failed"); --- -2.41.0 - - -From d5f1097b6220676d56ed5fc6707acf667b704518 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 16:11:48 +0200 -Subject: [PATCH 3/4] s4:rpc_server:netlogon: generate FAULT_INVALID_TAG for - invalid netr_LogonGetCapabilities levels - -This is important as Windows clients with KB5028166 seem to -call netr_LogonGetCapabilities with query_level=2 after -a call with query_level=1. - -An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG -for query_level values other than 1. -While Samba tries to return NT_STATUS_NOT_SUPPORTED, but -later fails to marshall the response, which results -in DCERPC_FAULT_BAD_STUB_DATA instead. - -Because we don't have any documentation for level 2 yet, -we just try to behave like an unpatched server and -generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of -DCERPC_FAULT_BAD_STUB_DATA. -Which allows patched Windows clients to keep working -against a Samba DC. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett ---- - .../knownfail.d/netr_LogonGetCapabilities | 2 -- - source4/rpc_server/netlogon/dcerpc_netlogon.c | 28 ++++++++++++++++--- - 2 files changed, 24 insertions(+), 6 deletions(-) - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -index 30aadf3bb9d..99c7ac711ed 100644 ---- a/selftest/knownfail.d/netr_LogonGetCapabilities -+++ b/selftest/knownfail.d/netr_LogonGetCapabilities -@@ -1,3 +1 @@ - ^samba3.rpc.schannel.*\.schannel\(nt4_dc --^samba3.rpc.schannel.*\.schannel\(ad_dc --^samba4.rpc.schannel.*\.schannel\(ad_dc -diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c -index 6ccba65d3bf..dc2167f08b2 100644 ---- a/source4/rpc_server/netlogon/dcerpc_netlogon.c -+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c -@@ -2364,6 +2364,30 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c - struct netlogon_creds_CredentialState *creds; - NTSTATUS status; - -+ switch (r->in.query_level) { -+ case 1: -+ break; -+ case 2: -+ /* -+ * Until we know the details behind KB5028166 -+ * just return DCERPC_NCA_S_FAULT_INVALID_TAG -+ * like an unpatched Windows Server. -+ */ -+ FALL_THROUGH; -+ default: -+ /* -+ * There would not be a way to marshall the -+ * the response. Which would mean our final -+ * ndr_push would fail an we would return -+ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. -+ * -+ * But it's important to match a Windows server -+ * especially before KB5028166, see also our bug #15418 -+ * Otherwise Windows client would stop talking to us. -+ */ -+ DCESRV_FAULT(DCERPC_NCA_S_FAULT_INVALID_TAG); -+ } -+ - status = dcesrv_netr_creds_server_step_check(dce_call, - mem_ctx, - r->in.computer_name, -@@ -2375,10 +2399,6 @@ static NTSTATUS dcesrv_netr_LogonGetCapabilities(struct dcesrv_call_state *dce_c - } - NT_STATUS_NOT_OK_RETURN(status); - -- if (r->in.query_level != 1) { -- return NT_STATUS_NOT_SUPPORTED; -- } -- - r->out.capabilities->server_capabilities = creds->negotiate_flags; - - return NT_STATUS_OK; --- -2.41.0 - - -From dfeabce44fbb78083fbbb2aa634fc4172cf83db9 Mon Sep 17 00:00:00 2001 -From: Stefan Metzmacher -Date: Sat, 15 Jul 2023 16:11:48 +0200 -Subject: [PATCH 4/4] s3:rpc_server:netlogon: generate FAULT_INVALID_TAG for - invalid netr_LogonGetCapabilities levels - -This is important as Windows clients with KB5028166 seem to -call netr_LogonGetCapabilities with query_level=2 after -a call with query_level=1. - -An unpatched Windows Server returns DCERPC_NCA_S_FAULT_INVALID_TAG -for query_level values other than 1. -While Samba tries to return NT_STATUS_NOT_SUPPORTED, but -later fails to marshall the response, which results -in DCERPC_FAULT_BAD_STUB_DATA instead. - -Because we don't have any documentation for level 2 yet, -we just try to behave like an unpatched server and -generate DCERPC_NCA_S_FAULT_INVALID_TAG instead of -DCERPC_FAULT_BAD_STUB_DATA. -Which allows patched Windows clients to keep working -against a Samba DC. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15418 - -Signed-off-by: Stefan Metzmacher -Reviewed-by: Andrew Bartlett - -Autobuild-User(master): Stefan Metzmacher -Autobuild-Date(master): Mon Jul 17 07:35:09 UTC 2023 on atb-devel-224 ---- - .../knownfail.d/netr_LogonGetCapabilities | 1 - - source3/rpc_server/netlogon/srv_netlog_nt.c | 29 ++++++++++++++++--- - 2 files changed, 25 insertions(+), 5 deletions(-) - delete mode 100644 selftest/knownfail.d/netr_LogonGetCapabilities - -diff --git a/selftest/knownfail.d/netr_LogonGetCapabilities b/selftest/knownfail.d/netr_LogonGetCapabilities -deleted file mode 100644 -index 99c7ac711ed..00000000000 ---- a/selftest/knownfail.d/netr_LogonGetCapabilities -+++ /dev/null -@@ -1 +0,0 @@ --^samba3.rpc.schannel.*\.schannel\(nt4_dc -diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c -index 3ba58e61206..e8aa14167fc 100644 ---- a/source3/rpc_server/netlogon/srv_netlog_nt.c -+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c -@@ -2284,6 +2284,31 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, - struct netlogon_creds_CredentialState *creds; - NTSTATUS status; - -+ switch (r->in.query_level) { -+ case 1: -+ break; -+ case 2: -+ /* -+ * Until we know the details behind KB5028166 -+ * just return DCERPC_NCA_S_FAULT_INVALID_TAG -+ * like an unpatched Windows Server. -+ */ -+ FALL_THROUGH; -+ default: -+ /* -+ * There would not be a way to marshall the -+ * the response. Which would mean our final -+ * ndr_push would fail an we would return -+ * an RPC-level fault with DCERPC_FAULT_BAD_STUB_DATA. -+ * -+ * But it's important to match a Windows server -+ * especially before KB5028166, see also our bug #15418 -+ * Otherwise Windows client would stop talking to us. -+ */ -+ p->fault_state = DCERPC_NCA_S_FAULT_INVALID_TAG; -+ return NT_STATUS_NOT_SUPPORTED; -+ } -+ - become_root(); - status = dcesrv_netr_creds_server_step_check(p->dce_call, - p->mem_ctx, -@@ -2296,10 +2321,6 @@ NTSTATUS _netr_LogonGetCapabilities(struct pipes_struct *p, - return status; - } - -- if (r->in.query_level != 1) { -- return NT_STATUS_NOT_SUPPORTED; -- } -- - r->out.capabilities->server_capabilities = creds->negotiate_flags; - - return NT_STATUS_OK; --- -2.41.0 - diff --git a/samba.spec b/samba.spec index 4bbddfc..115d603 100644 --- a/samba.spec +++ b/samba.spec @@ -137,8 +137,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.4 -%global baserelease 3 +%global samba_version 4.18.5 +%global baserelease 0 # This should be rc1 or %%nil %global pre_release %nil @@ -234,8 +234,6 @@ Source17: samba-usershares-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: master-netlogongetcaps.patch - Requires(pre): /usr/sbin/groupadd Requires(pre): %{name}-common = %{samba_depver} @@ -4335,6 +4333,14 @@ fi %endif %changelog +* Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 +- resolves: #2224040 - Update to version 4.18.5 +- resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 +- resolves: #2222792, #2224255 - Security fix for CVE-2023-3347 +- resolves: #2222793, #2224253 - Security fix for CVE-2023-34966 +- resolves: #2222794, #2224252 - Security fix for CVE-2023-34967 +- resolves: #2222795, #2224250 - Security fix for CVE-2023-34968 + * Sat Jul 15 2023 Guenther Deschner - 4.18.4-3 - resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling diff --git a/sources b/sources index e1b7b1c..d77b19c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.4.tar.xz) = 9b9ed3111e8c1f8fbb990e2cf78bdd00bbe03e79247ec87a3ee51744acfbc6692f110dc88ccb1049b7d9c6aaa8fd6ba3ab4acd7ad0480dbb9df8b61980c0da83 -SHA512 (samba-4.18.4.tar.asc) = bc13d14b8da6a05494a79b8a8fb35fc27670f7ab8609eaeb3f3df49dd04bdb1389e77c2d571db5efcdd85532971c423eb977d46c2a5cbee3daadd6c6eca721ec +SHA512 (samba-4.18.5.tar.xz) = 3e405731813d5b0937e6c16938c6dcf8e182dafd29010dc75711afc397a63ee459fda04e78ff24e31fa0efd213e25a7e6c214a5bdf82d4d0f0123f2c6a8ebdd6 +SHA512 (samba-4.18.5.tar.asc) = 29b541a95dc565e541526a9aeecff5d4df4e7df38c5c00ec8cc848b13c683c0d0c7dee442ab1a2d03e0f88b960cec7fb5a2cb8ea44c53ce29c858f5a058e7f84 From ef6e3a1cfe3e80c77abdec5f34baa0c141224156 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 7 Aug 2023 00:27:40 +0200 Subject: [PATCH 148/295] Update to version 4.19.0rc1 resolves: #2227246 Guenther --- .gitignore | 2 + samba.spec | 140 ++++++++++++++++++++++++++++++++++++++++++++++++----- sources | 4 +- 3 files changed, 133 insertions(+), 13 deletions(-) diff --git a/.gitignore b/.gitignore index 7d7069f..bea983c 100644 --- a/.gitignore +++ b/.gitignore @@ -337,3 +337,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.4.tar.asc /samba-4.18.5.tar.xz /samba-4.18.5.tar.asc +/samba-4.19.0rc1.tar.xz +/samba-4.19.0rc1.tar.asc diff --git a/samba.spec b/samba.spec index 115d603..b4cc800 100644 --- a/samba.spec +++ b/samba.spec @@ -137,10 +137,10 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.18.5 +%global samba_version 4.19.0 %global baserelease 0 # This should be rc1 or %%nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -171,10 +171,10 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.4.0 -%global tdb_version 1.4.8 -%global tevent_version 0.14.1 -%global ldb_version 2.7.2 +%global talloc_version 2.4.1 +%global tdb_version 1.4.9 +%global tevent_version 0.15.0 +%global ldb_version 2.8.0 %global required_mit_krb5 1.20.1 @@ -1798,7 +1798,6 @@ fi %{_mandir}/man1/smbclient.1* %{_mandir}/man1/smbcquotas.1* %{_mandir}/man1/smbget.1* -%{_mandir}/man5/smbgetrc.5* %{_mandir}/man1/smbtar.1* %{_mandir}/man1/smbtree.1* %{_mandir}/man7/traffic_learner.7.* @@ -1856,10 +1855,12 @@ fi %{_libdir}/samba/libMESSAGING-SEND-samba4.so %{_libdir}/samba/libMESSAGING-samba4.so %{_libdir}/samba/libaddns-samba4.so +%{_libdir}/samba/libad-claims-samba4.so %{_libdir}/samba/libads-samba4.so %{_libdir}/samba/libasn1util-samba4.so %{_libdir}/samba/libauth-samba4.so %{_libdir}/samba/libauthkrb5-samba4.so +%{_libdir}/samba/libauthn-policy-util-samba4.so %{_libdir}/samba/libcli-cldap-samba4.so %{_libdir}/samba/libcli-ldap-common-samba4.so %{_libdir}/samba/libcli-ldap-samba4.so @@ -2005,10 +2006,12 @@ fi %{_bindir}/net %{_bindir}/pdbedit %{_bindir}/profiles +%{_bindir}/samba-log-parser %{_bindir}/smbcontrol %{_bindir}/smbpasswd %{_bindir}/testparm %{_mandir}/man1/profiles.1* +%{_mandir}/man1/samba-log-parser.1* %{_mandir}/man1/smbcontrol.1* %{_mandir}/man1/testparm.1* %{_mandir}/man8/net.8* @@ -2447,6 +2450,7 @@ fi %{python3_sitearch}/samba/__pycache__/descriptor.*.pyc %{python3_sitearch}/samba/__pycache__/dnsresolver.*.pyc %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc +%{python3_sitearch}/samba/__pycache__/functional_level.*.pyc %{python3_sitearch}/samba/__pycache__/getopt.*.pyc %{python3_sitearch}/samba/__pycache__/graph.*.pyc %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc @@ -2458,6 +2462,7 @@ fi %{python3_sitearch}/samba/__pycache__/ms_schema.*.pyc %{python3_sitearch}/samba/__pycache__/ndr.*.pyc %{python3_sitearch}/samba/__pycache__/ntacls.*.pyc +%{python3_sitearch}/samba/__pycache__/policies.*.pyc %{python3_sitearch}/samba/__pycache__/safe_tarfile.*.pyc %{python3_sitearch}/samba/__pycache__/sd_utils.*.pyc %{python3_sitearch}/samba/__pycache__/sites.*.pyc @@ -2527,6 +2532,7 @@ fi %{python3_sitearch}/samba/drs_utils.py %{python3_sitearch}/samba/dsdb.*.so %{python3_sitearch}/samba/dsdb_dns.*.so +%{python3_sitearch}/samba/functional_level.py %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py %{python3_sitearch}/samba/graph.py @@ -2549,6 +2555,8 @@ fi %{python3_sitearch}/samba/emulate/traffic_packets.py %dir %{python3_sitearch}/samba/gp %dir %{python3_sitearch}/samba/gp/__pycache__ +%{python3_sitearch}/samba/gp/__init__.py +%{python3_sitearch}/samba/gp/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gpclass.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_centrify_crontab_ext.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_centrify_sudoers_ext.*.pyc @@ -2627,12 +2635,12 @@ fi %{python3_sitearch}/samba/netcmd/__pycache__/dbcheck.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/delegation.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/dns.*.pyc -%{python3_sitearch}/samba/netcmd/__pycache__/domain.*.pyc -%{python3_sitearch}/samba/netcmd/__pycache__/domain_backup.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/drs.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/dsacl.*.pyc +%{python3_sitearch}/samba/netcmd/__pycache__/encoders.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/forest.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/fsmo.*.pyc +%{python3_sitearch}/samba/netcmd/__pycache__/gpcommon.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/gpo.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/group.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/ldapcmp.*.pyc @@ -2648,19 +2656,102 @@ fi %{python3_sitearch}/samba/netcmd/__pycache__/spn.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/testparm.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/user.*.pyc +%{python3_sitearch}/samba/netcmd/__pycache__/validators.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/visualize.*.pyc %{python3_sitearch}/samba/netcmd/common.py %{python3_sitearch}/samba/netcmd/computer.py %{python3_sitearch}/samba/netcmd/contact.py %{python3_sitearch}/samba/netcmd/dbcheck.py %{python3_sitearch}/samba/netcmd/delegation.py +%dir %{python3_sitearch}/samba/netcmd/domain +%{python3_sitearch}/samba/netcmd/domain/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/backup.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/classicupgrade.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/common.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/dcpromo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/demote.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/functional_prep.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/info.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/join.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/keytab.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/leave.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/level.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/passwordsettings.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/provision.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/samba3upgrade.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/schemaupgrade.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/tombstones.*.pyc +%{python3_sitearch}/samba/netcmd/domain/__pycache__/trust.*.pyc +%dir %{python3_sitearch}/samba/netcmd/domain/auth +%{python3_sitearch}/samba/netcmd/domain/auth/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/policy.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo_member.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy.py +%{python3_sitearch}/samba/netcmd/domain/auth/silo.py +%{python3_sitearch}/samba/netcmd/domain/auth/silo_member.py +%{python3_sitearch}/samba/netcmd/domain/backup.py +%dir %{python3_sitearch}/samba/netcmd/domain/claim +%{python3_sitearch}/samba/netcmd/domain/claim/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/claim/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/claim/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/claim/__pycache__/claim_type.*.pyc +%{python3_sitearch}/samba/netcmd/domain/claim/__pycache__/value_type.*.pyc +%{python3_sitearch}/samba/netcmd/domain/claim/claim_type.py +%{python3_sitearch}/samba/netcmd/domain/claim/value_type.py +%{python3_sitearch}/samba/netcmd/domain/classicupgrade.py +%{python3_sitearch}/samba/netcmd/domain/common.py +%{python3_sitearch}/samba/netcmd/domain/dcpromo.py +%{python3_sitearch}/samba/netcmd/domain/demote.py +%{python3_sitearch}/samba/netcmd/domain/functional_prep.py +%{python3_sitearch}/samba/netcmd/domain/info.py +%{python3_sitearch}/samba/netcmd/domain/join.py +%{python3_sitearch}/samba/netcmd/domain/keytab.py +%{python3_sitearch}/samba/netcmd/domain/leave.py +%{python3_sitearch}/samba/netcmd/domain/level.py +%dir %{python3_sitearch}/samba/netcmd/domain/models +%{python3_sitearch}/samba/netcmd/domain/models/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/models/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_policy.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/claim_type.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/exceptions.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/fields.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/model.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/site.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/subnet.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/user.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/value_type.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/auth_policy.py +%{python3_sitearch}/samba/netcmd/domain/models/auth_silo.py +%{python3_sitearch}/samba/netcmd/domain/models/claim_type.py +%{python3_sitearch}/samba/netcmd/domain/models/exceptions.py +%{python3_sitearch}/samba/netcmd/domain/models/fields.py +%{python3_sitearch}/samba/netcmd/domain/models/model.py +%{python3_sitearch}/samba/netcmd/domain/models/schema.py +%{python3_sitearch}/samba/netcmd/domain/models/site.py +%{python3_sitearch}/samba/netcmd/domain/models/subnet.py +%{python3_sitearch}/samba/netcmd/domain/models/user.py +%{python3_sitearch}/samba/netcmd/domain/models/value_type.py +%{python3_sitearch}/samba/netcmd/domain/passwordsettings.py +%{python3_sitearch}/samba/netcmd/domain/provision.py +%{python3_sitearch}/samba/netcmd/domain/samba3upgrade.py +%{python3_sitearch}/samba/netcmd/domain/schemaupgrade.py +%{python3_sitearch}/samba/netcmd/domain/tombstones.py +%{python3_sitearch}/samba/netcmd/domain/trust.py %{python3_sitearch}/samba/netcmd/dns.py -%{python3_sitearch}/samba/netcmd/domain.py -%{python3_sitearch}/samba/netcmd/domain_backup.py %{python3_sitearch}/samba/netcmd/drs.py %{python3_sitearch}/samba/netcmd/dsacl.py +%{python3_sitearch}/samba/netcmd/encoders.py %{python3_sitearch}/samba/netcmd/forest.py %{python3_sitearch}/samba/netcmd/fsmo.py +%{python3_sitearch}/samba/netcmd/gpcommon.py %{python3_sitearch}/samba/netcmd/gpo.py %{python3_sitearch}/samba/netcmd/group.py %{python3_sitearch}/samba/netcmd/ldapcmp.py @@ -2676,9 +2767,11 @@ fi %{python3_sitearch}/samba/netcmd/spn.py %{python3_sitearch}/samba/netcmd/testparm.py %{python3_sitearch}/samba/netcmd/user.py +%{python3_sitearch}/samba/netcmd/validators.py %{python3_sitearch}/samba/netcmd/visualize.py %{python3_sitearch}/samba/ntacls.py %{python3_sitearch}/samba/param.*.so +%{python3_sitearch}/samba/policies.py %{python3_sitearch}/samba/policy.*.so %{python3_sitearch}/samba/registry.*.so %{python3_sitearch}/samba/reparse_symlink.*.so @@ -2855,6 +2948,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/ldap_whoami.*.pyc %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc %{python3_sitearch}/samba/tests/__pycache__/logfiles.*.pyc %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc @@ -2902,6 +2996,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/s3_net_join.*.pyc %{python3_sitearch}/samba/tests/__pycache__/safe_tarfile.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samba_upgradedns_lmdb.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/samba_startup_fl_change.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samba3sam.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb_api.*.pyc @@ -3084,8 +3179,11 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/authn_policy_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/claims_in_pac.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/claims_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/device_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/group_tests.*.pyc @@ -3098,6 +3196,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/protected_users_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc @@ -3117,8 +3216,11 @@ fi %{python3_sitearch}/samba/tests/krb5/alias_tests.py %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py %{python3_sitearch}/samba/tests/krb5/as_req_tests.py +%{python3_sitearch}/samba/tests/krb5/authn_policy_tests.py +%{python3_sitearch}/samba/tests/krb5/claims_in_pac.py %{python3_sitearch}/samba/tests/krb5/claims_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/device_tests.py %{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/group_tests.py @@ -3131,6 +3233,7 @@ fi %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py +%{python3_sitearch}/samba/tests/krb5/pkinit_tests.py %{python3_sitearch}/samba/tests/krb5/protected_users_tests.py %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py @@ -3152,6 +3255,7 @@ fi %{python3_sitearch}/samba/tests/ldap_spn.py %{python3_sitearch}/samba/tests/ldap_referrals.py %{python3_sitearch}/samba/tests/ldap_upn_sam_account.py +%{python3_sitearch}/samba/tests/ldap_whoami.py %{python3_sitearch}/samba/tests/libsmb.py %{python3_sitearch}/samba/tests/libsmb-basic.py %{python3_sitearch}/samba/tests/loadparm.py @@ -3199,6 +3303,7 @@ fi %{python3_sitearch}/samba/tests/s3_net_join.py %{python3_sitearch}/samba/tests/safe_tarfile.py %{python3_sitearch}/samba/tests/samba3sam.py +%{python3_sitearch}/samba/tests/samba_startup_fl_change.py %{python3_sitearch}/samba/tests/samba_upgradedns_lmdb.py %dir %{python3_sitearch}/samba/tests/samba_tool %{python3_sitearch}/samba/tests/samba_tool/__init__.py @@ -3209,6 +3314,11 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/contact.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/demote.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dnscmd.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_base.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_policy.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_silo.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_claim.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_models.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/drs_clone_dc_data_lmdb_size.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dsacl.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/forest.*.pyc @@ -3246,6 +3356,11 @@ fi %{python3_sitearch}/samba/tests/samba_tool/contact.py %{python3_sitearch}/samba/tests/samba_tool/demote.py %{python3_sitearch}/samba/tests/samba_tool/dnscmd.py +%{python3_sitearch}/samba/tests/samba_tool/domain_auth_base.py +%{python3_sitearch}/samba/tests/samba_tool/domain_auth_policy.py +%{python3_sitearch}/samba/tests/samba_tool/domain_auth_silo.py +%{python3_sitearch}/samba/tests/samba_tool/domain_claim.py +%{python3_sitearch}/samba/tests/samba_tool/domain_models.py %{python3_sitearch}/samba/tests/samba_tool/drs_clone_dc_data_lmdb_size.py %{python3_sitearch}/samba/tests/samba_tool/dsacl.py %{python3_sitearch}/samba/tests/samba_tool/forest.py @@ -4333,6 +4448,9 @@ fi %endif %changelog +* Mon Aug 07 2023 Guenther Deschner - 4.19.0rc1-0 +- resolves: #2227246 - Update to version 4.19.0rc1 + * Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 - resolves: #2224040 - Update to version 4.18.5 - resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 diff --git a/sources b/sources index d77b19c..4600e2c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.18.5.tar.xz) = 3e405731813d5b0937e6c16938c6dcf8e182dafd29010dc75711afc397a63ee459fda04e78ff24e31fa0efd213e25a7e6c214a5bdf82d4d0f0123f2c6a8ebdd6 -SHA512 (samba-4.18.5.tar.asc) = 29b541a95dc565e541526a9aeecff5d4df4e7df38c5c00ec8cc848b13c683c0d0c7dee442ab1a2d03e0f88b960cec7fb5a2cb8ea44c53ce29c858f5a058e7f84 +SHA512 (samba-4.19.0rc1.tar.xz) = ba1b7616843cd6157e845b48b03260e36474159c7c9dbdd1a131fe158bf737928df9d4233a61ca5168ef582912807c4ada9a642124221385217ddbd8eb10995a +SHA512 (samba-4.19.0rc1.tar.asc) = 1b1f7389f3638d0c6892dbe0c708ad15032e9a88a7c55a8f74e93d39191d3079c1305c40568a67bb68f293a1677e28b2445b7ef347bf541f1e6cf2301907d994 From 9602a07a36b5fbe33eca0c55c883b1a163ac2f64 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 8 Aug 2023 11:06:00 +0200 Subject: [PATCH 149/295] Update to version 4.19.0rc2 resolves: #2227246 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index bea983c..0b30322 100644 --- a/.gitignore +++ b/.gitignore @@ -339,3 +339,5 @@ samba-3.6.0pre1.tar.gz /samba-4.18.5.tar.asc /samba-4.19.0rc1.tar.xz /samba-4.19.0rc1.tar.asc +/samba-4.19.0rc2.tar.xz +/samba-4.19.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index b4cc800..7b550f2 100644 --- a/samba.spec +++ b/samba.spec @@ -138,9 +138,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 0 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4448,6 +4448,9 @@ fi %endif %changelog +* Tue Aug 08 2023 Guenther Deschner - 4.19.0rc2-1 +- resolves: #2227246 - Update to version 4.19.0rc2 + * Mon Aug 07 2023 Guenther Deschner - 4.19.0rc1-0 - resolves: #2227246 - Update to version 4.19.0rc1 diff --git a/sources b/sources index 4600e2c..66da186 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0rc1.tar.xz) = ba1b7616843cd6157e845b48b03260e36474159c7c9dbdd1a131fe158bf737928df9d4233a61ca5168ef582912807c4ada9a642124221385217ddbd8eb10995a -SHA512 (samba-4.19.0rc1.tar.asc) = 1b1f7389f3638d0c6892dbe0c708ad15032e9a88a7c55a8f74e93d39191d3079c1305c40568a67bb68f293a1677e28b2445b7ef347bf541f1e6cf2301907d994 +SHA512 (samba-4.19.0rc2.tar.xz) = ef521a17a8d407432fe5b74fbbdeb6f61ade04488378591741603935154f975ea7f5ccdbfe11a6dc3a05f3e5e1d767d0cf7c9a82cfb6252d145845f7110ecca7 +SHA512 (samba-4.19.0rc2.tar.asc) = e8b2f909da5aefa65c03a02295638168adc9182d7ab930805ca83f03a3c5f5800c2ee7b4a66c3d1cee09fec3e78eb6df634e64ee945fb4b018780b19e3239170 From dc22ad5bd221318a8234264c80aa9146a82475fb Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Tue, 15 Aug 2023 13:08:22 -0700 Subject: [PATCH 150/295] python3-samba-dc requires python3-markdown now --- samba.spec | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 7b550f2..635f24b 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release rc2 @@ -898,6 +898,8 @@ Summary: Samba Python libraries for Samba AD Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-%{name} = %{samba_depver} +# for ms_forest_updates_markdown.py and ms_schema_markdown.py +Requires: python3-markdown %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs @@ -4448,10 +4450,13 @@ fi %endif %changelog -* Tue Aug 08 2023 Guenther Deschner - 4.19.0rc2-1 +* Tue Aug 15 2023 Adam Williamson - 4.19.0-0.2.rc2 +- python3-samba-dc requires python3-markdown now + +* Tue Aug 08 2023 Guenther Deschner - 4.19.0-0.1.rc2 - resolves: #2227246 - Update to version 4.19.0rc2 -* Mon Aug 07 2023 Guenther Deschner - 4.19.0rc1-0 +* Mon Aug 07 2023 Guenther Deschner - 4.19.0-0.0.rc1 - resolves: #2227246 - Update to version 4.19.0rc1 * Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 From 070d655da4015e4585c108220da59db7013af485 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 16 Aug 2023 01:48:56 -0400 Subject: [PATCH 151/295] Move ad-claims and authn-policy-util to dc-libs These libraries depend on libdsdb-module and are only built if DC is enabled (and therefore not for RHEL). --- samba.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 635f24b..65cd11d 100644 --- a/samba.spec +++ b/samba.spec @@ -138,7 +138,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release rc2 @@ -1857,12 +1857,10 @@ fi %{_libdir}/samba/libMESSAGING-SEND-samba4.so %{_libdir}/samba/libMESSAGING-samba4.so %{_libdir}/samba/libaddns-samba4.so -%{_libdir}/samba/libad-claims-samba4.so %{_libdir}/samba/libads-samba4.so %{_libdir}/samba/libasn1util-samba4.so %{_libdir}/samba/libauth-samba4.so %{_libdir}/samba/libauthkrb5-samba4.so -%{_libdir}/samba/libauthn-policy-util-samba4.so %{_libdir}/samba/libcli-cldap-samba4.so %{_libdir}/samba/libcli-ldap-common-samba4.so %{_libdir}/samba/libcli-ldap-samba4.so @@ -2157,6 +2155,8 @@ fi %endif %{_libdir}/libdcerpc-server.so.* +%{_libdir}/samba/libad-claims-samba4.so +%{_libdir}/samba/libauthn-policy-util-samba4.so %{_libdir}/samba/libdsdb-module-samba4.so %{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so %{_libdir}/samba/libscavenge-dns-records-samba4.so @@ -4450,6 +4450,9 @@ fi %endif %changelog +* Wed Aug 16 2023 Yaakov Selkowitz - 2:4.19.0-0.3.rc2 +- Move ad-claims and authn-policy-util to dc-libs + * Tue Aug 15 2023 Adam Williamson - 4.19.0-0.2.rc2 - python3-samba-dc requires python3-markdown now From 7837b083f245cf91f37c9ba9673c80801b5dc8a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 18 Aug 2023 15:27:59 +0200 Subject: [PATCH 152/295] Update to version 4.19.0rc3 resolves: #2232744 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 0b30322..e848165 100644 --- a/.gitignore +++ b/.gitignore @@ -341,3 +341,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc1.tar.asc /samba-4.19.0rc2.tar.xz /samba-4.19.0rc2.tar.asc +/samba-4.19.0rc3.tar.xz +/samba-4.19.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index 65cd11d..bdb65eb 100644 --- a/samba.spec +++ b/samba.spec @@ -138,9 +138,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4450,6 +4450,9 @@ fi %endif %changelog +* Fri Aug 18 2023 Guenther Deschner - 4.19.0-0.4.rc3 +- resolves: #2232744 - Update to version 4.19.0rc3 + * Wed Aug 16 2023 Yaakov Selkowitz - 2:4.19.0-0.3.rc2 - Move ad-claims and authn-policy-util to dc-libs diff --git a/sources b/sources index 66da186..4795247 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0rc2.tar.xz) = ef521a17a8d407432fe5b74fbbdeb6f61ade04488378591741603935154f975ea7f5ccdbfe11a6dc3a05f3e5e1d767d0cf7c9a82cfb6252d145845f7110ecca7 -SHA512 (samba-4.19.0rc2.tar.asc) = e8b2f909da5aefa65c03a02295638168adc9182d7ab930805ca83f03a3c5f5800c2ee7b4a66c3d1cee09fec3e78eb6df634e64ee945fb4b018780b19e3239170 +SHA512 (samba-4.19.0rc3.tar.xz) = 0304e09b7c6a1afab3d0e3a206a7204a784d9c82e3d77e5174c585b45b193165fa4ccaa7b931cd92210fcd8e4e58b16eb913e3cf507b4e28e646a6ff0dd9c83d +SHA512 (samba-4.19.0rc3.tar.asc) = 3ada9012744d63e41472e4683eef991e7565fec07116cf476f7cb8b573b6171bf68f8fe55127857c216db92ce1e8e5ba52dfb93ef66c927798b5495ba0ecc6f5 From 38db6815581db7214d926bd9bf1f261716e171eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 28 Aug 2023 16:59:29 +0200 Subject: [PATCH 153/295] Update to version 4.19.0rc4 resolves: #2232744 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index e848165..8607d71 100644 --- a/.gitignore +++ b/.gitignore @@ -343,3 +343,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc2.tar.asc /samba-4.19.0rc3.tar.xz /samba-4.19.0rc3.tar.asc +/samba-4.19.0rc4.tar.xz +/samba-4.19.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index bdb65eb..a760de9 100644 --- a/samba.spec +++ b/samba.spec @@ -138,9 +138,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4450,6 +4450,9 @@ fi %endif %changelog +* Mon Aug 28 2023 Guenther Deschner - 4.19.0-0.5.rc4 +- resolves: #2232744 - Update to version 4.19.0rc4 + * Fri Aug 18 2023 Guenther Deschner - 4.19.0-0.4.rc3 - resolves: #2232744 - Update to version 4.19.0rc3 diff --git a/sources b/sources index 4795247..3a0c8fe 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0rc3.tar.xz) = 0304e09b7c6a1afab3d0e3a206a7204a784d9c82e3d77e5174c585b45b193165fa4ccaa7b931cd92210fcd8e4e58b16eb913e3cf507b4e28e646a6ff0dd9c83d -SHA512 (samba-4.19.0rc3.tar.asc) = 3ada9012744d63e41472e4683eef991e7565fec07116cf476f7cb8b573b6171bf68f8fe55127857c216db92ce1e8e5ba52dfb93ef66c927798b5495ba0ecc6f5 +SHA512 (samba-4.19.0rc4.tar.xz) = 5215127dab4f9a4a5cacfb1d6e236f37e6625552995690a20f1d01533d30858204a25bc4e9839e9f15f1585b3fc403e2bf6f1b4b1a89a1fd4d9f72b3026d5691 +SHA512 (samba-4.19.0rc4.tar.asc) = 9cc262fefae703d56740d3878ed3863c42d1c005c994adcbd4538ed3704cb89e882955869690c126089bffd3948e259f20382bee4ee8326d2c386c5843153aea From 43d90c91754455ff88e7d5d28c80ce4fff706456 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 4 Sep 2023 15:20:35 +0200 Subject: [PATCH 154/295] Update to version 4.19.0 resolves: #2237259 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 8607d71..279c4a2 100644 --- a/.gitignore +++ b/.gitignore @@ -345,3 +345,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc3.tar.asc /samba-4.19.0rc4.tar.xz /samba-4.19.0rc4.tar.asc +/samba-4.19.0.tar.xz +/samba-4.19.0.tar.asc diff --git a/samba.spec b/samba.spec index a760de9..1bef008 100644 --- a/samba.spec +++ b/samba.spec @@ -138,9 +138,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.0 -%global baserelease 5 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release rc4 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4450,6 +4450,9 @@ fi %endif %changelog +* Mon Sep 04 2023 Guenther Deschner - 4.19.0-1 +- resolves: #2237259 - Update to version 4.19.0 + * Mon Aug 28 2023 Guenther Deschner - 4.19.0-0.5.rc4 - resolves: #2232744 - Update to version 4.19.0rc4 diff --git a/sources b/sources index 3a0c8fe..a802550 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0rc4.tar.xz) = 5215127dab4f9a4a5cacfb1d6e236f37e6625552995690a20f1d01533d30858204a25bc4e9839e9f15f1585b3fc403e2bf6f1b4b1a89a1fd4d9f72b3026d5691 -SHA512 (samba-4.19.0rc4.tar.asc) = 9cc262fefae703d56740d3878ed3863c42d1c005c994adcbd4538ed3704cb89e882955869690c126089bffd3948e259f20382bee4ee8326d2c386c5843153aea +SHA512 (samba-4.19.0.tar.xz) = a82347b496bb092ced6e4a25e5405ce0c5da40b0a4363e1e5f0cc295c7693d863bcd8d30b0da6d2a99c5525dc01e3a65c524ca832dc6d7e055f2c0ab264f7ae6 +SHA512 (samba-4.19.0.tar.asc) = 75dda279cc07db2a3a79fd4abd99db9383ca5d008d586c3ef168ef317857218c69e2589dbc3f4fcec2f3237d8f6dc72b034ba96268bfdc31a742937a8d92c22d From a1a3c76fb57477d09ea21884a3bdc8b54470bda9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 10 Oct 2023 17:18:12 +0200 Subject: [PATCH 155/295] Update to version 4.19.1 resolves: #2243073 resolves: #2241881, #2243228: Security fix for CVE-2023-3961 resolves: #2241882, #2243231: Security fix for CVE-2023-4091 resolves: #2241883, #2243230: Security fix for CVE-2023-4154 resolves: #2241884, #2243229: Security fix for CVE-2023-42669 resolves: #2241885, #2243232: Security fix for CVE-2023-42670 Guenther --- .gitignore | 2 ++ samba.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 279c4a2..56c8116 100644 --- a/.gitignore +++ b/.gitignore @@ -347,3 +347,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0rc4.tar.asc /samba-4.19.0.tar.xz /samba-4.19.0.tar.asc +/samba-4.19.1.tar.xz +/samba-4.19.1.tar.asc diff --git a/samba.spec b/samba.spec index 1bef008..fdc5e01 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.0 +%global samba_version 4.19.1 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -2032,7 +2032,6 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc -%{_libexecdir}/samba/rpcd_rpcecho %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_mandir}/man8/samba-dcerpcd.8* @@ -4450,6 +4449,14 @@ fi %endif %changelog +* Tue Oct 10 2023 Guenther Deschner - 4.19.1-1 +- resolves: #2243073 - Update to version 4.19.1 +- resolves: #2241881, #2243228: Security fix for CVE-2023-3961 +- resolves: #2241882, #2243231: Security fix for CVE-2023-4091 +- resolves: #2241883, #2243230: Security fix for CVE-2023-4154 +- resolves: #2241884, #2243229: Security fix for CVE-2023-42669 +- resolves: #2241885, #2243232: Security fix for CVE-2023-42670 + * Mon Sep 04 2023 Guenther Deschner - 4.19.0-1 - resolves: #2237259 - Update to version 4.19.0 diff --git a/sources b/sources index a802550..5b09a26 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.0.tar.xz) = a82347b496bb092ced6e4a25e5405ce0c5da40b0a4363e1e5f0cc295c7693d863bcd8d30b0da6d2a99c5525dc01e3a65c524ca832dc6d7e055f2c0ab264f7ae6 -SHA512 (samba-4.19.0.tar.asc) = 75dda279cc07db2a3a79fd4abd99db9383ca5d008d586c3ef168ef317857218c69e2589dbc3f4fcec2f3237d8f6dc72b034ba96268bfdc31a742937a8d92c22d +SHA512 (samba-4.19.1.tar.xz) = a96dc8b0fc1b11b92a15c57a10982327f837e79e641e317a098809c4f9b7007d19efdaad307e8349f1dcdb1dc30d38053721dc59eccd6c238856933a27f59335 +SHA512 (samba-4.19.1.tar.asc) = 28ae534aca182f3bb3c0bd85d79af729f7b3fbde4efd6b86c1e5ddd91e3e45e3c3dde223fdede1d9e55e617c5d8309fc018d869e697323503f24edc0b5b5ca4e From 00b32c417221ac19923d06ebaaa6451c7d2ef46d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 13 Oct 2023 11:43:02 +0200 Subject: [PATCH 156/295] When built with testsuite rpcd_echo is built as well Guenther --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index fdc5e01..803492a 100644 --- a/samba.spec +++ b/samba.spec @@ -2032,6 +2032,9 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc +%if %{with testsuite} +%{_libexecdir}/samba/rpcd_rpcecho +%endif %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_mandir}/man8/samba-dcerpcd.8* From 9996023e42ea80f823c5a70199984386077107f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 16 Oct 2023 18:00:00 +0200 Subject: [PATCH 157/295] Update to version 4.19.2 resolves: #2244496 Guenther --- .gitignore | 2 ++ samba.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 56c8116..3b6f4d1 100644 --- a/.gitignore +++ b/.gitignore @@ -349,3 +349,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.0.tar.asc /samba-4.19.1.tar.xz /samba-4.19.1.tar.asc +/samba-4.19.2.tar.xz +/samba-4.19.2.tar.asc diff --git a/samba.spec b/samba.spec index 803492a..50aeb4b 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.1 +%global samba_version 4.19.2 %global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4452,6 +4452,9 @@ fi %endif %changelog +* Mon Oct 16 2023 Guenther Deschner - 4.19.2-1 +- resolves: #2244496 - Update to version 4.19.2 + * Tue Oct 10 2023 Guenther Deschner - 4.19.1-1 - resolves: #2243073 - Update to version 4.19.1 - resolves: #2241881, #2243228: Security fix for CVE-2023-3961 diff --git a/sources b/sources index 5b09a26..952ec2b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.1.tar.xz) = a96dc8b0fc1b11b92a15c57a10982327f837e79e641e317a098809c4f9b7007d19efdaad307e8349f1dcdb1dc30d38053721dc59eccd6c238856933a27f59335 -SHA512 (samba-4.19.1.tar.asc) = 28ae534aca182f3bb3c0bd85d79af729f7b3fbde4efd6b86c1e5ddd91e3e45e3c3dde223fdede1d9e55e617c5d8309fc018d869e697323503f24edc0b5b5ca4e +SHA512 (samba-4.19.2.tar.xz) = 5b959aa9b276a306ecde99aa8a9ad30e335a7de21d89148d45ccf85ab2027aed31471b379683e5add4436a26cd878a238c7a82df1e0ebf28fc62bcdbc8c5c3ec +SHA512 (samba-4.19.2.tar.asc) = 998985d0c0d64e5c0c8dea8ddc43be366a3f9f4d4720010d2cbc5a4b72d023aaad7c0c46b010a594404047101c82c2068d5ea04887287b2b8c57efd84b7803e6 From 4f9b4790325bc1b889412c073716f46ebc4d7bb0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 15 Nov 2023 10:37:35 +0100 Subject: [PATCH 158/295] Package samba-gpupdate also for RHEL9 --- samba.spec | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/samba.spec b/samba.spec index 50aeb4b..6b42dad 100644 --- a/samba.spec +++ b/samba.spec @@ -135,10 +135,16 @@ %bcond_with etcd_mutex %endif +%if 0%{?fedora} || 0%{?rhel} >= 9 +%bcond_without gpupdate +%else +%bcond_with gpupdate +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.2 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -721,7 +727,7 @@ Samba VFS module for GlusterFS integration. %endif ### GPUPDATE -%if %{with dc} +%if %{with gpupdate} %package gpupdate Summary: Samba GPO support for clients Requires: cepces @@ -733,7 +739,7 @@ Requires: python3-%{name} = %{samba_depver} This package provides the samba-gpupdate tool to apply Group Policy Objects (GPO) on Samba clients. -# /with dc +#endif with gpupdate %endif ### KRB5-PRINTING @@ -1424,14 +1430,17 @@ touch %{buildroot}%{_libdir}/krb5/plugins/libkrb5/winbind_krb5_locator.so for i in \ %{_mandir}/man8/samba.8 \ %{_mandir}/man8/samba_downgrade_db.8 \ - %{_mandir}/man8/samba-gpupdate.8 \ %{_unitdir}/samba.service \ - %{_sbindir}/samba-gpupdate \ ; do rm -f %{buildroot}$i done %endif +%if %{without gpupdate} +rm -f %{_sbindir}/samba-gpupdate +rm -f %{_mandir}/man8/samba-gpupdate.8 +%endif + %if %{without vfs_glusterfs} rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8* %endif @@ -2327,10 +2336,11 @@ fi %endif ### GPUPDATE -%if %{with dc} +%if %{with gpupdate} %files gpupdate %{_mandir}/man8/samba-gpupdate.8* %{_sbindir}/samba-gpupdate +#endif with gpupdate %endif ### KRB5-PRINTING @@ -4452,6 +4462,9 @@ fi %endif %changelog +* Wed Nov 15 2023 Andreas Schneider - 4.19.2-2 +- Package samba-gpupdate also for RHEL9 + * Mon Oct 16 2023 Guenther Deschner - 4.19.2-1 - resolves: #2244496 - Update to version 4.19.2 From c92b2eb22b4b71488a8619cbe9d8a5b73b9b8be2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 15 Nov 2023 14:38:09 +0100 Subject: [PATCH 159/295] Do not use mold on i686, support for it has been dropped --- samba.spec | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 6b42dad..bb7d1eb 100644 --- a/samba.spec +++ b/samba.spec @@ -336,9 +336,11 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) +%ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold %endif +%endif %if %{with vfs_glusterfs} BuildRequires: glusterfs-api-devel >= 3.4.0.16 @@ -1267,12 +1269,16 @@ rm -f lib/crypto/{aes,rijndael}*.c # TODO: resolve underlinked python modules export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -# Use the mold linker +# Use the mold linker if possible +export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" + +%ifnarch i686 %if 0%{?fedora} >= 37 export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" -%else -export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" +#endif fedora >= 37 +%endif +#endif narch i686 %endif # Add support for mock ccache plugin From 601c5e7cbbaccce1a8c88322dad8b6edb03785ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Sun, 19 Nov 2023 12:47:18 +0100 Subject: [PATCH 160/295] Fix the 'without gpupdate' uninstalled file removal --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index bb7d1eb..33b38b6 100644 --- a/samba.spec +++ b/samba.spec @@ -1443,8 +1443,8 @@ done %endif %if %{without gpupdate} -rm -f %{_sbindir}/samba-gpupdate -rm -f %{_mandir}/man8/samba-gpupdate.8 +rm -f %{buildroot}%{_sbindir}/samba-gpupdate +rm -f %{buildroot}%{_mandir}/man8/samba-gpupdate.8* %endif %if %{without vfs_glusterfs} From 9e2c1829db848e685f97cdc0cfb10a0abf694630 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 27 Nov 2023 15:15:58 +0100 Subject: [PATCH 161/295] Update to Samba 4.19.3 resolves: #2251766 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 3b6f4d1..ed08576 100644 --- a/.gitignore +++ b/.gitignore @@ -351,3 +351,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.1.tar.asc /samba-4.19.2.tar.xz /samba-4.19.2.tar.asc +/samba-4.19.3.tar.xz +/samba-4.19.3.tar.asc diff --git a/samba.spec b/samba.spec index 33b38b6..aa7fe25 100644 --- a/samba.spec +++ b/samba.spec @@ -143,8 +143,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.2 -%global baserelease 2 +%global samba_version 4.19.3 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4468,6 +4468,9 @@ fi %endif %changelog +* Mon Nov 27 2023 Guenther Deschner - 4.19.3-1 +- resolves: #2251766 - Update to version 4.19.3 + * Wed Nov 15 2023 Andreas Schneider - 4.19.2-2 - Package samba-gpupdate also for RHEL9 diff --git a/sources b/sources index 952ec2b..a0453a0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.2.tar.xz) = 5b959aa9b276a306ecde99aa8a9ad30e335a7de21d89148d45ccf85ab2027aed31471b379683e5add4436a26cd878a238c7a82df1e0ebf28fc62bcdbc8c5c3ec -SHA512 (samba-4.19.2.tar.asc) = 998985d0c0d64e5c0c8dea8ddc43be366a3f9f4d4720010d2cbc5a4b72d023aaad7c0c46b010a594404047101c82c2068d5ea04887287b2b8c57efd84b7803e6 +SHA512 (samba-4.19.3.tar.xz) = c222d11c2b196c02ce99a5d6b806df5b9dbfdc50f0d5de43723cf75af69e0fb8ec06d9fbd9a4ca8be03f3ff39a8e5422464afb9279816d3350308045350245a3 +SHA512 (samba-4.19.3.tar.asc) = 76692b6eced6ecbbb49dea21e895ee4486aa09118a53b9a113ba0679063c6052333789156abe30b9d4ee11527743c2334eb49c055421c2cf6b347df18f6afb03 From 93059a0a6a3e5c5df282344a04f9b11caa6583df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 28 Nov 2023 13:33:44 +0100 Subject: [PATCH 162/295] Disable ctdb-pcp build for i686 for Fedora performance-co-pilot is no longer supported on i686 in Fedora Rawhide/40 Guenther --- samba.spec | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index aa7fe25..716441d 100644 --- a/samba.spec +++ b/samba.spec @@ -121,9 +121,12 @@ #endif fedora || rhel >= 8 %endif -# Build the ctdb-pcp-pmda package by default on Fedora +# Build the ctdb-pcp-pmda package by default on Fedora, except for i686 where +# pcp is no longer supported %if 0%{?fedora} +%ifnarch i686 %bcond_without pcp_pmda +%endif %else %bcond_with pcp_pmda %endif @@ -144,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.3 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil @@ -4468,6 +4471,9 @@ fi %endif %changelog +* Tue Nov 28 2023 Guenther Deschner - 4.19.3-2 +- Disable performance co-pilot support for i686 + * Mon Nov 27 2023 Guenther Deschner - 4.19.3-1 - resolves: #2251766 - Update to version 4.19.3 From 448b9a166115ea9ecb25d4108192f4ae6bd3e1d5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 13 Dec 2023 10:01:58 +0100 Subject: [PATCH 163/295] Add missing BuildRequires for cepces We should install for building what we require during runtime. --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index 716441d..41e3bb8 100644 --- a/samba.spec +++ b/samba.spec @@ -368,6 +368,10 @@ BuildRequires: librados-devel BuildRequires: python3-etcd %endif +%if %{with gpupdate} +BuildRequires: cepces +%endif + # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) BuildRequires: perl(FindBin) From 6a716d5e7ee5135f67c81d086cb2acde6833c28f Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 8 Jan 2024 17:30:42 +0100 Subject: [PATCH 164/295] Add missing dependencies for samba-gpupdate --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index 41e3bb8..06bc5f1 100644 --- a/samba.spec +++ b/samba.spec @@ -740,9 +740,12 @@ Samba VFS module for GlusterFS integration. %package gpupdate Summary: Samba GPO support for clients Requires: cepces +Requires: cepces-certmonger Requires: certmonger Requires: %{name}-ldb-ldap-modules = %{samba_depver} Requires: python3-%{name} = %{samba_depver} +# samba-tool needs python3-samba-dc also on non-dc build +Requires: python3-%{name}-dc = %{samba_depver} %description gpupdate This package provides the samba-gpupdate tool to apply Group Policy Objects From 95272cbe7670bd7d736e51fde74150cc49b7ce07 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 8 Jan 2024 16:34:43 +0100 Subject: [PATCH 165/295] Update to version 4.19.4 resolves: #2257287 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index ed08576..347f3eb 100644 --- a/.gitignore +++ b/.gitignore @@ -353,3 +353,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.2.tar.asc /samba-4.19.3.tar.xz /samba-4.19.3.tar.asc +/samba-4.19.4.tar.xz +/samba-4.19.4.tar.asc diff --git a/samba.spec b/samba.spec index 06bc5f1..9cce836 100644 --- a/samba.spec +++ b/samba.spec @@ -146,8 +146,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.3 -%global baserelease 2 +%global samba_version 4.19.4 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -4478,6 +4478,9 @@ fi %endif %changelog +* Mon Jan 08 2024 Guenther Deschner - 4.19.4-1 +- resolves: #2257287 - Update to version 4.19.4 + * Tue Nov 28 2023 Guenther Deschner - 4.19.3-2 - Disable performance co-pilot support for i686 diff --git a/sources b/sources index a0453a0..ed14bdd 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.3.tar.xz) = c222d11c2b196c02ce99a5d6b806df5b9dbfdc50f0d5de43723cf75af69e0fb8ec06d9fbd9a4ca8be03f3ff39a8e5422464afb9279816d3350308045350245a3 -SHA512 (samba-4.19.3.tar.asc) = 76692b6eced6ecbbb49dea21e895ee4486aa09118a53b9a113ba0679063c6052333789156abe30b9d4ee11527743c2334eb49c055421c2cf6b347df18f6afb03 +SHA512 (samba-4.19.4.tar.xz) = 3d2899e4a3b8bcb77befc29c4af66d3ac858b7f7a0dbbb66a8bc210cd88d9cde3e11361334a5cce650318473134ec8b134148bfa4af4d51f555de33eff395029 +SHA512 (samba-4.19.4.tar.asc) = 11bc51407d1464339817d7568f5d5bb059c19a05b49c6a1307d7425d289acb617ecd3e633e3736bdaa94947a7b3630d6cdb7ed6fe59d52556234c549eca8172a From f245ed7ba22cd3c5fbe9c3a603e182c5ff2baaa5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 9 Jan 2024 09:51:38 +0100 Subject: [PATCH 166/295] Create winbind groups using systemd Also drop creating groups with groupadd entirely. resolves: rhbz#2256326 --- samba-winbind-systemd-sysusers.conf | 2 ++ samba.spec | 21 ++++++++++----------- 2 files changed, 12 insertions(+), 11 deletions(-) create mode 100644 samba-winbind-systemd-sysusers.conf diff --git a/samba-winbind-systemd-sysusers.conf b/samba-winbind-systemd-sysusers.conf new file mode 100644 index 0000000..7ccc216 --- /dev/null +++ b/samba-winbind-systemd-sysusers.conf @@ -0,0 +1,2 @@ +#Type Name ID +g wbpriv 88 diff --git a/samba.spec b/samba.spec index 9cce836..b96f57c 100644 --- a/samba.spec +++ b/samba.spec @@ -239,12 +239,11 @@ Source14: samba.pamd Source15: usershares.conf.vendor Source16: samba-systemd-sysusers.conf Source17: samba-usershares-systemd-sysusers.conf +Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Requires(pre): /usr/sbin/groupadd - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -1419,6 +1418,7 @@ echo "d /run/ctdb 755 root root" > %{buildroot}%{_tmpfilesdir}/ctdb.conf install -d -m 0755 %{buildroot}%{_sysusersdir} install -m 0644 %{SOURCE16} %{buildroot}%{_sysusersdir}/samba.conf install -m 0644 %{SOURCE17} %{buildroot}%{_sysusersdir}/samba-usershares.conf +install -m 0644 %{SOURCE18} %{buildroot}%{_sysusersdir}/samba-winbind.conf install -d -m 0755 %{buildroot}%{_sysconfdir}/sysconfig install -m 0644 packaging/systemd/samba.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/samba @@ -1533,11 +1533,8 @@ export WINBINDD_DONT_LOG_STDOUT=1 %systemd_postun_with_restart nmb.service %pre common -%if 0%{?fedora} || 0%{?rhel} > 8 +# This creates the group 'printadmin' %sysusers_create_compat %{SOURCE16} -%else -getent group printadmin >/dev/null || groupadd -r printadmin || : -%endif %post common %{?ldconfig} @@ -1607,14 +1604,12 @@ fi %ldconfig_scriptlets test %pre usershares -%if 0%{?fedora} || 0%{?rhel} > 8 +# This creates the group 'usershares' %sysusers_create_compat %{SOURCE17} -%else -getent group usershares >/dev/null || groupadd -r usershares || : -%endif %pre winbind -/usr/sbin/groupadd -g 88 wbpriv >/dev/null 2>&1 || : +# This creates the group 'wbpriv' +%sysusers_create_compat %{SOURCE18} %post winbind %systemd_post winbind.service @@ -3490,6 +3485,7 @@ fi %{_libdir}/samba/libnss-info-samba4.so %{_libdir}/samba/libidmap-samba4.so %{_sbindir}/winbindd +%{_sysusersdir}/samba-winbind.conf %attr(750,root,wbpriv) %dir /var/lib/samba/winbindd_privileged %{_unitdir}/winbind.service %{_prefix}/lib/NetworkManager @@ -4478,6 +4474,9 @@ fi %endif %changelog +* Tue Jan 09 2024 Andreas Schneider - 4.19.4-2 +- resolves: rhbz#2256326 - Create all groups using systemd + * Mon Jan 08 2024 Guenther Deschner - 4.19.4-1 - resolves: #2257287 - Update to version 4.19.4 From 368799d573a8948346d3ab4d397a2ac0cb3fe2cf Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 9 Jan 2024 13:07:37 +0100 Subject: [PATCH 167/295] Bump release number --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index b96f57c..7f9da2f 100644 --- a/samba.spec +++ b/samba.spec @@ -147,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.4 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release %nil From 2c97dc253a4c71201cea3b4e97e9fe9ba60c4310 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 10 Jan 2024 13:16:55 +0100 Subject: [PATCH 168/295] Remove unused globals libwbc_alternatives_* --- samba.spec | 6 ------ 1 file changed, 6 deletions(-) diff --git a/samba.spec b/samba.spec index 7f9da2f..e1437ee 100644 --- a/samba.spec +++ b/samba.spec @@ -197,12 +197,6 @@ # https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md %undefine _strict_symbol_defs_build -%global libwbc_alternatives_version 0.16 -%global libwbc_alternatives_suffix %nil -%if 0%{?__isa_bits} == 64 -%global libwbc_alternatives_suffix -64 -%endif - %global _systemd_extra "Environment=KRB5CCNAME=FILE:/run/samba/krb5cc_samba" # Make a copy of this variable to prevent repeated evaluation of the From cbf258a1156a147cd12efe5937732db4b0be74a0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 16 Jan 2024 12:22:50 +0100 Subject: [PATCH 169/295] Fix samba-gpupdate on Fedora/RHEL --- samba-4.19-fix-gpupdate-rhel-fedora.patch | 638 ++++++++++++++++++++++ samba-4.19-fix-gpupdate-site-aware.patch | 61 +++ samba.spec | 8 +- 3 files changed, 706 insertions(+), 1 deletion(-) create mode 100644 samba-4.19-fix-gpupdate-rhel-fedora.patch create mode 100644 samba-4.19-fix-gpupdate-site-aware.patch diff --git a/samba-4.19-fix-gpupdate-rhel-fedora.patch b/samba-4.19-fix-gpupdate-rhel-fedora.patch new file mode 100644 index 0000000..6381e0a --- /dev/null +++ b/samba-4.19-fix-gpupdate-rhel-fedora.patch @@ -0,0 +1,638 @@ +From 549b5fe579fc15d63b71b1cc8a0ebf4e4869171b Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Thu, 17 Aug 2023 01:05:54 +0300 +Subject: [PATCH 1/9] gp: Support more global trust directories + +In addition to the SUSE global trust directory, add support for RHEL and +Debian-based distributions (including Ubuntu). + +To determine the correct directory to use, we iterate over the variants +and stop at the first which is a directory. + +In case none is found, fallback to the first option which will produce a +warning as it did previously. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit a1b285e485c0b5a8747499bdbbb9f3f4fc025b2f) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index 312c8ddf467..1b90ab46e90 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -45,10 +45,12 @@ cert_wrap = b""" + -----BEGIN CERTIFICATE----- + %s + -----END CERTIFICATE-----""" +-global_trust_dir = '/etc/pki/trust/anchors' + endpoint_re = '(https|HTTPS)://(?P[a-zA-Z0-9.-]+)/ADPolicyProvider' + \ + '_CEP_(?P[a-zA-Z]+)/service.svc/CEP' + ++global_trust_dirs = ['/etc/pki/trust/anchors', # SUSE ++ '/etc/pki/ca-trust/source/anchors', # RHEL/Fedora ++ '/usr/local/share/ca-certificates'] # Debian/Ubuntu + + def octet_string_to_objectGUID(data): + """Convert an octet string to an objectGUID.""" +@@ -249,12 +251,20 @@ def getca(ca, url, trust_dir): + return root_certs + + ++def find_global_trust_dir(): ++ """Return the global trust dir using known paths from various Linux distros.""" ++ for trust_dir in global_trust_dirs: ++ if os.path.isdir(trust_dir): ++ return trust_dir ++ return global_trust_dirs[0] ++ + def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + """Install the root certificate chain.""" + data = dict({'files': [], 'templates': []}, **ca) + url = 'http://%s/CertSrv/mscep/mscep.dll/pkiclient.exe?' % ca['hostname'] + root_certs = getca(ca, url, trust_dir) + data['files'].extend(root_certs) ++ global_trust_dir = find_global_trust_dir() + for src in root_certs: + # Symlink the certs to global trust dir + dst = os.path.join(global_trust_dir, os.path.basename(src)) +-- +2.43.0 + + +From c624a1e9b1d09fe2bb3f9778cb616230e57168a8 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Thu, 17 Aug 2023 01:09:28 +0300 +Subject: [PATCH 2/9] gp: Support update-ca-trust helper + +This is used on RHEL/Fedora instead of update-ca-certificates. They +behave similarly so it's enough to change the command name. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit fa80d1d86439749c44e60cf9075e84dc9ed3c268) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index 1b90ab46e90..cefdafa21b2 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -258,6 +258,10 @@ def find_global_trust_dir(): + return trust_dir + return global_trust_dirs[0] + ++def update_ca_command(): ++ """Return the command to update the CA trust store.""" ++ return which('update-ca-certificates') or which('update-ca-trust') ++ + def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + """Install the root certificate chain.""" + data = dict({'files': [], 'templates': []}, **ca) +@@ -283,7 +287,7 @@ def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + # already exists. Ignore the FileExistsError. Preserve the + # existing symlink in the unapply data. + data['files'].append(dst) +- update = which('update-ca-certificates') ++ update = update_ca_command() + if update is not None: + Popen([update]).wait() + # Setup Certificate Auto Enrollment +-- +2.43.0 + + +From 086406ca457cc17e15001fb44802276ada068679 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 11 Aug 2023 18:46:42 +0300 +Subject: [PATCH 3/9] gp: Change root cert extension suffix + +On Ubuntu, certificates must end in '.crt' in order to be considered by +the `update-ca-certificates` helper. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit bce3a89204545dcab5fb39a712590f6e166f997b) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index cefdafa21b2..c562722906b 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -241,7 +241,8 @@ def getca(ca, url, trust_dir): + certs = load_der_pkcs7_certificates(r.content) + for i in range(0, len(certs)): + cert = certs[i].public_bytes(Encoding.PEM) +- dest = '%s.%d' % (root_cert, i) ++ filename, extension = root_cert.rsplit('.', 1) ++ dest = '%s.%d.%s' % (filename, i, extension) + with open(dest, 'wb') as w: + w.write(cert) + root_certs.append(dest) +-- +2.43.0 + + +From c57c32020cc9017191b8c8657ebabe00d552a6e3 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 18 Aug 2023 17:06:43 +0300 +Subject: [PATCH 4/9] gp: Test with binary content for certificate data + +This fails all GPO-related tests that call `gpupdate --rsop`. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 1ef722cf66f9ec99f52939f1cfca031c5fe1ad70) +--- + python/samba/tests/gpo.py | 8 ++++---- + selftest/knownfail.d/gpo | 13 +++++++++++++ + 2 files changed, 17 insertions(+), 4 deletions(-) + create mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py +index e4b75cc62a4..963f873f755 100644 +--- a/python/samba/tests/gpo.py ++++ b/python/samba/tests/gpo.py +@@ -6783,14 +6783,14 @@ class GPOTests(tests.TestCase): + ldb.add({'dn': certa_dn, + 'objectClass': 'certificationAuthority', + 'authorityRevocationList': ['XXX'], +- 'cACertificate': 'XXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateRevocationList': ['XXX'], + }) + # Write the dummy pKIEnrollmentService + enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) + ldb.add({'dn': enroll_dn, + 'objectClass': 'pKIEnrollmentService', +- 'cACertificate': 'XXXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateTemplates': ['Machine'], + 'dNSHostName': hostname, + }) +@@ -7201,14 +7201,14 @@ class GPOTests(tests.TestCase): + ldb.add({'dn': certa_dn, + 'objectClass': 'certificationAuthority', + 'authorityRevocationList': ['XXX'], +- 'cACertificate': 'XXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateRevocationList': ['XXX'], + }) + # Write the dummy pKIEnrollmentService + enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) + ldb.add({'dn': enroll_dn, + 'objectClass': 'pKIEnrollmentService', +- 'cACertificate': 'XXXX', ++ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', + 'certificateTemplates': ['Machine'], + 'dNSHostName': hostname, + }) +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +new file mode 100644 +index 00000000000..0aad59607c2 +--- /dev/null ++++ b/selftest/knownfail.d/gpo +@@ -0,0 +1,13 @@ ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From c53b2994fd13f4c74cee891e725a4558cdb06b2d Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Wed, 16 Aug 2023 12:20:11 +0300 +Subject: [PATCH 5/9] gp: Convert CA certificates to base64 + +I don't know whether this applies universally, but in our case the +contents of `es['cACertificate'][0]` are binary, so cleanly converting +to a string fails with the following: + +'utf-8' codec can't decode byte 0x82 in position 1: invalid start byte + +We found a fix to be encoding the certificate to base64 when +constructing the CA list. + +Section 4.4.5.2 of MS-CAESO also suggests that the content of +`cACertificate` is binary (OCTET string). + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 157335ee93eb866f9b6a47486a5668d6e76aced5) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 5 ++--- + selftest/knownfail.d/gpo | 13 ------------- + 2 files changed, 2 insertions(+), 16 deletions(-) + delete mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index c562722906b..c8b5368c16a 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -158,7 +158,7 @@ def fetch_certification_authorities(ldb): + for es in res: + data = { 'name': get_string(es['cn'][0]), + 'hostname': get_string(es['dNSHostName'][0]), +- 'cACertificate': get_string(es['cACertificate'][0]) ++ 'cACertificate': get_string(base64.b64encode(es['cACertificate'][0])) + } + result.append(data) + return result +@@ -176,8 +176,7 @@ def fetch_template_attrs(ldb, name, attrs=None): + return {'msPKI-Minimal-Key-Size': ['2048']} + + def format_root_cert(cert): +- cert = base64.b64encode(cert.encode()) +- return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert, 0, re.DOTALL) ++ return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert.encode(), 0, re.DOTALL) + + def find_cepces_submit(): + certmonger_dirs = [os.environ.get("PATH"), '/usr/lib/certmonger', +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +deleted file mode 100644 +index 0aad59607c2..00000000000 +--- a/selftest/knownfail.d/gpo ++++ /dev/null +@@ -1,13 +0,0 @@ +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From fd13702a9cd6475a14113de87ccad6588d2d443b Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 18 Aug 2023 17:16:23 +0300 +Subject: [PATCH 6/9] gp: Test adding new cert templates enforces changes + +Ensure that cepces-submit reporting additional templates and re-applying +will enforce the updated policy. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 2d6943a864405f324c467e8c3464c31ac08457b0) +--- + python/samba/tests/bin/cepces-submit | 3 +- + python/samba/tests/gpo.py | 48 ++++++++++++++++++++++++++++ + selftest/knownfail.d/gpo | 2 ++ + 3 files changed, 52 insertions(+), 1 deletion(-) + create mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/tests/bin/cepces-submit b/python/samba/tests/bin/cepces-submit +index 668682a9f58..de63164692b 100755 +--- a/python/samba/tests/bin/cepces-submit ++++ b/python/samba/tests/bin/cepces-submit +@@ -14,4 +14,5 @@ if __name__ == "__main__": + assert opts.auth == 'Kerberos' + if 'CERTMONGER_OPERATION' in os.environ and \ + os.environ['CERTMONGER_OPERATION'] == 'GET-SUPPORTED-TEMPLATES': +- print('Machine') # Report a Machine template ++ templates = os.environ.get('CEPCES_SUBMIT_SUPPORTED_TEMPLATES', 'Machine').split(',') ++ print('\n'.join(templates)) # Report the requested templates +diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py +index 963f873f755..e75c411bde7 100644 +--- a/python/samba/tests/gpo.py ++++ b/python/samba/tests/gpo.py +@@ -6812,6 +6812,23 @@ class GPOTests(tests.TestCase): + self.assertTrue(os.path.exists(machine_crt), + 'Machine key was not generated') + ++ # Subsequent apply should react to new certificate templates ++ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' ++ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') ++ ext.process_group_policy([], gpos, dname, dname) ++ self.assertTrue(os.path.exists(ca_crt), ++ 'Root CA certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine key was not generated') ++ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca_cn) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation certificate was not requested') ++ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca_cn) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation key was not generated') ++ + # Verify RSOP does not fail + ext.rsop([g for g in gpos if g.name == guid][0]) + +@@ -6829,11 +6846,17 @@ class GPOTests(tests.TestCase): + 'Machine certificate was not removed') + self.assertFalse(os.path.exists(machine_crt), + 'Machine key was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation certificate was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation key was not removed') + out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() + self.assertNotIn(get_bytes(ca_cn), out, 'CA was not removed') + out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() + self.assertNotIn(b'Machine', out, + 'Machine certificate not removed') ++ self.assertNotIn(b'Workstation', out, ++ 'Workstation certificate not removed') + + # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate + ldb.delete(certa_dn) +@@ -7233,6 +7256,25 @@ class GPOTests(tests.TestCase): + self.assertTrue(os.path.exists(machine_crt), + 'Machine key was not generated') + ++ # Subsequent apply should react to new certificate templates ++ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' ++ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') ++ ext.process_group_policy([], gpos, dname, dname) ++ for ca in ca_list: ++ self.assertTrue(os.path.exists(ca_crt), ++ 'Root CA certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine key was not generated') ++ ++ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation certificate was not requested') ++ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca) ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation key was not generated') ++ + # Verify RSOP does not fail + ext.rsop([g for g in gpos if g.name == guid][0]) + +@@ -7250,12 +7292,18 @@ class GPOTests(tests.TestCase): + 'Machine certificate was not removed') + self.assertFalse(os.path.exists(machine_crt), + 'Machine key was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation certificate was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation key was not removed') + out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() + for ca in ca_list: + self.assertNotIn(get_bytes(ca), out, 'CA was not removed') + out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() + self.assertNotIn(b'Machine', out, + 'Machine certificate not removed') ++ self.assertNotIn(b'Workstation', out, ++ 'Workstation certificate not removed') + + # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate + ldb.delete(certa_dn) +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +new file mode 100644 +index 00000000000..4edc1dce730 +--- /dev/null ++++ b/selftest/knownfail.d/gpo +@@ -0,0 +1,2 @@ ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From 4578c6664ab6eac476ee10afae4a1a95b3b63272 Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Wed, 16 Aug 2023 12:37:17 +0300 +Subject: [PATCH 7/9] gp: Template changes should invalidate cache + +If certificate templates are added or removed, the autoenroll extension +should react to this and reapply the policy. Previously this wasn't +taken into account. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit 2a6ae997f2464b12b72b5314fa80d9784fb0f6c1) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 15 ++++++++++----- + selftest/knownfail.d/gpo | 2 -- + 2 files changed, 10 insertions(+), 7 deletions(-) + delete mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index c8b5368c16a..8233713e8ad 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -262,6 +262,11 @@ def update_ca_command(): + """Return the command to update the CA trust store.""" + return which('update-ca-certificates') or which('update-ca-trust') + ++def changed(new_data, old_data): ++ """Return True if any key present in both dicts has changed.""" ++ return any((new_data[k] != old_data[k] if k in old_data else False) \ ++ for k in new_data.keys()) ++ + def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): + """Install the root certificate chain.""" + data = dict({'files': [], 'templates': []}, **ca) +@@ -351,12 +356,12 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): + # If the policy has changed, unapply, then apply new policy + old_val = self.cache_get_attribute_value(guid, attribute) + old_data = json.loads(old_val) if old_val is not None else {} +- if all([(ca[k] == old_data[k] if k in old_data else False) \ +- for k in ca.keys()]) or \ +- self.cache_get_apply_state() == GPOSTATE.ENFORCE: ++ templates = ['%s.%s' % (ca['name'], t.decode()) for t in get_supported_templates(ca['hostname'])] ++ new_data = { 'templates': templates, **ca } ++ if changed(new_data, old_data) or self.cache_get_apply_state() == GPOSTATE.ENFORCE: + self.unapply(guid, attribute, old_val) +- # If policy is already applied, skip application +- if old_val is not None and \ ++ # If policy is already applied and unchanged, skip application ++ if old_val is not None and not changed(new_data, old_data) and \ + self.cache_get_apply_state() != GPOSTATE.ENFORCE: + return + +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +deleted file mode 100644 +index 4edc1dce730..00000000000 +--- a/selftest/knownfail.d/gpo ++++ /dev/null +@@ -1,2 +0,0 @@ +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From 2d641b736b42f7623955f251ad354439b954159d Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Fri, 18 Aug 2023 17:26:59 +0300 +Subject: [PATCH 8/9] gp: Test disabled enrollment unapplies policy + +For this we need to stage a Registry.pol file with certificate +autoenrollment enabled, but with checkboxes unticked. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder +(cherry picked from commit ee814f7707a8ddef2657212cd6d31799501b7bb3) +--- + python/samba/tests/gpo.py | 54 +++++++++++++++++++++++++++++++++++++++ + selftest/knownfail.d/gpo | 1 + + 2 files changed, 55 insertions(+) + create mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py +index e75c411bde7..580f3568de8 100644 +--- a/python/samba/tests/gpo.py ++++ b/python/samba/tests/gpo.py +@@ -281,6 +281,28 @@ b""" + + """ + ++auto_enroll_unchecked_reg_pol = \ ++b""" ++ ++ ++ ++ Software\Policies\Microsoft\Cryptography\AutoEnrollment ++ AEPolicy ++ 0 ++ ++ ++ Software\Policies\Microsoft\Cryptography\AutoEnrollment ++ OfflineExpirationPercent ++ 10 ++ ++ ++ Software\Policies\Microsoft\Cryptography\AutoEnrollment ++ OfflineExpirationStoreNames ++ MY ++ ++ ++""" ++ + advanced_enroll_reg_pol = \ + b""" + +@@ -6836,6 +6858,38 @@ class GPOTests(tests.TestCase): + ret = rsop(self.lp) + self.assertEqual(ret, 0, 'gpupdate --rsop failed!') + ++ # Remove policy by staging pol file with auto-enroll unchecked ++ parser.load_xml(etree.fromstring(auto_enroll_unchecked_reg_pol.strip())) ++ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) ++ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) ++ ext.process_group_policy([], gpos, dname, dname) ++ self.assertFalse(os.path.exists(ca_crt), ++ 'Root CA certificate was not removed') ++ self.assertFalse(os.path.exists(machine_crt), ++ 'Machine certificate was not removed') ++ self.assertFalse(os.path.exists(machine_crt), ++ 'Machine key was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation certificate was not removed') ++ self.assertFalse(os.path.exists(workstation_crt), ++ 'Workstation key was not removed') ++ ++ # Reapply policy by staging the enabled pol file ++ parser.load_xml(etree.fromstring(auto_enroll_reg_pol.strip())) ++ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) ++ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) ++ ext.process_group_policy([], gpos, dname, dname) ++ self.assertTrue(os.path.exists(ca_crt), ++ 'Root CA certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine certificate was not requested') ++ self.assertTrue(os.path.exists(machine_crt), ++ 'Machine key was not generated') ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation certificate was not requested') ++ self.assertTrue(os.path.exists(workstation_crt), ++ 'Workstation key was not generated') ++ + # Remove policy + gp_db = store.get_gplog(machine_creds.get_username()) + del_gpos = get_deleted_gpos_list(gp_db, []) +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +new file mode 100644 +index 00000000000..83bc9f0ac1f +--- /dev/null ++++ b/selftest/knownfail.d/gpo +@@ -0,0 +1 @@ ++^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + + +From e5588f8800899894388284468b9e25463d3c3e6c Mon Sep 17 00:00:00 2001 +From: Gabriel Nagy +Date: Wed, 16 Aug 2023 12:33:59 +0300 +Subject: [PATCH 9/9] gp: Send list of keys instead of dict to remove + +`cache_get_all_attribute_values` returns a dict whereas we need to pass +a list of keys to `remove`. These will be interpolated in the gpdb search. + +Signed-off-by: Gabriel Nagy +Reviewed-by: Joseph Sutton +Reviewed-by: David Mulder + +Autobuild-User(master): Andrew Bartlett +Autobuild-Date(master): Mon Aug 28 03:01:22 UTC 2023 on atb-devel-224 + +(cherry picked from commit 7dc181757c76b881ceaf1915ebb0bfbcf5aca83a) +--- + python/samba/gp/gp_cert_auto_enroll_ext.py | 2 +- + selftest/knownfail.d/gpo | 1 - + 2 files changed, 1 insertion(+), 2 deletions(-) + delete mode 100644 selftest/knownfail.d/gpo + +diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py +index 8233713e8ad..64c35782ae8 100644 +--- a/python/samba/gp/gp_cert_auto_enroll_ext.py ++++ b/python/samba/gp/gp_cert_auto_enroll_ext.py +@@ -415,7 +415,7 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): + # remove any existing policy + ca_attrs = \ + self.cache_get_all_attribute_values(gpo.name) +- self.clean(gpo.name, remove=ca_attrs) ++ self.clean(gpo.name, remove=list(ca_attrs.keys())) + + def __read_cep_data(self, guid, ldb, end_point_information, + trust_dir, private_dir): +diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo +deleted file mode 100644 +index 83bc9f0ac1f..00000000000 +--- a/selftest/knownfail.d/gpo ++++ /dev/null +@@ -1 +0,0 @@ +-^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext +-- +2.43.0 + diff --git a/samba-4.19-fix-gpupdate-site-aware.patch b/samba-4.19-fix-gpupdate-site-aware.patch new file mode 100644 index 0000000..3354bb0 --- /dev/null +++ b/samba-4.19-fix-gpupdate-site-aware.patch @@ -0,0 +1,61 @@ +From 372b8f15ccf37c491f43ec7ab81be692ff0fcfed Mon Sep 17 00:00:00 2001 +From: David Mulder +Date: Fri, 5 Jan 2024 08:47:07 -0700 +Subject: [PATCH] WIP: gp: Skip site GP list if no site is found + +[MS-GPOL] 3.2.5.1.4 Site Search says if the site +search returns ERROR_NO_SITENAME, the GP site +search should be skipped. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15548 + +Signed-off-by: David Mulder +--- + python/samba/gp/gpclass.py | 30 ++++++++++++++++++------------ + 1 file changed, 18 insertions(+), 12 deletions(-) + +diff --git a/python/samba/gp/gpclass.py b/python/samba/gp/gpclass.py +index b7a0dcb0ed5..26c2386847e 100644 +--- a/python/samba/gp/gpclass.py ++++ b/python/samba/gp/gpclass.py +@@ -896,19 +896,25 @@ def get_gpo_list(dc_hostname, creds, lp, username): + + # (S)ite + if gpo_list_machine: +- site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) +- + try: +- log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) +- gp_link = get_gpo_link(samdb, site_dn) +- except ldb.LdbError as e: +- (enum, estr) = e.args +- log.debug(estr) +- else: +- add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, +- site_dn, gp_link, +- gpo.GP_LINK_SITE, +- add_only_forced_gpos, token) ++ site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) ++ ++ try: ++ log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) ++ gp_link = get_gpo_link(samdb, site_dn) ++ except ldb.LdbError as e: ++ (enum, estr) = e.args ++ log.debug(estr) ++ else: ++ add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, ++ site_dn, gp_link, ++ gpo.GP_LINK_SITE, ++ add_only_forced_gpos, token) ++ except ldb.LdbError: ++ # [MS-GPOL] 3.2.5.1.4 Site Search: If the method returns ++ # ERROR_NO_SITENAME, the remainder of this message MUST be skipped ++ # and the protocol sequence MUST continue at GPO Search ++ pass + + # (L)ocal + gpo_list.insert(0, gpo.GROUP_POLICY_OBJECT("Local Policy", +-- +GitLab + diff --git a/samba.spec b/samba.spec index e1437ee..8dce900 100644 --- a/samba.spec +++ b/samba.spec @@ -147,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.4 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil %global pre_release %nil @@ -238,6 +238,9 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.19-fix-gpupdate-rhel-fedora.patch +Patch1: samba-4.19-fix-gpupdate-site-aware.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4468,6 +4471,9 @@ fi %endif %changelog +* Tue Jan 16 2024 Andreas Schneider - 4.29.4-3 +- Fix samba-gpupdate on Fedora/RHEL + * Tue Jan 09 2024 Andreas Schneider - 4.19.4-2 - resolves: rhbz#2256326 - Create all groups using systemd From a0149239aa31a7f0083e05c8e2e46ec25b6f17f0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 02:03:30 +0000 Subject: [PATCH 170/295] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 8dce900..136e8e3 100644 --- a/samba.spec +++ b/samba.spec @@ -147,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.19.4 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil %global pre_release %nil @@ -4471,6 +4471,9 @@ fi %endif %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 2:4.19.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Tue Jan 16 2024 Andreas Schneider - 4.29.4-3 - Fix samba-gpupdate on Fedora/RHEL From fc5ba481784bccd717ed4961113dea7b2c2a7d5a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Jan 2024 19:39:19 +0100 Subject: [PATCH 171/295] Update to version 4.20.0rc1 resolves: #2260895 Guenther --- .gitignore | 2 + samba-4.19-fix-gpupdate-rhel-fedora.patch | 638 ---------------------- samba-4.19-fix-gpupdate-site-aware.patch | 61 --- samba.spec | 375 ++++++++----- sources | 4 +- 5 files changed, 251 insertions(+), 829 deletions(-) delete mode 100644 samba-4.19-fix-gpupdate-rhel-fedora.patch delete mode 100644 samba-4.19-fix-gpupdate-site-aware.patch diff --git a/.gitignore b/.gitignore index 347f3eb..9a1363f 100644 --- a/.gitignore +++ b/.gitignore @@ -355,3 +355,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.3.tar.asc /samba-4.19.4.tar.xz /samba-4.19.4.tar.asc +/samba-4.20.0rc1.tar.xz +/samba-4.20.0rc1.tar.asc diff --git a/samba-4.19-fix-gpupdate-rhel-fedora.patch b/samba-4.19-fix-gpupdate-rhel-fedora.patch deleted file mode 100644 index 6381e0a..0000000 --- a/samba-4.19-fix-gpupdate-rhel-fedora.patch +++ /dev/null @@ -1,638 +0,0 @@ -From 549b5fe579fc15d63b71b1cc8a0ebf4e4869171b Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Thu, 17 Aug 2023 01:05:54 +0300 -Subject: [PATCH 1/9] gp: Support more global trust directories - -In addition to the SUSE global trust directory, add support for RHEL and -Debian-based distributions (including Ubuntu). - -To determine the correct directory to use, we iterate over the variants -and stop at the first which is a directory. - -In case none is found, fallback to the first option which will produce a -warning as it did previously. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit a1b285e485c0b5a8747499bdbbb9f3f4fc025b2f) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 12 +++++++++++- - 1 file changed, 11 insertions(+), 1 deletion(-) - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index 312c8ddf467..1b90ab46e90 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -45,10 +45,12 @@ cert_wrap = b""" - -----BEGIN CERTIFICATE----- - %s - -----END CERTIFICATE-----""" --global_trust_dir = '/etc/pki/trust/anchors' - endpoint_re = '(https|HTTPS)://(?P[a-zA-Z0-9.-]+)/ADPolicyProvider' + \ - '_CEP_(?P[a-zA-Z]+)/service.svc/CEP' - -+global_trust_dirs = ['/etc/pki/trust/anchors', # SUSE -+ '/etc/pki/ca-trust/source/anchors', # RHEL/Fedora -+ '/usr/local/share/ca-certificates'] # Debian/Ubuntu - - def octet_string_to_objectGUID(data): - """Convert an octet string to an objectGUID.""" -@@ -249,12 +251,20 @@ def getca(ca, url, trust_dir): - return root_certs - - -+def find_global_trust_dir(): -+ """Return the global trust dir using known paths from various Linux distros.""" -+ for trust_dir in global_trust_dirs: -+ if os.path.isdir(trust_dir): -+ return trust_dir -+ return global_trust_dirs[0] -+ - def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - """Install the root certificate chain.""" - data = dict({'files': [], 'templates': []}, **ca) - url = 'http://%s/CertSrv/mscep/mscep.dll/pkiclient.exe?' % ca['hostname'] - root_certs = getca(ca, url, trust_dir) - data['files'].extend(root_certs) -+ global_trust_dir = find_global_trust_dir() - for src in root_certs: - # Symlink the certs to global trust dir - dst = os.path.join(global_trust_dir, os.path.basename(src)) --- -2.43.0 - - -From c624a1e9b1d09fe2bb3f9778cb616230e57168a8 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Thu, 17 Aug 2023 01:09:28 +0300 -Subject: [PATCH 2/9] gp: Support update-ca-trust helper - -This is used on RHEL/Fedora instead of update-ca-certificates. They -behave similarly so it's enough to change the command name. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit fa80d1d86439749c44e60cf9075e84dc9ed3c268) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index 1b90ab46e90..cefdafa21b2 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -258,6 +258,10 @@ def find_global_trust_dir(): - return trust_dir - return global_trust_dirs[0] - -+def update_ca_command(): -+ """Return the command to update the CA trust store.""" -+ return which('update-ca-certificates') or which('update-ca-trust') -+ - def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - """Install the root certificate chain.""" - data = dict({'files': [], 'templates': []}, **ca) -@@ -283,7 +287,7 @@ def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - # already exists. Ignore the FileExistsError. Preserve the - # existing symlink in the unapply data. - data['files'].append(dst) -- update = which('update-ca-certificates') -+ update = update_ca_command() - if update is not None: - Popen([update]).wait() - # Setup Certificate Auto Enrollment --- -2.43.0 - - -From 086406ca457cc17e15001fb44802276ada068679 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 11 Aug 2023 18:46:42 +0300 -Subject: [PATCH 3/9] gp: Change root cert extension suffix - -On Ubuntu, certificates must end in '.crt' in order to be considered by -the `update-ca-certificates` helper. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit bce3a89204545dcab5fb39a712590f6e166f997b) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index cefdafa21b2..c562722906b 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -241,7 +241,8 @@ def getca(ca, url, trust_dir): - certs = load_der_pkcs7_certificates(r.content) - for i in range(0, len(certs)): - cert = certs[i].public_bytes(Encoding.PEM) -- dest = '%s.%d' % (root_cert, i) -+ filename, extension = root_cert.rsplit('.', 1) -+ dest = '%s.%d.%s' % (filename, i, extension) - with open(dest, 'wb') as w: - w.write(cert) - root_certs.append(dest) --- -2.43.0 - - -From c57c32020cc9017191b8c8657ebabe00d552a6e3 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 18 Aug 2023 17:06:43 +0300 -Subject: [PATCH 4/9] gp: Test with binary content for certificate data - -This fails all GPO-related tests that call `gpupdate --rsop`. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 1ef722cf66f9ec99f52939f1cfca031c5fe1ad70) ---- - python/samba/tests/gpo.py | 8 ++++---- - selftest/knownfail.d/gpo | 13 +++++++++++++ - 2 files changed, 17 insertions(+), 4 deletions(-) - create mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py -index e4b75cc62a4..963f873f755 100644 ---- a/python/samba/tests/gpo.py -+++ b/python/samba/tests/gpo.py -@@ -6783,14 +6783,14 @@ class GPOTests(tests.TestCase): - ldb.add({'dn': certa_dn, - 'objectClass': 'certificationAuthority', - 'authorityRevocationList': ['XXX'], -- 'cACertificate': 'XXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateRevocationList': ['XXX'], - }) - # Write the dummy pKIEnrollmentService - enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) - ldb.add({'dn': enroll_dn, - 'objectClass': 'pKIEnrollmentService', -- 'cACertificate': 'XXXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateTemplates': ['Machine'], - 'dNSHostName': hostname, - }) -@@ -7201,14 +7201,14 @@ class GPOTests(tests.TestCase): - ldb.add({'dn': certa_dn, - 'objectClass': 'certificationAuthority', - 'authorityRevocationList': ['XXX'], -- 'cACertificate': 'XXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateRevocationList': ['XXX'], - }) - # Write the dummy pKIEnrollmentService - enroll_dn = 'CN=%s,CN=Enrollment Services,%s' % (ca_cn, confdn) - ldb.add({'dn': enroll_dn, - 'objectClass': 'pKIEnrollmentService', -- 'cACertificate': 'XXXX', -+ 'cACertificate': b'0\x82\x03u0\x82\x02]\xa0\x03\x02\x01\x02\x02\x10I', - 'certificateTemplates': ['Machine'], - 'dNSHostName': hostname, - }) -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -new file mode 100644 -index 00000000000..0aad59607c2 ---- /dev/null -+++ b/selftest/knownfail.d/gpo -@@ -0,0 +1,13 @@ -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From c53b2994fd13f4c74cee891e725a4558cdb06b2d Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Wed, 16 Aug 2023 12:20:11 +0300 -Subject: [PATCH 5/9] gp: Convert CA certificates to base64 - -I don't know whether this applies universally, but in our case the -contents of `es['cACertificate'][0]` are binary, so cleanly converting -to a string fails with the following: - -'utf-8' codec can't decode byte 0x82 in position 1: invalid start byte - -We found a fix to be encoding the certificate to base64 when -constructing the CA list. - -Section 4.4.5.2 of MS-CAESO also suggests that the content of -`cACertificate` is binary (OCTET string). - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 157335ee93eb866f9b6a47486a5668d6e76aced5) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 5 ++--- - selftest/knownfail.d/gpo | 13 ------------- - 2 files changed, 2 insertions(+), 16 deletions(-) - delete mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index c562722906b..c8b5368c16a 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -158,7 +158,7 @@ def fetch_certification_authorities(ldb): - for es in res: - data = { 'name': get_string(es['cn'][0]), - 'hostname': get_string(es['dNSHostName'][0]), -- 'cACertificate': get_string(es['cACertificate'][0]) -+ 'cACertificate': get_string(base64.b64encode(es['cACertificate'][0])) - } - result.append(data) - return result -@@ -176,8 +176,7 @@ def fetch_template_attrs(ldb, name, attrs=None): - return {'msPKI-Minimal-Key-Size': ['2048']} - - def format_root_cert(cert): -- cert = base64.b64encode(cert.encode()) -- return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert, 0, re.DOTALL) -+ return cert_wrap % re.sub(b"(.{64})", b"\\1\n", cert.encode(), 0, re.DOTALL) - - def find_cepces_submit(): - certmonger_dirs = [os.environ.get("PATH"), '/usr/lib/certmonger', -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -deleted file mode 100644 -index 0aad59607c2..00000000000 ---- a/selftest/knownfail.d/gpo -+++ /dev/null -@@ -1,13 +0,0 @@ --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_centrify_crontab_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_user_scripts_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_rsop --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_access --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_files --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_issue --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_motd --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_openssh --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_startup_scripts --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_sudoers --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_vgp_symlink --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From fd13702a9cd6475a14113de87ccad6588d2d443b Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 18 Aug 2023 17:16:23 +0300 -Subject: [PATCH 6/9] gp: Test adding new cert templates enforces changes - -Ensure that cepces-submit reporting additional templates and re-applying -will enforce the updated policy. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 2d6943a864405f324c467e8c3464c31ac08457b0) ---- - python/samba/tests/bin/cepces-submit | 3 +- - python/samba/tests/gpo.py | 48 ++++++++++++++++++++++++++++ - selftest/knownfail.d/gpo | 2 ++ - 3 files changed, 52 insertions(+), 1 deletion(-) - create mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/tests/bin/cepces-submit b/python/samba/tests/bin/cepces-submit -index 668682a9f58..de63164692b 100755 ---- a/python/samba/tests/bin/cepces-submit -+++ b/python/samba/tests/bin/cepces-submit -@@ -14,4 +14,5 @@ if __name__ == "__main__": - assert opts.auth == 'Kerberos' - if 'CERTMONGER_OPERATION' in os.environ and \ - os.environ['CERTMONGER_OPERATION'] == 'GET-SUPPORTED-TEMPLATES': -- print('Machine') # Report a Machine template -+ templates = os.environ.get('CEPCES_SUBMIT_SUPPORTED_TEMPLATES', 'Machine').split(',') -+ print('\n'.join(templates)) # Report the requested templates -diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py -index 963f873f755..e75c411bde7 100644 ---- a/python/samba/tests/gpo.py -+++ b/python/samba/tests/gpo.py -@@ -6812,6 +6812,23 @@ class GPOTests(tests.TestCase): - self.assertTrue(os.path.exists(machine_crt), - 'Machine key was not generated') - -+ # Subsequent apply should react to new certificate templates -+ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' -+ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') -+ ext.process_group_policy([], gpos, dname, dname) -+ self.assertTrue(os.path.exists(ca_crt), -+ 'Root CA certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine key was not generated') -+ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca_cn) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation certificate was not requested') -+ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca_cn) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation key was not generated') -+ - # Verify RSOP does not fail - ext.rsop([g for g in gpos if g.name == guid][0]) - -@@ -6829,11 +6846,17 @@ class GPOTests(tests.TestCase): - 'Machine certificate was not removed') - self.assertFalse(os.path.exists(machine_crt), - 'Machine key was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation certificate was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation key was not removed') - out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() - self.assertNotIn(get_bytes(ca_cn), out, 'CA was not removed') - out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() - self.assertNotIn(b'Machine', out, - 'Machine certificate not removed') -+ self.assertNotIn(b'Workstation', out, -+ 'Workstation certificate not removed') - - # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate - ldb.delete(certa_dn) -@@ -7233,6 +7256,25 @@ class GPOTests(tests.TestCase): - self.assertTrue(os.path.exists(machine_crt), - 'Machine key was not generated') - -+ # Subsequent apply should react to new certificate templates -+ os.environ['CEPCES_SUBMIT_SUPPORTED_TEMPLATES'] = 'Machine,Workstation' -+ self.addCleanup(os.environ.pop, 'CEPCES_SUBMIT_SUPPORTED_TEMPLATES') -+ ext.process_group_policy([], gpos, dname, dname) -+ for ca in ca_list: -+ self.assertTrue(os.path.exists(ca_crt), -+ 'Root CA certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine key was not generated') -+ -+ workstation_crt = os.path.join(dname, '%s.Workstation.crt' % ca) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation certificate was not requested') -+ workstation_key = os.path.join(dname, '%s.Workstation.key' % ca) -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation key was not generated') -+ - # Verify RSOP does not fail - ext.rsop([g for g in gpos if g.name == guid][0]) - -@@ -7250,12 +7292,18 @@ class GPOTests(tests.TestCase): - 'Machine certificate was not removed') - self.assertFalse(os.path.exists(machine_crt), - 'Machine key was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation certificate was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation key was not removed') - out, _ = Popen(['getcert', 'list-cas'], stdout=PIPE).communicate() - for ca in ca_list: - self.assertNotIn(get_bytes(ca), out, 'CA was not removed') - out, _ = Popen(['getcert', 'list'], stdout=PIPE).communicate() - self.assertNotIn(b'Machine', out, - 'Machine certificate not removed') -+ self.assertNotIn(b'Workstation', out, -+ 'Workstation certificate not removed') - - # Remove the dummy CA, pKIEnrollmentService, and pKICertificateTemplate - ldb.delete(certa_dn) -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -new file mode 100644 -index 00000000000..4edc1dce730 ---- /dev/null -+++ b/selftest/knownfail.d/gpo -@@ -0,0 +1,2 @@ -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From 4578c6664ab6eac476ee10afae4a1a95b3b63272 Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Wed, 16 Aug 2023 12:37:17 +0300 -Subject: [PATCH 7/9] gp: Template changes should invalidate cache - -If certificate templates are added or removed, the autoenroll extension -should react to this and reapply the policy. Previously this wasn't -taken into account. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit 2a6ae997f2464b12b72b5314fa80d9784fb0f6c1) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 15 ++++++++++----- - selftest/knownfail.d/gpo | 2 -- - 2 files changed, 10 insertions(+), 7 deletions(-) - delete mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index c8b5368c16a..8233713e8ad 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -262,6 +262,11 @@ def update_ca_command(): - """Return the command to update the CA trust store.""" - return which('update-ca-certificates') or which('update-ca-trust') - -+def changed(new_data, old_data): -+ """Return True if any key present in both dicts has changed.""" -+ return any((new_data[k] != old_data[k] if k in old_data else False) \ -+ for k in new_data.keys()) -+ - def cert_enroll(ca, ldb, trust_dir, private_dir, auth='Kerberos'): - """Install the root certificate chain.""" - data = dict({'files': [], 'templates': []}, **ca) -@@ -351,12 +356,12 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): - # If the policy has changed, unapply, then apply new policy - old_val = self.cache_get_attribute_value(guid, attribute) - old_data = json.loads(old_val) if old_val is not None else {} -- if all([(ca[k] == old_data[k] if k in old_data else False) \ -- for k in ca.keys()]) or \ -- self.cache_get_apply_state() == GPOSTATE.ENFORCE: -+ templates = ['%s.%s' % (ca['name'], t.decode()) for t in get_supported_templates(ca['hostname'])] -+ new_data = { 'templates': templates, **ca } -+ if changed(new_data, old_data) or self.cache_get_apply_state() == GPOSTATE.ENFORCE: - self.unapply(guid, attribute, old_val) -- # If policy is already applied, skip application -- if old_val is not None and \ -+ # If policy is already applied and unchanged, skip application -+ if old_val is not None and not changed(new_data, old_data) and \ - self.cache_get_apply_state() != GPOSTATE.ENFORCE: - return - -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -deleted file mode 100644 -index 4edc1dce730..00000000000 ---- a/selftest/knownfail.d/gpo -+++ /dev/null -@@ -1,2 +0,0 @@ --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_advanced_gp_cert_auto_enroll_ext --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From 2d641b736b42f7623955f251ad354439b954159d Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Fri, 18 Aug 2023 17:26:59 +0300 -Subject: [PATCH 8/9] gp: Test disabled enrollment unapplies policy - -For this we need to stage a Registry.pol file with certificate -autoenrollment enabled, but with checkboxes unticked. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder -(cherry picked from commit ee814f7707a8ddef2657212cd6d31799501b7bb3) ---- - python/samba/tests/gpo.py | 54 +++++++++++++++++++++++++++++++++++++++ - selftest/knownfail.d/gpo | 1 + - 2 files changed, 55 insertions(+) - create mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/tests/gpo.py b/python/samba/tests/gpo.py -index e75c411bde7..580f3568de8 100644 ---- a/python/samba/tests/gpo.py -+++ b/python/samba/tests/gpo.py -@@ -281,6 +281,28 @@ b""" - - """ - -+auto_enroll_unchecked_reg_pol = \ -+b""" -+ -+ -+ -+ Software\Policies\Microsoft\Cryptography\AutoEnrollment -+ AEPolicy -+ 0 -+ -+ -+ Software\Policies\Microsoft\Cryptography\AutoEnrollment -+ OfflineExpirationPercent -+ 10 -+ -+ -+ Software\Policies\Microsoft\Cryptography\AutoEnrollment -+ OfflineExpirationStoreNames -+ MY -+ -+ -+""" -+ - advanced_enroll_reg_pol = \ - b""" - -@@ -6836,6 +6858,38 @@ class GPOTests(tests.TestCase): - ret = rsop(self.lp) - self.assertEqual(ret, 0, 'gpupdate --rsop failed!') - -+ # Remove policy by staging pol file with auto-enroll unchecked -+ parser.load_xml(etree.fromstring(auto_enroll_unchecked_reg_pol.strip())) -+ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) -+ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) -+ ext.process_group_policy([], gpos, dname, dname) -+ self.assertFalse(os.path.exists(ca_crt), -+ 'Root CA certificate was not removed') -+ self.assertFalse(os.path.exists(machine_crt), -+ 'Machine certificate was not removed') -+ self.assertFalse(os.path.exists(machine_crt), -+ 'Machine key was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation certificate was not removed') -+ self.assertFalse(os.path.exists(workstation_crt), -+ 'Workstation key was not removed') -+ -+ # Reapply policy by staging the enabled pol file -+ parser.load_xml(etree.fromstring(auto_enroll_reg_pol.strip())) -+ ret = stage_file(reg_pol, ndr_pack(parser.pol_file)) -+ self.assertTrue(ret, 'Could not create the target %s' % reg_pol) -+ ext.process_group_policy([], gpos, dname, dname) -+ self.assertTrue(os.path.exists(ca_crt), -+ 'Root CA certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine certificate was not requested') -+ self.assertTrue(os.path.exists(machine_crt), -+ 'Machine key was not generated') -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation certificate was not requested') -+ self.assertTrue(os.path.exists(workstation_crt), -+ 'Workstation key was not generated') -+ - # Remove policy - gp_db = store.get_gplog(machine_creds.get_username()) - del_gpos = get_deleted_gpos_list(gp_db, []) -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -new file mode 100644 -index 00000000000..83bc9f0ac1f ---- /dev/null -+++ b/selftest/knownfail.d/gpo -@@ -0,0 +1 @@ -+^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - - -From e5588f8800899894388284468b9e25463d3c3e6c Mon Sep 17 00:00:00 2001 -From: Gabriel Nagy -Date: Wed, 16 Aug 2023 12:33:59 +0300 -Subject: [PATCH 9/9] gp: Send list of keys instead of dict to remove - -`cache_get_all_attribute_values` returns a dict whereas we need to pass -a list of keys to `remove`. These will be interpolated in the gpdb search. - -Signed-off-by: Gabriel Nagy -Reviewed-by: Joseph Sutton -Reviewed-by: David Mulder - -Autobuild-User(master): Andrew Bartlett -Autobuild-Date(master): Mon Aug 28 03:01:22 UTC 2023 on atb-devel-224 - -(cherry picked from commit 7dc181757c76b881ceaf1915ebb0bfbcf5aca83a) ---- - python/samba/gp/gp_cert_auto_enroll_ext.py | 2 +- - selftest/knownfail.d/gpo | 1 - - 2 files changed, 1 insertion(+), 2 deletions(-) - delete mode 100644 selftest/knownfail.d/gpo - -diff --git a/python/samba/gp/gp_cert_auto_enroll_ext.py b/python/samba/gp/gp_cert_auto_enroll_ext.py -index 8233713e8ad..64c35782ae8 100644 ---- a/python/samba/gp/gp_cert_auto_enroll_ext.py -+++ b/python/samba/gp/gp_cert_auto_enroll_ext.py -@@ -415,7 +415,7 @@ class gp_cert_auto_enroll_ext(gp_pol_ext, gp_applier): - # remove any existing policy - ca_attrs = \ - self.cache_get_all_attribute_values(gpo.name) -- self.clean(gpo.name, remove=ca_attrs) -+ self.clean(gpo.name, remove=list(ca_attrs.keys())) - - def __read_cep_data(self, guid, ldb, end_point_information, - trust_dir, private_dir): -diff --git a/selftest/knownfail.d/gpo b/selftest/knownfail.d/gpo -deleted file mode 100644 -index 83bc9f0ac1f..00000000000 ---- a/selftest/knownfail.d/gpo -+++ /dev/null -@@ -1 +0,0 @@ --^samba.tests.gpo.samba.tests.gpo.GPOTests.test_gp_cert_auto_enroll_ext --- -2.43.0 - diff --git a/samba-4.19-fix-gpupdate-site-aware.patch b/samba-4.19-fix-gpupdate-site-aware.patch deleted file mode 100644 index 3354bb0..0000000 --- a/samba-4.19-fix-gpupdate-site-aware.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 372b8f15ccf37c491f43ec7ab81be692ff0fcfed Mon Sep 17 00:00:00 2001 -From: David Mulder -Date: Fri, 5 Jan 2024 08:47:07 -0700 -Subject: [PATCH] WIP: gp: Skip site GP list if no site is found - -[MS-GPOL] 3.2.5.1.4 Site Search says if the site -search returns ERROR_NO_SITENAME, the GP site -search should be skipped. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15548 - -Signed-off-by: David Mulder ---- - python/samba/gp/gpclass.py | 30 ++++++++++++++++++------------ - 1 file changed, 18 insertions(+), 12 deletions(-) - -diff --git a/python/samba/gp/gpclass.py b/python/samba/gp/gpclass.py -index b7a0dcb0ed5..26c2386847e 100644 ---- a/python/samba/gp/gpclass.py -+++ b/python/samba/gp/gpclass.py -@@ -896,19 +896,25 @@ def get_gpo_list(dc_hostname, creds, lp, username): - - # (S)ite - if gpo_list_machine: -- site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) -- - try: -- log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) -- gp_link = get_gpo_link(samdb, site_dn) -- except ldb.LdbError as e: -- (enum, estr) = e.args -- log.debug(estr) -- else: -- add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, -- site_dn, gp_link, -- gpo.GP_LINK_SITE, -- add_only_forced_gpos, token) -+ site_dn = site_dn_for_machine(samdb, dc_hostname, lp, creds, username) -+ -+ try: -+ log.debug("get_gpo_list: query SITE: [%s] for GPOs" % site_dn) -+ gp_link = get_gpo_link(samdb, site_dn) -+ except ldb.LdbError as e: -+ (enum, estr) = e.args -+ log.debug(estr) -+ else: -+ add_gplink_to_gpo_list(samdb, gpo_list, forced_gpo_list, -+ site_dn, gp_link, -+ gpo.GP_LINK_SITE, -+ add_only_forced_gpos, token) -+ except ldb.LdbError: -+ # [MS-GPOL] 3.2.5.1.4 Site Search: If the method returns -+ # ERROR_NO_SITENAME, the remainder of this message MUST be skipped -+ # and the protocol sequence MUST continue at GPO Search -+ pass - - # (L)ocal - gpo_list.insert(0, gpo.GROUP_POLICY_OBJECT("Local Policy", --- -GitLab - diff --git a/samba.spec b/samba.spec index 136e8e3..e55167e 100644 --- a/samba.spec +++ b/samba.spec @@ -146,10 +146,10 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.19.4 -%global baserelease 4 +%global samba_version 4.20.0 +%global baserelease 1 # This should be rc1 or %%nil -%global pre_release %nil +%global pre_release rc1 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -164,7 +164,7 @@ %global libdcerpc_so_version 0 %global libndr_krb5pac_so_version 0 %global libndr_nbt_so_version 0 -%global libndr_so_version 3 +%global libndr_so_version 4 %global libndr_standard_so_version 0 %global libnetapi_so_version 1 %global libsamba_credentials_so_version 1 @@ -180,10 +180,10 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.4.1 -%global tdb_version 1.4.9 -%global tevent_version 0.15.0 -%global ldb_version 2.8.0 +%global talloc_version 2.4.2 +%global tdb_version 1.4.10 +%global tevent_version 0.16.1 +%global ldb_version 2.9.0 %global required_mit_krb5 1.20.1 @@ -238,9 +238,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.19-fix-gpupdate-rhel-fedora.patch -Patch1: samba-4.19-fix-gpupdate-site-aware.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -1660,8 +1657,8 @@ fi %{_sbindir}/nmbd %{_sbindir}/smbd %if %{with dc} || %{with testsuite} -# This is only used by vfs_dfs_samba4 -%{_libdir}/samba/libdfs-server-ad-samba4.so +# This is only used by vfs_dfs_samba-private +%{_libdir}/samba/libdfs-server-ad-private-samba.so %endif %dir %{_libdir}/samba/auth %{_libdir}/samba/auth/unix.so @@ -1799,6 +1796,7 @@ fi %{_bindir}/smbspool %{_bindir}/smbtar %{_bindir}/smbtree +%{_bindir}/wspsearch %dir %{_libexecdir}/samba %ghost %{_libexecdir}/samba/cups_backend_smb %{_mandir}/man1/dbwrap_tool.1* @@ -1870,86 +1868,86 @@ fi %{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* %dir %{_libdir}/samba -%{_libdir}/samba/libCHARSET3-samba4.so -%{_libdir}/samba/libMESSAGING-SEND-samba4.so -%{_libdir}/samba/libMESSAGING-samba4.so -%{_libdir}/samba/libaddns-samba4.so -%{_libdir}/samba/libads-samba4.so -%{_libdir}/samba/libasn1util-samba4.so -%{_libdir}/samba/libauth-samba4.so -%{_libdir}/samba/libauthkrb5-samba4.so -%{_libdir}/samba/libcli-cldap-samba4.so -%{_libdir}/samba/libcli-ldap-common-samba4.so -%{_libdir}/samba/libcli-ldap-samba4.so -%{_libdir}/samba/libcli-nbt-samba4.so -%{_libdir}/samba/libcli-smb-common-samba4.so -%{_libdir}/samba/libcli-spoolss-samba4.so -%{_libdir}/samba/libcliauth-samba4.so -%{_libdir}/samba/libclidns-samba4.so -%{_libdir}/samba/libcluster-samba4.so -%{_libdir}/samba/libcmdline-contexts-samba4.so -%{_libdir}/samba/libcommon-auth-samba4.so -%{_libdir}/samba/libctdb-event-client-samba4.so -%{_libdir}/samba/libdbwrap-samba4.so -%{_libdir}/samba/libdcerpc-pkt-auth-samba4.so -%{_libdir}/samba/libdcerpc-samba-samba4.so -%{_libdir}/samba/libevents-samba4.so -%{_libdir}/samba/libflag-mapping-samba4.so -%{_libdir}/samba/libgenrand-samba4.so -%{_libdir}/samba/libgensec-samba4.so -%{_libdir}/samba/libgpext-samba4.so -%{_libdir}/samba/libgpo-samba4.so -%{_libdir}/samba/libgse-samba4.so -%{_libdir}/samba/libhttp-samba4.so -%{_libdir}/samba/libinterfaces-samba4.so -%{_libdir}/samba/libiov-buf-samba4.so -%{_libdir}/samba/libkrb5samba-samba4.so -%{_libdir}/samba/libldbsamba-samba4.so -%{_libdir}/samba/liblibcli-lsa3-samba4.so -%{_libdir}/samba/liblibcli-netlogon3-samba4.so -%{_libdir}/samba/liblibsmb-samba4.so -%{_libdir}/samba/libmessages-dgm-samba4.so -%{_libdir}/samba/libmessages-util-samba4.so -%{_libdir}/samba/libmscat-samba4.so -%{_libdir}/samba/libmsghdr-samba4.so -%{_libdir}/samba/libmsrpc3-samba4.so -%{_libdir}/samba/libndr-samba-samba4.so -%{_libdir}/samba/libndr-samba4.so -%{_libdir}/samba/libnet-keytab-samba4.so -%{_libdir}/samba/libnetif-samba4.so -%{_libdir}/samba/libnpa-tstream-samba4.so -%{_libdir}/samba/libposix-eadb-samba4.so -%{_libdir}/samba/libprinter-driver-samba4.so -%{_libdir}/samba/libprinting-migrate-samba4.so -%{_libdir}/samba/libreplace-samba4.so -%{_libdir}/samba/libregistry-samba4.so -%{_libdir}/samba/libsamba-cluster-support-samba4.so -%{_libdir}/samba/libsamba-debug-samba4.so -%{_libdir}/samba/libsamba-modules-samba4.so -%{_libdir}/samba/libsamba-security-samba4.so -%{_libdir}/samba/libsamba-sockets-samba4.so -%{_libdir}/samba/libsamba3-util-samba4.so -%{_libdir}/samba/libsamdb-common-samba4.so -%{_libdir}/samba/libsecrets3-samba4.so -%{_libdir}/samba/libserver-id-db-samba4.so -%{_libdir}/samba/libserver-role-samba4.so -%{_libdir}/samba/libsmb-transport-samba4.so -%{_libdir}/samba/libsmbclient-raw-samba4.so -%{_libdir}/samba/libsmbd-base-samba4.so -%{_libdir}/samba/libsmbd-shim-samba4.so -%{_libdir}/samba/libsmbldaphelper-samba4.so -%{_libdir}/samba/libstable-sort-samba4.so -%{_libdir}/samba/libsys-rw-samba4.so -%{_libdir}/samba/libsocket-blocking-samba4.so -%{_libdir}/samba/libtalloc-report-printf-samba4.so -%{_libdir}/samba/libtalloc-report-samba4.so -%{_libdir}/samba/libtdb-wrap-samba4.so -%{_libdir}/samba/libtime-basic-samba4.so -%{_libdir}/samba/libtorture-samba4.so -%{_libdir}/samba/libtrusts-util-samba4.so -%{_libdir}/samba/libutil-reg-samba4.so -%{_libdir}/samba/libutil-setid-samba4.so -%{_libdir}/samba/libutil-tdb-samba4.so +%{_libdir}/samba/libCHARSET3-private-samba.so +%{_libdir}/samba/libMESSAGING-SEND-private-samba.so +%{_libdir}/samba/libMESSAGING-private-samba.so +%{_libdir}/samba/libaddns-private-samba.so +%{_libdir}/samba/libads-private-samba.so +%{_libdir}/samba/libasn1util-private-samba.so +%{_libdir}/samba/libauth-private-samba.so +%{_libdir}/samba/libauthkrb5-private-samba.so +%{_libdir}/samba/libcli-cldap-private-samba.so +%{_libdir}/samba/libcli-ldap-common-private-samba.so +%{_libdir}/samba/libcli-ldap-private-samba.so +%{_libdir}/samba/libcli-nbt-private-samba.so +%{_libdir}/samba/libcli-smb-common-private-samba.so +%{_libdir}/samba/libcli-spoolss-private-samba.so +%{_libdir}/samba/libcliauth-private-samba.so +%{_libdir}/samba/libclidns-private-samba.so +%{_libdir}/samba/libcluster-private-samba.so +%{_libdir}/samba/libcmdline-contexts-private-samba.so +%{_libdir}/samba/libcommon-auth-private-samba.so +%{_libdir}/samba/libctdb-event-client-private-samba.so +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so +%{_libdir}/samba/libdcerpc-samba-private-samba.so +%{_libdir}/samba/libevents-private-samba.so +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libgenrand-private-samba.so +%{_libdir}/samba/libgensec-private-samba.so +%{_libdir}/samba/libgpext-private-samba.so +%{_libdir}/samba/libgpo-private-samba.so +%{_libdir}/samba/libgse-private-samba.so +%{_libdir}/samba/libhttp-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libkrb5samba-private-samba.so +%{_libdir}/samba/libldbsamba-private-samba.so +%{_libdir}/samba/liblibcli-lsa3-private-samba.so +%{_libdir}/samba/liblibcli-netlogon3-private-samba.so +%{_libdir}/samba/liblibsmb-private-samba.so +%{_libdir}/samba/libmessages-dgm-private-samba.so +%{_libdir}/samba/libmessages-util-private-samba.so +%{_libdir}/samba/libmscat-private-samba.so +%{_libdir}/samba/libmsghdr-private-samba.so +%{_libdir}/samba/libmsrpc3-private-samba.so +%{_libdir}/samba/libndr-samba-private-samba.so +%{_libdir}/samba/libndr-samba4-private-samba.so +%{_libdir}/samba/libnet-keytab-private-samba.so +%{_libdir}/samba/libnetif-private-samba.so +%{_libdir}/samba/libnpa-tstream-private-samba.so +%{_libdir}/samba/libposix-eadb-private-samba.so +%{_libdir}/samba/libprinter-driver-private-samba.so +%{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libreplace-private-samba.so +%{_libdir}/samba/libregistry-private-samba.so +%{_libdir}/samba/libsamba-cluster-support-private-samba.so +%{_libdir}/samba/libsamba-debug-private-samba.so +%{_libdir}/samba/libsamba-modules-private-samba.so +%{_libdir}/samba/libsamba-security-private-samba.so +%{_libdir}/samba/libsamba-sockets-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libsamdb-common-private-samba.so +%{_libdir}/samba/libsecrets3-private-samba.so +%{_libdir}/samba/libserver-id-db-private-samba.so +%{_libdir}/samba/libserver-role-private-samba.so +%{_libdir}/samba/libsmb-transport-private-samba.so +%{_libdir}/samba/libsmbclient-raw-private-samba.so +%{_libdir}/samba/libsmbd-base-private-samba.so +%{_libdir}/samba/libsmbd-shim-private-samba.so +%{_libdir}/samba/libsmbldaphelper-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libsys-rw-private-samba.so +%{_libdir}/samba/libsocket-blocking-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so +%{_libdir}/samba/libtime-basic-private-samba.so +%{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libtrusts-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* @@ -1964,9 +1962,9 @@ fi %if %{with includelibs} %{_libdir}/samba/libldb-*.so -%{_libdir}/samba/libtalloc-samba4.so -%{_libdir}/samba/libtdb-samba4.so -%{_libdir}/samba/libtevent-samba4.so +%{_libdir}/samba/libtalloc-private-samba.so +%{_libdir}/samba/libtdb-private-samba.so +%{_libdir}/samba/libtevent-private-samba.so %{_libdir}/samba/ldb/asq.so %{_libdir}/samba/ldb/ldb.so @@ -2009,7 +2007,7 @@ fi ### COMMON-LIBS %files common-libs # common libraries -%{_libdir}/samba/libcmdline-samba4.so +%{_libdir}/samba/libcmdline-private-samba.so %dir %{_libdir}/samba/ldb @@ -2054,6 +2052,7 @@ fi %endif %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg +%{_libexecdir}/samba/rpcd_witness %{_mandir}/man8/samba-dcerpcd.8* ### DC @@ -2139,16 +2138,16 @@ fi %endif ### DC-LIBS %files dc-libs -%{_libdir}/samba/libauth4-samba4.so +%{_libdir}/samba/libauth4-private-samba.so %if %{with dc} || %{with testsuite} -%{_libdir}/samba/libdb-glue-samba4.so -%{_libdir}/samba/libpac-samba4.so -%{_libdir}/samba/libprocess-model-samba4.so -%{_libdir}/samba/libservice-samba4.so +%{_libdir}/samba/libdb-glue-private-samba.so +%{_libdir}/samba/libpac-private-samba.so +%{_libdir}/samba/libprocess-model-private-samba.so +%{_libdir}/samba/libservice-private-samba.so %if %{with testsuite} -%{_libdir}/samba/libntvfs-samba4.so +%{_libdir}/samba/libntvfs-private-samba.so %endif %dir %{_libdir}/samba/process_model @@ -2174,11 +2173,11 @@ fi %endif %{_libdir}/libdcerpc-server.so.* -%{_libdir}/samba/libad-claims-samba4.so -%{_libdir}/samba/libauthn-policy-util-samba4.so -%{_libdir}/samba/libdsdb-module-samba4.so -%{_libdir}/samba/libdsdb-garbage-collect-tombstones-samba4.so -%{_libdir}/samba/libscavenge-dns-records-samba4.so +%{_libdir}/samba/libad-claims-private-samba.so +%{_libdir}/samba/libauthn-policy-util-private-samba.so +%{_libdir}/samba/libdsdb-module-private-samba.so +%{_libdir}/samba/libdsdb-garbage-collect-tombstones-private-samba.so +%{_libdir}/samba/libscavenge-dns-records-private-samba.so ### DC-BIND %files dc-bind-dlz @@ -2252,6 +2251,7 @@ fi %{_includedir}/samba-4.0/samba/version.h %{_includedir}/samba-4.0/share.h %{_includedir}/samba-4.0/smb2_lease_struct.h +%{_includedir}/samba-4.0/smb3posix.h %{_includedir}/samba-4.0/smbconf.h %{_includedir}/samba-4.0/smb_ldap.h %{_includedir}/samba-4.0/smbldap.h @@ -2365,16 +2365,16 @@ fi %files libs %{_libdir}/libdcerpc-samr.so.* -%{_libdir}/samba/libLIBWBCLIENT-OLD-samba4.so -%{_libdir}/samba/libauth-unix-token-samba4.so -%{_libdir}/samba/libdcerpc-samba4.so -%{_libdir}/samba/libdnsserver-common-samba4.so -%{_libdir}/samba/libshares-samba4.so -%{_libdir}/samba/libsmbpasswdparser-samba4.so -%{_libdir}/samba/libxattr-tdb-samba4.so -%{_libdir}/samba/libREG-FULL-samba4.so -%{_libdir}/samba/libRPC-SERVER-LOOP-samba4.so -%{_libdir}/samba/libRPC-WORKER-samba4.so +%{_libdir}/samba/libLIBWBCLIENT-OLD-private-samba.so +%{_libdir}/samba/libauth-unix-token-private-samba.so +%{_libdir}/samba/libdcerpc-samba4-private-samba.so +%{_libdir}/samba/libdnsserver-common-private-samba.so +%{_libdir}/samba/libshares-private-samba.so +%{_libdir}/samba/libsmbpasswdparser-private-samba.so +%{_libdir}/samba/libxattr-tdb-private-samba.so +%{_libdir}/samba/libREG-FULL-private-samba.so +%{_libdir}/samba/libRPC-SERVER-LOOP-private-samba.so +%{_libdir}/samba/libRPC-WORKER-private-samba.so ### LIBNETAPI %files -n libnetapi @@ -2474,6 +2474,7 @@ fi %{python3_sitearch}/samba/__pycache__/drs_utils.*.pyc %{python3_sitearch}/samba/__pycache__/functional_level.*.pyc %{python3_sitearch}/samba/__pycache__/getopt.*.pyc +%{python3_sitearch}/samba/__pycache__/gkdi.*.pyc %{python3_sitearch}/samba/__pycache__/graph.*.pyc %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/__pycache__/idmap.*.pyc @@ -2484,6 +2485,7 @@ fi %{python3_sitearch}/samba/__pycache__/ms_schema.*.pyc %{python3_sitearch}/samba/__pycache__/ndr.*.pyc %{python3_sitearch}/samba/__pycache__/ntacls.*.pyc +%{python3_sitearch}/samba/__pycache__/nt_time.*.pyc %{python3_sitearch}/samba/__pycache__/policies.*.pyc %{python3_sitearch}/samba/__pycache__/safe_tarfile.*.pyc %{python3_sitearch}/samba/__pycache__/sd_utils.*.pyc @@ -2512,6 +2514,7 @@ fi %{python3_sitearch}/samba/dcerpc/auth.*.so %{python3_sitearch}/samba/dcerpc/base.*.so %{python3_sitearch}/samba/dcerpc/claims.*.so +%{python3_sitearch}/samba/dcerpc/conditional_ace.*.so %{python3_sitearch}/samba/dcerpc/dcerpc.*.so %{python3_sitearch}/samba/dcerpc/dfs.*.so %{python3_sitearch}/samba/dcerpc/dns.*.so @@ -2520,6 +2523,8 @@ fi %{python3_sitearch}/samba/dcerpc/drsuapi.*.so %{python3_sitearch}/samba/dcerpc/echo.*.so %{python3_sitearch}/samba/dcerpc/epmapper.*.so +%{python3_sitearch}/samba/dcerpc/gkdi.*.so +%{python3_sitearch}/samba/dcerpc/gmsa.*.so %{python3_sitearch}/samba/dcerpc/idmap.*.so %{python3_sitearch}/samba/dcerpc/initshutdown.*.so %{python3_sitearch}/samba/dcerpc/irpc.*.so @@ -2538,6 +2543,8 @@ fi %{python3_sitearch}/samba/dcerpc/security.*.so %{python3_sitearch}/samba/dcerpc/server_id.*.so %{python3_sitearch}/samba/dcerpc/smb_acl.*.so +%{python3_sitearch}/samba/dcerpc/smb3posix.*.so +%{python3_sitearch}/samba/dcerpc/smbXsrv.*.so %{python3_sitearch}/samba/dcerpc/spoolss.*.so %{python3_sitearch}/samba/dcerpc/srvsvc.*.so %{python3_sitearch}/samba/dcerpc/svcctl.*.so @@ -2557,6 +2564,7 @@ fi %{python3_sitearch}/samba/functional_level.py %{python3_sitearch}/samba/gensec.*.so %{python3_sitearch}/samba/getopt.py +%{python3_sitearch}/samba/gkdi.py %{python3_sitearch}/samba/graph.py %{python3_sitearch}/samba/hostconfig.py %{python3_sitearch}/samba/idmap.py @@ -2583,6 +2591,7 @@ fi %{python3_sitearch}/samba/gp/__pycache__/gp_centrify_crontab_ext.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_centrify_sudoers_ext.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_cert_auto_enroll_ext.*.pyc +%{python3_sitearch}/samba/gp/__pycache__/gp_drive_maps_ext.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_chromium_ext.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_ext_loader.*.pyc %{python3_sitearch}/samba/gp/__pycache__/gp_firefox_ext.*.pyc @@ -2608,6 +2617,7 @@ fi %{python3_sitearch}/samba/gp/gp_centrify_crontab_ext.py %{python3_sitearch}/samba/gp/gp_centrify_sudoers_ext.py %{python3_sitearch}/samba/gp/gp_cert_auto_enroll_ext.py +%{python3_sitearch}/samba/gp/gp_drive_maps_ext.py %{python3_sitearch}/samba/gp/gp_chromium_ext.py %{python3_sitearch}/samba/gp/gp_ext_loader.py %{python3_sitearch}/samba/gp/gp_firefox_ext.py @@ -2642,6 +2652,7 @@ fi %{python3_sitearch}/samba/gp_parse/gp_inf.py %{python3_sitearch}/samba/gp_parse/gp_ini.py %{python3_sitearch}/samba/gp_parse/gp_pol.py +%{python3_sitearch}/samba/hresult.*.so %{python3_sitearch}/samba/logger.py %{python3_sitearch}/samba/mdb_util.py %{python3_sitearch}/samba/ms_display_specifiers.py @@ -2673,11 +2684,11 @@ fi %{python3_sitearch}/samba/netcmd/__pycache__/processes.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/pso.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/rodc.*.pyc +%{python3_sitearch}/samba/netcmd/__pycache__/shell.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/schema.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/sites.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/spn.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/testparm.*.pyc -%{python3_sitearch}/samba/netcmd/__pycache__/user.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/validators.*.pyc %{python3_sitearch}/samba/netcmd/__pycache__/visualize.*.pyc %{python3_sitearch}/samba/netcmd/common.py @@ -2744,7 +2755,9 @@ fi %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/claim_type.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/exceptions.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/fields.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/group.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/model.*.pyc +%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/query.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/schema.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/site.*.pyc %{python3_sitearch}/samba/netcmd/domain/models/__pycache__/subnet.*.pyc @@ -2755,7 +2768,9 @@ fi %{python3_sitearch}/samba/netcmd/domain/models/claim_type.py %{python3_sitearch}/samba/netcmd/domain/models/exceptions.py %{python3_sitearch}/samba/netcmd/domain/models/fields.py +%{python3_sitearch}/samba/netcmd/domain/models/group.py %{python3_sitearch}/samba/netcmd/domain/models/model.py +%{python3_sitearch}/samba/netcmd/domain/models/query.py %{python3_sitearch}/samba/netcmd/domain/models/schema.py %{python3_sitearch}/samba/netcmd/domain/models/site.py %{python3_sitearch}/samba/netcmd/domain/models/subnet.py @@ -2785,13 +2800,72 @@ fi %{python3_sitearch}/samba/netcmd/pso.py %{python3_sitearch}/samba/netcmd/rodc.py %{python3_sitearch}/samba/netcmd/schema.py +%{python3_sitearch}/samba/netcmd/shell.py %{python3_sitearch}/samba/netcmd/sites.py %{python3_sitearch}/samba/netcmd/spn.py %{python3_sitearch}/samba/netcmd/testparm.py -%{python3_sitearch}/samba/netcmd/user.py +%dir %{python3_sitearch}/samba/netcmd/user +%{python3_sitearch}/samba/netcmd/user/__init__.py +%{python3_sitearch}/samba/netcmd/user/add.py +%{python3_sitearch}/samba/netcmd/user/add_unix_attrs.py +%dir %{python3_sitearch}/samba/netcmd/user/auth +%{python3_sitearch}/samba/netcmd/user/auth/__init__.py +%{python3_sitearch}/samba/netcmd/user/auth/policy.py +%dir %{python3_sitearch}/samba/netcmd/user/auth/__pycache__ +%{python3_sitearch}/samba/netcmd/user/auth/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/user/auth/__pycache__/policy.*.pyc +%{python3_sitearch}/samba/netcmd/user/auth/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/user/auth/silo.py +%{python3_sitearch}/samba/netcmd/user/delete.py +%{python3_sitearch}/samba/netcmd/user/disable.py +%{python3_sitearch}/samba/netcmd/user/edit.py +%{python3_sitearch}/samba/netcmd/user/enable.py +%{python3_sitearch}/samba/netcmd/user/getgroups.py +%{python3_sitearch}/samba/netcmd/user/list.py +%{python3_sitearch}/samba/netcmd/user/move.py +%{python3_sitearch}/samba/netcmd/user/password.py +%dir %{python3_sitearch}/samba/netcmd/user/__pycache__ +%{python3_sitearch}/samba/netcmd/user/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/add.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/add_unix_attrs.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/delete.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/disable.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/edit.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/enable.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/getgroups.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/list.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/move.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/password.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/rename.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/sensitive.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/setexpiry.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/setpassword.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/setprimarygroup.*.pyc +%{python3_sitearch}/samba/netcmd/user/__pycache__/unlock.*.pyc +%dir %{python3_sitearch}/samba/netcmd/user/readpasswords +%{python3_sitearch}/samba/netcmd/user/readpasswords/common.py +%{python3_sitearch}/samba/netcmd/user/readpasswords/get_kerberos_ticket.py +%{python3_sitearch}/samba/netcmd/user/readpasswords/getpassword.py +%{python3_sitearch}/samba/netcmd/user/readpasswords/__init__.py +%dir %{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__ +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/common.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/get_kerberos_ticket.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/getpassword.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/show.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/__pycache__/syncpasswords.*.pyc +%{python3_sitearch}/samba/netcmd/user/readpasswords/show.py +%{python3_sitearch}/samba/netcmd/user/readpasswords/syncpasswords.py +%{python3_sitearch}/samba/netcmd/user/rename.py +%{python3_sitearch}/samba/netcmd/user/sensitive.py +%{python3_sitearch}/samba/netcmd/user/setexpiry.py +%{python3_sitearch}/samba/netcmd/user/setpassword.py +%{python3_sitearch}/samba/netcmd/user/setprimarygroup.py +%{python3_sitearch}/samba/netcmd/user/unlock.py %{python3_sitearch}/samba/netcmd/validators.py %{python3_sitearch}/samba/netcmd/visualize.py %{python3_sitearch}/samba/ntacls.py +%{python3_sitearch}/samba/nt_time.py %{python3_sitearch}/samba/param.*.so %{python3_sitearch}/samba/policies.py %{python3_sitearch}/samba/policy.*.so @@ -2933,6 +3007,9 @@ fi %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc %{python3_sitearch}/samba/tests/__pycache__/compression.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/conditional_ace_assembler.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/conditional_ace_bytes.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/conditional_ace_claims.*.pyc %{python3_sitearch}/samba/tests/__pycache__/core.*.pyc %{python3_sitearch}/samba/tests/__pycache__/credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/cred_opt.*.pyc @@ -2957,6 +3034,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/gensec.*.pyc %{python3_sitearch}/samba/tests/__pycache__/get_opt.*.pyc %{python3_sitearch}/samba/tests/__pycache__/getdcname.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/gkdi.*.pyc %{python3_sitearch}/samba/tests/__pycache__/glue.*.pyc %{python3_sitearch}/samba/tests/__pycache__/gpo.*.pyc %{python3_sitearch}/samba/tests/__pycache__/gpo_member.*.pyc @@ -2977,7 +3055,6 @@ fi %{python3_sitearch}/samba/tests/__pycache__/libsmb-basic.*.pyc %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc %{python3_sitearch}/samba/tests/__pycache__/messaging.*.pyc -%{python3_sitearch}/samba/tests/__pycache__/ndr.*.pyc %{python3_sitearch}/samba/tests/__pycache__/netbios.*.pyc %{python3_sitearch}/samba/tests/__pycache__/netcmd.*.pyc %{python3_sitearch}/samba/tests/__pycache__/net_join_no_spnego.*.pyc @@ -3023,7 +3100,9 @@ fi %{python3_sitearch}/samba/tests/__pycache__/samdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/samdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/sddl.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/sddl_conditional_ace.*.pyc %{python3_sitearch}/samba/tests/__pycache__/security.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/security_descriptors.*.pyc %{python3_sitearch}/samba/tests/__pycache__/segfault.*.pyc %{python3_sitearch}/samba/tests/__pycache__/sid_strings.*.pyc %{python3_sitearch}/samba/tests/__pycache__/smb.*.pyc @@ -3039,6 +3118,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/strings.*.pyc %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc %{python3_sitearch}/samba/tests/__pycache__/tdb_util.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/token_factory.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovision.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovisionneeddc.*.pyc @@ -3062,16 +3142,19 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/bug13653.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/claims.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_dns.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_json.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/rpcd_witness_samba_only.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/samba_dnsupdate.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_basic.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_dfs_propagate_inherit.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_propagate_inhertance.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcacls_save_restore.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcontrol.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/smbcontrol_process.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/traffic_learner.*.pyc @@ -3079,16 +3162,19 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/traffic_summary.*.pyc %{python3_sitearch}/samba/tests/blackbox/bug13653.py %{python3_sitearch}/samba/tests/blackbox/check_output.py +%{python3_sitearch}/samba/tests/blackbox/claims.py %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py %{python3_sitearch}/samba/tests/blackbox/netads_dns.py %{python3_sitearch}/samba/tests/blackbox/netads_json.py +%{python3_sitearch}/samba/tests/blackbox/rpcd_witness_samba_only.py %{python3_sitearch}/samba/tests/blackbox/samba_dnsupdate.py %{python3_sitearch}/samba/tests/blackbox/smbcacls.py %{python3_sitearch}/samba/tests/blackbox/smbcacls_basic.py %{python3_sitearch}/samba/tests/blackbox/smbcacls_dfs_propagate_inherit.py %{python3_sitearch}/samba/tests/blackbox/smbcacls_propagate_inhertance.py +%{python3_sitearch}/samba/tests/blackbox/smbcacls_save_restore.py %{python3_sitearch}/samba/tests/blackbox/smbcontrol.py %{python3_sitearch}/samba/tests/blackbox/smbcontrol_process.py %{python3_sitearch}/samba/tests/blackbox/traffic_learner.py @@ -3097,6 +3183,9 @@ fi %{python3_sitearch}/samba/tests/common.py %{python3_sitearch}/samba/tests/compression.py %{python3_sitearch}/samba/tests/complex_expressions.py +%{python3_sitearch}/samba/tests/conditional_ace_assembler.py +%{python3_sitearch}/samba/tests/conditional_ace_bytes.py +%{python3_sitearch}/samba/tests/conditional_ace_claims.py %{python3_sitearch}/samba/tests/core.py %{python3_sitearch}/samba/tests/credentials.py %{python3_sitearch}/samba/tests/cred_opt.py @@ -3176,6 +3265,7 @@ fi %{python3_sitearch}/samba/tests/gensec.py %{python3_sitearch}/samba/tests/getdcname.py %{python3_sitearch}/samba/tests/get_opt.py +%{python3_sitearch}/samba/tests/gkdi.py %{python3_sitearch}/samba/tests/glue.py %{python3_sitearch}/samba/tests/gpo.py %{python3_sitearch}/samba/tests/gpo_member.py @@ -3205,14 +3295,17 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/claims_in_pac.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/claims_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/conditional_ace_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/device_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/gkdi_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/group_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgt_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc @@ -3223,6 +3316,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1_generated.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc @@ -3242,14 +3336,17 @@ fi %{python3_sitearch}/samba/tests/krb5/claims_in_pac.py %{python3_sitearch}/samba/tests/krb5/claims_tests.py %{python3_sitearch}/samba/tests/krb5/compatability_tests.py +%{python3_sitearch}/samba/tests/krb5/conditional_ace_tests.py %{python3_sitearch}/samba/tests/krb5/device_tests.py %{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py +%{python3_sitearch}/samba/tests/krb5/gkdi_tests.py %{python3_sitearch}/samba/tests/krb5/group_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py %{python3_sitearch}/samba/tests/krb5/kdc_tests.py %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py +%{python3_sitearch}/samba/tests/krb5/kdc_tgt_tests.py %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/lockout_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py @@ -3260,6 +3357,7 @@ fi %{python3_sitearch}/samba/tests/krb5/raw_testcase.py %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py +%{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1_generated.py %{python3_sitearch}/samba/tests/krb5/rodc_tests.py %{python3_sitearch}/samba/tests/krb5/simple_tests.py %{python3_sitearch}/samba/tests/krb5/test_idmap_nss.py @@ -3284,7 +3382,14 @@ fi %{python3_sitearch}/samba/tests/logfiles.py %{python3_sitearch}/samba/tests/lsa_string.py %{python3_sitearch}/samba/tests/messaging.py -%{python3_sitearch}/samba/tests/ndr.py +%dir %{python3_sitearch}/samba/tests/ndr +%{python3_sitearch}/samba/tests/ndr/gkdi.py +%{python3_sitearch}/samba/tests/ndr/gmsa.py +%dir %{python3_sitearch}/samba/tests/ndr/__pycache__ +%{python3_sitearch}/samba/tests/ndr/__pycache__/gkdi.*.pyc +%{python3_sitearch}/samba/tests/ndr/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/tests/ndr/__pycache__/wbint.*.pyc +%{python3_sitearch}/samba/tests/ndr/wbint.py %{python3_sitearch}/samba/tests/netbios.py %{python3_sitearch}/samba/tests/netcmd.py %{python3_sitearch}/samba/tests/net_join_no_spnego.py @@ -3336,7 +3441,6 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/contact.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/demote.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dnscmd.*.pyc -%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_policy.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_silo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_claim.*.pyc @@ -3362,10 +3466,15 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_userPassword_crypt.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/rodc.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/silo_base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/sites.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/timecmd.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_auth_policy.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_auth_silo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_check_password_script.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_get_kerberos_ticket.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_getpassword_gmsa.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/user_virtualCryptSHA_gpg.*.pyc @@ -3378,7 +3487,6 @@ fi %{python3_sitearch}/samba/tests/samba_tool/contact.py %{python3_sitearch}/samba/tests/samba_tool/demote.py %{python3_sitearch}/samba/tests/samba_tool/dnscmd.py -%{python3_sitearch}/samba/tests/samba_tool/domain_auth_base.py %{python3_sitearch}/samba/tests/samba_tool/domain_auth_policy.py %{python3_sitearch}/samba/tests/samba_tool/domain_auth_silo.py %{python3_sitearch}/samba/tests/samba_tool/domain_claim.py @@ -3404,10 +3512,15 @@ fi %{python3_sitearch}/samba/tests/samba_tool/provision_userPassword_crypt.py %{python3_sitearch}/samba/tests/samba_tool/rodc.py %{python3_sitearch}/samba/tests/samba_tool/schema.py +%{python3_sitearch}/samba/tests/samba_tool/silo_base.py %{python3_sitearch}/samba/tests/samba_tool/sites.py %{python3_sitearch}/samba/tests/samba_tool/timecmd.py %{python3_sitearch}/samba/tests/samba_tool/user.py +%{python3_sitearch}/samba/tests/samba_tool/user_auth_policy.py +%{python3_sitearch}/samba/tests/samba_tool/user_auth_silo.py %{python3_sitearch}/samba/tests/samba_tool/user_check_password_script.py +%{python3_sitearch}/samba/tests/samba_tool/user_get_kerberos_ticket.py +%{python3_sitearch}/samba/tests/samba_tool/user_getpassword_gmsa.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_base.py %{python3_sitearch}/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py @@ -3418,7 +3531,9 @@ fi %{python3_sitearch}/samba/tests/samdb.py %{python3_sitearch}/samba/tests/samdb_api.py %{python3_sitearch}/samba/tests/sddl.py +%{python3_sitearch}/samba/tests/sddl_conditional_ace.py %{python3_sitearch}/samba/tests/security.py +%{python3_sitearch}/samba/tests/security_descriptors.py %{python3_sitearch}/samba/tests/segfault.py %{python3_sitearch}/samba/tests/sid_strings.py %{python3_sitearch}/samba/tests/smb.py @@ -3434,6 +3549,7 @@ fi %{python3_sitearch}/samba/tests/strings.py %{python3_sitearch}/samba/tests/subunitrun.py %{python3_sitearch}/samba/tests/tdb_util.py +%{python3_sitearch}/samba/tests/token_factory.py %{python3_sitearch}/samba/tests/upgrade.py %{python3_sitearch}/samba/tests/upgradeprovision.py %{python3_sitearch}/samba/tests/upgradeprovisionneeddc.py @@ -3464,9 +3580,9 @@ fi ### TEST-LIBS %files test-libs %if %{with dc} || %{with testsuite} -%{_libdir}/samba/libdlz-bind9-for-torture-samba4.so +%{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so %else -%{_libdir}/samba/libdsdb-module-samba4.so +%{_libdir}/samba/libdsdb-module-private-samba.so %endif ### USERSHARES @@ -3479,8 +3595,8 @@ fi %files winbind %{_libdir}/samba/idmap %{_libdir}/samba/nss_info -%{_libdir}/samba/libnss-info-samba4.so -%{_libdir}/samba/libidmap-samba4.so +%{_libdir}/samba/libnss-info-private-samba.so +%{_libdir}/samba/libidmap-private-samba.so %{_sbindir}/winbindd %{_sysusersdir}/samba-winbind.conf %attr(750,root,wbpriv) %dir /var/lib/samba/winbindd_privileged @@ -4471,6 +4587,9 @@ fi %endif %changelog +* Mon Jan 29 2024 Guenther Deschner - 4.20.0rc1-1 +- resolves: #2260895 - Update to version 4.20.0rc1 + * Sat Jan 27 2024 Fedora Release Engineering - 2:4.19.4-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index ed14bdd..a412569 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.19.4.tar.xz) = 3d2899e4a3b8bcb77befc29c4af66d3ac858b7f7a0dbbb66a8bc210cd88d9cde3e11361334a5cce650318473134ec8b134148bfa4af4d51f555de33eff395029 -SHA512 (samba-4.19.4.tar.asc) = 11bc51407d1464339817d7568f5d5bb059c19a05b49c6a1307d7425d289acb617ecd3e633e3736bdaa94947a7b3630d6cdb7ed6fe59d52556234c549eca8172a +SHA512 (samba-4.20.0rc1.tar.xz) = aec30327572403ab1a8fccd0e702da3939e57120a99dfadfb0b81cf997abf40a004dd682da81ea7284909e7e321db2ead6c397d654b2cff853dc9758ba5bbd52 +SHA512 (samba-4.20.0rc1.tar.asc) = 15e5c4be7eca42ffff0d3b98ab73e57b0a095f43848907a46c16a238c4a1d0d634f6a8cfb0d9c012fd7aa53052b9cdcbba19293a5d75d37f58da9f8b185ea615 From cd3cf3831b22b47aa07e563469b64d8437679afc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 1 Feb 2024 07:59:36 +0100 Subject: [PATCH 172/295] Fix typo Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index e55167e..b973fb1 100644 --- a/samba.spec +++ b/samba.spec @@ -1657,7 +1657,7 @@ fi %{_sbindir}/nmbd %{_sbindir}/smbd %if %{with dc} || %{with testsuite} -# This is only used by vfs_dfs_samba-private +# This is only used by vfs_dfs_samba4 %{_libdir}/samba/libdfs-server-ad-private-samba.so %endif %dir %{_libdir}/samba/auth From 885a433df05b4f0b0ba2df53954ebd187664d414 Mon Sep 17 00:00:00 2001 From: Pete Walter Date: Thu, 1 Feb 2024 11:15:57 +0000 Subject: [PATCH 173/295] Rebuild for ICU 74 --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index b973fb1..bd2361d 100644 --- a/samba.spec +++ b/samba.spec @@ -147,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 1 +%global baserelease 2 # This should be rc1 or %%nil %global pre_release rc1 @@ -4587,6 +4587,9 @@ fi %endif %changelog +* Thu Feb 01 2024 Pete Walter - 2:4.20.0-0.2.rc1 +- Rebuild for ICU 74 + * Mon Jan 29 2024 Guenther Deschner - 4.20.0rc1-1 - resolves: #2260895 - Update to version 4.20.0rc1 From 691752e56b4fdb9ed25bb852ccf9f9f336aa1c5e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 9 Feb 2024 09:27:06 +0100 Subject: [PATCH 174/295] Require cepces >= 0.3.8 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index bd2361d..2bea379 100644 --- a/samba.spec +++ b/samba.spec @@ -362,7 +362,7 @@ BuildRequires: python3-etcd %endif %if %{with gpupdate} -BuildRequires: cepces +BuildRequires: cepces >= 0.3.8 %endif # pidl requirements From 86c73e995b99fa5f36f5ea42c0e73dc8940ad157 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 9 Feb 2024 09:29:46 +0100 Subject: [PATCH 175/295] The AES crypto code has been removed We use GnuTLS for everything now. --- samba.spec | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 2bea379..9d25bad 100644 --- a/samba.spec +++ b/samba.spec @@ -1222,10 +1222,8 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - %endif %autosetup -n samba-%{version}%{pre_release} -p1 -# Ensure we rely on GnuTLS and do not build any other crypto code shipping with -# the sources. -rm -rf third_party/{aesni-intel,heimdal} -rm -f lib/crypto/{aes,rijndael}*.c +# Make sure we do not build with heimdal code +rm -rfv third_party/heimdal %build %if %{with includelibs} From 3a7dad4a24b041084f570dc533f769f9af7c69fb Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 9 Feb 2024 16:32:58 +0100 Subject: [PATCH 176/295] Require cepces-certmonger This is the package providing cepces-submit required by samba-gpupdate. It will install all the other required packages. --- samba.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 9d25bad..82db994 100644 --- a/samba.spec +++ b/samba.spec @@ -362,7 +362,7 @@ BuildRequires: python3-etcd %endif %if %{with gpupdate} -BuildRequires: cepces >= 0.3.8 +BuildRequires: cepces-certmonger >= 0.3.8 %endif # pidl requirements @@ -732,7 +732,6 @@ Samba VFS module for GlusterFS integration. %if %{with gpupdate} %package gpupdate Summary: Samba GPO support for clients -Requires: cepces Requires: cepces-certmonger Requires: certmonger Requires: %{name}-ldb-ldap-modules = %{samba_depver} From 9a35124520905271d85148c5234f870a01bf5ea6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 12 Feb 2024 15:25:15 +0100 Subject: [PATCH 177/295] Update to version 4.20.0rc2 resolves: #2263874 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 9a1363f..e9a49b4 100644 --- a/.gitignore +++ b/.gitignore @@ -357,3 +357,5 @@ samba-3.6.0pre1.tar.gz /samba-4.19.4.tar.asc /samba-4.20.0rc1.tar.xz /samba-4.20.0rc1.tar.asc +/samba-4.20.0rc2.tar.xz +/samba-4.20.0rc2.tar.asc diff --git a/samba.spec b/samba.spec index 82db994..fba5f6b 100644 --- a/samba.spec +++ b/samba.spec @@ -147,9 +147,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 2 +%global baserelease 3 # This should be rc1 or %%nil -%global pre_release rc1 +%global pre_release rc2 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -1814,6 +1814,7 @@ fi %{_mandir}/man1/smbget.1* %{_mandir}/man1/smbtar.1* %{_mandir}/man1/smbtree.1* +%{_mandir}/man1/wspsearch.1* %{_mandir}/man7/traffic_learner.7.* %{_mandir}/man7/traffic_replay.7.* %{_mandir}/man8/cifsdd.8.* @@ -4584,6 +4585,9 @@ fi %endif %changelog +* Mon Feb 12 2024 Guenther Deschner - 4.20.0rc2-3 +- resolves: #2263874 - Update to version 4.20.0rc2 + * Thu Feb 01 2024 Pete Walter - 2:4.20.0-0.2.rc1 - Rebuild for ICU 74 diff --git a/sources b/sources index a412569..8acf952 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.0rc1.tar.xz) = aec30327572403ab1a8fccd0e702da3939e57120a99dfadfb0b81cf997abf40a004dd682da81ea7284909e7e321db2ead6c397d654b2cff853dc9758ba5bbd52 -SHA512 (samba-4.20.0rc1.tar.asc) = 15e5c4be7eca42ffff0d3b98ab73e57b0a095f43848907a46c16a238c4a1d0d634f6a8cfb0d9c012fd7aa53052b9cdcbba19293a5d75d37f58da9f8b185ea615 +SHA512 (samba-4.20.0rc2.tar.xz) = 787fd7fcffcff4a6722c07c0e853c48121dd031ff401a2f9c6faae1e4a378f217cb2d1a7c4dc6eed220597516a1878b802996f88e4156a2c0e7c924b90234123 +SHA512 (samba-4.20.0rc2.tar.asc) = 97e6d6af3b5ae17119206fb89135875496f66c38dfbd5c62882cbc87dfa70b48b96f2b0b64d32956fa64f1e76108a0e790aa602e4dee5731117e9a27874e2dcb From 81028e3aa95658623fa2bcbb545e21597d9331f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 26 Feb 2024 12:53:11 +0100 Subject: [PATCH 178/295] Update to version 4.20.0rc3 resolves: #2266039 Guenther --- .gitignore | 2 ++ samba.spec | 8 ++++++-- sources | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index e9a49b4..cc41ee4 100644 --- a/.gitignore +++ b/.gitignore @@ -359,3 +359,5 @@ samba-3.6.0pre1.tar.gz /samba-4.20.0rc1.tar.asc /samba-4.20.0rc2.tar.xz /samba-4.20.0rc2.tar.asc +/samba-4.20.0rc3.tar.xz +/samba-4.20.0rc3.tar.asc diff --git a/samba.spec b/samba.spec index fba5f6b..c28c81f 100644 --- a/samba.spec +++ b/samba.spec @@ -147,9 +147,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 3 +%global baserelease 4 # This should be rc1 or %%nil -%global pre_release rc2 +%global pre_release rc3 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -3726,6 +3726,7 @@ fi %{_datadir}/ctdb/events/legacy/31.clamd.script %{_datadir}/ctdb/events/legacy/40.vsftpd.script %{_datadir}/ctdb/events/legacy/41.httpd.script +%{_datadir}/ctdb/events/legacy/47.samba-dcerpcd.script %{_datadir}/ctdb/events/legacy/48.netbios.script %{_datadir}/ctdb/events/legacy/49.winbind.script %{_datadir}/ctdb/events/legacy/50.samba.script @@ -4585,6 +4586,9 @@ fi %endif %changelog +* Mon Feb 26 2024 Guenther Deschner - 4.20.0rc3-4 +- resolves: #2266039 - Update to version 4.20.0rc3 + * Mon Feb 12 2024 Guenther Deschner - 4.20.0rc2-3 - resolves: #2263874 - Update to version 4.20.0rc2 diff --git a/sources b/sources index 8acf952..a7e977a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.0rc2.tar.xz) = 787fd7fcffcff4a6722c07c0e853c48121dd031ff401a2f9c6faae1e4a378f217cb2d1a7c4dc6eed220597516a1878b802996f88e4156a2c0e7c924b90234123 -SHA512 (samba-4.20.0rc2.tar.asc) = 97e6d6af3b5ae17119206fb89135875496f66c38dfbd5c62882cbc87dfa70b48b96f2b0b64d32956fa64f1e76108a0e790aa602e4dee5731117e9a27874e2dcb +SHA512 (samba-4.20.0rc3.tar.xz) = 0268bb96e3aed0e639b82e87d823c11040139e7b62d0e9482dd09190f3e89945f31c0a4ad512f8d9741cda5e038bb3aab2d511e4f56b3667ab0d8a465f767ddc +SHA512 (samba-4.20.0rc3.tar.asc) = 3b65768562239455b0c4df5a3ae2a94ffdc7d9e8003d07d5d51760beb1e62fc0c51421687fd082cf072ad995ef46a937b76326d80e731ab5ae836659d3c8d5bd From 8fa9d9ff95c9cc0764fe6dce2b2369078771a2e0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 5 Mar 2024 13:54:33 +0100 Subject: [PATCH 179/295] Silence warnings when upgrading libwbclient --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index c28c81f..cfa8a53 100644 --- a/samba.spec +++ b/samba.spec @@ -1584,9 +1584,9 @@ fi %if %{with libwbclient} %pre -n libwbclient if [ $1 -gt 1 ] ; then - rm -rf %{_libdir}/samba/wbclient/ - rm -f /etc/alternatives/libwbclient.so* - rm -f /var/lib/alternatives/libwbclient.so* + rm -rf %{_libdir}/samba/wbclient/ 2>/dev/null + rm -f /etc/alternatives/libwbclient.so* 2>/dev/null + rm -f /var/lib/alternatives/libwbclient.so* 2>/dev/null fi %{?ldconfig} #endif {with libwbclient} From 05916b6f9c054887756847a157152115fcc91481 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 11 Mar 2024 18:39:03 +0100 Subject: [PATCH 180/295] Update to version 4.20.0rc4 resolves: #2269037 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index cc41ee4..7ac496a 100644 --- a/.gitignore +++ b/.gitignore @@ -361,3 +361,5 @@ samba-3.6.0pre1.tar.gz /samba-4.20.0rc2.tar.asc /samba-4.20.0rc3.tar.xz /samba-4.20.0rc3.tar.asc +/samba-4.20.0rc4.tar.xz +/samba-4.20.0rc4.tar.asc diff --git a/samba.spec b/samba.spec index cfa8a53..92cedc5 100644 --- a/samba.spec +++ b/samba.spec @@ -147,9 +147,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 4 +%global baserelease 5 # This should be rc1 or %%nil -%global pre_release rc3 +%global pre_release rc4 %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4586,6 +4586,9 @@ fi %endif %changelog +* Mon Mar 11 2024 Guenther Deschner - 4.20.0rc4-5 +- resolves: #2269037 - Update to version 4.20.0rc4 + * Mon Feb 26 2024 Guenther Deschner - 4.20.0rc3-4 - resolves: #2266039 - Update to version 4.20.0rc3 diff --git a/sources b/sources index a7e977a..baa2190 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.0rc3.tar.xz) = 0268bb96e3aed0e639b82e87d823c11040139e7b62d0e9482dd09190f3e89945f31c0a4ad512f8d9741cda5e038bb3aab2d511e4f56b3667ab0d8a465f767ddc -SHA512 (samba-4.20.0rc3.tar.asc) = 3b65768562239455b0c4df5a3ae2a94ffdc7d9e8003d07d5d51760beb1e62fc0c51421687fd082cf072ad995ef46a937b76326d80e731ab5ae836659d3c8d5bd +SHA512 (samba-4.20.0rc4.tar.xz) = c4f7e36a88ec7021277ceb5d68ef7d3a01dd4bfe1301441172751903e8c998bc8ed7ca7684524c7ae5f925aa7382c0ff89badf738be9fcccf714ee3b5c38026f +SHA512 (samba-4.20.0rc4.tar.asc) = 2344e451ffc13f5173a611ccb9babd72bd954581417dbbefe47c2bda36ec99db040bf5e74508f99335b43b2e1ab96ca690dbac3da0c5fe3fef872c789192797f From eccf82df8a11503db4a56bc4eb15bb0f0d828162 Mon Sep 17 00:00:00 2001 From: David Abdurachmanov Date: Thu, 11 Jan 2024 12:26:29 +0200 Subject: [PATCH 181/295] Add support for riscv64 Signed-off-by: David Abdurachmanov --- samba.spec | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/samba.spec b/samba.spec index 92cedc5..1d24fa0 100644 --- a/samba.spec +++ b/samba.spec @@ -57,7 +57,7 @@ # ppc64le excluded pending resolution of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 #%%ifarch aarch64 ppc64le s390x x86_64 -%ifarch aarch64 s390x x86_64 +%ifarch aarch64 s390x x86_64 riscv64 %bcond_without vfs_cephfs %bcond_without ceph_mutex %else @@ -80,7 +80,7 @@ %if 0%{?fedora} -%ifarch aarch64 ppc64le s390x x86_64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond_without vfs_glusterfs %else %bcond_with vfs_glusterfs @@ -109,7 +109,7 @@ # Build vfs_io_uring module by default on 64bit Fedora %if 0%{?fedora} || 0%{?rhel} >= 8 -%ifarch aarch64 ppc64le s390x x86_64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond_without vfs_io_uring %else %bcond_with vfs_io_uring @@ -332,7 +332,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch i686 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 BuildRequires: mold %endif @@ -1272,7 +1272,7 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" # Use the mold linker if possible export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -%ifnarch i686 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" From a5c93245d3dcfed1a9c51811279d56cabdcf3c46 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 12 Mar 2024 20:39:26 +0000 Subject: [PATCH 182/295] Bump and rebuild package (for riscv64) --- samba.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 1d24fa0..ace1d28 100644 --- a/samba.spec +++ b/samba.spec @@ -147,7 +147,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 5 +%global baserelease 6 # This should be rc1 or %%nil %global pre_release rc4 @@ -4586,6 +4586,9 @@ fi %endif %changelog +* Tue Mar 12 2024 Richard W.M. Jones - 2:4.20.0-0.6.rc4 +- Bump and rebuild package (for riscv64) + * Mon Mar 11 2024 Guenther Deschner - 4.20.0rc4-5 - resolves: #2269037 - Update to version 4.20.0rc4 From 129e39f982f572af1919eb0f0b3ab5080cfb17e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 27 Mar 2024 19:02:19 +0100 Subject: [PATCH 183/295] Update to version 4.20.0 resolves: #2271916 Guenther --- .gitignore | 2 ++ samba.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 7ac496a..78d239a 100644 --- a/.gitignore +++ b/.gitignore @@ -363,3 +363,5 @@ samba-3.6.0pre1.tar.gz /samba-4.20.0rc3.tar.asc /samba-4.20.0rc4.tar.xz /samba-4.20.0rc4.tar.asc +/samba-4.20.0.tar.xz +/samba-4.20.0.tar.asc diff --git a/samba.spec b/samba.spec index ace1d28..cf7e67b 100644 --- a/samba.spec +++ b/samba.spec @@ -147,9 +147,9 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.0 -%global baserelease 6 +%global baserelease 7 # This should be rc1 or %%nil -%global pre_release rc4 +%global pre_release %nil %global samba_release %{baserelease} %if "x%{?pre_release}" != "x" @@ -4586,6 +4586,9 @@ fi %endif %changelog +* Wed Mar 27 2024 Guenther Deschner - 4.20.0-7 +- resolves: #2271916 - Update to version 4.20.0 + * Tue Mar 12 2024 Richard W.M. Jones - 2:4.20.0-0.6.rc4 - Bump and rebuild package (for riscv64) diff --git a/sources b/sources index baa2190..bb5e796 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.0rc4.tar.xz) = c4f7e36a88ec7021277ceb5d68ef7d3a01dd4bfe1301441172751903e8c998bc8ed7ca7684524c7ae5f925aa7382c0ff89badf738be9fcccf714ee3b5c38026f -SHA512 (samba-4.20.0rc4.tar.asc) = 2344e451ffc13f5173a611ccb9babd72bd954581417dbbefe47c2bda36ec99db040bf5e74508f99335b43b2e1ab96ca690dbac3da0c5fe3fef872c789192797f +SHA512 (samba-4.20.0.tar.xz) = af706b95fbf0f690b1ca6f97c704fa2ab994617c1b94b16c9e83cfba72d6d1e020f1e2225d658629f97bdc3500f91aacfed417605d4806f38eab54ee5999e6af +SHA512 (samba-4.20.0.tar.asc) = e435c68b276e06a469cf8f9a275c6d09987c17b2e42fc0ac8dd74420073bc644598ece464721c71d20d99b4e5d6ec0bdbfa85d45ee46415d25806b336dc4278c From a194b836ce22677e4b8f9b9f69d6798ee798ae44 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 30 Apr 2024 15:56:01 +0200 Subject: [PATCH 184/295] rpminspect.yaml: update badfuncs with new library names --- rpminspect.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rpminspect.yaml b/rpminspect.yaml index 4c2edfa..75d7856 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -5,8 +5,8 @@ badfuncs: - /usr/bin/smbtorture - /usr/lib*/libndr.so.* - /usr/lib*/libsmbconf.so.* - - /usr/lib*/samba/libgse-samba4.so - - /usr/lib*/samba/libsamba-sockets-samba4.so + - /usr/lib*/samba/libgse-private-samba.so + - /usr/lib*/samba/libsamba-sockets-private-samba.so - /usr/lib*/samba/service/nbtd.so - /usr/libexec/ctdb/smnotify - /usr/sbin/nmbd From 058c9e46a835f08b4fc623007a8870cbd39180e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 9 May 2024 17:28:42 +0200 Subject: [PATCH 185/295] Update to version 4.20.1 resolves: #2279780 Guenther --- .gitignore | 2 ++ samba.spec | 15 +++++++++++++-- sources | 4 ++-- 3 files changed, 17 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 78d239a..fd0792f 100644 --- a/.gitignore +++ b/.gitignore @@ -365,3 +365,5 @@ samba-3.6.0pre1.tar.gz /samba-4.20.0rc4.tar.asc /samba-4.20.0.tar.xz /samba-4.20.0.tar.asc +/samba-4.20.1.tar.xz +/samba-4.20.1.tar.asc diff --git a/samba.spec b/samba.spec index cf7e67b..72558fd 100644 --- a/samba.spec +++ b/samba.spec @@ -146,8 +146,8 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.20.0 -%global baserelease 7 +%global samba_version 4.20.1 +%global baserelease 1 # This should be rc1 or %%nil %global pre_release %nil @@ -1512,14 +1512,17 @@ export WINBINDD_DONT_LOG_STDOUT=1 %endif %post +%systemd_post samba-bgqd.service %systemd_post smb.service %systemd_post nmb.service %preun +%systemd_preun samba-bgqd.service %systemd_preun smb.service %systemd_preun nmb.service %postun +%systemd_postun_with_restart samba-bgqd.service %systemd_postun_with_restart smb.service %systemd_postun_with_restart nmb.service @@ -1717,6 +1720,7 @@ fi %{_unitdir}/nmb.service %{_unitdir}/smb.service +%{_unitdir}/samba-bgqd.service %dir %{_sysconfdir}/openldap/schema %config %{_sysconfdir}/openldap/schema/samba.schema %config(noreplace) %{_sysconfdir}/pam.d/samba @@ -3142,6 +3146,8 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/claims.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/http_chunk.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/http_content.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_dns.*.pyc @@ -3162,6 +3168,8 @@ fi %{python3_sitearch}/samba/tests/blackbox/check_output.py %{python3_sitearch}/samba/tests/blackbox/claims.py %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py +%{python3_sitearch}/samba/tests/blackbox/http_chunk.py +%{python3_sitearch}/samba/tests/blackbox/http_content.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py %{python3_sitearch}/samba/tests/blackbox/netads_dns.py @@ -4586,6 +4594,9 @@ fi %endif %changelog +* Wed May 08 2024 Guenther Deschner - 4.20.1-1 +- resolves: #2279780 - Update to version 4.20.1 + * Wed Mar 27 2024 Guenther Deschner - 4.20.0-7 - resolves: #2271916 - Update to version 4.20.0 diff --git a/sources b/sources index bb5e796..cfeeed8 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.0.tar.xz) = af706b95fbf0f690b1ca6f97c704fa2ab994617c1b94b16c9e83cfba72d6d1e020f1e2225d658629f97bdc3500f91aacfed417605d4806f38eab54ee5999e6af -SHA512 (samba-4.20.0.tar.asc) = e435c68b276e06a469cf8f9a275c6d09987c17b2e42fc0ac8dd74420073bc644598ece464721c71d20d99b4e5d6ec0bdbfa85d45ee46415d25806b336dc4278c +SHA512 (samba-4.20.1.tar.xz) = 7cef945833516b305a2eb6bd4717cc4e8d895575e6dcf7a47d80fa1859847adeb4a9f32814bafdd5c732ce63d793ca168b7f4e0bdda89c56f10d1595ea45b5c0 +SHA512 (samba-4.20.1.tar.asc) = 5ce9f0e4358c1ff5ce991204aaf72e1dfe431ba2686d12f1668b15c7b48247666ecbf6354acbadbcf5e77e657ef93bc07fab0ff7ed7b8a7588f5bcc7bf6facef From 857301aa5c1f05db69eb9452d23f98d149110798 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 21 May 2024 14:12:37 +0200 Subject: [PATCH 186/295] Convert to %autorelease and %autochangelog [skip changelog] --- changelog | 3039 +++++++++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 3055 +--------------------------------------------------- 2 files changed, 3048 insertions(+), 3046 deletions(-) create mode 100644 changelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..680c54c --- /dev/null +++ b/changelog @@ -0,0 +1,3039 @@ +* Wed May 08 2024 Guenther Deschner - 4.20.1-1 +- resolves: #2279780 - Update to version 4.20.1 + +* Wed Mar 27 2024 Guenther Deschner - 4.20.0-7 +- resolves: #2271916 - Update to version 4.20.0 + +* Tue Mar 12 2024 Richard W.M. Jones - 2:4.20.0-0.6.rc4 +- Bump and rebuild package (for riscv64) + +* Mon Mar 11 2024 Guenther Deschner - 4.20.0rc4-5 +- resolves: #2269037 - Update to version 4.20.0rc4 + +* Mon Feb 26 2024 Guenther Deschner - 4.20.0rc3-4 +- resolves: #2266039 - Update to version 4.20.0rc3 + +* Mon Feb 12 2024 Guenther Deschner - 4.20.0rc2-3 +- resolves: #2263874 - Update to version 4.20.0rc2 + +* Thu Feb 01 2024 Pete Walter - 2:4.20.0-0.2.rc1 +- Rebuild for ICU 74 + +* Mon Jan 29 2024 Guenther Deschner - 4.20.0rc1-1 +- resolves: #2260895 - Update to version 4.20.0rc1 + +* Sat Jan 27 2024 Fedora Release Engineering - 2:4.19.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Tue Jan 16 2024 Andreas Schneider - 4.29.4-3 +- Fix samba-gpupdate on Fedora/RHEL + +* Tue Jan 09 2024 Andreas Schneider - 4.19.4-2 +- resolves: rhbz#2256326 - Create all groups using systemd + +* Mon Jan 08 2024 Guenther Deschner - 4.19.4-1 +- resolves: #2257287 - Update to version 4.19.4 + +* Tue Nov 28 2023 Guenther Deschner - 4.19.3-2 +- Disable performance co-pilot support for i686 + +* Mon Nov 27 2023 Guenther Deschner - 4.19.3-1 +- resolves: #2251766 - Update to version 4.19.3 + +* Wed Nov 15 2023 Andreas Schneider - 4.19.2-2 +- Package samba-gpupdate also for RHEL9 + +* Mon Oct 16 2023 Guenther Deschner - 4.19.2-1 +- resolves: #2244496 - Update to version 4.19.2 + +* Tue Oct 10 2023 Guenther Deschner - 4.19.1-1 +- resolves: #2243073 - Update to version 4.19.1 +- resolves: #2241881, #2243228: Security fix for CVE-2023-3961 +- resolves: #2241882, #2243231: Security fix for CVE-2023-4091 +- resolves: #2241883, #2243230: Security fix for CVE-2023-4154 +- resolves: #2241884, #2243229: Security fix for CVE-2023-42669 +- resolves: #2241885, #2243232: Security fix for CVE-2023-42670 + +* Mon Sep 04 2023 Guenther Deschner - 4.19.0-1 +- resolves: #2237259 - Update to version 4.19.0 + +* Mon Aug 28 2023 Guenther Deschner - 4.19.0-0.5.rc4 +- resolves: #2232744 - Update to version 4.19.0rc4 + +* Fri Aug 18 2023 Guenther Deschner - 4.19.0-0.4.rc3 +- resolves: #2232744 - Update to version 4.19.0rc3 + +* Wed Aug 16 2023 Yaakov Selkowitz - 2:4.19.0-0.3.rc2 +- Move ad-claims and authn-policy-util to dc-libs + +* Tue Aug 15 2023 Adam Williamson - 4.19.0-0.2.rc2 +- python3-samba-dc requires python3-markdown now + +* Tue Aug 08 2023 Guenther Deschner - 4.19.0-0.1.rc2 +- resolves: #2227246 - Update to version 4.19.0rc2 + +* Mon Aug 07 2023 Guenther Deschner - 4.19.0-0.0.rc1 +- resolves: #2227246 - Update to version 4.19.0rc1 + +* Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 +- resolves: #2224040 - Update to version 4.18.5 +- resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 +- resolves: #2222792, #2224255 - Security fix for CVE-2023-3347 +- resolves: #2222793, #2224253 - Security fix for CVE-2023-34966 +- resolves: #2222794, #2224252 - Security fix for CVE-2023-34967 +- resolves: #2222795, #2224250 - Security fix for CVE-2023-34968 + +* Sat Jul 15 2023 Guenther Deschner - 4.18.4-3 +- resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling + +* Tue Jul 11 2023 František Zatloukal - 2:4.18.4-2 +- Rebuilt for ICU 73.2 + +* Wed Jul 05 2023 Python Maint - 2:4.18.4-1 +- Rebuilt for Python 3.12 + +* Wed Jul 05 2023 Guenther Deschner - 4.18.4-0 +- resolves: #2219799 - Update to version 4.18.4 + +* Mon Jun 26 2023 Python Maint - 2:4.18.3-5 +- Rebuilt for Python 3.12 + +* Mon Jun 26 2023 Adam Williamson - 4.18.3-4 +- Only run libwbclient %pre on upgrade, not fresh install + +* Fri Jun 23 2023 Andreas Schneider - 4.18.3-3 +- resolves: rhbz#2211577 - Fix libwbclient package upgrades + +* Thu Jun 15 2023 Python Maint - 2:4.18.3-2 +- Rebuilt for Python 3.12 + +* Thu Jun 15 2023 Andreas Schneider - 4.18.3-1 +- resolves: #2203539 - Also cover mit_kdc.log by logrotate + +* Thu Jun 01 2023 Guenther Deschner - 4.18.3-0 +- resolves: #2211453 - Update to version 4.18.3 + +* Wed Apr 19 2023 Guenther Deschner - 4.18.2-0 +- resolves: #2187991 - Update to version 4.18.2 + +* Wed Mar 29 2023 Guenther Deschner - 4.18.1-0 +- resolves: #2182787 - Update to version 4.18.1 +- resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 +- resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 +- resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 + +* Tue Mar 21 2023 Andreas Schneider - 4.18.0-12 +- Fix ctdb file lists when built with test suite enabled + +* Fri Mar 17 2023 Kalev Lember - 4.18.0-10 +- Move libstable-sort-samba4.so to samba-client-libs subpackage + +* Wed Mar 08 2023 Guenther Deschner - 4.18.0-9 +- resolves: #2176469 - Update to version 4.18.0 + +* Wed Mar 01 2023 Guenther Deschner - 4.18.0rc4-8 +- resolves: #2174415 - Update to version 4.18.0rc4 + +* Tue Feb 28 2023 Andreas Schneider - 4.18.0-0.7.rc3 +- resolves: #2173619 - Add missing Requires for glibc-gconv-extra + +* Thu Feb 23 2023 Pavel Filipenský - 4.18.0-0.6.rc3 +- SPDX migration + +* Wed Feb 15 2023 Guenther Deschner - 4.18.0rc3-6 +- resolves: #2166416 - Update to version 4.18.0rc3 + +* Mon Feb 13 2023 Pavel Filipenský - 4.18.0rc2-5 +- Create package samba-tools, move there samba-tool binary + +* Thu Feb 02 2023 Guenther Deschner - 4.18.0rc2-3 +- resolves: #2166416 - Update to version 4.18.0rc2 + +* Sat Jan 21 2023 Fedora Release Engineering - 2:4.18.0-0.2.rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1-0 +- resolves: #2162097 - Update to version 4.18.0rc1 + +* Sat Dec 31 2022 Pete Walter - 2:4.17.4-4 +- Rebuild for ICU 72 + +* Thu Dec 22 2022 Pavel Filipenský - 4.17.4-3 +- Create package dc-libs also for 'non-dc build' + +* Tue Dec 20 2022 Pavel Filipenský - 4.17.4-2 +- Fix '--without dc' build: delete libauth4-samba4.so + +* Mon Dec 19 2022 Pavel Filipenský - 4.17.4-1 +- Create a samba-dcerpc sub-package +- Fix package installation without samba and samba-dc package + +* Fri Dec 16 2022 Guenther Deschner - 4.17.4-0 +- resolves: #2153906 - Update to version 4.17.4 +- resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 +- resolves: #2154303, #2154304 - Security fixes for CVE-2022-37966 +- resolves: #2154320, #2154322 - Security fixes for CVE-2022-37967 + +* Thu Dec 1 2022 Alexander Bokovoy - 2:4.17.3-2 +- Rebuild against krb5 1.20.1, new KDB interface + +* Mon Nov 21 2022 Florian Weimer - 2:4.17.3-1 +- Remove C89-specific language constructs from configure checks +- Fix feature detection for major/minor macros + +* Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 +- resolves: #2142959 - Update to version 4.17.3 +- resolves: #2140960, #2143117 - Security fixes for CVE-2022-42898 + +* Wed Nov 02 2022 Pavel Filipenský - 4.17.2-1 +- Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional + +* Tue Oct 25 2022 Andreas Schneider - 4.17.2-1 +- Update to version 4.17.2 +- Fix CVE-2022-3592: A malicious client can use a symlink to escape the + exported + +* Mon Oct 24 2022 Andreas Schneider - 4.17.1-2 +- Add missing dependency for wbinfo used by ctdb scripts + +* Wed Oct 19 2022 Pavel Filipenský - 4.17.1-1 +- Update to version 4.17.1 +- resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists +- resolves: rhbz#2133818 - rpcclient 4.17.0 unable to resolve server hostname + +* Wed Oct 05 2022 Andreas Schneider - 4.17.0-2 +- Move group creation logic to sysusers.d fragment + +* Tue Sep 13 2022 Andreas Schneider - 4.17.0-1 +- resolves: rhbz#2118818 - Update to version 4.17.0 +- resolves: rhbz#2121138 - Fix CVE-2022-32743 +- resolves: rhbz#2122650 - Fix CVE-2022-1615 + +* Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 +- resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages +- resolves: rhbz#2096405 - Add samba-usershare package + +* Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 +- resolves: #2118818 - Update to version 4.17.0rc5 + +* Wed Aug 31 2022 Guenther Deschner - 4.17.0-0.9.rc4 +- resolves: #2118818 - Update to version 4.17.0rc4 + +* Thu Aug 25 2022 Adam Williamson - 4.17.0-0.8.rc3 +- Rebuild with no changes to fix F37 update grouping + +* Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.7.rc3 +- python3-samba package should not require the samba package + +* Tue Aug 23 2022 Pavel Filipenský - 4.17.0-0.6.rc3 +- resolves: #2118818 - Update to version 4.17.0rc3 + +* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.5.rc2 +- Create a samba-gpupdate sub-package for GPO client support + +* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.4.rc2 +- Split out a samba-ldb-ldap-modules subpackage + +* Thu Aug 18 2022 Kalev Lember - 2:4.17.0-0.3.rc2 +- Avoid requiring systemd as per updated packaging guidelines + +* Wed Aug 17 2022 Guenther Deschner - 4.17.0rc2-2 +- resolves: #2118818 - Update to version 4.17.0rc2 + +* Wed Aug 10 2022 Andreas Schneider - 4.17.0rc1-1 +- Make sure we detect if SO version numbers of public libraries change. + +* Mon Aug 08 2022 Guenther Deschner - 4.17.0rc1-0 +- resolves: #2116503 - Update to version 4.17.0rc1 + +* Mon Aug 01 2022 Frantisek Zatloukal - 2:4.16.4-1 +- Rebuilt for ICU 71.1 + +* Wed Jul 27 2022 Guenther Deschner - 4.16.4-0 +- resolves: #2111490 - Update to version 4.16.4 +- resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 +- resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744 +- resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745 +- resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746 + +* Sat Jul 23 2022 Fedora Release Engineering - 2:4.16.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon Jul 18 2022 Andreas Schneider - 4.16.3-1 +- Update to version 4.16.3 + +* Wed Jun 15 2022 Python Maint - 2:4.16.2-1 +- Rebuilt for Python 3.11 + +* Mon Jun 13 2022 Guenther Deschner - 4.16.2-0 +- Update to Samba 4.16.2 +- resolves: #2096167 + +* Wed Jun 08 2022 Andreas Schneider - 4.16.1-7 +- resolves: rhbz#2093833 - Remove weak dependency for logrotate for CentOS/RHEL + +* Tue May 31 2022 Jitka Plesnikova - 2:4.16.1-6 +- Perl 5.36 rebuild + +* Fri May 13 2022 Pavel Filipenský - 4.16.1-5 +- Fix rpminspect abidiff + +* Fri May 06 2022 Pavel Filipenský - 4.16.1-2 +- Update requires for packages + +* Thu May 05 2022 Tomas Popela - 4.16.1-1 +- Don't require full systemd for tmp files handling in samba-common + +* Mon May 02 2022 Pavel Filipenský - 4.16.1-0 +- Update to Samba 4.16.1 +- resolves: #2080915 + +* Fri Mar 25 2022 Sandro Mani - 2:4.16.0-7 +- Rebuild with mingw-gcc-12 + +* Tue Mar 22 2022 Guenther Deschner - 4.16.0-6 +- Update to Samba 4.16.0 +- resolves: #2066290 + +* Wed Mar 09 2022 Guenther Deschner - 4.16.0-0.5.rc5 +- Update to Samba 4.16.0rc5 +- resolves: #2042518 + +* Tue Mar 01 2022 Pavel Filipenský - 4.16.0-0.4.rc4 +- Update to Samba 4.16.0rc4 +- resolves: #2042518 + +* Wed Feb 23 2022 Andreas Schneider - 4.16.0-0.3.rc3 +- resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc + +* Tue Feb 15 2022 Pavel Filipenský - 4.16.0rc3 +- Update to Samba 4.16.0rc3 +- resolves: #2042518 + +* Tue Feb 01 2022 Pavel Filipenský - 4.16.0rc2 +- Update to Samba 4.16.0rc2 +- resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 +- resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142 +- resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336 +- resolves: #2042518 + +* Wed Jan 26 2022 Pavel Filipenský - 4.16.0rc1 +- Exclude temporarily ceph on ppc64le to fix failing build + +* Tue Jan 25 2022 Pavel Filipenský - 4.16.0rc1 +- Update to Samba 4.16.0rc1 +- resolves: #2042518 + +* Thu Jan 20 2022 Pavel Filipenský - 4.15.4-0 +- Update to Samba 4.15.4 +- resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 +- resolves: #2042518 + +* Wed Dec 15 2021 Pavel Filipenský - 4.15.3-1 +- Fix resolv_wrapper with glibc 2.34 +- resolves: #2019669 + +* Wed Dec 08 2021 Pavel Filipenský - 4.15.3-0 +- Update to Samba 4.15.3 +- resolves: #2030382 + +* Sat Nov 13 2021 Guenther Deschner - 4.15.2-3 +- Fix IPA DC schannel support + +* Thu Nov 11 2021 Guenther Deschner - 4.15.2-2 +- Fix winbind trusted domain regression +- related: #2021716 +- Fix logfile handling +- Fix smbclient -N failures in container setups + +* Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 +- Update to Samba 4.15.2 +- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 +- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 +- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 +- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 +- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 +- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 +- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 +- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 +- resolves: #2021625 + +* Fri Nov 05 2021 Guenther Deschner - 4.15.1-1 +- Fix winexe core dump +- resolves: #2020376 + +* Wed Oct 27 2021 Guenther Deschner - 4.15.1-0 +- Update to Samba 4.15.1 +- resolves: #2017847 + +* Mon Sep 20 2021 Guenther Deschner - 4.15.0-13 +- Update to Samba 4.15.0 +- resolves: #2005817 + +* Mon Sep 13 2021 Guenther Deschner - 4.15.0-0.12.rc7 +- Update to Samba 4.15.0rc7 +- resolves: #2003740 + +* Thu Sep 09 2021 Guenther Deschner - 4.15.0-0.11.rc6 +- Update to Samba 4.15.0rc6 +- resolves: #2002546 + +* Tue Sep 07 2021 Guenther Deschner - 4.15.0-0.10.rc5 +- Update to Samba 4.15.0rc5 +- resolves: #2001827 + +* Wed Sep 01 2021 Guenther Deschner - 4.15.0-0.9.rc4 +- Update to Samba 4.15.0rc4 +- resolves: #2000079 + +* Thu Aug 26 2021 Guenther Deschner - 4.15.0-0.8.rc3 +- Update to Samba 4.15.0rc3 +- resolves: #1998024 + +* Wed Aug 25 2021 Guenther Deschner - 4.15.0-0.7.rc2 +- Add ceph and etcd mutex helpers for CTDB + +* Mon Aug 16 2021 Anoop C S - 4.15.0-0.6.rc2 +- Avoid removing PyDSDB library files from buildroot for non AD DC build + +* Fri Aug 13 2021 Adam Williamson - 4.15.0-0.5.rc2 +- Fix samba-common-tools dependency + +* Thu Aug 12 2021 Andreas Schneider - 4.15.0-0.4.rc2 +- Package samba-tool correctly + +* Mon Aug 09 2021 Guenther Deschner - 4.15.0-0.3.rc2 +- Update to Samba 4.15.0rc2 +- resolves: #1991634 + +* Fri Jul 23 2021 Fedora Release Engineering - 2:4.15.0-0.2.rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Mon Jul 19 2021 Guenther Deschner - 4.15.0rc1-1 +- Fix ctdb-pcp-pmda install +- resolves: #1983369 + +* Thu Jul 15 2021 Guenther Deschner - 4.15.0rc1-0 +- Update to Samba 4.15.0rc1 +- resolves: #1982623 + +* Wed Jul 14 2021 Guenther Deschner - 4.14.6-1 +- Build with pcp-pmda support by default on Fedora +- resolves: #1552276 + +* Tue Jul 13 2021 Guenther Deschner - 4.14.6-0 +- Update to Samba 4.14.6 +- resolves: #1981764 + +* Thu Jun 24 2021 Andreas Schneider - 4.14.5-3 +- Create a subpackage for vfs-io-uring + +* Fri Jun 04 2021 Python Maint - 2:4.14.5-1 +- Rebuilt for Python 3.10 + +* Tue Jun 01 2021 Guenther Deschner - 4.14.5-0 +- Update to Samba 4.14.5 +- resolves: #1966456 + +* Fri May 21 2021 Jitka Plesnikova - 2:4.14.4-3 +- Perl 5.34 rebuild + +* Wed May 19 2021 Pete Walter - 2:4.14.4-2 +- Rebuild for ICU 69 + +* Tue May 18 2021 Andreas Schneider - 4.14.4-1 +- Fixed building with gcc 11.x +- Fixed quota support + +* Thu Apr 29 2021 Guenther Deschner - 4.14.4-0 +- Update to Samba 4.14.4 +- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 +- resolves: #1955011 + +* Wed Apr 28 2021 Anoop C S - 4.14.3-2 +- resolves: #1954263 - wrong conditional build check of AD DC + +* Tue Apr 20 2021 Andreas Schneider - 4.14.3-1 +- resolves: #1942378 - Drop NIS support + +* Tue Apr 20 2021 Guenther Deschner - 4.14.3-0 +- Update to Samba 4.14.3 +- resolves: #1951531 + +* Mon Apr 19 2021 Michal Ambroz - 4.14.2-4 + - Added python3-ldb to BR + +* Mon Apr 19 2021 Andreas Schneider - 4.12.2-3 +- resolves: #1949295 - Remove findsmb script + +* Wed Apr 14 2021 Richard W.M. Jones - 2:4.14.2-2 +- Rebuild for updated liburing. + +* Wed Apr 07 2021 Alexander Bokovoy - 4.14.2-1 +- Fix memory leaks in RPC server +- resolves: #1946950 + +* Thu Mar 25 2021 Guenther Deschner - 4.14.2-0 +- Update to Samba 4.14.2 +- related: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- related: #1941402, #1942497 - Security fixes for CVE-2021-20277 + +* Wed Mar 24 2021 Guenther Deschner - 4.14.1-0 +- Update to Samba 4.14.1 +- resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 +- resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 + +* Tue Mar 09 2021 Guenther Deschner - 4.14.0-3 +- Update to Samba 4.14.0 + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2:4.14.0-0.0.rc4.2 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Mon Mar 01 2021 Guenther Deschner - 4.14.0rc4-0 +- Update to Samba 4.14.0rc4 + +* Thu Feb 18 2021 Guenther Deschner - 4.14.0rc3-0 +- Update to Samba 4.14.0rc3 + +* Thu Feb 04 2021 Guenther Deschner - 4.14.0rc2-0 +- Update to Samba 4.14.0rc2 + +* Wed Jan 27 2021 Guenther Deschner - 4.14.0rc1-0 +- Update to Samba 4.14.0rc1 + +* Tue Jan 26 2021 Guenther Deschner - 4.13.4-0 +- Update to Samba 4.13.4 + +* Wed Dec 16 2020 Guenther Deschner - 4.13.3-1 +- Rebuild against krb5-1.19 +- Resolves: rhbz#1915928 + +* Tue Dec 15 2020 Guenther Deschner - 4.13.3-0 +- Update to Samba 4.13.3 + +* Wed Nov 25 2020 Alexander Bokovoy - 4.13.2-2 +- rhbz#1892745, rhbz#1900232: smbclient mget crashes (upstream bug 14517) +- Merge RHEL 8.4 patches: + - FIPS-related enhancements + - FreeIPA Global Catalog patches + +* Tue Nov 03 2020 Andreas Schneider - 4.13.2-1 +- Create a python3-samba-devel package to avoid unnessary dependencies + +* Tue Nov 03 2020 Guenther Deschner - 4.13.2-0 +- Update to Samba 4.13.2 + +* Thu Oct 29 2020 Guenther Deschner - 4.13.1-0 +- Update to Samba 4.13.1 +- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 +- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 +- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 + +* Mon Oct 26 2020 Andreas Schneider - 4.13.0-14 +- Fixed dbcheck running in a release tarball +- Updated internal resolv_wrapper copy to verison 1.1.7 + +* Sun Oct 25 2020 Alexander Bokovoy - 4.13.0-13 +- Report 'samba' daemon status back to systemd +- Support dnspython 2.0.0 or later in samba_dnsupdate + +* Thu Oct 22 2020 Alexander Bokovoy - 4.13.0-12 +- Add preliminary support for S4U operations in Samba AD DC + resolves: #1836630 - Samba DC: Remote Desktop cannot access files +- Fix lookup_unix_user_name to allow lookup of realm-qualified users and groups + required for upcoming FreeIPA Global Catalog support + +* Tue Sep 22 2020 Guenther Deschner - 4.13.0-11 +- Update to Samba 4.13.0 + +* Fri Sep 18 2020 Guenther Deschner - 4.13.0rc6-10 +- Update to Samba 4.13.0rc6 +- resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 + +* Wed Sep 16 2020 Guenther Deschner - 4.13.0rc5-9 +- Update to Samba 4.13.0rc5 + +* Mon Sep 07 2020 Guenther Deschner - 4.13.0rc4-8 +- Update to Samba 4.13.0rc4 + +* Fri Aug 28 2020 Neal Gompa - 4.13.0rc3-6 +- Enable winexe by default everywhere + +* Fri Aug 28 2020 Guenther Deschner - 4.13.0rc3-5 +- Update to Samba 4.13.0rc3 + +* Fri Aug 14 2020 Guenther Deschner - 4.13.0rc2-4 +- Update to Samba 4.13.0rc2 + +* Wed Aug 12 2020 Andreas Schneider - 4.13.0rc1-3 +- resolves: #1865831 - Add missing /usr/lib64/samba/krb5 directory +- resolves: #1866989 - Remove obsolete python3-crypto dependency + +* Wed Jul 29 2020 Fedora Release Engineering - 2:4.13.0-0.2.rc1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 14 2020 Tom Stellard - 2:4.13.0-0.2.rc1 +- Use make macros + https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + +* Tue Jul 14 2020 Andreas Schneider - 4.13.0rc1-1 +- Move mdssvc data files to correct package + +* Thu Jul 09 2020 Guenther Deschner - 4.13.0rc1-0 +- Update to Samba 4.13.0rc1 + +* Wed Jul 08 2020 Merlin Mathesius - 4.12.5-1 +- Remove nonexistent --without-winexe option from configure + +* Thu Jul 02 2020 Guenther Deschner - 4.12.5-0 +- Update to Samba 4.12.5 + +* Thu Jul 02 2020 Guenther Deschner - 4.12.4-0 +- Update to Samba 4.12.4 +- resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 +- resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 +- resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 +- resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 + +* Sat Jun 27 2020 Jitka Plesnikova - 2:4.12.3-1.1 +- Perl 5.32 re-rebuild updated packages + +* Thu Jun 25 2020 Guenther Deschner - 4.12.3-1 +- Add BuildRequires for python3-setuptools + +* Thu Jun 25 2020 Jitka Plesnikova - 2:4.12.3-0.4 +- Perl 5.32 rebuild + +* Tue May 26 2020 Miro Hrončok - 2:4.12.3-0.3 +- Rebuilt for Python 3.9 + +* Tue May 19 2020 Guenther Deschner - 4.12.3-0 +- Update to Samba 4.12.3 + +* Fri May 15 2020 Pete Walter - 2:4.12.2-1.2 +- Rebuild for ICU 67 + +* Wed May 13 2020 Guenther Deschner - 4.12.2-1 +- Add support for building the new experimental io_uring VFS module + +* Tue Apr 28 2020 Guenther Deschner - 4.12.2-0 +- Update to Samba 4.12.2 +- resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 +- resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 + +* Sun Apr 12 2020 Alexander Bokovoy - 4.12.1-1 +- Revert POSIX stat tuning in libsmbclient +- Resolves: rhbz#1801442 + +* Tue Apr 07 2020 Guenther Deschner - 4.12.1-0 +- Update to Samba 4.12.1 + +* Sat Mar 21 2020 Alexander Bokovoy - 4.12.0-6 +- Fix samba_requires_eq macro definition +- Resolves rhbz#1815739 + +* Tue Mar 10 2020 Guenther Deschner - 4.12.0-5 +- Add build requirement for perl-FindBin +- resolves: #1661213 - Add winexe subpackage for remote windows command execution + +* Tue Mar 03 2020 Guenther Deschner - 4.12.0-3 +- Update to Samba 4.12.0 + +* Wed Feb 26 2020 Guenther Deschner - 4.12.0rc4-2 +- Update to Samba 4.12.0rc4 + +* Wed Feb 19 2020 Guenther Deschner - 4.12.0rc3-2 +- Update to Samba 4.12.0rc3 + +* Tue Feb 04 2020 Guenther Deschner - 4.12.0rc2-2 +- Update to Samba 4.12.0rc2 + +* Thu Jan 30 2020 Fedora Release Engineering - 2:4.12.0-0.1.rc1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Fri Jan 24 2020 Alexander Bokovoy - 4.12.0.rc1-1 +- Allow building against krb5 1.18 beta and require it for Rawhide + +* Wed Jan 22 2020 Guenther Deschner - 4.12.0rc1-0 +- Update to Samba 4.12.0rc1 + +* Tue Jan 21 2020 Guenther Deschner - 4.11.5-0 +- Update to Samba 4.11.5 +- resolves: #1791201, #1793405 - Security fixes for CVE-2019-14902 +- resolves: #1791207, #1793407 - Security fixes for CVE-2019-14907 +- resolves: #1791204, #1793406 - Security fixes for CVE-2019-19344 + +* Mon Dec 16 2019 Guenther Deschner - 4.11.4-0 +- Update to Samba 4.11.4 + +* Tue Dec 10 2019 Guenther Deschner - 4.11.3-0 +- Update to Samba 4.11.3 +- resolves: #1778586, #1781542 - Security fixes for CVE-2019-14861 +- resolves: #1778589, #1781545 - Security fixes for CVE-2019-14870 + +* Thu Dec 05 2019 Andreas Schneider - 4.11.2-2 +- Restart winbindd on samba-winbind package upgrade + +* Wed Nov 06 2019 Alexander Bokovoy - 4.11.2-1 +- Update DES removal patch + +* Tue Oct 29 2019 Guenther Deschner - 4.11.2-0 +- Update to Samba 4.11.2 +- resolves: #1763137, #1766558 - Security fixes for CVE-2019-10218 +- resolves: #1764126, #1766559 - Security fixes for CVE-2019-14833 + +* Sun Oct 27 2019 Alexander Bokovoy - 4.11.1-1 +- resolves: #1757071 - Deploy new samba DC fails + +* Fri Oct 18 2019 Guenther Deschner - 4.11.1-0 +- Update to Samba 4.11.1 + +* Tue Sep 17 2019 Guenther Deschner - 4.11.0-3 +- Update to Samba 4.11.0 + +* Wed Sep 11 2019 Guenther Deschner - 4.11.0rc4-2 +- Update to Samba 4.11.0rc4 + +* Tue Sep 03 2019 Guenther Deschner - 4.11.0rc3-2 +- Update to Samba 4.11.0rc3 +- resolves: #1746225, #1748308 - Security fixes for CVE-2019-10197 + +* Tue Aug 27 2019 Guenther Deschner - 4.11.0rc2-2 +- resolves: #1746014 - re-add pidl + +* Mon Aug 26 2019 Lubomir Rintel - 2:4.11.0-0.1.rc2 +- Move the NetworkManager dispatcher script out of /etc + +* Wed Aug 21 2019 Guenther Deschner - 4.11.0rc2-0 +- Update to Samba 4.11.0rc2 + +* Tue Aug 20 2019 Guenther Deschner - 4.11.0rc1-0 +- Update to Samba 4.11.0rc1 + +* Mon Aug 19 2019 Miro Hrončok - 2:4.10.6-1.1 +- Rebuilt for Python 3.8 + +* Fri Aug 16 2019 Alexander Bokovoy - 2:4.10.6-1 +- Fix Samba bug https://bugzilla.samba.org/show_bug.cgi?id=14091 +- Fixes: Windows systems cannot resolve IPA users and groups over LSA RPC + +* Fri Jul 26 2019 Fedora Release Engineering - 2:4.10.6-0.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon Jul 08 2019 Guenther Deschner - 4.10.6-0 +- Update to Samba 4.10.6 + +* Mon Jul 01 2019 Guenther Deschner - 4.10.5-2 +- resolves: #1718113 - Avoid deprecated time.clock in wafsamba +- resolves: #1711638 - Update to latest waf version 2.0.17 + +* Thu Jun 20 2019 Guenther Deschner - 4.10.5-1 +- resolves: #1602824 - Make vfs_fruit operable with other remote VFS modules +- resolves: #1716455 - Avoid pathconf() in get_real_filename() VFS calls +- resolves: #1706090, #1700791 - Fix smbspool + +* Wed Jun 19 2019 Guenther Deschner - 4.10.5-0 +- Update to Samba 4.10.5 +- resolves: #1711816, #1721872 - Security fixes for CVE-2019-12435 +- resolves: #1711837, #1721873 - Security fixes for CVE-2019-12436 + +* Fri May 31 2019 Jitka Plesnikova - 2:4.10.4-1.1 +- Perl 5.30 rebuild + +* Tue May 28 2019 Guenther Deschner - 4.10.4-1 +- Add missing ctdb directories +- resolves: #1656777 + +* Wed May 22 2019 Guenther Deschner - 4.10.4-0 +- Update to Samba 4.10.4 + +* Tue May 14 2019 Guenther Deschner - 4.10.3-0 +- Update to Samba 4.10.3 +- resolves: #1705877, #1709679 - Security fixes for CVE-2018-16860 + +* Mon Apr 15 2019 Andreas Schneider - 4.10.2-1 +- resolves: #1699230 - Rebuild for MIT Kerberos soname bump of libkadm5srv + +* Mon Apr 08 2019 Guenther Deschner - 4.10.2-0 +- Update to Samba 4.10.2 +- resolves: #1689010, #1697718 - Security fixes for CVE-2019-3870 +- resolves: #1691518, #1697717 - Security fixes for CVE-2019-3880 + +* Wed Apr 03 2019 Guenther Deschner - 4.10.1-0 +- Update to Samba 4.10.1 + +* Mon Mar 25 2019 Andreas Schneider - 4.10.0-6 +- resolves: #1692347 - Add missing DC requirement for its python3 tools + +* Wed Mar 20 2019 Guenther Deschner - 4.10.0-5 +- Fix build failure (duplication during install) + +* Tue Mar 19 2019 Guenther Deschner - 4.10.0-4 +- Update to Samba 4.10.0 + +* Wed Mar 06 2019 Guenther Deschner - 4.10.0rc4-2 +- Update to Samba 4.10.0rc4 + +* Fri Feb 22 2019 Guenther Deschner - 4.10.0rc3-2 +- Update to Samba 4.10.0rc3 + +* Sun Feb 17 2019 Igor Gnatenko - 2:4.10.0-0.2.rc2.1 +- Rebuild for readline 8.0 + +* Thu Feb 14 2019 Andreas Schneider - 4.10.0rc2-2 +- resolves: #1672231 - Fix public NDR API + +* Tue Feb 12 2019 Guenther Deschner - 4.10.0rc2-1 +- resolves: #1674547 - Move samba.xattr modules out of python3 test package + +* Wed Feb 06 2019 Guenther Deschner - 4.10.0rc2-0 +- Update to Samba 4.10.0rc2 + +* Tue Jan 15 2019 Guenther Deschner - 4.10.0rc1-0 +- Update to Samba 4.10.0rc1 + +* Mon Jan 14 2019 Björn Esser - 2:4.9.4-0.1 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Thu Dec 20 2018 Guenther Deschner - 4.9.4-0 +- Update to Samba 4.9.4 + +* Tue Nov 27 2018 Guenther Deschner - 4.9.3-0 +- Update to Samba 4.9.3 +- resolves: #1625449, #1654078 - Security fixes for CVE-2018-14629 +- resolves: #1642545, #1654082 - Security fixes for CVE-2018-16841 +- resolves: #1646377, #1654091 - Security fixes for CVE-2018-16851 +- resolves: #1646386, #1654092 - Security fixes for CVE-2018-16852 +- resolves: #1647246, #1654093 - Security fixes for CVE-2018-16853 +- resolves: #1649278, #1654095 - Security fixes for CVE-2018-16857 + +* Thu Nov 08 2018 Guenther Deschner - 4.9.2-0 +- Update to Samba 4.9.2 + +* Wed Sep 26 2018 Alexander Bokovoy - 4.9.1-2 +- Package ctdb/doc/examples + +* Mon Sep 24 2018 Andreas Schneider - 4.9.1-1 +- Update to Samba 4.9.1 + +* Thu Sep 13 2018 Guenther Deschner - 4.9.0-4 +- Update to Samba 4.9.0 + +* Thu Sep 06 2018 Andreas Schneider - 4.9.0rc5-3 +- Update to Samba 4.9.0rc5 + +* Wed Aug 29 2018 Guenther Deschner - 4.9.0rc4-3 +- Update to Samba 4.9.0rc4 + +* Thu Aug 16 2018 Andreas Schneider - 4.9.0rc3-3 +- Fix python3 packaging + +* Wed Aug 15 2018 Guenther Deschner - 4.9.0rc3-2 +- Update to Samba 4.9.0rc3 +- resolves: #1589651, #1617916 - Security fixes for CVE-2018-1139 +- resolves: #1580230, #1618613 - Security fixes for CVE-2018-1140 +- resolves: #1612805, #1618697 - Security fixes for CVE-2018-10858 +- resolves: #1610640, #1617910 - Security fixes for CVE-2018-10918 +- resolves: #1610645, #1617911 - Security fixes for CVE-2018-10919 + +* Wed Aug 01 2018 Andreas Schneider - 4.9.0rc2-2 +- Add some spec file cleanups + +* Wed Aug 01 2018 Guenther Deschner - 4.9.0rc2-0 +- Update to Samba 4.9.0rc2 + +* Thu Jul 12 2018 Guenther Deschner - 4.9.0rc1-0 +- Update to Samba 4.9.0rc1 + +* Thu Jul 12 2018 Alexander Bokovoy - 2:4.8.3-4.1 +- Scope to local __bss_start symbol (typo in a patch) +- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 + +* Thu Jul 12 2018 Alexander Bokovoy - 2:4.8.3-4 +- Change scope to local for symbols automatically added by upcoming binutils 2.31 +- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 + +* Wed Jul 11 2018 Alexander Bokovoy - 2:4.8.3-3 +- Rebuild Samba against binutils 2.30.90-2.fc29 +- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 +- Add explicit BuildRequires for gcc + +* Fri Jul 06 2018 Petr Pisar +- Perl 5.28 rebuild + +* Thu Jul 05 2018 Alexander Bokovoy - 2:4.8.3-2 +- Fix rawhide build by explicitly using /usr/bin/python2 + +* Tue Jul 03 2018 Petr Pisar +- Perl 5.28 rebuild + +* Mon Jul 02 2018 Miro Hrončok - 2:4.8.3-1.2 +- Rebuilt for Python 3.7 + +* Thu Jun 28 2018 Jitka Plesnikova - 2:4.8.3-1.1 +- Perl 5.28 rebuild + +* Tue Jun 26 2018 Andreas Schneider - 4.8.3-1 +- Update to Samba 4.8.3 +- Remove python(2|3)-subunit dependency + +* Tue Jun 19 2018 Miro Hrončok - 2:4.8.2-1.1 +- Rebuilt for Python 3.7 + +* Wed May 16 2018 Guenther Deschner - 4.8.2-0 +- Update to Samba 4.8.2 + +* Wed May 09 2018 Andreas Schneider - 4.8.1-1 +- resolves: #1574177 - Fix smbspool command line argument handling + +* Thu Apr 26 2018 Guenther Deschner - 4.8.1-0 +- Update to Samba 4.8.1 + +* Wed Mar 14 2018 Guenther Deschner - 4.8.0-7 +- resolves: #1554754, #1554756 - Security fixes for CVE-2018-1050 CVE-2018-1057 +- resolves: #1555112 - Update to Samba 4.8.0 + +* Tue Mar 13 2018 Andreas Schneider - 4.8.0rc4-6 +- resolves: #1552652 - Fix usage of nc in ctdb tests and only recommned it + +* Fri Mar 02 2018 Guenther Deschner - 4.8.0rc4-5 +- Update to Samba 4.8.0rc4 + +* Mon Feb 12 2018 Guenther Deschner - 4.8.0rc3-4 +- Update to Samba 4.8.0rc3 + +* Fri Feb 09 2018 Igor Gnatenko - 2:4.8.0-0.3.rc2.1 +- Escape macros in %%changelog + +* Fri Jan 26 2018 Guenther Deschner - 4.8.0rc2-3 +- Update to Samba 4.8.0rc2 + +* Sun Jan 21 2018 Björn Esser - 2:4.8.0-0.2.rc1 +- Explicitly BR: rpcsvc-proto-devel + +* Sat Jan 20 2018 Björn Esser - 2:4.8.0-0.1.rc1.1 +- Rebuilt for switch to libxcrypt + +* Mon Jan 15 2018 Guenther Deschner - 4.8.0rc1-1 +- Update to Samba 4.8.0rc1 + +* Mon Jan 08 2018 Andreas Schneider - 4.7.4-1 +- resolves: #1508092 - Add missing dependency for tdbbackup + +* Mon Dec 25 2017 Guenther Deschner - 4.7.4-0 +- Update to Samba 4.7.4 + +* Mon Dec 04 2017 Andreas Schneider - 4.7.3-3 +- resolves: #1520163 - Link libaesni-intel-samba4.so with -z noexecstack + +* Thu Nov 30 2017 Andreas Schneider - 4.7.3-2 +- Fix deamon startup with systemd + +* Thu Nov 23 2017 Bastien Nocera - 4.7.3-1 +- Enable AES acceleration on Intel compatible CPUs by default + +* Tue Nov 21 2017 Guenther Deschner - 4.7.3-0 +- Update to Samba 4.7.3 +- resolves: #1515692 - Security fix for CVE-2017-14746 and CVE-2017-15275 + +* Wed Nov 15 2017 Guenther Deschner - 4.7.2-0 +- resolves: #1513452 - Update to Samba 4.7.2 + +* Mon Nov 13 2017 Andreas Schneider - 4.7.1-2 +- Fix release number + +* Tue Nov 07 2017 Igor Gnatenko - 4.7.1-1 +- Remove old crufty coreutils requires + +* Thu Nov 02 2017 Guenther Deschner - 4.7.1-0 +- resolves: #1508871 - Update to Samba 4.7.1 + +* Mon Oct 30 2017 Alexander Bokovoy - 4.7.0-18 +- Force samba-dc to use the same libldb version as LDB modules compiled +- resolves: #1507420 - LDB / Samba module version mismatch + +* Fri Oct 27 2017 Andreas Schneider - 4.7.0-17 +- Move dsdb libs to python2-samba-dc + +* Thu Oct 26 2017 Andreas Schneider - 4.7.0-16 +- Create python[2|3]-samba-dc packages + +* Wed Oct 25 2017 Andreas Schneider - 4.7.0-15 +- related: #1499140 - Fix several dependency issues +- Fix building with MIT Kerberos 1.16 + +* Fri Oct 13 2017 Andreas Schneider - 4.7.0-14 +- resolves: #1499140 - Move libdfs-server-ad to the correct subpackage + +* Fri Oct 06 2017 Alexander Bokovoy - 4.7.0-13 +- Move /usr/lib{64,}/samba/libdsdb-garbage-collect-tombstones-samba4.so to samba-dc-libs +- Rebuild in rawhide against new krb5 1.16 and docbook-xml + +* Thu Sep 21 2017 Guenther Deschner - 4.7.0-12 +- Update to Samba 4.7.0 +- resolves: #1493441 - Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163 + +* Sun Sep 17 2017 Guenther Deschner - 4.7.0-0.11.rc6 +- Update to Samba 4.7.0rc6 + +* Wed Sep 13 2017 Alexander Bokovoy - 4.7.0-0.11.rc5 +- resolves: #1491137 - dcerpc/__init__.py is not packaged for py3 + +* Tue Sep 12 2017 Andreas Schneider - 4.7.0-0.10.rc5 +- resolves: #1476175 - Create seperate package for bind_dlz module + +* Tue Aug 29 2017 Guenther Deschner - 4.7.0-0.9.rc5 +- Update to Samba 4.7.0rc5 + +* Tue Aug 08 2017 Andreas Schneider - 4.7.0-0.9.rc3 +- Add printadmin group for printer driver handling + +* Sun Jul 30 2017 Florian Weimer - 2:4.7.0-0.8.rc3.2 +- Rebuild with binutils fix for ppc64le (#1475636) + +* Thu Jul 27 2017 Fedora Release Engineering - 2:4.7.0-0.8.rc3.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Wed Jul 26 2017 Andreas Schneider - 4.7.0-0.8.rc3 +- resolves: #1301002 - Enable avahi support + +* Tue Jul 25 2017 Guenther Deschner - 4.7.0-0.7.rc3 +- Update to Samba 4.7.0rc3 + +* Mon Jul 24 2017 Andreas Schneider - 4.7.0-0.7.rc1 +- Rename samba-python to python2-samba +- Update build requirement for libcephfs + +* Thu Jul 20 2017 Alexander Bokovoy - 4.7.0-0.6.rc1 +- Use Python 2 explicitly for samba-tool and other Python-based tools +- Install samba.service as it is required for the AD DC case + +* Tue Jul 18 2017 Alexander Bokovoy - 4.7.0-0.5.rc1 +- Convert more rpc modules to python3 +- Explicitly specify Python artifacts in the spec to be able to catch unpackaged ones +- Split 'make test' Python code into separate python2-samba-test/python3-samba-test sub-packages +- Remove embedded python2-dns version, require python{2,3}-dns instead + +* Thu Jul 06 2017 Andreas Schneider - 4.7.0-0.4.rc1 +- Add python3 support +- Fix %%posttrans for libwbclient-devel + +* Thu Jul 06 2017 Andreas Schneider - 4.7.0-0.3.rc1 +- Do not install conflicting file _ldb_text.py + +* Wed Jul 05 2017 Andreas Schneider - 4.7.0-0.2.rc1 +- Fix requirement generation for shared libraries + +* Wed Jul 05 2017 Andreas Schneider - 4.7.0-0.1.rc1 +- Build Samba with Active Directory support! + +* Mon Jun 12 2017 Guenther Deschner - 4.7.0-0.0.rc1 +- Update to Samba 4.7.0rc1 + +* Mon Jun 12 2017 Guenther Deschner - 4.6.5-0 +- Update to Samba 4.6.5 + +* Sun Jun 04 2017 Jitka Plesnikova - 2:4.6.4-1.1 +- Perl 5.26 rebuild + +* Wed May 24 2017 Andreas Schneider - 4.6.4-1 +- #resolves: #1451486 - Add source tarball comment + +* Wed May 24 2017 Guenther Deschner - 4.6.4-0 +- Update to Samba 4.6.4 +- resolves: #1455050 - Security fix for CVE-2017-7494 + +* Tue Apr 25 2017 Guenther Deschner - 4.6.3-0 +- Update to Samba 4.6.3 + +* Fri Mar 31 2017 Guenther Deschner - 4.6.2-0 +- Update to Samba 4.6.2 +- related: #1435156 - Security fix for CVE-2017-2619 + +* Thu Mar 23 2017 Guenther Deschner - 4.6.1-0 +- Update to Samba 4.6.1 +- resolves: #1435156 - Security fix for CVE-2017-2619 + +* Wed Mar 15 2017 Alexander Bokovoy - 4.6.0-4 +- Export arcfour_crypt_blob to Python as samba.crypto.arcfour_encrypt +- Makes possible to run trust to AD in FreeIPA in FIPS mode + +* Fri Mar 10 2017 Alexander Bokovoy - 4.6.0-3 +- auth/credentials: Always set the the realm if we set the principal from the ccache +- resolves: #1430761 - credentials_crb5: use gss_acquire_cred for client-side GSSAPI use case + +* Thu Mar 09 2017 Alexander Bokovoy - 4.6.0-2 +- resolves: #1430761 - credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case + +* Tue Mar 07 2017 Andreas Schneider - 4.6.0-1 +- Update to Samba 4.6.0 + +* Wed Mar 01 2017 Andreas Schneider - 4.6.0-0.3.rc4 +- Update to Samba 4.6.0rc4 + +* Tue Feb 14 2017 Andreas Schneider - 4.6.0-0.1.rc3 +- Update to Samba 4.6.0rc3 + +* Sat Feb 11 2017 Fedora Release Engineering - 4.6.0-0.1.rc2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Fri Jan 27 2017 Guenther Deschner - 4.6.0-0.1.rc2 +- Update to Samba 4.6.0rc2 + +* Thu Jan 12 2017 Andreas Schneider - 4.6.0-0.1.rc1 +- resolves: #1319098 - Add missing Requires for pre-required packages + +* Thu Jan 05 2017 Guenther Deschner - 4.6.0-0.1.rc1 +- Update to Samba 4.6.0rc1 + +* Mon Dec 19 2016 Guenther Deschner - 4.5.3-0 +- Update to Samba 4.5.3 +- resolves: #1405984 - CVE-2016-2123,CVE-2016-2125 and CVE-2016-2126 + +* Wed Dec 07 2016 Guenther Deschner - 4.5.2-0 +- Update to Samba 4.5.2 + +* Mon Dec 05 2016 Rex Dieter - - +- rebuild (libldb) + +* Fri Nov 04 2016 Anoop C S - 4.5.1-1 +- Fix glfs_realpath allocation in vfs_glusterfs + +* Wed Oct 26 2016 Guenther Deschner - 4.5.1-0 +- Update to Samba 4.5.1 + +* Mon Oct 17 2016 Andreas Schneider - 4.5.0-3 +- resolves: 1375973 - Fix tevent incompatibility issue + +* Wed Sep 14 2016 Guenther Deschner - 4.5.0-2 +- Fix smbspool alternatives handling during samba-client uninstall + +* Wed Sep 07 2016 Guenther Deschner - 4.5.0-1 +- Update to Samba 4.5.0 + +* Mon Aug 29 2016 Guenther Deschner - 4.5.0rc3-0 +- Update to Samba 4.5.0rc3 + +* Mon Aug 15 2016 Guenther Deschner - 4.5.0rc2-0 +- Update to Samba 4.5.0rc2 + +* Thu Jul 28 2016 Guenther Deschner - 4.5.0rc1-0 +- Update to Samba 4.5.0rc1 + +* Tue Jul 19 2016 Fedora Release Engineering - 2:4.4.5-1.1 +- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages + +* Thu Jul 07 2016 Guenther Deschner - 4.4.5-1 +- Update to Samba 4.4.5 +- resolves: #1353504 - CVE-2016-2119 + +* Thu Jun 23 2016 Guenther Deschner - 4.4.4-4 +- resolves: #1348899 - Import of samba.ntacls fails + +* Mon Jun 20 2016 Andreas Schneider - 4.4.4-3 +- resolves: #1337260 - Small fix to the example smb.conf file + +* Wed Jun 15 2016 Andreas Schneider - 4.4.4-2 +- Fix resolving trusted domain users on domain member + +* Tue Jun 07 2016 Guenther Deschner - 4.4.4-1 +- Update to Samba 4.4.4 +- resolves: #1343529 + +* Wed May 25 2016 Alexander Bokovoy - 2:4.4.3-2 +- Fix libsystemd patch (#1125086) so that it actually works + +* Mon May 23 2016 Zbigniew Jędrzejewski-Szmek - 2:4.4.3-1.2 +- Rebuild to drop libsystemd-daemon dependency (#1125086) + +* Sun May 15 2016 Jitka Plesnikova - 2:4.4.3-1.1 +- Perl 5.24 rebuild + +* Mon May 02 2016 Guenther Deschner - 4.4.3-1 +- Update to Samba 4.4.3 +- resolves: #1332178 + +* Tue Apr 12 2016 Guenther Deschner - 4.4.2-1 +- Update to Samba 4.4.2, fix badlock security bug +- resolves: #1326453 - CVE-2015-5370 +- resolves: #1326453 - CVE-2016-2110 +- resolves: #1326453 - CVE-2016-2111 +- resolves: #1326453 - CVE-2016-2112 +- resolves: #1326453 - CVE-2016-2113 +- resolves: #1326453 - CVE-2016-2114 +- resolves: #1326453 - CVE-2016-2115 +- resolves: #1326453 - CVE-2016-2118 + +* Tue Mar 22 2016 Guenther Deschner - 4.4.0-1 +- Update to Samba 4.4.0 + +* Wed Mar 16 2016 Guenther Deschner - 4.4.0-0.8.rc5 +- Update to Samba 4.4.0rc5 + +* Tue Mar 08 2016 Guenther Deschner - 4.4.0-0.7.rc4 +- Update to Samba 4.4.0rc4 +- resolves: #1315942 - CVE-2015-7560 Incorrect ACL get/set allowed on symlink path + +* Tue Feb 23 2016 Guenther Deschner - 4.4.0-0.6.rc3 +- Update to Samba 4.4.0rc3 + +* Wed Feb 17 2016 Guenther Deschner - 4.4.0-0.5.rc2 +- Activate multi channel support (switched off by default) + +* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.4.rc2 +- More spec file fixes +- resolves: #1306542 - scriptlet failure because of comments + +* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.3.rc2 +- More spec file fixes + +* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.2.rc2 +- More spec file fixes + +* Wed Feb 10 2016 Guenther Deschner - 4.4.0-0.1.rc2 +- Update to Samba 4.4.0rc2 + +* Thu Feb 04 2016 Fedora Release Engineering - 2:4.4.0-0.1.rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Wed Jan 27 2016 Guenther Deschner - 4.4.0-0.0.rc1 +- Update to Samba 4.4.0rc1 + +* Fri Jan 22 2016 Alexander Bokovoy - 4.3.4-1 +- resolves: #1300038 - PANIC: Bad talloc magic value - wrong talloc version used/mixed + +* Tue Jan 12 2016 Guenther Deschner - 4.3.4-0 +- resolves: #1261230 - Update to Samba 4.3.4 + +* Wed Dec 16 2015 Guenther Deschner - 4.3.3-0 +- Update to Samba 4.3.3 +- resolves: #1292069 +- CVE-2015-3223 Remote DoS in Samba (AD) LDAP server +- CVE-2015-5252 Insufficient symlink verification in smbd +- CVE-2015-5296 Samba client requesting encryption vulnerable to + downgrade attack +- CVE-2015-5299 Missing access control check in shadow copy code +- CVE-2015-7540 DoS to AD-DC due to insufficient checking of asn1 + memory allocation + +* Tue Dec 15 2015 Guenther Deschner - 4.3.2-2 +- revert dependencies to samba-common and -tools + +* Tue Dec 01 2015 Guenther Deschner - 4.3.2-1 +- resolves: #1261230 - Update to Samba 4.3.2 + +* Wed Nov 18 2015 Guenther Deschner - 4.3.1-3 +- resolves: #1282931 - Fix DCE/RPC bind nak parsing + +* Fri Oct 23 2015 Guenther Deschner - 4.3.1-2 +- Fix dependencies to samba-common + +* Tue Oct 20 2015 Guenther Deschner - 4.3.1-1 +- resolves: #1261230 - Update to Samba 4.3.1 + +* Mon Oct 12 2015 Guenther Deschner - 4.3.0-3 +- Use separate lockdir + +* Mon Oct 12 2015 Guenther Deschner - 4.3.0-2 +- resolves: #1270568 - Samba fails to start after update to 4.3.0 + +* Tue Sep 08 2015 Guenther Deschner - 4.3.0-1 +- resolves: #1088911 - Update to Samba 4.3.0 + +* Tue Sep 01 2015 Andreas Schneider - 4.3.0-0.1rc4 +- Update to Samba 4.3.0rc4 + +* Mon Aug 31 2015 Andreas Schneider - 4.3.0-0.1rc3 +- Update to Samba 4.3.0rc3 + +* Tue Jul 14 2015 Guenther Deschner - 4.2.3-0 +- resolves: #1088911 - Update to Samba 4.2.3 + +* Fri Jun 19 2015 Andreas Schneider - 4.2.2-1 +- resolves: #1227911 - Enable tar support for smbclient +- resolves: #1234908 - Own the /var/lib/samba directory +- Enable hardened build + +* Fri Jun 19 2015 Fedora Release Engineering - 2:4.2.2-0.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Thu Jun 04 2015 Jitka Plesnikova - 2:4.2.2-0.1 +- Perl 5.22 rebuild + +* Thu May 28 2015 Guenther Deschner - 4.2.2-0 +- Update to Samba 4.2.2 + +* Mon May 11 2015 Alexander Bokovoy - 4.2.1-8 +- Fixes: #1219832: Samba 4.2 broke FreeIPA trusts to AD +- Remove usage of deprecated API from gnutls + +* Thu Apr 30 2015 Alexander Bokovoy - 4.2.1-7 +- Fix LSASD daemon +- resolves: #1217346 - FreeIPA trusts to AD broken due to Samba 4.2 failure to run LSARPC pipe externally + +* Mon Apr 27 2015 Alexander Bokovoy - 4.2.1-6 +- Remove samba-common-tools from samba-client package as it brings back Python 2.7 + +* Mon Apr 27 2015 Alexander Bokovoy - 4.2.1-5 +- Require samba-common-tools in samba package +- Require samba-common-tools in samba-client package +- resolves: #1215631 - /usr/bin/net moved to samba-common-tools but the package is not required by samba + +* Sat Apr 25 2015 Alexander Bokovoy - 4.2.1-4 +- Fix systemd library detection (incomplete patch upstream) + +* Fri Apr 24 2015 Andreas Schneider - 4.2.1-3 +- resolves: #1214973 - Fix libwbclient alternatives link. + +* Wed Apr 22 2015 Guenther Deschner - 4.2.1-2 +- Add vfs snapper module. + +* Tue Apr 21 2015 Andreas Schneider - 4.2.1-1 +- Update to Samba 4.2.1 +- resolves: #1213373 - Fix DEBUG macro issues in public headers + +* Wed Apr 08 2015 Andreas Schneider - 4.2.0-3 +- resolves: #1207381 - Fix libsystemd detection. + +* Tue Mar 10 2015 Andreas Schneider - 4.2.0-2 +- Fix the AD build. +- Create samba-client-libs subpackage. +- Fix multiarch issues by splitting the samba-common package. + +* Thu Mar 05 2015 Guenther Deschner - 4.2.0-1 +- Update to Samba 4.2.0 + +* Tue Mar 03 2015 Andreas Schneider - 4.2.0-0.5.rc5 +- Update to Samba 4.2.0rc5 + +* Fri Jan 16 2015 - Andreas Schneider - 4.2.0-0.4.rc4 +- Update to Samba 4.2.0rc4 +- resolves: #1154600 - Install missing samba pam.d configuration file. + +* Mon Jan 12 2015 Guenther Deschner - 4.2.0-0.6.rc3 +- Fix awk as a dependency (and require gawk) + +* Mon Jan 12 2015 Michael Adam - 4.2.0-0.5.rc3 +- Add dependencies for ctdb. + +* Fri Jan 09 2015 Stephen Gallagher 4.2.0-0.4.rc3 +- Apply the DEBUG patch + +* Fri Jan 09 2015 Andreas Schneider - 4.2.0-0.3.rc3 +- Fix issues with conflicting DEBUG macros. + +* Tue Jan 06 2015 Michael Adam - 4.2.0-0.2.rc3 +- Improve dependencies of vfs-glusterfs and vfs-cephfs. +- Remove unused python_libdir. +- Fix malformed changelog entries. + +* Tue Jan 06 2015 Guenther Deschner - 4.2.0-0.2.rc3 +- Fix ctdb and libcephfs dependencies. + +* Mon Jan 05 2015 Andreas Schneider - 4.2.0-0.1.rc3 +- Update to Samba 4.2.0rc3 + + Samba provides ctdb packages now. + +* Tue Dec 16 2014 Andreas Schneider - 4.2.0-0.3.rc2 +- resolves: #1174412 - Build VFS Ceph module. +- resolves: #1169067 - Move libsamba-cluster-support.so to samba-libs package. +- resolves: #1016122 - Move smbpasswd to samba-common package. + +* Fri Nov 21 2014 Andreas Schneider - 4.2.0-0.2.rc2 +- Use alternatives for libwbclient. +- Add cwrap to BuildRequires. + +* Wed Nov 12 2014 Andreas Schneider - 4.2.0-0.1.rc2 +- Update to Samba 4.2.0rc2. + +* Tue Oct 07 2014 Andreas Schneider - 4.1.12-5 +- resolves: #1033595 - Fix segfault in winbind. + +* Wed Sep 24 2014 Andreas Schneider - 4.1.12-1 +- Update to Samba 4.1.12. + +* Tue Sep 09 2014 Jitka Plesnikova - 2:4.1.11-1.4 +- Perl 5.20 mass + +* Wed Aug 27 2014 Jitka Plesnikova - 2:4.1.11-1.3 +- Perl 5.20 rebuild + +* Wed Aug 20 2014 Kalev Lember - 2:4.1.11-1.2 +- Rebuilt for rpm dependency generator failure (#1131892) + +* Mon Aug 18 2014 Fedora Release Engineering - 0:4.1.11-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Fri Aug 1 2014 Jared Smith - 4.1.11-1 +- Update to upstream Samba 4.1.11 release +- resolves: #1126015 - Fix CVE-2014-3560 + +* Mon Jun 23 2014 Guenther Deschner - 4.1.9-3 +- Update to Samba 4.1.9. +- resolves: #1112251 - Fix CVE-2014-0244 and CVE-2014-3493. + +* Wed Jun 11 2014 Guenther Deschner - 4.1.8-3 +- Update to Samba 4.1.8. +- resolves: #1102528 - CVE-2014-0178. + +* Sun Jun 08 2014 Fedora Release Engineering - 2:4.1.6-3.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Thu Apr 03 2014 Andreas Schneider - 4.1.6-3 +- Add systemd integration to the service daemons. + +* Tue Mar 18 2014 Andreas Schneider - 4.1.6-2 +- Created a samba-test-libs package. + +* Tue Mar 11 2014 Andreas Schneider - 4.1.6-1 +- Fix CVE-2013-4496 and CVE-2013-6442. +- Fix installation of pidl. + +* Fri Feb 21 2014 Andreas Schneider - 4.1.5-1 +- Update to Samba 4.1.5. + +* Fri Feb 07 2014 Andreas Schneider - 4.1.4-1 +- Update to Samba 4.1.4. + +* Wed Jan 08 2014 Andreas Schneider - 4.1.3-3 +- resolves: #1042845 - Do not build with libbsd. + +* Tue Dec 10 2013 Guenther Deschner - 4.1.3-2 +- resolves: #1019469 - Fix winbind debug message NULL pointer derreference. + +* Mon Dec 09 2013 Andreas Schneider - 4.1.3-1 +- Update to Samba 4.1.3. +- resolves: #1039454 - CVE-2013-4408. +- resolves: #1039500 - CVE-2012-6150. + +* Mon Nov 25 2013 Andreas Schneider - 4.1.2-1 +- Update to Samba 4.1.2. + +* Mon Nov 18 2013 Guenther Deschner - 4.1.1-3 +- resolves: #948509 - Fix manpage correctness. + +* Fri Nov 15 2013 Andreas Schneider - 4.1.1-2 +- related: #884169 - Fix strict aliasing warnings. + +* Mon Nov 11 2013 Andreas Schneider - 4.1.1-1 +- resolves: #1024544 - Fix CVE-2013-4475. +- Update to Samba 4.1.1. + +* Mon Nov 11 2013 Andreas Schneider - 4.1.0-5 +- related: #884169 - Fix the upgrade path. + +* Wed Oct 30 2013 Andreas Schneider - 4.1.0-4 +- related: #884169 - Add direct dependency to samba-libs in the + glusterfs package. +- resolves: #996567 - Fix userPrincipalName composition. +- related: #884169 - Fix memset call with zero length in in ntdb. + +* Fri Oct 18 2013 Andreas Schneider - 4.1.0-3 +- resolves: #1020329 - Build glusterfs VFS plguin. + +* Tue Oct 15 2013 Andreas Schneider - 4.1.0-2 +- resolves: #1018856 - Fix installation of pam_winbind after upgrade. +- related: #1010722 - Split out a samba-winbind-modules package. +- related: #985609 + +* Fri Oct 11 2013 Andreas Schneider - 4.1.0-1 +- related: #985609 - Update to Samba 4.1.0. + +* Tue Oct 01 2013 Andreas Schneider - 2:4.1.0-0.8 +- related: #985609 - Update to Samba 4.1.0rc4. +- resolves: #1010722 - Split out a samba-winbind-modules package. + +* Wed Sep 11 2013 Andreas Schneider - 2:4.1.0-0.7 +- related: #985609 - Update to Samba 4.1.0rc3. +- resolves: #1005422 - Add support for KEYRING ccache type in pam_winbindd. + +* Wed Sep 04 2013 Andreas Schneider - 2:4.1.0-0.6 +- resolves: #717484 - Enable profiling data support. + +* Thu Aug 22 2013 Guenther Deschner - 2:4.1.0-0.5 +- resolves: #996160 - Fix winbind with trusted domains. + +* Wed Aug 14 2013 Andreas Schneider 2:4.1.0-0.4 +- resolves: #996160 - Fix winbind nbt name lookup segfault. + +* Mon Aug 12 2013 Andreas Schneider - 2:4.1.0-0.3 +- related: #985609 - Update to Samba 4.1.0rc2. + +* Sat Aug 03 2013 Petr Pisar - 2:4.1.0-0.2.rc1.1 +- Perl 5.18 rebuild + +* Wed Jul 24 2013 Andreas Schneider - 2:4.1.0-0.2 +- resolves: #985985 - Fix file conflict between samba and wine. +- resolves: #985107 - Add support for new default location for Kerberos + credential caches. + +* Sat Jul 20 2013 Petr Pisar - 2:4.1.0-0.1.rc1.1 +- Perl 5.18 rebuild + +* Wed Jul 17 2013 Andreas Schneider - 2:4.1.0-0.1 +- Update to Samba 4.1.0rc1. + +* Mon Jul 15 2013 Andreas Schneider - 2:4.0.7-2 +- resolves: #972692 - Build with PIE and full RELRO. +- resolves: #884169 - Add explicit dependencies suggested by rpmdiff. +- resolves: #981033 - Local user's krb5cc deleted by winbind. +- resolves: #984331 - Fix samba-common tmpfiles configuration file in wrong + directory. + +* Wed Jul 03 2013 Andreas Schneider - 2:4.0.7-1 +- Update to Samba 4.0.7. + +* Fri Jun 07 2013 Andreas Schneider - 2:4.0.6-3 +- Add UPN enumeration to passdb internal API (bso #9779). + +* Wed May 22 2013 Andreas Schneider - 2:4.0.6-2 +- resolves: #966130 - Fix build with MIT Kerberos. +- List vfs modules in spec file. + +* Tue May 21 2013 Andreas Schneider - 2:4.0.6-1 +- Update to Samba 4.0.6. +- Remove SWAT. + +* Wed Apr 10 2013 Andreas Schneider - 2:4.0.5-1 +- Update to Samba 4.0.5. +- Add UPN enumeration to passdb internal API (bso #9779). +- resolves: #928947 - samba-doc is obsolete now. +- resolves: #948606 - LogRotate should be optional, and not a hard "Requires". + +* Fri Mar 22 2013 Andreas Schneider - 2:4.0.4-3 +- resolves: #919405 - Fix and improve large_readx handling for broken clients. +- resolves: #924525 - Don't use waf caching. + +* Wed Mar 20 2013 Andreas Schneider - 2:4.0.4-2 +- resolves: #923765 - Improve packaging of README files. + +* Wed Mar 20 2013 Andreas Schneider - 2:4.0.4-1 +- Update to Samba 4.0.4. + +* Mon Mar 11 2013 Andreas Schneider - 2:4.0.3-4 +- resolves: #919333 - Create /run/samba too. + +* Mon Mar 04 2013 Andreas Schneider - 2:4.0.3-3 +- Fix the cache dir to be /var/lib/samba to support upgrades. + +* Thu Feb 14 2013 Andreas Schneider - 2:4.0.3-2 +- resolves: #907915 - libreplace.so => not found + +* Thu Feb 07 2013 Andreas Schneider - 2:4.0.3-1 +- Update to Samba 4.0.3. +- resolves: #907544 - Add unowned directory /usr/lib64/samba. +- resolves: #906517 - Fix pidl code generation with gcc 4.8. +- resolves: #908353 - Fix passdb backend ldapsam as module. + +* Wed Jan 30 2013 Andreas Schneider - 2:4.0.2-1 +- Update to Samba 4.0.2. +- Fixes CVE-2013-0213. +- Fixes CVE-2013-0214. +- resolves: #906002 +- resolves: #905700 +- resolves: #905704 +- Fix conn->share_access which is reset between user switches. +- resolves: #903806 +- Add missing example and make sure we don't introduce perl dependencies. +- resolves: #639470 + +* Wed Jan 16 2013 Andreas Schneider - 2:4.0.1-1 +- Update to Samba 4.0.1. +- Fixes CVE-2013-0172. + +* Mon Dec 17 2012 Andreas Schneider - 2:4.0.0-174 +- Fix typo in winbind-krb-locator post uninstall script. + +* Tue Dec 11 2012 Andreas Schneider - 2:4.0.0-173 +- Update to Samba 4.0.0. + +* Thu Dec 06 2012 Andreas Schneider - 2:4.0.0-171.rc6 +- Fix typo in winbind-krb-locator post uninstall script. + +* Tue Dec 04 2012 Andreas Schneider - 2:4.0.0-170.rc6 +- Update to Samba 4.0.0rc6. +- Add /etc/pam.d/samba for swat to work correctly. +- resolves #882700 + +* Fri Nov 23 2012 Guenther Deschner - 2:4.0.0-169.rc5 +- Make sure ncacn_ip_tcp client code looks for NBT_NAME_SERVER name types. + +* Thu Nov 15 2012 Andreas Schneider - 2:4.0.0-168.rc5 +- Reduce dependencies of samba-devel and create samba-test-devel package. + +* Tue Nov 13 2012 Andreas Schneider - 2:4.0.0-167.rc5 +- Use workaround for winbind default domain only when set. +- Build with old ctdb support. + +* Tue Nov 13 2012 Andreas Schneider - 2:4.0.0-166.rc5 +- Update to Samba 4.0.0rc5. + +* Mon Nov 05 2012 Andreas Schneider - 2:4.0.0-165.rc4 +- Fix library dependencies of libnetapi. + +* Mon Nov 05 2012 Andreas Schneider - 2:4.0.0-164.rc4 +- resolves: #872818 - Fix perl dependencies. + +* Tue Oct 30 2012 Andreas Schneider - 2:4.0.0-163.rc4 +- Update to Samba 4.0.0rc4. + +* Mon Oct 29 2012 Andreas Schneider - 2:4.0.0-162.rc3 +- resolves: #870630 - Fix scriptlets interpeting a comment as argument. + +* Fri Oct 26 2012 Andreas Schneider - 2:4.0.0-161.rc3 +- Add missing Requries for python modules. +- Add NetworkManager dispatcher script for winbind. + +* Fri Oct 19 2012 Andreas Schneider - 2:4.0.0-160.rc3 +- resolves: #867893 - Move /var/log/samba to samba-common package for + winbind which requires it. + +* Thu Oct 18 2012 Andreas Schneider - 2:4.0.0-159.rc3 +- Compile default auth methods into smbd. + +* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-158.rc3 +- Move pam_winbind.conf and the manpages to the right package. + +* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-157.rc3 +* resolves: #866959 - Build auth_builtin as static module. + +* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-156.rc3 +- Update systemd Requires to reflect latest packaging guidelines. + +* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-155.rc3 +- Add back the AES patches which didn't make it in rc3. + +* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-154.rc3 +- Update to 4.0.0rc3. +- resolves: #805562 - Unable to share print queues. +- resolves: #863388 - Unable to reload smbd configuration with systemctl. + +* Wed Oct 10 2012 Alexander Bokovoy - 2:4.0.0-153.rc2 +- Use alternatives to configure winbind_krb5_locator.so +- Fix Requires for winbind. + +* Thu Oct 04 2012 Andreas Schneider - 2:4.0.0-152.rc2 +- Add kerberos AES support. +- Fix printing initialization. + +* Tue Oct 02 2012 Andreas Schneider - 2:4.0.0-151.rc2 +- Update to 4.0.0rc2. + +* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-150.rc1 +- Fix Obsoletes/Provides for update from samba4. +- Bump release number to be bigger than samba4. + +* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-96.rc1 +- Package smbprint again. + +* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-95.rc1 +- Update to 4.0.0rc1. + +* Mon Aug 20 2012 Guenther Deschner - 2:3.6.7-94.2 +- Update to 3.6.7 + +* Sat Jul 21 2012 Fedora Release Engineering - 2:3.6.6-93.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Thu Jul 19 2012 Guenther Deschner - 2:3.6.6-93 +- Fix printing tdb upgrade for 3.6.6 +- resolves: #841609 + +* Sun Jul 15 2012 Ville Skyttä - 2:3.6.6-92 +- Call ldconfig at libwbclient and -winbind-clients post(un)install time. +- Fix empty localization files, use %%find_lang to find and %%lang-mark them. +- Escape macros in %%changelog. +- Fix source tarball URL. + +* Tue Jun 26 2012 Guenther Deschner - 2:3.6.6-91 +- Update to 3.6.6 + +* Thu Jun 21 2012 Andreas Schneider - 2:3.6.5-90 +- Fix ldonfig. +- Require systemd for samba-common package. +- resolves: #829197 + +* Mon Jun 18 2012 Andreas Schneider - 2:3.6.5-89 +- Fix usrmove paths. +- resolves: #829197 + +* Tue May 15 2012 Andreas Schneider - 2:3.6.5-88 +- Move tmpfiles.d config to common package as it is needed for smbd and + winbind. +- Make sure tmpfiles get created after installation. + +* Wed May 09 2012 Guenther Deschner - 2:3.6.5-87 +- Correctly use system iniparser library + +* Fri May 04 2012 Andreas Schneider - 2:3.6.5-86 +- Bump Epoch to fix a problem with a Samba4 update in testing. + +* Mon Apr 30 2012 Guenther Deschner - 1:3.6.5-85 +- Security Release, fixes CVE-2012-2111 +- resolves: #817551 + +* Mon Apr 23 2012 Andreas Schneider - 1:3.6.4-84 +- Fix creation of /var/run/samba. +- resolves: #751625 + +* Fri Apr 20 2012 Guenther Deschner - 1:3.6.4-83 +- Avoid private krb5_locate_kdc usage +- resolves: #754783 + +* Thu Apr 12 2012 Jon Ciesla - 1:3.6.4-82 +- Update to 3.6.4 +- Fixes CVE-2012-1182 + +* Mon Mar 19 2012 Andreas Schneider - 1:3.6.3-81 +- Fix provides for of libwclient-devel for samba-winbind-devel. + +* Thu Feb 23 2012 Andreas Schneider - 1:3.6.3-80 +- Add commented out 'max protocol' to the default config. + +* Mon Feb 13 2012 Andreas Schneider - 1:3.6.3-79 +- Create a libwbclient package. +- Replace winbind-devel with libwbclient-devel package. + +* Mon Jan 30 2012 Andreas Schneider - 1:3.6.3-78 +- Update to 3.6.3 +- Fixes CVE-2012-0817 + +* Sat Jan 14 2012 Fedora Release Engineering - 1:3.6.1-77.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Mon Dec 05 2011 Andreas Schneider - 1:3.6.1-77 +- Fix winbind cache upgrade. +- resolves: #760137 + +* Fri Nov 18 2011 Andreas Schneider - 1:3.6.1-76 +- Fix piddir to match with systemd files. +- Fix crash bug in the debug system. +- resolves: #754525 + +* Fri Nov 04 2011 Andreas Schneider - 1:3.6.1-75 +- Fix systemd dependencies +- resolves: #751397 + +* Wed Oct 26 2011 Andreas Schneider - 1:3.6.1-74 +- Update to 3.6.1 + +* Tue Oct 04 2011 Guenther Deschner - 1:3.6.0-73 +- Fix nmbd startup +- resolves: #741630 + +* Tue Sep 20 2011 Tom Callaway - 1:3.6.0-72 +- convert to systemd +- restore epoch from f15 + +* Sat Aug 13 2011 Guenther Deschner - 3.6.0-71 +- Update to 3.6.0 final + +* Sun Jul 31 2011 Guenther Deschner - 3.6.0rc3-70 +- Update to 3.6.0rc3 + +* Tue Jun 07 2011 Guenther Deschner - 3.6.0rc2-69 +- Update to 3.6.0rc2 + +* Tue May 17 2011 Guenther Deschner - 3.6.0rc1-68 +- Update to 3.6.0rc1 + +* Wed Apr 27 2011 Guenther Deschner - 3.6.0pre3-67 +- Update to 3.6.0pre3 + +* Wed Apr 13 2011 Guenther Deschner - 3.6.0pre2-66 +- Update to 3.6.0pre2 + +* Fri Mar 11 2011 Guenther Deschner - 3.6.0pre1-65 +- Enable quota support + +* Wed Feb 09 2011 Fedora Release Engineering - 0:3.6.0-64pre1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Wed Nov 24 2010 Guenther Deschner - 3.6.0pre1-64 +- Add %%ghost entry for /var/run using tmpfs +- resolves: #656685 + +* Thu Aug 26 2010 Guenther Deschner - 3.6.0pre1-63 +- Put winbind krb5 locator plugin into a separate rpm +- resolves: #627181 + +* Tue Aug 03 2010 Guenther Deschner - 3.6.0pre1-62 +- Update to 3.6.0pre1 + +* Wed Jun 23 2010 Guenther Deschner - 3.5.4-61 +- Update to 3.5.4 + +* Wed May 19 2010 Guenther Deschner - 3.5.3-60 +- Update to 3.5.3 +- Make sure nmb and smb initscripts return LSB compliant return codes +- Fix winbind over ipv6 + +* Wed Apr 07 2010 Guenther Deschner - 3.5.2-59 +- Update to 3.5.2 + +* Mon Mar 08 2010 Simo Sorce - 3.5.1-58 +- Security update to 3.5.1 +- Fixes CVE-2010-0728 + +* Mon Mar 08 2010 Guenther Deschner - 3.5.0-57 +- Remove cifs.upcall and mount.cifs entirely + +* Mon Mar 01 2010 Guenther Deschner - 3.5.0-56 +- Update to 3.5.0 + +* Fri Feb 19 2010 Guenther Deschner - 3.5.0rc3-55 +- Update to 3.5.0rc3 + +* Tue Jan 26 2010 Guenther Deschner - 3.5.0rc2-54 +- Update to 3.5.0rc2 + +* Fri Jan 15 2010 Jeff Layton - 3.5.0rc1-53 +- separate out CIFS tools into cifs-utils package + +* Fri Jan 08 2010 Guenther Deschner - 3.5.0rc1-52 +- Update to 3.5.0rc1 + +* Tue Dec 15 2009 Guenther Deschner - 3.5.0pre2-51 +- Update to 3.5.0pre2 +- Remove umount.cifs + +* Wed Nov 25 2009 Guenther Deschner - 3.4.3-49 +- Various updates to inline documentation in default smb.conf file +- resolves: #483703 + +* Thu Oct 29 2009 Guenther Deschner - 3.4.3-48 +- Update to 3.4.3 + +* Fri Oct 09 2009 Simo Sorce - 3.4.2-47 +- Spec file cleanup +- Fix sources upstream location +- Remove conditionals to build talloc and tdb, now they are completely indepent + packages in Fedora +- Add defattr() where missing +- Turn all tabs into 4 spaces +- Remove unused migration script +- Split winbind-clients out of main winbind package to avoid multilib to include + huge packages for no good reason + +* Thu Oct 01 2009 Guenther Deschner - 3.4.2-0.46 +- Update to 3.4.2 +- Security Release, fixes CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906 + +* Wed Sep 16 2009 Tomas Mraz - 3.4.1-0.45 +- Use password-auth common PAM configuration instead of system-auth + +* Wed Sep 09 2009 Guenther Deschner - 3.4.1-0.44 +- Update to 3.4.1 + +* Thu Aug 20 2009 Guenther Deschner - 3.4.0-0.43 +- Fix cli_read() +- resolves: #516165 + +* Thu Aug 06 2009 Guenther Deschner - 3.4.0-0.42 +- Fix required talloc version number +- resolves: #516086 + +* Sun Jul 26 2009 Fedora Release Engineering - 0:3.4.0-0.41.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Fri Jul 17 2009 Guenther Deschner - 3.4.0-0.41 +- Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX) +- Specify required talloc and tdb version for BuildRequires + +* Fri Jul 03 2009 Guenther Deschner - 3.4.0-0.40 +- Update to 3.4.0 + +* Fri Jun 19 2009 Guenther Deschner - 3.4.0rc1-0.39 +- Update to 3.4.0rc1 + +* Mon Jun 08 2009 Guenther Deschner - 3.4.0pre2-0.38 +- Update to 3.4.0pre2 + +* Thu Apr 30 2009 Guenther Deschner - 3.4.0pre1-0.37 +- Update to 3.4.0pre1 + +* Wed Apr 29 2009 Guenther Deschner - 3.3.4-0.36 +- Update to 3.3.4 + +* Mon Apr 20 2009 Guenther Deschner - 3.3.3-0.35 +- Enable build of idmap_tdb2 for clustered setups + +* Wed Apr 1 2009 Guenther Deschner - 3.3.3-0.34 +- Update to 3.3.3 + +* Thu Mar 26 2009 Simo Sorce - 3.3.2-0.33 +- Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the + configuration +- Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on + startup, causing your own machine not to show up in the network for 5 minutes + if it was the only client in that workgroup (fix committed upstream) + +* Thu Mar 12 2009 Guenther Deschner - 3.3.2-0.31 +- Update to 3.3.2 +- resolves: #489547 + +* Thu Mar 5 2009 Guenther Deschner - 3.3.1-0.30 +- Add libcap-devel to requires list (resolves: #488559) + +* Tue Mar 3 2009 Simo Sorce - 3.3.1-0.29 +- Make the talloc and ldb packages optionsl and disable their build within + the samba3 package, they are now built as part of the samba4 package + until they will both be released as independent packages. + +* Wed Feb 25 2009 Guenther Deschner - 3.3.1-0.28 +- Enable cluster support + +* Tue Feb 24 2009 Guenther Deschner - 3.3.1-0.27 +- Update to 3.3.1 + +* Sat Feb 21 2009 Simo Sorce - 3.3.0-0.26 +- Rename ldb* tools to ldb3* to avoid conflicts with newer ldb releases + +* Tue Feb 3 2009 Guenther Deschner - 3.3.0-0.25 +- Update to 3.3.0 final +- Add upstream fix for ldap connections to AD (Bug #6073) +- Remove bogus perl dependencies (resolves: #473051) + +* Fri Nov 28 2008 Guenther Deschner - 3.3.0-0rc1.24 +- Update to 3.3.0rc1 + +* Thu Nov 27 2008 Simo Sorce - 3.2.5-0.23 +- Security Release, fixes CVE-2008-4314 + +* Thu Sep 18 2008 Guenther Deschner - 3.2.4-0.22 +- Update to 3.2.4 +- resolves: #456889 +- move cifs.upcall to /usr/sbin + +* Wed Aug 27 2008 Guenther Deschner - 3.2.3-0.21 +- Security fix for CVE-2008-3789 + +* Mon Aug 25 2008 Guenther Deschner - 3.2.2-0.20 +- Update to 3.2.2 + +* Mon Aug 11 2008 Simo Sorce - 3.2.1-0.19 +- Add fix for CUPS problem, fixes bug #453951 + +* Wed Aug 6 2008 Simo Sorce - 3.2.1-0.18 +- Update to 3.2.1 + +* Tue Jul 1 2008 Guenther Deschner - 3.2.0-2.17 +- Update to 3.2.0 final +- resolves: #452622 + +* Tue Jun 10 2008 Guenther Deschner - 3.2.0-1.rc2.16 +- Update to 3.2.0rc2 +- resolves: #449522 +- resolves: #448107 + +* Fri May 30 2008 Guenther Deschner - 3.2.0-1.rc1.15 +- Fix security=server +- resolves: #449038, #449039 + +* Wed May 28 2008 Guenther Deschner - 3.2.0-1.rc1.14 +- Add fix for CVE-2008-1105 +- resolves: #446724 + +* Fri May 23 2008 Guenther Deschner - 3.2.0-1.rc1.13 +- Update to 3.2.0rc1 + +* Wed May 21 2008 Simo Sorce - 3.2.0-1.pre3.12 +- make it possible to print against Vista and XP SP3 as servers +- resolves: #439154 + +* Thu May 15 2008 Guenther Deschner - 3.2.0-1.pre3.11 +- Add "net ads join createcomputer=ou1/ou2/ou3" fix (BZO #5465) + +* Fri May 09 2008 Guenther Deschner - 3.2.0-1.pre3.10 +- Add smbclient fix (BZO #5452) + +* Fri Apr 25 2008 Guenther Deschner - 3.2.0-1.pre3.9 +- Update to 3.2.0pre3 + +* Tue Mar 18 2008 Guenther Deschner - 3.2.0-1.pre2.8 +- Add fixes for libsmbclient and support for r/o relocations + +* Mon Mar 10 2008 Guenther Deschner - 3.2.0-1.pre2.7 +- Fix libnetconf, libnetapi and msrpc DSSETUP call + +* Thu Mar 06 2008 Guenther Deschner - 3.2.0-1.pre2.6 +- Create separate packages for samba-winbind and samba-winbind-devel +- Add cifs.spnego helper + +* Wed Mar 05 2008 Guenther Deschner - 3.2.0-1.pre2.3 +- Update to 3.2.0pre2 +- Add talloc and tdb lib and devel packages +- Add domainjoin-gui package + +* Fri Feb 22 2008 Simo Sorce - 3.2.0-0.pre1.3 +- Try to fix GCC 4.3 build +- Add --with-dnsupdate flag and also make sure other flags are required just to + be sure the features are included without relying on autodetection to be + successful + +* Tue Feb 19 2008 Fedora Release Engineering - 0:3.2.0-1.pre1.2 +- Autorebuild for GCC 4.3 + +* Tue Dec 04 2007 Release Engineering - 3.2.0-0.pre1.2 +- Rebuild for openldap bump + +* Thu Oct 18 2007 Guenther Deschner 3.2.0-0.pre1.1.fc9 +- 32/64bit padding fix (affects multilib installations) + +* Mon Oct 8 2007 Simo Sorce 3.2.0-0.pre1.fc9 +- New major relase, minor switched from 0 to 2 +- License change, the code is now GPLv3+ +- Numerous improvements and bugfixes included +- package libsmbsharemodes too +- remove smbldap-tools as they are already packaged separately in Fedora +- Fix bug 245506 + +* Tue Oct 2 2007 Simo Sorce 3.0.26a-1.fc8 +- rebuild with AD DNS Update support + +* Tue Sep 11 2007 Simo Sorce 3.0.26a-0.fc8 +- upgrade to the latest upstream realease +- includes security fixes released today in 3.0.26 + +* Fri Aug 24 2007 Simo Sorce 3.0.25c-4.fc8 +- add fix reported upstream for heavy idmap_ldap memleak + +* Tue Aug 21 2007 Simo Sorce 3.0.25c-3.fc8 +- fix a few places were "open" is used an interfere with the new glibc + +* Tue Aug 21 2007 Simo Sorce 3.0.25c-2.fc8 +- remove old source +- add patch to fix samba bugzilla 4772 + +* Tue Aug 21 2007 Guenther Deschner 3.0.25c-0.fc8 +- update to 3.0.25c + +* Fri Jun 29 2007 Simo Sorce 3.0.25b-3.fc8 +- handle cases defined in #243766 + +* Tue Jun 26 2007 Simo Sorce 3.0.25b-2.fc8 +- update to 3.0.25b +- better error codes for init scripts: #244823 + +* Tue May 29 2007 Günther Deschner +- fix pam_smbpass patch. + +* Fri May 25 2007 Simo Sorce +- update to 3.0.25a as it contains many fixes +- add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut. + +* Mon May 14 2007 Simo Sorce +- final 3.0.25 +- includes security fixes for CVE-2007-2444,CVE-2007-2446,CVE-2007-2447 + +* Mon Apr 30 2007 Günther Deschner +- move to 3.0.25rc3 + +* Thu Apr 19 2007 Simo Sorce +- fixes in the spec file +- moved to 3.0.25rc1 +- addedd patches (merged upstream so they will be removed in 3.0.25rc2) + +* Wed Apr 4 2007 Simo Sorce 3.0.24-12.fc7 +- fixes in smb.conf +- advice in smb.conf to put scripts in /var/lib/samba/scripts +- create /var/lib/samba/scripts so that selinux can be happy +- fix Vista problems with msdfs errors + +* Tue Apr 03 2007 Guenther Deschner 3.0.24-11.fc7 +- enable PAM and NSS dlopen checks during build +- fix unresolved symbols in libnss_wins.so (bug #198230) + +* Fri Mar 30 2007 Simo Sorce 3.0.24-10.fc7 +- set passdb backend = tdbsam as default in smb.conf +- remove samba-docs dependency from swat, that was a mistake +- put back COPYING and other files in samba-common +- put examples in samba not in samba-docs +- leave only stuff under docs/ in samba-doc + +* Thu Mar 29 2007 Simo Sorce 3.0.24-9.fc7 +- integrate most of merge review proposed changes (bug #226387) +- remove libsmbclient-devel-static and simply stop shipping the + static version of smbclient as it seem this is deprecated and + actively discouraged + +* Wed Mar 28 2007 Simo Sorce 3.0.24-8.fc7 +- fix for bug #176649 + +* Mon Mar 26 2007 Simo Sorce +- remove patch for bug 106483 as it introduces a new bug that prevents + the use of a credentials file with the smbclient tar command +- move the samba private dir from being the same as the config dir + (/etc/samba) to /var/lib/samba/private + +* Mon Mar 26 2007 Simo Sorce 3.0.24-7.fc7 +- make winbindd start earlier in the init process, at the same time + ypbind is usually started as well +- add a sepoarate init script for nmbd called nmb, we need to be able + to restart nmbd without dropping al smbd connections unnecessarily + +* Fri Mar 23 2007 Simo Sorce +- add samba.schema to /etc/openldap/schema + +* Thu Mar 22 2007 Florian La Roche +- adjust the Requires: for the scripts, add "chkconfig --add smb" + +* Tue Mar 20 2007 Simo Sorce 3.0.24-6.fc7 +- do not put comments inline on smb.conf options, they may be read + as part of the value (for example log files names) + +* Mon Mar 19 2007 Simo Sorce 3.0.24-5.fc7 +- actually use the correct samba.pamd file not the old samba.pamd.stack file +- fix logifles and use upstream convention of log.* instead of our old *.log + Winbindd creates its own log.* files anyway so we will be more consistent +- install our own (enhanced) default smb.conf file +- Fix pam_winbind acct_mgmt PAM result code (prevented local users from + logging in). Fixed by Guenther. +- move some files from samba to samba-common as they are used with winbindd + as well + +* Fri Mar 16 2007 Guenther Deschner 3.0.24-4.fc7 +- fix arch macro which reported Vista to Samba clients. + +* Thu Mar 15 2007 Simo Sorce 3.0.24-3.fc7 +- Directories reorg, tdb files must go to /var/lib, not + to /var/cache, add migration script in %%post common +- Split out libsmbclient, devel and doc packages +- Remove libmsrpc.[h|so] for now as they are not really usable +- Remove kill -HUP from rotate, samba use -HUP for other things + noit to reopen logs + +* Tue Feb 20 2007 Simo Sorce 3.0.24-2.fc7 +- New upstream release +- Fix packaging issue wrt idmap modules used only by smbd +- Addedd Vista Patchset for compatibility with Windows Vista +- Change default of "msdfs root", it seem to cause problems with + some applications and it has been proposed to change it for + 3.0.25 upstream + +* Fri Sep 1 2006 Jay Fenlason 3.0.23c-2 +- New upstream release. + +* Tue Aug 8 2006 Jay Fenlason 3.0.23b-2 +- New upstream release. + +* Mon Jul 24 2006 Jay Fenlason 3.0.23a-3 +- Fix the -logfiles patch to close + bz#199607 Samba compiled with wrong log path. + bz#199206 smb.conf has incorrect log file path + +* Mon Jul 24 2006 Jay Fenlason 3.0.23a-2 +- Upgrade to new upstream 3.0.23a +- include upstream samr_alias patch + +* Tue Jul 11 2006 Jay Fenlason 3.0.23-2 +- New upstream release. +- Use modified filter-requires-samba.sh from packaging/RHEL/setup/ + to get rid of bogus dependency on perl(Unicode::MapUTF8) +- Update the -logfiles and -smb.conf patches to work with 3.0.23 + +* Thu Jul 6 2006 Jay Fenlason 3.0.23-0.RC3 +- New upstream RC release. +- Update the -logfiles, and -passwd patches for + 3.0.23rc3 +- Include the change to smb.init from Bastien Nocera ) + to close + bz#182560 Wrong retval for initscript when smbd is dead +- Update this spec file to build with 3.0.23rc3 +- Remove the -install.mount.smbfs patch, since we don't install + mount.smbfs any more. + +* Wed Jun 14 2006 Tomas Mraz - 2.0.21c-3 +- rebuilt with new gnutls + +* Fri Mar 17 2006 Jay Fenlason 2.0.21c-2 +- New upstream version. + +* Mon Feb 13 2006 Jay Fenlason 3.0.21b-2 +- New upstream version. +- Since the rawhide kernel has dropped support for smbfs, remove smbmount + and smbumount. Users should use mount.cifs instead. +- Upgrade to 3.0.21b + +* Fri Feb 10 2006 Jesse Keating - 0:3.0.20b-2.1.1 +- bump again for double-long bug on ppc(64) + +* Fri Dec 09 2005 Jesse Keating +- rebuilt + +* Sun Nov 13 2005 Jay Fenlason 3.0.20b-2 +- turn on -DLDAP_DEPRECATED to allow access to ldap functions that have + been depricated in 2.3.11, but which don't have well-documented + replacements (ldap_simple_bind_s(), for example). +- Upgrade to 3.0.20b, which includes all the previous upstream patches. +- Updated the -warnings patch for 3.0.20a. +- Include --with-shared-modules=idmap_ad,idmap_rid to close + bz#156810 --with-shared-modules=idmap_ad,idmap_rid +- Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close + bz#170259 pam_stack is deprecated + +* Sun Nov 13 2005 Warren Togami 3.0.20-3 +- epochs from deps, req exact release +- rebuild against new openssl + +* Mon Aug 22 2005 Jay Fenlason 3.0.20-2 +- New upstream release + Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3, + -regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1 + This obsoletes the -pie and -delim patches + the -warning and -gcc4 patches are obsolete too + The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1 + Also, the -quoting patch was implemented differently upstream + There is now a umount.cifs executable and manpage + We run autogen.sh as part of the build phase + The testprns command is now gone + libsmbclient now has a man page +- Include -bug106483 patch to close + bz#106483 smbclient: -N negates the provided password, despite documentation +- Added the -warnings patch to quiet some compiler warnings. +- Removed many obsolete patches from CVS. + +* Mon May 2 2005 Jay Fenlason 3.0.14a-2 +- New upstream release. +- the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1, + winbind_find_dc_v2 patches are now obsolete. + +* Thu Apr 7 2005 Jay Fenlason 3.0.13-2 +- New upstream release +- add my -quoting patch, to fix swat with strings that contain + html meta-characters, and to use correct quote characters in + lists, closing bz#134310 +- include the upstream winbindd_2k3sp1 patch +- include the -smbclient patch. +- include the -hang patch from upstream. + +* Thu Mar 24 2005 Florian La Roche +- add a "exit 0" to the postun of the main samba package + +* Wed Mar 2 2005 Tomas Mraz 3.0.11-5 +- rebuild with openssl-0.9.7e + +* Thu Feb 24 2005 Jay Fenlason 3.0.11-4 +- Use the updated filter-requires-samba.sh file, so we don't accidentally + pick up a dependency on perl(Crypt::SmbHash) + +* Fri Feb 18 2005 Jay Fenlason 3.0.11-3 +- add -gcc4 patch to compile with gcc 4. +- remove the now obsolete -smbclient-kerberos.patch +- Include four upstream patches from + http://samba.org/~jerry/patches/post-3.0.11/ + (Slightly modified the winbind_find_dc_v2 patch to apply easily with + rpmbuild). + +* Fri Feb 4 2005 Jay Fenlason 3.0.11-2 +- include -smbspool patch to close bz#104136 + +* Wed Jan 12 2005 Jay Fenlason 3.0.10-4 +- Update the -man patch to fix ntlm_auth.1 too. +- Move pam_smbpass.so to the -common package, so both the 32 + and 64-bit versions will be installed on multiarch platforms. + This closes bz#143617 +- Added new -delim patch to fix mount.cifs so it can accept + passwords with commas in them (via environment or credentials + file) to close bz#144198 + +* Wed Jan 12 2005 Tim Waugh 3.0.10-3 +- Rebuilt for new readline. + +* Fri Dec 17 2004 Jay Fenlason 3.0.10-2 +- New upstream release that closes CAN-2004-1154 bz#142544 +- Include the -64bit patch from Nalin. This closes bz#142873 +- Update the -logfiles patch to work with 3.0.10 +- Create /var/run/winbindd and make it part of the -common rpm to close + bz#142242 + +* Mon Nov 22 2004 Jay Fenlason 3.0.9-2 +- New upstream release. This obsoletes the -secret patch. + Include my changetrustpw patch to make "net ads changetrustpw" stop + aborting. This closes #134694 +- Remove obsolete triggers for ancient samba versions. +- Move /var/log/samba to the -common rpm. This closes #76628 +- Remove the hack needed to get around the bad docs files in the + 3.0.8 tarball. +- Change the comment in winbind.init to point at the correct pidfile. + This closes #76641 + +* Mon Nov 22 2004 Than Ngo 3.0.8-4 +- fix unresolved symbols in libsmbclient which caused applications + such as KDE's konqueror to fail when accessing smb:// URLs. #139894 + +* Thu Nov 11 2004 Jay Fenlason 3.0.8-3.1 +- Rescue the install.mount.smbfs patch from Juanjo Villaplana + (villapla@si.uji.es) to prevent building the srpm from trashing your + installed /usr/bin/smbmount + +* Tue Nov 9 2004 Jay Fenlason 3.0.8-3 +- Include the corrected docs tarball, and use it instead of the + obsolete docs from the upstream 3.0.8 tarball. +- Update the logfiles patch to work with the updated docs. + +* Mon Nov 8 2004 Jay Fenlason 3.0.8-2 +- New upstream version fixes CAN-2004-0930. This obsoletes the + disable-sendfile, salt, signing-shortkey and fqdn patches. +- Add my ugly non-ascii-domain patch. +- Updated the pie patch for 3.0.8. +- Updated the logfiles patch for 3.0.8. + +* Tue Oct 26 2004 Jay Fenlason 3.0.8-0.pre2 +- New upstream version +- Add Nalin's signing-shortkey patch. + +* Tue Oct 19 2004 Jay Fenlason 3.0.8-0.pre1.3 +- disable the -salt patch, because it causes undefined references in + libsmbclient that prevent gnome-vfs from building. + +* Fri Oct 15 2004 Jay Fenlason 3.0.8-0.pre1.2 +- Re-enable the x_fclose patch that was accidentally disabled + in 3.0.8-0.pre1.1. This closes #135832 +- include Nalin's -fqdn and -salt patches. + +* Wed Oct 13 2004 Jay Fenlason 3.0.8-0.pre1.1 +- Include disable-sendfile patch to default "use sendfile" to "no". + This closes #132779 + +* Wed Oct 6 2004 Jay Fenlason +- Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies + smbmnt to work with 32-bit uids. + +* Mon Sep 27 2004 Jay Fenlason 3.0.8-0.pre1 +- new upstream release. This obsoletes the ldapsam_compat patches. + +* Wed Sep 15 2004 Jay Fenlason 3.0.7-4 +- Update docs section to not carryover the docs/manpages directory + This moved many files from /usr/share/doc/samba-3.0.7/docs/* to + /usr/share/doc/samba-3.0.7/* +- Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu) + to correctly create libsmbclient.so.0 and to use %%_initrddir instead + of rolling our own. This closes #132642 +- Add patch to default "use sendfile" to no, since sendfile appears to + be broken +- Add patch from Volker Lendecke to help make + ldapsam_compat work again. +- Add patch from "Vince Brimhall" for ldapsam_compat + These two patches close bugzilla #132169 + +* Mon Sep 13 2004 Jay Fenlason 3.0.7-3 +- Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808 + This obsoletes the 3.0.6-schema patch. +- Update BuildRequires line to include openldap-devel openssl-devel + and cups-devel + +* Mon Aug 16 2004 Jay Fenlason 3.0.6-3 +- New upstream version. +- Include post 3.0.6 patch from "Gerald (Jerry) Carter" + to fix a duplicate in the LDAP schema. +- Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com) + to allow correct timestamp handling on 64-bit platforms and fix #126109. +- reenable the -pie patch. Samba is too widely used, and too vulnerable + to potential security holes to disable an important security feature + like -pie. The correct fix is to have the toolchain not create broken + executables when programs compiled -pie are stripped. +- Remove obsolete patches. +- Modify this spec file to put libsmbclient.{a,so} in the right place on + x86_64 machines. + +* Thu Aug 5 2004 Jason Vas Dias 3.0.5-3 +- Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination +- resulted in executables getting corrupt stacks, causing smbmnt to +- get a SIGBUS in the mount() call (bug 127420). + +* Fri Jul 30 2004 Jay Fenlason 3.0.5-2 +- Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a + security fix. +- Include the 3.0.4-backport patch from the 3E branch. This restores + some of the 3.0.5pre1 and 3.0.5rc1 functionality. + +* Tue Jul 20 2004 Jay Fenlason 3.0.5-0.pre1.1 +- Backport base64_decode patche to close CAN-2004-0500 +- Backport hash patch to close CAN-2004-0686 +- use_authtok patch from Nalin Dahyabhai +- smbclient-kerberos patch from Alexander Larsson +- passwd patch uses "*" instead of "x" for "hashed" passwords for + accounts created by winbind. "x" means "password is in /etc/shadow" to + brain-damaged pam_unix module. + +* Fri Jul 2 2004 Jay Fenlason 3.0.5.0pre1.0 +- New upstream version +- use %% { SOURCE1 } instead of a hardcoded path +- include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org) + https://bugzilla.samba.org/show_bug.cgi?id=1315 + to make winbindd work against Windows versions that do not have + 128 bit encryption enabled. +- Moved %%{_bindir}/net to the -common package, so that folks who just + want to use winbind, etc don't have to install -client in order to + "net join" their domain. +- New upstream version obsoletes the patches added in 3.0.3-5 +- Remove smbgetrc.5 man page, since we don't ship smbget. + +* Tue Jun 15 2004 Elliot Lee +- rebuilt + +* Tue May 4 2004 Jay Fenlason 3.0.3-5 +- Patch to allow password changes from machines patched with + Microsoft hotfix MS04-011. +- Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302 + and https://bugzilla.samba.org/show_bug.cgi?id=1309 + +* Thu Apr 29 2004 Jay Fenlason 3.0.3-4 +- Samba 3.0.3 released. + +* Wed Apr 21 2004 jay Fenlason 3.0.3-3.rc1 +- New upstream version +- updated spec file to make libsmbclient.so executable. This closes + bugzilla #121356 + +* Mon Apr 5 2004 Jay Fenlason 3.0.3-2.pre2 +- New upstream version +- Updated configure line to remove --with-fhs and to explicitly set all + the directories that --with-fhs was setting. We were overriding most of + them anyway. This closes #118598 + +* Mon Mar 15 2004 Jay Fenlason 3.0.3-1.pre1 +- New upstream version. +- Updated -pie and -logfiles patches for 3.0.3pre1 +- add krb5-devel to buildrequires, fixes #116560 +- Add patch from Miloslav Trmac (mitr@volny.cz) to allow non-root to run + "service smb status". This fixes #116559 + +* Tue Mar 02 2004 Elliot Lee +- rebuilt + +* Mon Feb 16 2004 Jay Fenlason 3.0.2a-1 +- Upgrade to 3.0.2a + +* Mon Feb 16 2004 Karsten Hopp 3.0.2-7 +- fix ownership in -common package + +* Fri Feb 13 2004 Elliot Lee +- rebuilt + +* Fri Feb 13 2004 Jay Fenlason +- Change all requires lines to list an explicit epoch. Closes #102715 +- Add an explicit Epoch so that %%{epoch} is defined. + +* Mon Feb 9 2004 Jay Fenlason 3.0.2-5 +- New upstream version: 3.0.2 final includes security fix for #114995 + (CAN-2004-0082) +- Edit postun script for the -common package to restart winbind when + appropriate. Fixes bugzilla #114051. + +* Mon Feb 2 2004 Jay Fenlason 3.0.2-3rc2 +- add %%dir entries for %%{_libdir}/samba and %%{_libdir}/samba/charset +- Upgrade to new upstream version +- build mount.cifs for the new cifs filesystem in the 2.6 kernel. + +* Mon Jan 19 2004 Jay Fenlason 3.0.2-1rc1 +- Upgrade to new upstream version + +* Wed Dec 17 2003 Felipe Alfaro Solana 3.0.1-1 +- Update to 3.0.1 +- Removed testparm patch as it's already merged +- Removed Samba.7* man pages +- Fixed .buildroot patch +- Fixed .pie patch +- Added new /usr/bin/tdbdump file + +* Thu Sep 25 2003 Jay Fenlason 3.0.0-15 +- New 3.0.0 final release +- merge nmbd-netbiosname and testparm patches from 3E branch +- updated the -logfiles patch to work against 3.0.0 +- updated the pie patch +- update the VERSION file during build +- use make -j if avaliable +- merge the winbindd_privileged change from 3E +- merge the "rm /usr/lib" patch that allows Samba to build on 64-bit + platforms despite the broken Makefile + +* Mon Aug 18 2003 Jay Fenlason +- Merge from samba-3E-branch after samba-3.0.0rc1 was released + +* Wed Jul 23 2003 Jay Fenlason 3.0.0-3beta3 +- Merge from 3.0.0-2beta3.3E +- (Correct log file names (#100981).) +- (Fix pidfile directory in samab.log) +- (Remove obsolete samba-3.0.0beta2.tar.bz2.md5 file) +- (Move libsmbclient to the -common package (#99449)) + +* Sun Jun 22 2003 Nalin Dahyabhai 2.2.8a-4 +- rebuild + +* Wed Jun 04 2003 Elliot Lee +- rebuilt + +* Wed May 28 2003 Jay Fenlason 2.2.8a-2 +- add libsmbclient.so for gnome-vfs-extras +- Edit specfile to specify /var/run for pid files +- Move /tmp/.winbindd/socket to /var/run/winbindd/socket + +* Wed May 14 2003 Florian La Roche +- add proper ldconfig calls + +* Thu Apr 24 2003 Jay Fenlason 2.2.8a-1 +- upgrade to 2.2.8a +- remove old .md5 files +- add "pid directory = /var/run" to the smb.conf file. Fixes #88495 +- Patch from jra@dp.samba.org to fix a delete-on-close regression + +* Mon Mar 24 2003 Jay Fenlason 2.2.8-0 +- Upgrade to 2.2.8 +- removed commented out patches. +- removed old patches and .md5 files from the repository. +- remove duplicate /sbin/chkconfig --del winbind which causes + warnings when removing samba. +- Fixed minor bug in smbprint that causes it to fail when called with + more than 10 parameters: the accounting file (and spool directory + derived from it) were being set wrong due to missing {}. This closes + bug #86473. +- updated smb.conf patch, includes new defaults to close bug #84822. + +* Mon Feb 24 2003 Elliot Lee +- rebuilt + +* Thu Feb 20 2003 Jonathan Blandford 2.2.7a-5 +- remove swat.desktop file + +* Thu Feb 20 2003 Nalin Dahyabhai 2.2.7a-4 +- relink libnss_wins.so with SHLD="%%{__cc} -lnsl" to force libnss_wins.so to + link with libnsl, avoiding unresolved symbol errors on functions in libnsl + +* Mon Feb 10 2003 Jay Fenlason 2.2.7a-3 +- edited spec file to put .so files in the correct directories + on 64-bit platforms that have 32-bit compatability issues + (sparc64, x86_64, etc). This fixes bugzilla #83782. +- Added samba-2.2.7a-error.patch from twaugh. This fixes + bugzilla #82454. + +* Wed Jan 22 2003 Tim Powers +- rebuilt + +* Thu Jan 9 2003 Jay Fenlason 2.2.7a-1 +- Update to 2.2.7a +- Change default printing system to CUPS +- Turn on pam_smbpass +- Turn on msdfs + +* Sat Jan 4 2003 Jeff Johnson 2.2.7-5 +- use internal dep generator. + +* Sat Dec 14 2002 Tim Powers 2.2.7-4 +- don't use rpms internal dep generator + +* Mon Dec 02 2002 Elliot Lee 2.2.7-3 +- Fix missing doc files. +- Fix multilib issues + +* Wed Nov 20 2002 Bill Nottingham 2.2.7-2 +- update to 2.2.7 +- add patch for LFS in smbclient () + +* Wed Aug 28 2002 Trond Eivind Glomsød 2.2.5-10 +- logrotate fixes (#65007) + +* Mon Aug 26 2002 Trond Eivind Glomsrød 2.2.5-9 +- /usr/lib was used in place of %%{_libdir} in three locations (#72554) + +* Mon Aug 5 2002 Trond Eivind Glomsrød 2.2.5-8 +- Initscript fix (#70720) + +* Fri Jul 26 2002 Trond Eivind Glomsrød 2.2.5-7 +- Enable VFS support and compile the "recycling" module (#69796) +- more selective includes of the examples dir + +* Tue Jul 23 2002 Trond Eivind Glomsrød 2.2.5-6 +- Fix the lpq parser for better handling of LPRng systems (#69352) + +* Tue Jul 23 2002 Trond Eivind Glomsrød 2.2.5-5 +- desktop file fixes (#69505) + +* Wed Jun 26 2002 Trond Eivind Glomsrød 2.2.5-4 +- Enable ACLs + +* Tue Jun 25 2002 Trond Eivind Glomsrød 2.2.5-3 +- Make it not depend on Net::LDAP - those are doc files and examples + +* Fri Jun 21 2002 Tim Powers +- automated rebuild + +* Thu Jun 20 2002 Trond Eivind Glomsrød 2.2.5-1 +- 2.2.5 + +* Fri Jun 14 2002 Trond Eivind Glomsrød 2.2.4-5 +- Move the post/preun of winbind into the -common subpackage, + where the script is (#66128) + +* Tue Jun 4 2002 Trond Eivind Glomsrød 2.2.4-4 +- Fix pidfile locations so it runs properly again (2.2.4 + added a new directtive - #65007) + +* Thu May 23 2002 Tim Powers +- automated rebuild + +* Tue May 14 2002 Trond Eivind Glomsrød 2.2.4-2 +- Fix #64804 + +* Thu May 9 2002 Trond Eivind Glomsrød 2.2.4-1 +- 2.2.4 +- Removed some zero-length and CVS internal files +- Make it build + +* Wed Apr 10 2002 Trond Eivind Glomsrød 2.2.3a-6 +- Don't use /etc/samba.d in smbadduser, it should be /etc/samba + +* Thu Apr 4 2002 Trond Eivind Glomsrød 2.2.3a-5 +- Add libsmbclient.a w/headerfile for KDE (#62202) + +* Tue Mar 26 2002 Trond Eivind Glomsrød 2.2.3a-4 +- Make the logrotate script look the correct place for the pid files + +* Thu Mar 14 2002 Nalin Dahyabhai 2.2.3a-3 +- include interfaces.o in pam_smbpass.so, which needs symbols from interfaces.o + (patch posted to samba-list by Ilia Chipitsine) + +* Thu Feb 21 2002 Trond Eivind Glomsrød 2.2.3a-2 +- Rebuild + +* Thu Feb 7 2002 Trond Eivind Glomsrød 2.2.3a-1 +- 2.2.3a + +* Mon Feb 4 2002 Trond Eivind Glomsrød 2.2.3-1 +- 2.2.3 + +* Thu Nov 29 2001 Trond Eivind Glomsrød 2.2.2-8 +- New pam configuration file for samba + +* Tue Nov 27 2001 Trond Eivind Glomsrød 2.2.2-7 +- Enable PAM session controll and password sync + +* Tue Nov 13 2001 Trond Eivind Glomsrød 2.2.2-6 +- Move winbind files to samba-common. Add separate initscript for + winbind +- Fixes for winbind - protect global variables with mutex, use + more secure getenv + +* Thu Nov 8 2001 Trond Eivind Glomsrød 2.2.2-5 +- Teach smbadduser about "getent passwd" +- Fix more pid-file references +- Add (conditional) winbindd startup to the initscript, configured in + /etc/sysconfig/samba + +* Wed Nov 7 2001 Trond Eivind Glomsrød 2.2.2-4 +- Fix pid-file reference in logrotate script +- include pam and nss modules for winbind + +* Mon Nov 5 2001 Trond Eivind Glomsrød 2.2.2-3 +- Add "--with-utmp" to configure options (#55372) +- Include winbind, pam_smbpass.so, rpcclient and smbcacls +- start using /var/cache/samba, we need to keep state and there is + more than just locks involved + +* Sat Nov 03 2001 Florian La Roche 2.2.2-2 +- add "reload" to the usage string in the startup script + +* Mon Oct 15 2001 Trond Eivind Glomsrød 2.2.2-1 +- 2.2.2 + +* Tue Sep 18 2001 Trond Eivind Glomsrød 2.2.1a-5 +- Add patch from Jeremy Allison to fix IA64 alignment problems (#51497) + +* Mon Aug 13 2001 Trond Eivind Glomsrød +- Don't include smbpasswd in samba, it's in samba-common (#51598) +- Add a disabled "obey pam restrictions" statement - it's not + active, as we use encrypted passwords, but if the admin turns + encrypted passwords off the choice is available. (#31351) + +* Wed Aug 8 2001 Trond Eivind Glomsrød +- Use /var/cache/samba instead of /var/lock/samba +- Remove "domain controller" keyword from smb.conf, it's + deprecated (from #13704) +- Sync some examples with smb.conf.default +- Fix password synchronization (#16987) + +* Fri Jul 20 2001 Trond Eivind Glomsrød +- Tweaks of BuildRequires (#49581) + +* Wed Jul 11 2001 Trond Eivind Glomsrød +- 2.2.1a bugfix release + +* Tue Jul 10 2001 Trond Eivind Glomsrød +- 2.2.1, which should work better for XP + +* Sat Jun 23 2001 Trond Eivind Glomsrød +- 2.2.0a security fix +- Mark lograte and pam configuration files as noreplace + +* Fri Jun 22 2001 Trond Eivind Glomsrød +- Add the /etc/samba directory to samba-common + +* Thu Jun 21 2001 Trond Eivind Glomsrød +- Add improvements to the smb.conf as suggested in #16931 + +* Tue Jun 19 2001 Trond Eivind Glomsrød +- (these changes are from the non-head version) +- Don't include /usr/sbin/samba, it's the same as the initscript +- unset TMPDIR, as samba can't write into a TMPDIR owned + by root (#41193) +- Add pidfile: lines for smbd and nmbd and a config: line + in the initscript (#15343) +- don't use make -j +- explicitly include /usr/share/samba, not just the files in it + +* Tue Jun 19 2001 Bill Nottingham +- mount.smb/mount.smbfs go in /sbin, *not* %%{_sbindir} + +* Fri Jun 8 2001 Preston Brown +- enable encypted passwords by default + +* Thu Jun 7 2001 Helge Deller +- build as 2.2.0-1 release +- skip the documentation-directories docbook, manpages and yodldocs +- don't include *.sgml documentation in package +- moved codepage-directory to /usr/share/samba/codepages +- make it compile with glibc-2.2.3-10 and kernel-headers-2.4.2-2 + +* Mon May 21 2001 Helge Deller +- updated to samba 2.2.0 +- moved codepages to %%{_datadir}/samba/codepages +- use all available CPUs for building rpm packages +- use %%{_xxx} defines at most places in spec-file +- "License:" replaces "Copyright:" +- dropped excludearch sparc +- de-activated japanese patches 100 and 200 for now + (they need to be fixed and tested wth 2.2.0) +- separated swat.desktop file from spec-file and added + german translations +- moved /etc/sysconfig/samba to a separate source-file +- use htmlview instead of direct call to netscape in + swat.desktop-file + +* Mon May 7 2001 Bill Nottingham +- device-remove security fix again () + +* Fri Apr 20 2001 Bill Nottingham +- fix tempfile security problems, officially () +- update to 2.0.8 + +* Sun Apr 8 2001 Bill Nottingham +- turn of SSL, kerberos + +* Thu Apr 5 2001 Bill Nottingham +- fix tempfile security problems (patch from ) + +* Thu Mar 29 2001 Bill Nottingham +- fix quota support, and quotas with the 2.4 kernel (#31362, #33915) + +* Mon Mar 26 2001 Nalin Dahyabhai +- tweak the PAM code some more to try to do a setcred() after initgroups() +- pull in all of the optflags on i386 and sparc +- don't explicitly enable Kerberos support -- it's only used for password + checking, and if PAM is enabled it's a no-op anyway + +* Mon Mar 5 2001 Tim Waugh +- exit successfully from preun script (bug #30644). + +* Fri Mar 2 2001 Nalin Dahyabhai +- rebuild in new environment + +* Wed Feb 14 2001 Bill Nottingham +- updated japanese stuff (#27683) + +* Fri Feb 9 2001 Bill Nottingham +- fix trigger (#26859) + +* Wed Feb 7 2001 Bill Nottingham +- add i18n support, japanese patch (#26253) + +* Wed Feb 7 2001 Trond Eivind Glomsrød +- i18n improvements in initscript (#26537) + +* Wed Jan 31 2001 Bill Nottingham +- put smbpasswd in samba-common (#25429) + +* Wed Jan 24 2001 Bill Nottingham +- new i18n stuff + +* Sun Jan 21 2001 Bill Nottingham +- rebuild + +* Thu Jan 18 2001 Bill Nottingham +- i18n-ize initscript +- add a sysconfig file for daemon options (#23550) +- clarify smbpasswd man page (#23370) +- build with LFS support (#22388) +- avoid extraneous pam error messages (#10666) +- add Urban Widmark's bug fixes for smbmount (#19623) +- fix setgid directory modes (#11911) +- split swat into subpackage (#19706) + +* Wed Oct 25 2000 Nalin Dahyabhai +- set a default CA certificate path in smb.conf (#19010) +- require openssl >= 0.9.5a-20 to make sure we have a ca-bundle.crt file + +* Mon Oct 16 2000 Bill Nottingham +- fix swat only_from line (#18726, others) +- fix attempt to write outside buildroot on install (#17943) + +* Mon Aug 14 2000 Bill Nottingham +- add smbspool back in (#15827) +- fix absolute symlinks (#16125) + +* Sun Aug 6 2000 Philipp Knirsch +- bugfix for smbadduser script (#15148) + +* Mon Jul 31 2000 Matt Wilson +- patch configure.ing (patch11) to disable cups test +- turn off swat by default + +* Fri Jul 28 2000 Bill Nottingham +- fix condrestart stuff + +* Fri Jul 21 2000 Bill Nottingham +- add copytruncate to logrotate file (#14360) +- fix init script (#13708) + +* Sat Jul 15 2000 Bill Nottingham +- move initscript back +- remove 'Using Samba' book from %%doc +- move stuff to /etc/samba (#13708) +- default configuration tweaks (#13704) +- some logrotate tweaks + +* Wed Jul 12 2000 Prospector +- automatic rebuild + +* Tue Jul 11 2000 Bill Nottingham +- fix logrotate script (#13698) + +* Thu Jul 6 2000 Bill Nottingham +- fix initscripts req (prereq /etc/init.d) + +* Wed Jul 5 2000 Than Ngo +- add initdir macro to handle the initscript directory +- add a new macro to handle /etc/pam.d/system-auth + +* Thu Jun 29 2000 Nalin Dahyabhai +- enable Kerberos 5 and SSL support +- patch for duplicate profile.h headers + +* Thu Jun 29 2000 Bill Nottingham +- fix init script + +* Tue Jun 27 2000 Bill Nottingham +- rename samba logs (#11606) + +* Mon Jun 26 2000 Bill Nottingham +- initscript munging + +* Fri Jun 16 2000 Bill Nottingham +- configure the swat stuff usefully +- re-integrate some specfile tweaks that got lost somewhere + +* Thu Jun 15 2000 Bill Nottingham +- rebuild to get rid of cups dependency + +* Wed Jun 14 2000 Nalin Dahyabhai +- tweak logrotate configurations to use the PID file in /var/lock/samba + +* Sun Jun 11 2000 Bill Nottingham +- rebuild in new environment + +* Thu Jun 1 2000 Nalin Dahyabhai +- change PAM setup to use system-auth + +* Mon May 8 2000 Bill Nottingham +- fixes for ia64 + +* Sat May 6 2000 Bill Nottingham +- switch to %%configure + +* Wed Apr 26 2000 Nils Philippsen +- version 2.0.7 + +* Sun Mar 26 2000 Florian La Roche +- simplify preun + +* Thu Mar 16 2000 Bill Nottingham +- fix yp_get_default_domain in autoconf +- only link against readline for smbclient +- fix log rotation (#9909) + +* Fri Feb 25 2000 Bill Nottingham +- fix trigger, again. + +* Mon Feb 7 2000 Bill Nottingham +- fix trigger. + +* Fri Feb 4 2000 Bill Nottingham +- turn on quota support + +* Mon Jan 31 2000 Cristian Gafton +- rebuild to fox dependencies +- man pages are compressed + +* Fri Jan 21 2000 Bill Nottingham +- munge post scripts slightly + +* Wed Jan 19 2000 Bill Nottingham +- turn on mmap again. Wheee. +- ship smbmount on alpha + +* Mon Dec 6 1999 Bill Nottingham +- turn off mmap. ;) + +* Wed Dec 1 1999 Bill Nottingham +- change /var/log/samba to 0700 +- turn on mmap support + +* Thu Nov 11 1999 Bill Nottingham +- update to 2.0.6 + +* Fri Oct 29 1999 Bill Nottingham +- add a %%defattr for -common + +* Tue Oct 5 1999 Bill Nottingham +- shift some files into -client +- remove /home/samba from package. + +* Tue Sep 28 1999 Bill Nottingham +- initscript oopsie. killproc -HUP, not other way around. + +* Sun Sep 26 1999 Bill Nottingham +- script cleanups. Again. + +* Wed Sep 22 1999 Bill Nottingham +- add a patch to fix dropped reconnection attempts + +* Mon Sep 6 1999 Jeff Johnson +- use cp rather than mv to preserve /etc/services perms (#4938 et al). +- use mktemp to generate /etc/tmp.XXXXXX file name. +- add prereqs on sed/mktemp/killall (need to move killall to /bin). +- fix trigger syntax (i.e. "samba < 1.9.18p7" not "samba < samba-1.9.18p7") + +* Mon Aug 30 1999 Bill Nottingham +- sed "s|nawk|gawk|" /usr/bin/convert_smbpasswd + +* Sat Aug 21 1999 Bill Nottingham +- fix typo in mount.smb + +* Fri Aug 20 1999 Bill Nottingham +- add a %%trigger to work around (sort of) broken scripts in + previous releases + +* Mon Aug 16 1999 Bill Nottingham +- initscript munging + +* Mon Aug 9 1999 Bill Nottingham +- add domain parsing to mount.smb + +* Fri Aug 6 1999 Bill Nottingham +- add a -common package, shuffle files around. + +* Fri Jul 23 1999 Bill Nottingham +- add a chmod in %%postun so /etc/services & inetd.conf don't become unreadable + +* Wed Jul 21 1999 Bill Nottingham +- update to 2.0.5 +- fix mount.smb - smbmount options changed again......... +- fix postun. oops. +- update some stuff from the samba team's spec file. + +* Fri Jun 18 1999 Bill Nottingham +- split off clients into separate package +- don't run samba by default + +* Mon Jun 14 1999 Bill Nottingham +- fix one problem with mount.smb script +- fix smbpasswd on sparc with a really ugly kludge + +* Thu Jun 10 1999 Dale Lovelace +- fixed logrotate script + +* Tue May 25 1999 Bill Nottingham +- turn of 64-bit locking on 32-bit platforms + +* Thu May 20 1999 Bill Nottingham +- so many releases, so little time +- explicitly uncomment 'printing = bsd' in sample config + +* Tue May 18 1999 Bill Nottingham +- update to 2.0.4a +- fix mount.smb arg ordering + +* Fri Apr 16 1999 Bill Nottingham +- go back to stop/start for restart (-HUP didn't work in testing) + +* Fri Mar 26 1999 Bill Nottingham +- add a mount.smb to make smb mounting a little easier. +- smb filesystems apparently don't work on alpha. Oops. + +* Thu Mar 25 1999 Bill Nottingham +- always create codepages + +* Tue Mar 23 1999 Bill Nottingham +- logrotate changes + +* Sun Mar 21 1999 Cristian Gafton +- auto rebuild in the new build environment (release 3) + +* Fri Mar 19 1999 Preston Brown +- updated init script to use graceful restart (not stop/start) + +* Tue Mar 9 1999 Bill Nottingham +- update to 2.0.3 + +* Thu Feb 18 1999 Bill Nottingham +- update to 2.0.2 + +* Mon Feb 15 1999 Bill Nottingham +- swat swat + +* Tue Feb 9 1999 Bill Nottingham +- fix bash2 breakage in post script + +* Fri Feb 5 1999 Bill Nottingham +- update to 2.0.0 + +* Mon Oct 12 1998 Cristian Gafton +- make sure all binaries are stripped + +* Thu Sep 17 1998 Jeff Johnson +- update to 1.9.18p10. +- fix %%triggerpostun. + +* Tue Jul 07 1998 Erik Troan +- updated postun triggerscript to check $0 +- clear /etc/codepages from %%preun instead of %%postun + +* Mon Jun 08 1998 Erik Troan +- made the %%postun script a tad less agressive; no reason to remove + the logs or lock file (after all, if the lock file is still there, + samba is still running) +- the %%postun and %%preun should only exectute if this is the final + removal +- migrated %%triggerpostun from Red Hat's samba package to work around + packaging problems in some Red Hat samba releases + +* Sun Apr 26 1998 John H Terpstra +- minor tidy up in preparation for release of 1.9.18p5 +- added findsmb utility from SGI package + +* Wed Mar 18 1998 John H Terpstra +- Updated version and codepage info. +- Release to test name resolve order + +* Sat Jan 24 1998 John H Terpstra +- Many optimisations (some suggested by Manoj Kasichainula +- Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb +- Compounded make line +- Updated smb.init restart mechanism +- Use compound mkdir -p line instead of individual calls to mkdir +- Fixed smb.conf file path for log files +- Fixed smb.conf file path for incoming smb print spool directory +- Added a number of options to smb.conf file +- Added smbadduser command (missed from all previous RPMs) - Doooh! +- Added smbuser file and smb.conf file updates for username map diff --git a/samba.spec b/samba.spec index 72558fd..143402e 100644 --- a/samba.spec +++ b/samba.spec @@ -147,13 +147,15 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") %global samba_version 4.20.1 + +# Use 'autorelease -b 100' to start counting at 100 +%global samba_release %autorelease + +%global pre_release %nil +%if "x%{?pre_release}" != "x" %global baserelease 1 # This should be rc1 or %%nil -%global pre_release %nil - -%global samba_release %{baserelease} -%if "x%{?pre_release}" != "x" -%global samba_release 0.%{baserelease}.%{pre_release} +%global samba_release 0.%{baserelease}.%{pre_release}%{?dist} %endif @@ -205,7 +207,7 @@ Name: samba Version: %{samba_version} -Release: %{samba_release}%{?dist} +Release: %{samba_release} %if 0%{?fedora} Epoch: 2 @@ -4594,3043 +4596,4 @@ fi %endif %changelog -* Wed May 08 2024 Guenther Deschner - 4.20.1-1 -- resolves: #2279780 - Update to version 4.20.1 - -* Wed Mar 27 2024 Guenther Deschner - 4.20.0-7 -- resolves: #2271916 - Update to version 4.20.0 - -* Tue Mar 12 2024 Richard W.M. Jones - 2:4.20.0-0.6.rc4 -- Bump and rebuild package (for riscv64) - -* Mon Mar 11 2024 Guenther Deschner - 4.20.0rc4-5 -- resolves: #2269037 - Update to version 4.20.0rc4 - -* Mon Feb 26 2024 Guenther Deschner - 4.20.0rc3-4 -- resolves: #2266039 - Update to version 4.20.0rc3 - -* Mon Feb 12 2024 Guenther Deschner - 4.20.0rc2-3 -- resolves: #2263874 - Update to version 4.20.0rc2 - -* Thu Feb 01 2024 Pete Walter - 2:4.20.0-0.2.rc1 -- Rebuild for ICU 74 - -* Mon Jan 29 2024 Guenther Deschner - 4.20.0rc1-1 -- resolves: #2260895 - Update to version 4.20.0rc1 - -* Sat Jan 27 2024 Fedora Release Engineering - 2:4.19.4-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Tue Jan 16 2024 Andreas Schneider - 4.29.4-3 -- Fix samba-gpupdate on Fedora/RHEL - -* Tue Jan 09 2024 Andreas Schneider - 4.19.4-2 -- resolves: rhbz#2256326 - Create all groups using systemd - -* Mon Jan 08 2024 Guenther Deschner - 4.19.4-1 -- resolves: #2257287 - Update to version 4.19.4 - -* Tue Nov 28 2023 Guenther Deschner - 4.19.3-2 -- Disable performance co-pilot support for i686 - -* Mon Nov 27 2023 Guenther Deschner - 4.19.3-1 -- resolves: #2251766 - Update to version 4.19.3 - -* Wed Nov 15 2023 Andreas Schneider - 4.19.2-2 -- Package samba-gpupdate also for RHEL9 - -* Mon Oct 16 2023 Guenther Deschner - 4.19.2-1 -- resolves: #2244496 - Update to version 4.19.2 - -* Tue Oct 10 2023 Guenther Deschner - 4.19.1-1 -- resolves: #2243073 - Update to version 4.19.1 -- resolves: #2241881, #2243228: Security fix for CVE-2023-3961 -- resolves: #2241882, #2243231: Security fix for CVE-2023-4091 -- resolves: #2241883, #2243230: Security fix for CVE-2023-4154 -- resolves: #2241884, #2243229: Security fix for CVE-2023-42669 -- resolves: #2241885, #2243232: Security fix for CVE-2023-42670 - -* Mon Sep 04 2023 Guenther Deschner - 4.19.0-1 -- resolves: #2237259 - Update to version 4.19.0 - -* Mon Aug 28 2023 Guenther Deschner - 4.19.0-0.5.rc4 -- resolves: #2232744 - Update to version 4.19.0rc4 - -* Fri Aug 18 2023 Guenther Deschner - 4.19.0-0.4.rc3 -- resolves: #2232744 - Update to version 4.19.0rc3 - -* Wed Aug 16 2023 Yaakov Selkowitz - 2:4.19.0-0.3.rc2 -- Move ad-claims and authn-policy-util to dc-libs - -* Tue Aug 15 2023 Adam Williamson - 4.19.0-0.2.rc2 -- python3-samba-dc requires python3-markdown now - -* Tue Aug 08 2023 Guenther Deschner - 4.19.0-0.1.rc2 -- resolves: #2227246 - Update to version 4.19.0rc2 - -* Mon Aug 07 2023 Guenther Deschner - 4.19.0-0.0.rc1 -- resolves: #2227246 - Update to version 4.19.0rc1 - -* Thu Jul 20 2023 Guenther Deschner - 4.18.5-0 -- resolves: #2224040 - Update to version 4.18.5 -- resolves: #2222791, #2224254 - Security fix for CVE-2022-2127 -- resolves: #2222792, #2224255 - Security fix for CVE-2023-3347 -- resolves: #2222793, #2224253 - Security fix for CVE-2023-34966 -- resolves: #2222794, #2224252 - Security fix for CVE-2023-34967 -- resolves: #2222795, #2224250 - Security fix for CVE-2023-34968 - -* Sat Jul 15 2023 Guenther Deschner - 4.18.4-3 -- resolves: #2223091 - Fix netlogon LogonGetCapabilities level 2 error handling - -* Tue Jul 11 2023 František Zatloukal - 2:4.18.4-2 -- Rebuilt for ICU 73.2 - -* Wed Jul 05 2023 Python Maint - 2:4.18.4-1 -- Rebuilt for Python 3.12 - -* Wed Jul 05 2023 Guenther Deschner - 4.18.4-0 -- resolves: #2219799 - Update to version 4.18.4 - -* Mon Jun 26 2023 Python Maint - 2:4.18.3-5 -- Rebuilt for Python 3.12 - -* Mon Jun 26 2023 Adam Williamson - 4.18.3-4 -- Only run libwbclient %pre on upgrade, not fresh install - -* Fri Jun 23 2023 Andreas Schneider - 4.18.3-3 -- resolves: rhbz#2211577 - Fix libwbclient package upgrades - -* Thu Jun 15 2023 Python Maint - 2:4.18.3-2 -- Rebuilt for Python 3.12 - -* Thu Jun 15 2023 Andreas Schneider - 4.18.3-1 -- resolves: #2203539 - Also cover mit_kdc.log by logrotate - -* Thu Jun 01 2023 Guenther Deschner - 4.18.3-0 -- resolves: #2211453 - Update to version 4.18.3 - -* Wed Apr 19 2023 Guenther Deschner - 4.18.2-0 -- resolves: #2187991 - Update to version 4.18.2 - -* Wed Mar 29 2023 Guenther Deschner - 4.18.1-0 -- resolves: #2182787 - Update to version 4.18.1 -- resolves: #2182772, #2182773 - Security fixes for CVE-2023-0225 -- resolves: #2182774, #2182775 - Security fixes for CVE-2023-0922 -- resolves: #2182776, #2182777 - Security fixes for CVE-2023-0614 - -* Tue Mar 21 2023 Andreas Schneider - 4.18.0-12 -- Fix ctdb file lists when built with test suite enabled - -* Fri Mar 17 2023 Kalev Lember - 4.18.0-10 -- Move libstable-sort-samba4.so to samba-client-libs subpackage - -* Wed Mar 08 2023 Guenther Deschner - 4.18.0-9 -- resolves: #2176469 - Update to version 4.18.0 - -* Wed Mar 01 2023 Guenther Deschner - 4.18.0rc4-8 -- resolves: #2174415 - Update to version 4.18.0rc4 - -* Tue Feb 28 2023 Andreas Schneider - 4.18.0-0.7.rc3 -- resolves: #2173619 - Add missing Requires for glibc-gconv-extra - -* Thu Feb 23 2023 Pavel Filipenský - 4.18.0-0.6.rc3 -- SPDX migration - -* Wed Feb 15 2023 Guenther Deschner - 4.18.0rc3-6 -- resolves: #2166416 - Update to version 4.18.0rc3 - -* Mon Feb 13 2023 Pavel Filipenský - 4.18.0rc2-5 -- Create package samba-tools, move there samba-tool binary - -* Thu Feb 02 2023 Guenther Deschner - 4.18.0rc2-3 -- resolves: #2166416 - Update to version 4.18.0rc2 - -* Sat Jan 21 2023 Fedora Release Engineering - 2:4.18.0-0.2.rc1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Thu Jan 19 2023 Guenther Deschner - 4.18.0rc1-0 -- resolves: #2162097 - Update to version 4.18.0rc1 - -* Sat Dec 31 2022 Pete Walter - 2:4.17.4-4 -- Rebuild for ICU 72 - -* Thu Dec 22 2022 Pavel Filipenský - 4.17.4-3 -- Create package dc-libs also for 'non-dc build' - -* Tue Dec 20 2022 Pavel Filipenský - 4.17.4-2 -- Fix '--without dc' build: delete libauth4-samba4.so - -* Mon Dec 19 2022 Pavel Filipenský - 4.17.4-1 -- Create a samba-dcerpc sub-package -- Fix package installation without samba and samba-dc package - -* Fri Dec 16 2022 Guenther Deschner - 4.17.4-0 -- resolves: #2153906 - Update to version 4.17.4 -- resolves: #2154362, #2154363 - Security fixes for CVE-2022-38023 -- resolves: #2154303, #2154304 - Security fixes for CVE-2022-37966 -- resolves: #2154320, #2154322 - Security fixes for CVE-2022-37967 - -* Thu Dec 1 2022 Alexander Bokovoy - 2:4.17.3-2 -- Rebuild against krb5 1.20.1, new KDB interface - -* Mon Nov 21 2022 Florian Weimer - 2:4.17.3-1 -- Remove C89-specific language constructs from configure checks -- Fix feature detection for major/minor macros - -* Tue Nov 15 2022 Guenther Deschner - 4.17.3-0 -- resolves: #2142959 - Update to version 4.17.3 -- resolves: #2140960, #2143117 - Security fixes for CVE-2022-42898 - -* Wed Nov 02 2022 Pavel Filipenský - 4.17.2-1 -- Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional - -* Tue Oct 25 2022 Andreas Schneider - 4.17.2-1 -- Update to version 4.17.2 -- Fix CVE-2022-3592: A malicious client can use a symlink to escape the - exported - -* Mon Oct 24 2022 Andreas Schneider - 4.17.1-2 -- Add missing dependency for wbinfo used by ctdb scripts - -* Wed Oct 19 2022 Pavel Filipenský - 4.17.1-1 -- Update to version 4.17.1 -- resolves: rhbz#2127301 - Permission denied calling SMBC_getatr when file not exists -- resolves: rhbz#2133818 - rpcclient 4.17.0 unable to resolve server hostname - -* Wed Oct 05 2022 Andreas Schneider - 4.17.0-2 -- Move group creation logic to sysusers.d fragment - -* Tue Sep 13 2022 Andreas Schneider - 4.17.0-1 -- resolves: rhbz#2118818 - Update to version 4.17.0 -- resolves: rhbz#2121138 - Fix CVE-2022-32743 -- resolves: rhbz#2122650 - Fix CVE-2022-1615 - -* Tue Sep 13 2022 Andreas Schneider - 4.17.0-0.11.rc5 -- resolves: rhbz#2093656 - Split out libnetapi(-devel) sub-packages -- resolves: rhbz#2096405 - Add samba-usershare package - -* Tue Sep 06 2022 Guenther Deschner - 4.17.0-0.10.rc5 -- resolves: #2118818 - Update to version 4.17.0rc5 - -* Wed Aug 31 2022 Guenther Deschner - 4.17.0-0.9.rc4 -- resolves: #2118818 - Update to version 4.17.0rc4 - -* Thu Aug 25 2022 Adam Williamson - 4.17.0-0.8.rc3 -- Rebuild with no changes to fix F37 update grouping - -* Thu Aug 25 2022 Andreas Schneider - 4.17.0-0.7.rc3 -- python3-samba package should not require the samba package - -* Tue Aug 23 2022 Pavel Filipenský - 4.17.0-0.6.rc3 -- resolves: #2118818 - Update to version 4.17.0rc3 - -* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.5.rc2 -- Create a samba-gpupdate sub-package for GPO client support - -* Fri Aug 19 2022 Andreas Schneider - 4.17.0-0.4.rc2 -- Split out a samba-ldb-ldap-modules subpackage - -* Thu Aug 18 2022 Kalev Lember - 2:4.17.0-0.3.rc2 -- Avoid requiring systemd as per updated packaging guidelines - -* Wed Aug 17 2022 Guenther Deschner - 4.17.0rc2-2 -- resolves: #2118818 - Update to version 4.17.0rc2 - -* Wed Aug 10 2022 Andreas Schneider - 4.17.0rc1-1 -- Make sure we detect if SO version numbers of public libraries change. - -* Mon Aug 08 2022 Guenther Deschner - 4.17.0rc1-0 -- resolves: #2116503 - Update to version 4.17.0rc1 - -* Mon Aug 01 2022 Frantisek Zatloukal - 2:4.16.4-1 -- Rebuilt for ICU 71.1 - -* Wed Jul 27 2022 Guenther Deschner - 4.16.4-0 -- resolves: #2111490 - Update to version 4.16.4 -- resolves: #2108196, #2111729 - Security fixes for CVE-2022-32742 -- resolves: #2108205, #2111731 - Security fixes for CVE-2022-32744 -- resolves: #2108211, #2111732 - Security fixes for CVE-2022-32745 -- resolves: #2108215, #2111734 - Security fixes for CVE-2022-32746 - -* Sat Jul 23 2022 Fedora Release Engineering - 2:4.16.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Mon Jul 18 2022 Andreas Schneider - 4.16.3-1 -- Update to version 4.16.3 - -* Wed Jun 15 2022 Python Maint - 2:4.16.2-1 -- Rebuilt for Python 3.11 - -* Mon Jun 13 2022 Guenther Deschner - 4.16.2-0 -- Update to Samba 4.16.2 -- resolves: #2096167 - -* Wed Jun 08 2022 Andreas Schneider - 4.16.1-7 -- resolves: rhbz#2093833 - Remove weak dependency for logrotate for CentOS/RHEL - -* Tue May 31 2022 Jitka Plesnikova - 2:4.16.1-6 -- Perl 5.36 rebuild - -* Fri May 13 2022 Pavel Filipenský - 4.16.1-5 -- Fix rpminspect abidiff - -* Fri May 06 2022 Pavel Filipenský - 4.16.1-2 -- Update requires for packages - -* Thu May 05 2022 Tomas Popela - 4.16.1-1 -- Don't require full systemd for tmp files handling in samba-common - -* Mon May 02 2022 Pavel Filipenský - 4.16.1-0 -- Update to Samba 4.16.1 -- resolves: #2080915 - -* Fri Mar 25 2022 Sandro Mani - 2:4.16.0-7 -- Rebuild with mingw-gcc-12 - -* Tue Mar 22 2022 Guenther Deschner - 4.16.0-6 -- Update to Samba 4.16.0 -- resolves: #2066290 - -* Wed Mar 09 2022 Guenther Deschner - 4.16.0-0.5.rc5 -- Update to Samba 4.16.0rc5 -- resolves: #2042518 - -* Tue Mar 01 2022 Pavel Filipenský - 4.16.0-0.4.rc4 -- Update to Samba 4.16.0rc4 -- resolves: #2042518 - -* Wed Feb 23 2022 Andreas Schneider - 4.16.0-0.3.rc3 -- resolves: rhbz#2036443 - Fix samba-tool on builds with samba-dc - -* Tue Feb 15 2022 Pavel Filipenský - 4.16.0rc3 -- Update to Samba 4.16.0rc3 -- resolves: #2042518 - -* Tue Feb 01 2022 Pavel Filipenský - 4.16.0rc2 -- Update to Samba 4.16.0rc2 -- resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141 -- resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142 -- resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336 -- resolves: #2042518 - -* Wed Jan 26 2022 Pavel Filipenský - 4.16.0rc1 -- Exclude temporarily ceph on ppc64le to fix failing build - -* Tue Jan 25 2022 Pavel Filipenský - 4.16.0rc1 -- Update to Samba 4.16.0rc1 -- resolves: #2042518 - -* Thu Jan 20 2022 Pavel Filipenský - 4.15.4-0 -- Update to Samba 4.15.4 -- resolves: #2009673, #2039034 - Security fixes for CVE-2021-20316 -- resolves: #2042518 - -* Wed Dec 15 2021 Pavel Filipenský - 4.15.3-1 -- Fix resolv_wrapper with glibc 2.34 -- resolves: #2019669 - -* Wed Dec 08 2021 Pavel Filipenský - 4.15.3-0 -- Update to Samba 4.15.3 -- resolves: #2030382 - -* Sat Nov 13 2021 Guenther Deschner - 4.15.2-3 -- Fix IPA DC schannel support - -* Thu Nov 11 2021 Guenther Deschner - 4.15.2-2 -- Fix winbind trusted domain regression -- related: #2021716 -- Fix logfile handling -- Fix smbclient -N failures in container setups - -* Tue Nov 09 2021 Guenther Deschner - 4.15.2-0 -- Update to Samba 4.15.2 -- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124 -- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717 -- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718 -- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719 -- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721 -- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722 -- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738 -- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192 -- resolves: #2021625 - -* Fri Nov 05 2021 Guenther Deschner - 4.15.1-1 -- Fix winexe core dump -- resolves: #2020376 - -* Wed Oct 27 2021 Guenther Deschner - 4.15.1-0 -- Update to Samba 4.15.1 -- resolves: #2017847 - -* Mon Sep 20 2021 Guenther Deschner - 4.15.0-13 -- Update to Samba 4.15.0 -- resolves: #2005817 - -* Mon Sep 13 2021 Guenther Deschner - 4.15.0-0.12.rc7 -- Update to Samba 4.15.0rc7 -- resolves: #2003740 - -* Thu Sep 09 2021 Guenther Deschner - 4.15.0-0.11.rc6 -- Update to Samba 4.15.0rc6 -- resolves: #2002546 - -* Tue Sep 07 2021 Guenther Deschner - 4.15.0-0.10.rc5 -- Update to Samba 4.15.0rc5 -- resolves: #2001827 - -* Wed Sep 01 2021 Guenther Deschner - 4.15.0-0.9.rc4 -- Update to Samba 4.15.0rc4 -- resolves: #2000079 - -* Thu Aug 26 2021 Guenther Deschner - 4.15.0-0.8.rc3 -- Update to Samba 4.15.0rc3 -- resolves: #1998024 - -* Wed Aug 25 2021 Guenther Deschner - 4.15.0-0.7.rc2 -- Add ceph and etcd mutex helpers for CTDB - -* Mon Aug 16 2021 Anoop C S - 4.15.0-0.6.rc2 -- Avoid removing PyDSDB library files from buildroot for non AD DC build - -* Fri Aug 13 2021 Adam Williamson - 4.15.0-0.5.rc2 -- Fix samba-common-tools dependency - -* Thu Aug 12 2021 Andreas Schneider - 4.15.0-0.4.rc2 -- Package samba-tool correctly - -* Mon Aug 09 2021 Guenther Deschner - 4.15.0-0.3.rc2 -- Update to Samba 4.15.0rc2 -- resolves: #1991634 - -* Fri Jul 23 2021 Fedora Release Engineering - 2:4.15.0-0.2.rc1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Mon Jul 19 2021 Guenther Deschner - 4.15.0rc1-1 -- Fix ctdb-pcp-pmda install -- resolves: #1983369 - -* Thu Jul 15 2021 Guenther Deschner - 4.15.0rc1-0 -- Update to Samba 4.15.0rc1 -- resolves: #1982623 - -* Wed Jul 14 2021 Guenther Deschner - 4.14.6-1 -- Build with pcp-pmda support by default on Fedora -- resolves: #1552276 - -* Tue Jul 13 2021 Guenther Deschner - 4.14.6-0 -- Update to Samba 4.14.6 -- resolves: #1981764 - -* Thu Jun 24 2021 Andreas Schneider - 4.14.5-3 -- Create a subpackage for vfs-io-uring - -* Fri Jun 04 2021 Python Maint - 2:4.14.5-1 -- Rebuilt for Python 3.10 - -* Tue Jun 01 2021 Guenther Deschner - 4.14.5-0 -- Update to Samba 4.14.5 -- resolves: #1966456 - -* Fri May 21 2021 Jitka Plesnikova - 2:4.14.4-3 -- Perl 5.34 rebuild - -* Wed May 19 2021 Pete Walter - 2:4.14.4-2 -- Rebuild for ICU 69 - -* Tue May 18 2021 Andreas Schneider - 4.14.4-1 -- Fixed building with gcc 11.x -- Fixed quota support - -* Thu Apr 29 2021 Guenther Deschner - 4.14.4-0 -- Update to Samba 4.14.4 -- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254 -- resolves: #1955011 - -* Wed Apr 28 2021 Anoop C S - 4.14.3-2 -- resolves: #1954263 - wrong conditional build check of AD DC - -* Tue Apr 20 2021 Andreas Schneider - 4.14.3-1 -- resolves: #1942378 - Drop NIS support - -* Tue Apr 20 2021 Guenther Deschner - 4.14.3-0 -- Update to Samba 4.14.3 -- resolves: #1951531 - -* Mon Apr 19 2021 Michal Ambroz - 4.14.2-4 - - Added python3-ldb to BR - -* Mon Apr 19 2021 Andreas Schneider - 4.12.2-3 -- resolves: #1949295 - Remove findsmb script - -* Wed Apr 14 2021 Richard W.M. Jones - 2:4.14.2-2 -- Rebuild for updated liburing. - -* Wed Apr 07 2021 Alexander Bokovoy - 4.14.2-1 -- Fix memory leaks in RPC server -- resolves: #1946950 - -* Thu Mar 25 2021 Guenther Deschner - 4.14.2-0 -- Update to Samba 4.14.2 -- related: #1941400, #1942496 - Security fixes for CVE-2020-27840 -- related: #1941402, #1942497 - Security fixes for CVE-2021-20277 - -* Wed Mar 24 2021 Guenther Deschner - 4.14.1-0 -- Update to Samba 4.14.1 -- resolves: #1941400, #1942496 - Security fixes for CVE-2020-27840 -- resolves: #1941402, #1942497 - Security fixes for CVE-2021-20277 - -* Tue Mar 09 2021 Guenther Deschner - 4.14.0-3 -- Update to Samba 4.14.0 - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 2:4.14.0-0.0.rc4.2 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - -* Mon Mar 01 2021 Guenther Deschner - 4.14.0rc4-0 -- Update to Samba 4.14.0rc4 - -* Thu Feb 18 2021 Guenther Deschner - 4.14.0rc3-0 -- Update to Samba 4.14.0rc3 - -* Thu Feb 04 2021 Guenther Deschner - 4.14.0rc2-0 -- Update to Samba 4.14.0rc2 - -* Wed Jan 27 2021 Guenther Deschner - 4.14.0rc1-0 -- Update to Samba 4.14.0rc1 - -* Tue Jan 26 2021 Guenther Deschner - 4.13.4-0 -- Update to Samba 4.13.4 - -* Wed Dec 16 2020 Guenther Deschner - 4.13.3-1 -- Rebuild against krb5-1.19 -- Resolves: rhbz#1915928 - -* Tue Dec 15 2020 Guenther Deschner - 4.13.3-0 -- Update to Samba 4.13.3 - -* Wed Nov 25 2020 Alexander Bokovoy - 4.13.2-2 -- rhbz#1892745, rhbz#1900232: smbclient mget crashes (upstream bug 14517) -- Merge RHEL 8.4 patches: - - FIPS-related enhancements - - FreeIPA Global Catalog patches - -* Tue Nov 03 2020 Andreas Schneider - 4.13.2-1 -- Create a python3-samba-devel package to avoid unnessary dependencies - -* Tue Nov 03 2020 Guenther Deschner - 4.13.2-0 -- Update to Samba 4.13.2 - -* Thu Oct 29 2020 Guenther Deschner - 4.13.1-0 -- Update to Samba 4.13.1 -- resolves: #1892631, #1892634 - Security fixes for CVE-2020-14318 -- resolves: #1891685, #1892628 - Security fixes for CVE-2020-14323 -- resolves: #1892636, #1892640 - Security fixes for CVE-2020-14383 - -* Mon Oct 26 2020 Andreas Schneider - 4.13.0-14 -- Fixed dbcheck running in a release tarball -- Updated internal resolv_wrapper copy to verison 1.1.7 - -* Sun Oct 25 2020 Alexander Bokovoy - 4.13.0-13 -- Report 'samba' daemon status back to systemd -- Support dnspython 2.0.0 or later in samba_dnsupdate - -* Thu Oct 22 2020 Alexander Bokovoy - 4.13.0-12 -- Add preliminary support for S4U operations in Samba AD DC - resolves: #1836630 - Samba DC: Remote Desktop cannot access files -- Fix lookup_unix_user_name to allow lookup of realm-qualified users and groups - required for upcoming FreeIPA Global Catalog support - -* Tue Sep 22 2020 Guenther Deschner - 4.13.0-11 -- Update to Samba 4.13.0 - -* Fri Sep 18 2020 Guenther Deschner - 4.13.0rc6-10 -- Update to Samba 4.13.0rc6 -- resolves: #1879822, #1880703 - Security fixes for CVE-2020-1472 - -* Wed Sep 16 2020 Guenther Deschner - 4.13.0rc5-9 -- Update to Samba 4.13.0rc5 - -* Mon Sep 07 2020 Guenther Deschner - 4.13.0rc4-8 -- Update to Samba 4.13.0rc4 - -* Fri Aug 28 2020 Neal Gompa - 4.13.0rc3-6 -- Enable winexe by default everywhere - -* Fri Aug 28 2020 Guenther Deschner - 4.13.0rc3-5 -- Update to Samba 4.13.0rc3 - -* Fri Aug 14 2020 Guenther Deschner - 4.13.0rc2-4 -- Update to Samba 4.13.0rc2 - -* Wed Aug 12 2020 Andreas Schneider - 4.13.0rc1-3 -- resolves: #1865831 - Add missing /usr/lib64/samba/krb5 directory -- resolves: #1866989 - Remove obsolete python3-crypto dependency - -* Wed Jul 29 2020 Fedora Release Engineering - 2:4.13.0-0.2.rc1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Tue Jul 14 2020 Tom Stellard - 2:4.13.0-0.2.rc1 -- Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - -* Tue Jul 14 2020 Andreas Schneider - 4.13.0rc1-1 -- Move mdssvc data files to correct package - -* Thu Jul 09 2020 Guenther Deschner - 4.13.0rc1-0 -- Update to Samba 4.13.0rc1 - -* Wed Jul 08 2020 Merlin Mathesius - 4.12.5-1 -- Remove nonexistent --without-winexe option from configure - -* Thu Jul 02 2020 Guenther Deschner - 4.12.5-0 -- Update to Samba 4.12.5 - -* Thu Jul 02 2020 Guenther Deschner - 4.12.4-0 -- Update to Samba 4.12.4 -- resolves: #1849489, #1853255 - Security fixes for CVE-2020-10730 -- resolves: #1849491, #1853256 - Security fixes for CVE-2020-10745 -- resolves: #1849509, #1853276 - Security fixes for CVE-2020-10760 -- resolves: #1851298, #1853259 - Security fixes for CVE-2020-14303 - -* Sat Jun 27 2020 Jitka Plesnikova - 2:4.12.3-1.1 -- Perl 5.32 re-rebuild updated packages - -* Thu Jun 25 2020 Guenther Deschner - 4.12.3-1 -- Add BuildRequires for python3-setuptools - -* Thu Jun 25 2020 Jitka Plesnikova - 2:4.12.3-0.4 -- Perl 5.32 rebuild - -* Tue May 26 2020 Miro Hrončok - 2:4.12.3-0.3 -- Rebuilt for Python 3.9 - -* Tue May 19 2020 Guenther Deschner - 4.12.3-0 -- Update to Samba 4.12.3 - -* Fri May 15 2020 Pete Walter - 2:4.12.2-1.2 -- Rebuild for ICU 67 - -* Wed May 13 2020 Guenther Deschner - 4.12.2-1 -- Add support for building the new experimental io_uring VFS module - -* Tue Apr 28 2020 Guenther Deschner - 4.12.2-0 -- Update to Samba 4.12.2 -- resolves: #1825731, #1828870 - Security fixes for CVE-2020-10700 -- resolves: #1825734, #1828872 - Security fixes for CVE-2020-10704 - -* Sun Apr 12 2020 Alexander Bokovoy - 4.12.1-1 -- Revert POSIX stat tuning in libsmbclient -- Resolves: rhbz#1801442 - -* Tue Apr 07 2020 Guenther Deschner - 4.12.1-0 -- Update to Samba 4.12.1 - -* Sat Mar 21 2020 Alexander Bokovoy - 4.12.0-6 -- Fix samba_requires_eq macro definition -- Resolves rhbz#1815739 - -* Tue Mar 10 2020 Guenther Deschner - 4.12.0-5 -- Add build requirement for perl-FindBin -- resolves: #1661213 - Add winexe subpackage for remote windows command execution - -* Tue Mar 03 2020 Guenther Deschner - 4.12.0-3 -- Update to Samba 4.12.0 - -* Wed Feb 26 2020 Guenther Deschner - 4.12.0rc4-2 -- Update to Samba 4.12.0rc4 - -* Wed Feb 19 2020 Guenther Deschner - 4.12.0rc3-2 -- Update to Samba 4.12.0rc3 - -* Tue Feb 04 2020 Guenther Deschner - 4.12.0rc2-2 -- Update to Samba 4.12.0rc2 - -* Thu Jan 30 2020 Fedora Release Engineering - 2:4.12.0-0.1.rc1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Fri Jan 24 2020 Alexander Bokovoy - 4.12.0.rc1-1 -- Allow building against krb5 1.18 beta and require it for Rawhide - -* Wed Jan 22 2020 Guenther Deschner - 4.12.0rc1-0 -- Update to Samba 4.12.0rc1 - -* Tue Jan 21 2020 Guenther Deschner - 4.11.5-0 -- Update to Samba 4.11.5 -- resolves: #1791201, #1793405 - Security fixes for CVE-2019-14902 -- resolves: #1791207, #1793407 - Security fixes for CVE-2019-14907 -- resolves: #1791204, #1793406 - Security fixes for CVE-2019-19344 - -* Mon Dec 16 2019 Guenther Deschner - 4.11.4-0 -- Update to Samba 4.11.4 - -* Tue Dec 10 2019 Guenther Deschner - 4.11.3-0 -- Update to Samba 4.11.3 -- resolves: #1778586, #1781542 - Security fixes for CVE-2019-14861 -- resolves: #1778589, #1781545 - Security fixes for CVE-2019-14870 - -* Thu Dec 05 2019 Andreas Schneider - 4.11.2-2 -- Restart winbindd on samba-winbind package upgrade - -* Wed Nov 06 2019 Alexander Bokovoy - 4.11.2-1 -- Update DES removal patch - -* Tue Oct 29 2019 Guenther Deschner - 4.11.2-0 -- Update to Samba 4.11.2 -- resolves: #1763137, #1766558 - Security fixes for CVE-2019-10218 -- resolves: #1764126, #1766559 - Security fixes for CVE-2019-14833 - -* Sun Oct 27 2019 Alexander Bokovoy - 4.11.1-1 -- resolves: #1757071 - Deploy new samba DC fails - -* Fri Oct 18 2019 Guenther Deschner - 4.11.1-0 -- Update to Samba 4.11.1 - -* Tue Sep 17 2019 Guenther Deschner - 4.11.0-3 -- Update to Samba 4.11.0 - -* Wed Sep 11 2019 Guenther Deschner - 4.11.0rc4-2 -- Update to Samba 4.11.0rc4 - -* Tue Sep 03 2019 Guenther Deschner - 4.11.0rc3-2 -- Update to Samba 4.11.0rc3 -- resolves: #1746225, #1748308 - Security fixes for CVE-2019-10197 - -* Tue Aug 27 2019 Guenther Deschner - 4.11.0rc2-2 -- resolves: #1746014 - re-add pidl - -* Mon Aug 26 2019 Lubomir Rintel - 2:4.11.0-0.1.rc2 -- Move the NetworkManager dispatcher script out of /etc - -* Wed Aug 21 2019 Guenther Deschner - 4.11.0rc2-0 -- Update to Samba 4.11.0rc2 - -* Tue Aug 20 2019 Guenther Deschner - 4.11.0rc1-0 -- Update to Samba 4.11.0rc1 - -* Mon Aug 19 2019 Miro Hrončok - 2:4.10.6-1.1 -- Rebuilt for Python 3.8 - -* Fri Aug 16 2019 Alexander Bokovoy - 2:4.10.6-1 -- Fix Samba bug https://bugzilla.samba.org/show_bug.cgi?id=14091 -- Fixes: Windows systems cannot resolve IPA users and groups over LSA RPC - -* Fri Jul 26 2019 Fedora Release Engineering - 2:4.10.6-0.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Mon Jul 08 2019 Guenther Deschner - 4.10.6-0 -- Update to Samba 4.10.6 - -* Mon Jul 01 2019 Guenther Deschner - 4.10.5-2 -- resolves: #1718113 - Avoid deprecated time.clock in wafsamba -- resolves: #1711638 - Update to latest waf version 2.0.17 - -* Thu Jun 20 2019 Guenther Deschner - 4.10.5-1 -- resolves: #1602824 - Make vfs_fruit operable with other remote VFS modules -- resolves: #1716455 - Avoid pathconf() in get_real_filename() VFS calls -- resolves: #1706090, #1700791 - Fix smbspool - -* Wed Jun 19 2019 Guenther Deschner - 4.10.5-0 -- Update to Samba 4.10.5 -- resolves: #1711816, #1721872 - Security fixes for CVE-2019-12435 -- resolves: #1711837, #1721873 - Security fixes for CVE-2019-12436 - -* Fri May 31 2019 Jitka Plesnikova - 2:4.10.4-1.1 -- Perl 5.30 rebuild - -* Tue May 28 2019 Guenther Deschner - 4.10.4-1 -- Add missing ctdb directories -- resolves: #1656777 - -* Wed May 22 2019 Guenther Deschner - 4.10.4-0 -- Update to Samba 4.10.4 - -* Tue May 14 2019 Guenther Deschner - 4.10.3-0 -- Update to Samba 4.10.3 -- resolves: #1705877, #1709679 - Security fixes for CVE-2018-16860 - -* Mon Apr 15 2019 Andreas Schneider - 4.10.2-1 -- resolves: #1699230 - Rebuild for MIT Kerberos soname bump of libkadm5srv - -* Mon Apr 08 2019 Guenther Deschner - 4.10.2-0 -- Update to Samba 4.10.2 -- resolves: #1689010, #1697718 - Security fixes for CVE-2019-3870 -- resolves: #1691518, #1697717 - Security fixes for CVE-2019-3880 - -* Wed Apr 03 2019 Guenther Deschner - 4.10.1-0 -- Update to Samba 4.10.1 - -* Mon Mar 25 2019 Andreas Schneider - 4.10.0-6 -- resolves: #1692347 - Add missing DC requirement for its python3 tools - -* Wed Mar 20 2019 Guenther Deschner - 4.10.0-5 -- Fix build failure (duplication during install) - -* Tue Mar 19 2019 Guenther Deschner - 4.10.0-4 -- Update to Samba 4.10.0 - -* Wed Mar 06 2019 Guenther Deschner - 4.10.0rc4-2 -- Update to Samba 4.10.0rc4 - -* Fri Feb 22 2019 Guenther Deschner - 4.10.0rc3-2 -- Update to Samba 4.10.0rc3 - -* Sun Feb 17 2019 Igor Gnatenko - 2:4.10.0-0.2.rc2.1 -- Rebuild for readline 8.0 - -* Thu Feb 14 2019 Andreas Schneider - 4.10.0rc2-2 -- resolves: #1672231 - Fix public NDR API - -* Tue Feb 12 2019 Guenther Deschner - 4.10.0rc2-1 -- resolves: #1674547 - Move samba.xattr modules out of python3 test package - -* Wed Feb 06 2019 Guenther Deschner - 4.10.0rc2-0 -- Update to Samba 4.10.0rc2 - -* Tue Jan 15 2019 Guenther Deschner - 4.10.0rc1-0 -- Update to Samba 4.10.0rc1 - -* Mon Jan 14 2019 Björn Esser - 2:4.9.4-0.1 -- Rebuilt for libcrypt.so.2 (#1666033) - -* Thu Dec 20 2018 Guenther Deschner - 4.9.4-0 -- Update to Samba 4.9.4 - -* Tue Nov 27 2018 Guenther Deschner - 4.9.3-0 -- Update to Samba 4.9.3 -- resolves: #1625449, #1654078 - Security fixes for CVE-2018-14629 -- resolves: #1642545, #1654082 - Security fixes for CVE-2018-16841 -- resolves: #1646377, #1654091 - Security fixes for CVE-2018-16851 -- resolves: #1646386, #1654092 - Security fixes for CVE-2018-16852 -- resolves: #1647246, #1654093 - Security fixes for CVE-2018-16853 -- resolves: #1649278, #1654095 - Security fixes for CVE-2018-16857 - -* Thu Nov 08 2018 Guenther Deschner - 4.9.2-0 -- Update to Samba 4.9.2 - -* Wed Sep 26 2018 Alexander Bokovoy - 4.9.1-2 -- Package ctdb/doc/examples - -* Mon Sep 24 2018 Andreas Schneider - 4.9.1-1 -- Update to Samba 4.9.1 - -* Thu Sep 13 2018 Guenther Deschner - 4.9.0-4 -- Update to Samba 4.9.0 - -* Thu Sep 06 2018 Andreas Schneider - 4.9.0rc5-3 -- Update to Samba 4.9.0rc5 - -* Wed Aug 29 2018 Guenther Deschner - 4.9.0rc4-3 -- Update to Samba 4.9.0rc4 - -* Thu Aug 16 2018 Andreas Schneider - 4.9.0rc3-3 -- Fix python3 packaging - -* Wed Aug 15 2018 Guenther Deschner - 4.9.0rc3-2 -- Update to Samba 4.9.0rc3 -- resolves: #1589651, #1617916 - Security fixes for CVE-2018-1139 -- resolves: #1580230, #1618613 - Security fixes for CVE-2018-1140 -- resolves: #1612805, #1618697 - Security fixes for CVE-2018-10858 -- resolves: #1610640, #1617910 - Security fixes for CVE-2018-10918 -- resolves: #1610645, #1617911 - Security fixes for CVE-2018-10919 - -* Wed Aug 01 2018 Andreas Schneider - 4.9.0rc2-2 -- Add some spec file cleanups - -* Wed Aug 01 2018 Guenther Deschner - 4.9.0rc2-0 -- Update to Samba 4.9.0rc2 - -* Thu Jul 12 2018 Guenther Deschner - 4.9.0rc1-0 -- Update to Samba 4.9.0rc1 - -* Thu Jul 12 2018 Alexander Bokovoy - 2:4.8.3-4.1 -- Scope to local __bss_start symbol (typo in a patch) -- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 - -* Thu Jul 12 2018 Alexander Bokovoy - 2:4.8.3-4 -- Change scope to local for symbols automatically added by upcoming binutils 2.31 -- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 - -* Wed Jul 11 2018 Alexander Bokovoy - 2:4.8.3-3 -- Rebuild Samba against binutils 2.30.90-2.fc29 -- Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1600035 -- Add explicit BuildRequires for gcc - -* Fri Jul 06 2018 Petr Pisar -- Perl 5.28 rebuild - -* Thu Jul 05 2018 Alexander Bokovoy - 2:4.8.3-2 -- Fix rawhide build by explicitly using /usr/bin/python2 - -* Tue Jul 03 2018 Petr Pisar -- Perl 5.28 rebuild - -* Mon Jul 02 2018 Miro Hrončok - 2:4.8.3-1.2 -- Rebuilt for Python 3.7 - -* Thu Jun 28 2018 Jitka Plesnikova - 2:4.8.3-1.1 -- Perl 5.28 rebuild - -* Tue Jun 26 2018 Andreas Schneider - 4.8.3-1 -- Update to Samba 4.8.3 -- Remove python(2|3)-subunit dependency - -* Tue Jun 19 2018 Miro Hrončok - 2:4.8.2-1.1 -- Rebuilt for Python 3.7 - -* Wed May 16 2018 Guenther Deschner - 4.8.2-0 -- Update to Samba 4.8.2 - -* Wed May 09 2018 Andreas Schneider - 4.8.1-1 -- resolves: #1574177 - Fix smbspool command line argument handling - -* Thu Apr 26 2018 Guenther Deschner - 4.8.1-0 -- Update to Samba 4.8.1 - -* Wed Mar 14 2018 Guenther Deschner - 4.8.0-7 -- resolves: #1554754, #1554756 - Security fixes for CVE-2018-1050 CVE-2018-1057 -- resolves: #1555112 - Update to Samba 4.8.0 - -* Tue Mar 13 2018 Andreas Schneider - 4.8.0rc4-6 -- resolves: #1552652 - Fix usage of nc in ctdb tests and only recommned it - -* Fri Mar 02 2018 Guenther Deschner - 4.8.0rc4-5 -- Update to Samba 4.8.0rc4 - -* Mon Feb 12 2018 Guenther Deschner - 4.8.0rc3-4 -- Update to Samba 4.8.0rc3 - -* Fri Feb 09 2018 Igor Gnatenko - 2:4.8.0-0.3.rc2.1 -- Escape macros in %%changelog - -* Fri Jan 26 2018 Guenther Deschner - 4.8.0rc2-3 -- Update to Samba 4.8.0rc2 - -* Sun Jan 21 2018 Björn Esser - 2:4.8.0-0.2.rc1 -- Explicitly BR: rpcsvc-proto-devel - -* Sat Jan 20 2018 Björn Esser - 2:4.8.0-0.1.rc1.1 -- Rebuilt for switch to libxcrypt - -* Mon Jan 15 2018 Guenther Deschner - 4.8.0rc1-1 -- Update to Samba 4.8.0rc1 - -* Mon Jan 08 2018 Andreas Schneider - 4.7.4-1 -- resolves: #1508092 - Add missing dependency for tdbbackup - -* Mon Dec 25 2017 Guenther Deschner - 4.7.4-0 -- Update to Samba 4.7.4 - -* Mon Dec 04 2017 Andreas Schneider - 4.7.3-3 -- resolves: #1520163 - Link libaesni-intel-samba4.so with -z noexecstack - -* Thu Nov 30 2017 Andreas Schneider - 4.7.3-2 -- Fix deamon startup with systemd - -* Thu Nov 23 2017 Bastien Nocera - 4.7.3-1 -- Enable AES acceleration on Intel compatible CPUs by default - -* Tue Nov 21 2017 Guenther Deschner - 4.7.3-0 -- Update to Samba 4.7.3 -- resolves: #1515692 - Security fix for CVE-2017-14746 and CVE-2017-15275 - -* Wed Nov 15 2017 Guenther Deschner - 4.7.2-0 -- resolves: #1513452 - Update to Samba 4.7.2 - -* Mon Nov 13 2017 Andreas Schneider - 4.7.1-2 -- Fix release number - -* Tue Nov 07 2017 Igor Gnatenko - 4.7.1-1 -- Remove old crufty coreutils requires - -* Thu Nov 02 2017 Guenther Deschner - 4.7.1-0 -- resolves: #1508871 - Update to Samba 4.7.1 - -* Mon Oct 30 2017 Alexander Bokovoy - 4.7.0-18 -- Force samba-dc to use the same libldb version as LDB modules compiled -- resolves: #1507420 - LDB / Samba module version mismatch - -* Fri Oct 27 2017 Andreas Schneider - 4.7.0-17 -- Move dsdb libs to python2-samba-dc - -* Thu Oct 26 2017 Andreas Schneider - 4.7.0-16 -- Create python[2|3]-samba-dc packages - -* Wed Oct 25 2017 Andreas Schneider - 4.7.0-15 -- related: #1499140 - Fix several dependency issues -- Fix building with MIT Kerberos 1.16 - -* Fri Oct 13 2017 Andreas Schneider - 4.7.0-14 -- resolves: #1499140 - Move libdfs-server-ad to the correct subpackage - -* Fri Oct 06 2017 Alexander Bokovoy - 4.7.0-13 -- Move /usr/lib{64,}/samba/libdsdb-garbage-collect-tombstones-samba4.so to samba-dc-libs -- Rebuild in rawhide against new krb5 1.16 and docbook-xml - -* Thu Sep 21 2017 Guenther Deschner - 4.7.0-12 -- Update to Samba 4.7.0 -- resolves: #1493441 - Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163 - -* Sun Sep 17 2017 Guenther Deschner - 4.7.0-0.11.rc6 -- Update to Samba 4.7.0rc6 - -* Wed Sep 13 2017 Alexander Bokovoy - 4.7.0-0.11.rc5 -- resolves: #1491137 - dcerpc/__init__.py is not packaged for py3 - -* Tue Sep 12 2017 Andreas Schneider - 4.7.0-0.10.rc5 -- resolves: #1476175 - Create seperate package for bind_dlz module - -* Tue Aug 29 2017 Guenther Deschner - 4.7.0-0.9.rc5 -- Update to Samba 4.7.0rc5 - -* Tue Aug 08 2017 Andreas Schneider - 4.7.0-0.9.rc3 -- Add printadmin group for printer driver handling - -* Sun Jul 30 2017 Florian Weimer - 2:4.7.0-0.8.rc3.2 -- Rebuild with binutils fix for ppc64le (#1475636) - -* Thu Jul 27 2017 Fedora Release Engineering - 2:4.7.0-0.8.rc3.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Wed Jul 26 2017 Andreas Schneider - 4.7.0-0.8.rc3 -- resolves: #1301002 - Enable avahi support - -* Tue Jul 25 2017 Guenther Deschner - 4.7.0-0.7.rc3 -- Update to Samba 4.7.0rc3 - -* Mon Jul 24 2017 Andreas Schneider - 4.7.0-0.7.rc1 -- Rename samba-python to python2-samba -- Update build requirement for libcephfs - -* Thu Jul 20 2017 Alexander Bokovoy - 4.7.0-0.6.rc1 -- Use Python 2 explicitly for samba-tool and other Python-based tools -- Install samba.service as it is required for the AD DC case - -* Tue Jul 18 2017 Alexander Bokovoy - 4.7.0-0.5.rc1 -- Convert more rpc modules to python3 -- Explicitly specify Python artifacts in the spec to be able to catch unpackaged ones -- Split 'make test' Python code into separate python2-samba-test/python3-samba-test sub-packages -- Remove embedded python2-dns version, require python{2,3}-dns instead - -* Thu Jul 06 2017 Andreas Schneider - 4.7.0-0.4.rc1 -- Add python3 support -- Fix %%posttrans for libwbclient-devel - -* Thu Jul 06 2017 Andreas Schneider - 4.7.0-0.3.rc1 -- Do not install conflicting file _ldb_text.py - -* Wed Jul 05 2017 Andreas Schneider - 4.7.0-0.2.rc1 -- Fix requirement generation for shared libraries - -* Wed Jul 05 2017 Andreas Schneider - 4.7.0-0.1.rc1 -- Build Samba with Active Directory support! - -* Mon Jun 12 2017 Guenther Deschner - 4.7.0-0.0.rc1 -- Update to Samba 4.7.0rc1 - -* Mon Jun 12 2017 Guenther Deschner - 4.6.5-0 -- Update to Samba 4.6.5 - -* Sun Jun 04 2017 Jitka Plesnikova - 2:4.6.4-1.1 -- Perl 5.26 rebuild - -* Wed May 24 2017 Andreas Schneider - 4.6.4-1 -- #resolves: #1451486 - Add source tarball comment - -* Wed May 24 2017 Guenther Deschner - 4.6.4-0 -- Update to Samba 4.6.4 -- resolves: #1455050 - Security fix for CVE-2017-7494 - -* Tue Apr 25 2017 Guenther Deschner - 4.6.3-0 -- Update to Samba 4.6.3 - -* Fri Mar 31 2017 Guenther Deschner - 4.6.2-0 -- Update to Samba 4.6.2 -- related: #1435156 - Security fix for CVE-2017-2619 - -* Thu Mar 23 2017 Guenther Deschner - 4.6.1-0 -- Update to Samba 4.6.1 -- resolves: #1435156 - Security fix for CVE-2017-2619 - -* Wed Mar 15 2017 Alexander Bokovoy - 4.6.0-4 -- Export arcfour_crypt_blob to Python as samba.crypto.arcfour_encrypt -- Makes possible to run trust to AD in FreeIPA in FIPS mode - -* Fri Mar 10 2017 Alexander Bokovoy - 4.6.0-3 -- auth/credentials: Always set the the realm if we set the principal from the ccache -- resolves: #1430761 - credentials_crb5: use gss_acquire_cred for client-side GSSAPI use case - -* Thu Mar 09 2017 Alexander Bokovoy - 4.6.0-2 -- resolves: #1430761 - credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case - -* Tue Mar 07 2017 Andreas Schneider - 4.6.0-1 -- Update to Samba 4.6.0 - -* Wed Mar 01 2017 Andreas Schneider - 4.6.0-0.3.rc4 -- Update to Samba 4.6.0rc4 - -* Tue Feb 14 2017 Andreas Schneider - 4.6.0-0.1.rc3 -- Update to Samba 4.6.0rc3 - -* Sat Feb 11 2017 Fedora Release Engineering - 4.6.0-0.1.rc2.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Fri Jan 27 2017 Guenther Deschner - 4.6.0-0.1.rc2 -- Update to Samba 4.6.0rc2 - -* Thu Jan 12 2017 Andreas Schneider - 4.6.0-0.1.rc1 -- resolves: #1319098 - Add missing Requires for pre-required packages - -* Thu Jan 05 2017 Guenther Deschner - 4.6.0-0.1.rc1 -- Update to Samba 4.6.0rc1 - -* Mon Dec 19 2016 Guenther Deschner - 4.5.3-0 -- Update to Samba 4.5.3 -- resolves: #1405984 - CVE-2016-2123,CVE-2016-2125 and CVE-2016-2126 - -* Wed Dec 07 2016 Guenther Deschner - 4.5.2-0 -- Update to Samba 4.5.2 - -* Mon Dec 05 2016 Rex Dieter - - -- rebuild (libldb) - -* Fri Nov 04 2016 Anoop C S - 4.5.1-1 -- Fix glfs_realpath allocation in vfs_glusterfs - -* Wed Oct 26 2016 Guenther Deschner - 4.5.1-0 -- Update to Samba 4.5.1 - -* Mon Oct 17 2016 Andreas Schneider - 4.5.0-3 -- resolves: 1375973 - Fix tevent incompatibility issue - -* Wed Sep 14 2016 Guenther Deschner - 4.5.0-2 -- Fix smbspool alternatives handling during samba-client uninstall - -* Wed Sep 07 2016 Guenther Deschner - 4.5.0-1 -- Update to Samba 4.5.0 - -* Mon Aug 29 2016 Guenther Deschner - 4.5.0rc3-0 -- Update to Samba 4.5.0rc3 - -* Mon Aug 15 2016 Guenther Deschner - 4.5.0rc2-0 -- Update to Samba 4.5.0rc2 - -* Thu Jul 28 2016 Guenther Deschner - 4.5.0rc1-0 -- Update to Samba 4.5.0rc1 - -* Tue Jul 19 2016 Fedora Release Engineering - 2:4.4.5-1.1 -- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages - -* Thu Jul 07 2016 Guenther Deschner - 4.4.5-1 -- Update to Samba 4.4.5 -- resolves: #1353504 - CVE-2016-2119 - -* Thu Jun 23 2016 Guenther Deschner - 4.4.4-4 -- resolves: #1348899 - Import of samba.ntacls fails - -* Mon Jun 20 2016 Andreas Schneider - 4.4.4-3 -- resolves: #1337260 - Small fix to the example smb.conf file - -* Wed Jun 15 2016 Andreas Schneider - 4.4.4-2 -- Fix resolving trusted domain users on domain member - -* Tue Jun 07 2016 Guenther Deschner - 4.4.4-1 -- Update to Samba 4.4.4 -- resolves: #1343529 - -* Wed May 25 2016 Alexander Bokovoy - 2:4.4.3-2 -- Fix libsystemd patch (#1125086) so that it actually works - -* Mon May 23 2016 Zbigniew Jędrzejewski-Szmek - 2:4.4.3-1.2 -- Rebuild to drop libsystemd-daemon dependency (#1125086) - -* Sun May 15 2016 Jitka Plesnikova - 2:4.4.3-1.1 -- Perl 5.24 rebuild - -* Mon May 02 2016 Guenther Deschner - 4.4.3-1 -- Update to Samba 4.4.3 -- resolves: #1332178 - -* Tue Apr 12 2016 Guenther Deschner - 4.4.2-1 -- Update to Samba 4.4.2, fix badlock security bug -- resolves: #1326453 - CVE-2015-5370 -- resolves: #1326453 - CVE-2016-2110 -- resolves: #1326453 - CVE-2016-2111 -- resolves: #1326453 - CVE-2016-2112 -- resolves: #1326453 - CVE-2016-2113 -- resolves: #1326453 - CVE-2016-2114 -- resolves: #1326453 - CVE-2016-2115 -- resolves: #1326453 - CVE-2016-2118 - -* Tue Mar 22 2016 Guenther Deschner - 4.4.0-1 -- Update to Samba 4.4.0 - -* Wed Mar 16 2016 Guenther Deschner - 4.4.0-0.8.rc5 -- Update to Samba 4.4.0rc5 - -* Tue Mar 08 2016 Guenther Deschner - 4.4.0-0.7.rc4 -- Update to Samba 4.4.0rc4 -- resolves: #1315942 - CVE-2015-7560 Incorrect ACL get/set allowed on symlink path - -* Tue Feb 23 2016 Guenther Deschner - 4.4.0-0.6.rc3 -- Update to Samba 4.4.0rc3 - -* Wed Feb 17 2016 Guenther Deschner - 4.4.0-0.5.rc2 -- Activate multi channel support (switched off by default) - -* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.4.rc2 -- More spec file fixes -- resolves: #1306542 - scriptlet failure because of comments - -* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.3.rc2 -- More spec file fixes - -* Mon Feb 15 2016 Andreas Schneider - 4.4.0-0.2.rc2 -- More spec file fixes - -* Wed Feb 10 2016 Guenther Deschner - 4.4.0-0.1.rc2 -- Update to Samba 4.4.0rc2 - -* Thu Feb 04 2016 Fedora Release Engineering - 2:4.4.0-0.1.rc1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Wed Jan 27 2016 Guenther Deschner - 4.4.0-0.0.rc1 -- Update to Samba 4.4.0rc1 - -* Fri Jan 22 2016 Alexander Bokovoy - 4.3.4-1 -- resolves: #1300038 - PANIC: Bad talloc magic value - wrong talloc version used/mixed - -* Tue Jan 12 2016 Guenther Deschner - 4.3.4-0 -- resolves: #1261230 - Update to Samba 4.3.4 - -* Wed Dec 16 2015 Guenther Deschner - 4.3.3-0 -- Update to Samba 4.3.3 -- resolves: #1292069 -- CVE-2015-3223 Remote DoS in Samba (AD) LDAP server -- CVE-2015-5252 Insufficient symlink verification in smbd -- CVE-2015-5296 Samba client requesting encryption vulnerable to - downgrade attack -- CVE-2015-5299 Missing access control check in shadow copy code -- CVE-2015-7540 DoS to AD-DC due to insufficient checking of asn1 - memory allocation - -* Tue Dec 15 2015 Guenther Deschner - 4.3.2-2 -- revert dependencies to samba-common and -tools - -* Tue Dec 01 2015 Guenther Deschner - 4.3.2-1 -- resolves: #1261230 - Update to Samba 4.3.2 - -* Wed Nov 18 2015 Guenther Deschner - 4.3.1-3 -- resolves: #1282931 - Fix DCE/RPC bind nak parsing - -* Fri Oct 23 2015 Guenther Deschner - 4.3.1-2 -- Fix dependencies to samba-common - -* Tue Oct 20 2015 Guenther Deschner - 4.3.1-1 -- resolves: #1261230 - Update to Samba 4.3.1 - -* Mon Oct 12 2015 Guenther Deschner - 4.3.0-3 -- Use separate lockdir - -* Mon Oct 12 2015 Guenther Deschner - 4.3.0-2 -- resolves: #1270568 - Samba fails to start after update to 4.3.0 - -* Tue Sep 08 2015 Guenther Deschner - 4.3.0-1 -- resolves: #1088911 - Update to Samba 4.3.0 - -* Tue Sep 01 2015 Andreas Schneider - 4.3.0-0.1rc4 -- Update to Samba 4.3.0rc4 - -* Mon Aug 31 2015 Andreas Schneider - 4.3.0-0.1rc3 -- Update to Samba 4.3.0rc3 - -* Tue Jul 14 2015 Guenther Deschner - 4.2.3-0 -- resolves: #1088911 - Update to Samba 4.2.3 - -* Fri Jun 19 2015 Andreas Schneider - 4.2.2-1 -- resolves: #1227911 - Enable tar support for smbclient -- resolves: #1234908 - Own the /var/lib/samba directory -- Enable hardened build - -* Fri Jun 19 2015 Fedora Release Engineering - 2:4.2.2-0.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Thu Jun 04 2015 Jitka Plesnikova - 2:4.2.2-0.1 -- Perl 5.22 rebuild - -* Thu May 28 2015 Guenther Deschner - 4.2.2-0 -- Update to Samba 4.2.2 - -* Mon May 11 2015 Alexander Bokovoy - 4.2.1-8 -- Fixes: #1219832: Samba 4.2 broke FreeIPA trusts to AD -- Remove usage of deprecated API from gnutls - -* Thu Apr 30 2015 Alexander Bokovoy - 4.2.1-7 -- Fix LSASD daemon -- resolves: #1217346 - FreeIPA trusts to AD broken due to Samba 4.2 failure to run LSARPC pipe externally - -* Mon Apr 27 2015 Alexander Bokovoy - 4.2.1-6 -- Remove samba-common-tools from samba-client package as it brings back Python 2.7 - -* Mon Apr 27 2015 Alexander Bokovoy - 4.2.1-5 -- Require samba-common-tools in samba package -- Require samba-common-tools in samba-client package -- resolves: #1215631 - /usr/bin/net moved to samba-common-tools but the package is not required by samba - -* Sat Apr 25 2015 Alexander Bokovoy - 4.2.1-4 -- Fix systemd library detection (incomplete patch upstream) - -* Fri Apr 24 2015 Andreas Schneider - 4.2.1-3 -- resolves: #1214973 - Fix libwbclient alternatives link. - -* Wed Apr 22 2015 Guenther Deschner - 4.2.1-2 -- Add vfs snapper module. - -* Tue Apr 21 2015 Andreas Schneider - 4.2.1-1 -- Update to Samba 4.2.1 -- resolves: #1213373 - Fix DEBUG macro issues in public headers - -* Wed Apr 08 2015 Andreas Schneider - 4.2.0-3 -- resolves: #1207381 - Fix libsystemd detection. - -* Tue Mar 10 2015 Andreas Schneider - 4.2.0-2 -- Fix the AD build. -- Create samba-client-libs subpackage. -- Fix multiarch issues by splitting the samba-common package. - -* Thu Mar 05 2015 Guenther Deschner - 4.2.0-1 -- Update to Samba 4.2.0 - -* Tue Mar 03 2015 Andreas Schneider - 4.2.0-0.5.rc5 -- Update to Samba 4.2.0rc5 - -* Fri Jan 16 2015 - Andreas Schneider - 4.2.0-0.4.rc4 -- Update to Samba 4.2.0rc4 -- resolves: #1154600 - Install missing samba pam.d configuration file. - -* Mon Jan 12 2015 Guenther Deschner - 4.2.0-0.6.rc3 -- Fix awk as a dependency (and require gawk) - -* Mon Jan 12 2015 Michael Adam - 4.2.0-0.5.rc3 -- Add dependencies for ctdb. - -* Fri Jan 09 2015 Stephen Gallagher 4.2.0-0.4.rc3 -- Apply the DEBUG patch - -* Fri Jan 09 2015 Andreas Schneider - 4.2.0-0.3.rc3 -- Fix issues with conflicting DEBUG macros. - -* Tue Jan 06 2015 Michael Adam - 4.2.0-0.2.rc3 -- Improve dependencies of vfs-glusterfs and vfs-cephfs. -- Remove unused python_libdir. -- Fix malformed changelog entries. - -* Tue Jan 06 2015 Guenther Deschner - 4.2.0-0.2.rc3 -- Fix ctdb and libcephfs dependencies. - -* Mon Jan 05 2015 Andreas Schneider - 4.2.0-0.1.rc3 -- Update to Samba 4.2.0rc3 - + Samba provides ctdb packages now. - -* Tue Dec 16 2014 Andreas Schneider - 4.2.0-0.3.rc2 -- resolves: #1174412 - Build VFS Ceph module. -- resolves: #1169067 - Move libsamba-cluster-support.so to samba-libs package. -- resolves: #1016122 - Move smbpasswd to samba-common package. - -* Fri Nov 21 2014 Andreas Schneider - 4.2.0-0.2.rc2 -- Use alternatives for libwbclient. -- Add cwrap to BuildRequires. - -* Wed Nov 12 2014 Andreas Schneider - 4.2.0-0.1.rc2 -- Update to Samba 4.2.0rc2. - -* Tue Oct 07 2014 Andreas Schneider - 4.1.12-5 -- resolves: #1033595 - Fix segfault in winbind. - -* Wed Sep 24 2014 Andreas Schneider - 4.1.12-1 -- Update to Samba 4.1.12. - -* Tue Sep 09 2014 Jitka Plesnikova - 2:4.1.11-1.4 -- Perl 5.20 mass - -* Wed Aug 27 2014 Jitka Plesnikova - 2:4.1.11-1.3 -- Perl 5.20 rebuild - -* Wed Aug 20 2014 Kalev Lember - 2:4.1.11-1.2 -- Rebuilt for rpm dependency generator failure (#1131892) - -* Mon Aug 18 2014 Fedora Release Engineering - 0:4.1.11-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Fri Aug 1 2014 Jared Smith - 4.1.11-1 -- Update to upstream Samba 4.1.11 release -- resolves: #1126015 - Fix CVE-2014-3560 - -* Mon Jun 23 2014 Guenther Deschner - 4.1.9-3 -- Update to Samba 4.1.9. -- resolves: #1112251 - Fix CVE-2014-0244 and CVE-2014-3493. - -* Wed Jun 11 2014 Guenther Deschner - 4.1.8-3 -- Update to Samba 4.1.8. -- resolves: #1102528 - CVE-2014-0178. - -* Sun Jun 08 2014 Fedora Release Engineering - 2:4.1.6-3.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Thu Apr 03 2014 Andreas Schneider - 4.1.6-3 -- Add systemd integration to the service daemons. - -* Tue Mar 18 2014 Andreas Schneider - 4.1.6-2 -- Created a samba-test-libs package. - -* Tue Mar 11 2014 Andreas Schneider - 4.1.6-1 -- Fix CVE-2013-4496 and CVE-2013-6442. -- Fix installation of pidl. - -* Fri Feb 21 2014 Andreas Schneider - 4.1.5-1 -- Update to Samba 4.1.5. - -* Fri Feb 07 2014 Andreas Schneider - 4.1.4-1 -- Update to Samba 4.1.4. - -* Wed Jan 08 2014 Andreas Schneider - 4.1.3-3 -- resolves: #1042845 - Do not build with libbsd. - -* Tue Dec 10 2013 Guenther Deschner - 4.1.3-2 -- resolves: #1019469 - Fix winbind debug message NULL pointer derreference. - -* Mon Dec 09 2013 Andreas Schneider - 4.1.3-1 -- Update to Samba 4.1.3. -- resolves: #1039454 - CVE-2013-4408. -- resolves: #1039500 - CVE-2012-6150. - -* Mon Nov 25 2013 Andreas Schneider - 4.1.2-1 -- Update to Samba 4.1.2. - -* Mon Nov 18 2013 Guenther Deschner - 4.1.1-3 -- resolves: #948509 - Fix manpage correctness. - -* Fri Nov 15 2013 Andreas Schneider - 4.1.1-2 -- related: #884169 - Fix strict aliasing warnings. - -* Mon Nov 11 2013 Andreas Schneider - 4.1.1-1 -- resolves: #1024544 - Fix CVE-2013-4475. -- Update to Samba 4.1.1. - -* Mon Nov 11 2013 Andreas Schneider - 4.1.0-5 -- related: #884169 - Fix the upgrade path. - -* Wed Oct 30 2013 Andreas Schneider - 4.1.0-4 -- related: #884169 - Add direct dependency to samba-libs in the - glusterfs package. -- resolves: #996567 - Fix userPrincipalName composition. -- related: #884169 - Fix memset call with zero length in in ntdb. - -* Fri Oct 18 2013 Andreas Schneider - 4.1.0-3 -- resolves: #1020329 - Build glusterfs VFS plguin. - -* Tue Oct 15 2013 Andreas Schneider - 4.1.0-2 -- resolves: #1018856 - Fix installation of pam_winbind after upgrade. -- related: #1010722 - Split out a samba-winbind-modules package. -- related: #985609 - -* Fri Oct 11 2013 Andreas Schneider - 4.1.0-1 -- related: #985609 - Update to Samba 4.1.0. - -* Tue Oct 01 2013 Andreas Schneider - 2:4.1.0-0.8 -- related: #985609 - Update to Samba 4.1.0rc4. -- resolves: #1010722 - Split out a samba-winbind-modules package. - -* Wed Sep 11 2013 Andreas Schneider - 2:4.1.0-0.7 -- related: #985609 - Update to Samba 4.1.0rc3. -- resolves: #1005422 - Add support for KEYRING ccache type in pam_winbindd. - -* Wed Sep 04 2013 Andreas Schneider - 2:4.1.0-0.6 -- resolves: #717484 - Enable profiling data support. - -* Thu Aug 22 2013 Guenther Deschner - 2:4.1.0-0.5 -- resolves: #996160 - Fix winbind with trusted domains. - -* Wed Aug 14 2013 Andreas Schneider 2:4.1.0-0.4 -- resolves: #996160 - Fix winbind nbt name lookup segfault. - -* Mon Aug 12 2013 Andreas Schneider - 2:4.1.0-0.3 -- related: #985609 - Update to Samba 4.1.0rc2. - -* Sat Aug 03 2013 Petr Pisar - 2:4.1.0-0.2.rc1.1 -- Perl 5.18 rebuild - -* Wed Jul 24 2013 Andreas Schneider - 2:4.1.0-0.2 -- resolves: #985985 - Fix file conflict between samba and wine. -- resolves: #985107 - Add support for new default location for Kerberos - credential caches. - -* Sat Jul 20 2013 Petr Pisar - 2:4.1.0-0.1.rc1.1 -- Perl 5.18 rebuild - -* Wed Jul 17 2013 Andreas Schneider - 2:4.1.0-0.1 -- Update to Samba 4.1.0rc1. - -* Mon Jul 15 2013 Andreas Schneider - 2:4.0.7-2 -- resolves: #972692 - Build with PIE and full RELRO. -- resolves: #884169 - Add explicit dependencies suggested by rpmdiff. -- resolves: #981033 - Local user's krb5cc deleted by winbind. -- resolves: #984331 - Fix samba-common tmpfiles configuration file in wrong - directory. - -* Wed Jul 03 2013 Andreas Schneider - 2:4.0.7-1 -- Update to Samba 4.0.7. - -* Fri Jun 07 2013 Andreas Schneider - 2:4.0.6-3 -- Add UPN enumeration to passdb internal API (bso #9779). - -* Wed May 22 2013 Andreas Schneider - 2:4.0.6-2 -- resolves: #966130 - Fix build with MIT Kerberos. -- List vfs modules in spec file. - -* Tue May 21 2013 Andreas Schneider - 2:4.0.6-1 -- Update to Samba 4.0.6. -- Remove SWAT. - -* Wed Apr 10 2013 Andreas Schneider - 2:4.0.5-1 -- Update to Samba 4.0.5. -- Add UPN enumeration to passdb internal API (bso #9779). -- resolves: #928947 - samba-doc is obsolete now. -- resolves: #948606 - LogRotate should be optional, and not a hard "Requires". - -* Fri Mar 22 2013 Andreas Schneider - 2:4.0.4-3 -- resolves: #919405 - Fix and improve large_readx handling for broken clients. -- resolves: #924525 - Don't use waf caching. - -* Wed Mar 20 2013 Andreas Schneider - 2:4.0.4-2 -- resolves: #923765 - Improve packaging of README files. - -* Wed Mar 20 2013 Andreas Schneider - 2:4.0.4-1 -- Update to Samba 4.0.4. - -* Mon Mar 11 2013 Andreas Schneider - 2:4.0.3-4 -- resolves: #919333 - Create /run/samba too. - -* Mon Mar 04 2013 Andreas Schneider - 2:4.0.3-3 -- Fix the cache dir to be /var/lib/samba to support upgrades. - -* Thu Feb 14 2013 Andreas Schneider - 2:4.0.3-2 -- resolves: #907915 - libreplace.so => not found - -* Thu Feb 07 2013 Andreas Schneider - 2:4.0.3-1 -- Update to Samba 4.0.3. -- resolves: #907544 - Add unowned directory /usr/lib64/samba. -- resolves: #906517 - Fix pidl code generation with gcc 4.8. -- resolves: #908353 - Fix passdb backend ldapsam as module. - -* Wed Jan 30 2013 Andreas Schneider - 2:4.0.2-1 -- Update to Samba 4.0.2. -- Fixes CVE-2013-0213. -- Fixes CVE-2013-0214. -- resolves: #906002 -- resolves: #905700 -- resolves: #905704 -- Fix conn->share_access which is reset between user switches. -- resolves: #903806 -- Add missing example and make sure we don't introduce perl dependencies. -- resolves: #639470 - -* Wed Jan 16 2013 Andreas Schneider - 2:4.0.1-1 -- Update to Samba 4.0.1. -- Fixes CVE-2013-0172. - -* Mon Dec 17 2012 Andreas Schneider - 2:4.0.0-174 -- Fix typo in winbind-krb-locator post uninstall script. - -* Tue Dec 11 2012 Andreas Schneider - 2:4.0.0-173 -- Update to Samba 4.0.0. - -* Thu Dec 06 2012 Andreas Schneider - 2:4.0.0-171.rc6 -- Fix typo in winbind-krb-locator post uninstall script. - -* Tue Dec 04 2012 Andreas Schneider - 2:4.0.0-170.rc6 -- Update to Samba 4.0.0rc6. -- Add /etc/pam.d/samba for swat to work correctly. -- resolves #882700 - -* Fri Nov 23 2012 Guenther Deschner - 2:4.0.0-169.rc5 -- Make sure ncacn_ip_tcp client code looks for NBT_NAME_SERVER name types. - -* Thu Nov 15 2012 Andreas Schneider - 2:4.0.0-168.rc5 -- Reduce dependencies of samba-devel and create samba-test-devel package. - -* Tue Nov 13 2012 Andreas Schneider - 2:4.0.0-167.rc5 -- Use workaround for winbind default domain only when set. -- Build with old ctdb support. - -* Tue Nov 13 2012 Andreas Schneider - 2:4.0.0-166.rc5 -- Update to Samba 4.0.0rc5. - -* Mon Nov 05 2012 Andreas Schneider - 2:4.0.0-165.rc4 -- Fix library dependencies of libnetapi. - -* Mon Nov 05 2012 Andreas Schneider - 2:4.0.0-164.rc4 -- resolves: #872818 - Fix perl dependencies. - -* Tue Oct 30 2012 Andreas Schneider - 2:4.0.0-163.rc4 -- Update to Samba 4.0.0rc4. - -* Mon Oct 29 2012 Andreas Schneider - 2:4.0.0-162.rc3 -- resolves: #870630 - Fix scriptlets interpeting a comment as argument. - -* Fri Oct 26 2012 Andreas Schneider - 2:4.0.0-161.rc3 -- Add missing Requries for python modules. -- Add NetworkManager dispatcher script for winbind. - -* Fri Oct 19 2012 Andreas Schneider - 2:4.0.0-160.rc3 -- resolves: #867893 - Move /var/log/samba to samba-common package for - winbind which requires it. - -* Thu Oct 18 2012 Andreas Schneider - 2:4.0.0-159.rc3 -- Compile default auth methods into smbd. - -* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-158.rc3 -- Move pam_winbind.conf and the manpages to the right package. - -* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-157.rc3 -* resolves: #866959 - Build auth_builtin as static module. - -* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-156.rc3 -- Update systemd Requires to reflect latest packaging guidelines. - -* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-155.rc3 -- Add back the AES patches which didn't make it in rc3. - -* Tue Oct 16 2012 Andreas Schneider - 2:4.0.0-154.rc3 -- Update to 4.0.0rc3. -- resolves: #805562 - Unable to share print queues. -- resolves: #863388 - Unable to reload smbd configuration with systemctl. - -* Wed Oct 10 2012 Alexander Bokovoy - 2:4.0.0-153.rc2 -- Use alternatives to configure winbind_krb5_locator.so -- Fix Requires for winbind. - -* Thu Oct 04 2012 Andreas Schneider - 2:4.0.0-152.rc2 -- Add kerberos AES support. -- Fix printing initialization. - -* Tue Oct 02 2012 Andreas Schneider - 2:4.0.0-151.rc2 -- Update to 4.0.0rc2. - -* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-150.rc1 -- Fix Obsoletes/Provides for update from samba4. -- Bump release number to be bigger than samba4. - -* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-96.rc1 -- Package smbprint again. - -* Wed Sep 26 2012 Andreas Schneider - 2:4.0.0-95.rc1 -- Update to 4.0.0rc1. - -* Mon Aug 20 2012 Guenther Deschner - 2:3.6.7-94.2 -- Update to 3.6.7 - -* Sat Jul 21 2012 Fedora Release Engineering - 2:3.6.6-93.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Thu Jul 19 2012 Guenther Deschner - 2:3.6.6-93 -- Fix printing tdb upgrade for 3.6.6 -- resolves: #841609 - -* Sun Jul 15 2012 Ville Skyttä - 2:3.6.6-92 -- Call ldconfig at libwbclient and -winbind-clients post(un)install time. -- Fix empty localization files, use %%find_lang to find and %%lang-mark them. -- Escape macros in %%changelog. -- Fix source tarball URL. - -* Tue Jun 26 2012 Guenther Deschner - 2:3.6.6-91 -- Update to 3.6.6 - -* Thu Jun 21 2012 Andreas Schneider - 2:3.6.5-90 -- Fix ldonfig. -- Require systemd for samba-common package. -- resolves: #829197 - -* Mon Jun 18 2012 Andreas Schneider - 2:3.6.5-89 -- Fix usrmove paths. -- resolves: #829197 - -* Tue May 15 2012 Andreas Schneider - 2:3.6.5-88 -- Move tmpfiles.d config to common package as it is needed for smbd and - winbind. -- Make sure tmpfiles get created after installation. - -* Wed May 09 2012 Guenther Deschner - 2:3.6.5-87 -- Correctly use system iniparser library - -* Fri May 04 2012 Andreas Schneider - 2:3.6.5-86 -- Bump Epoch to fix a problem with a Samba4 update in testing. - -* Mon Apr 30 2012 Guenther Deschner - 1:3.6.5-85 -- Security Release, fixes CVE-2012-2111 -- resolves: #817551 - -* Mon Apr 23 2012 Andreas Schneider - 1:3.6.4-84 -- Fix creation of /var/run/samba. -- resolves: #751625 - -* Fri Apr 20 2012 Guenther Deschner - 1:3.6.4-83 -- Avoid private krb5_locate_kdc usage -- resolves: #754783 - -* Thu Apr 12 2012 Jon Ciesla - 1:3.6.4-82 -- Update to 3.6.4 -- Fixes CVE-2012-1182 - -* Mon Mar 19 2012 Andreas Schneider - 1:3.6.3-81 -- Fix provides for of libwclient-devel for samba-winbind-devel. - -* Thu Feb 23 2012 Andreas Schneider - 1:3.6.3-80 -- Add commented out 'max protocol' to the default config. - -* Mon Feb 13 2012 Andreas Schneider - 1:3.6.3-79 -- Create a libwbclient package. -- Replace winbind-devel with libwbclient-devel package. - -* Mon Jan 30 2012 Andreas Schneider - 1:3.6.3-78 -- Update to 3.6.3 -- Fixes CVE-2012-0817 - -* Sat Jan 14 2012 Fedora Release Engineering - 1:3.6.1-77.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - -* Mon Dec 05 2011 Andreas Schneider - 1:3.6.1-77 -- Fix winbind cache upgrade. -- resolves: #760137 - -* Fri Nov 18 2011 Andreas Schneider - 1:3.6.1-76 -- Fix piddir to match with systemd files. -- Fix crash bug in the debug system. -- resolves: #754525 - -* Fri Nov 04 2011 Andreas Schneider - 1:3.6.1-75 -- Fix systemd dependencies -- resolves: #751397 - -* Wed Oct 26 2011 Andreas Schneider - 1:3.6.1-74 -- Update to 3.6.1 - -* Tue Oct 04 2011 Guenther Deschner - 1:3.6.0-73 -- Fix nmbd startup -- resolves: #741630 - -* Tue Sep 20 2011 Tom Callaway - 1:3.6.0-72 -- convert to systemd -- restore epoch from f15 - -* Sat Aug 13 2011 Guenther Deschner - 3.6.0-71 -- Update to 3.6.0 final - -* Sun Jul 31 2011 Guenther Deschner - 3.6.0rc3-70 -- Update to 3.6.0rc3 - -* Tue Jun 07 2011 Guenther Deschner - 3.6.0rc2-69 -- Update to 3.6.0rc2 - -* Tue May 17 2011 Guenther Deschner - 3.6.0rc1-68 -- Update to 3.6.0rc1 - -* Wed Apr 27 2011 Guenther Deschner - 3.6.0pre3-67 -- Update to 3.6.0pre3 - -* Wed Apr 13 2011 Guenther Deschner - 3.6.0pre2-66 -- Update to 3.6.0pre2 - -* Fri Mar 11 2011 Guenther Deschner - 3.6.0pre1-65 -- Enable quota support - -* Wed Feb 09 2011 Fedora Release Engineering - 0:3.6.0-64pre1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Wed Nov 24 2010 Guenther Deschner - 3.6.0pre1-64 -- Add %%ghost entry for /var/run using tmpfs -- resolves: #656685 - -* Thu Aug 26 2010 Guenther Deschner - 3.6.0pre1-63 -- Put winbind krb5 locator plugin into a separate rpm -- resolves: #627181 - -* Tue Aug 03 2010 Guenther Deschner - 3.6.0pre1-62 -- Update to 3.6.0pre1 - -* Wed Jun 23 2010 Guenther Deschner - 3.5.4-61 -- Update to 3.5.4 - -* Wed May 19 2010 Guenther Deschner - 3.5.3-60 -- Update to 3.5.3 -- Make sure nmb and smb initscripts return LSB compliant return codes -- Fix winbind over ipv6 - -* Wed Apr 07 2010 Guenther Deschner - 3.5.2-59 -- Update to 3.5.2 - -* Mon Mar 08 2010 Simo Sorce - 3.5.1-58 -- Security update to 3.5.1 -- Fixes CVE-2010-0728 - -* Mon Mar 08 2010 Guenther Deschner - 3.5.0-57 -- Remove cifs.upcall and mount.cifs entirely - -* Mon Mar 01 2010 Guenther Deschner - 3.5.0-56 -- Update to 3.5.0 - -* Fri Feb 19 2010 Guenther Deschner - 3.5.0rc3-55 -- Update to 3.5.0rc3 - -* Tue Jan 26 2010 Guenther Deschner - 3.5.0rc2-54 -- Update to 3.5.0rc2 - -* Fri Jan 15 2010 Jeff Layton - 3.5.0rc1-53 -- separate out CIFS tools into cifs-utils package - -* Fri Jan 08 2010 Guenther Deschner - 3.5.0rc1-52 -- Update to 3.5.0rc1 - -* Tue Dec 15 2009 Guenther Deschner - 3.5.0pre2-51 -- Update to 3.5.0pre2 -- Remove umount.cifs - -* Wed Nov 25 2009 Guenther Deschner - 3.4.3-49 -- Various updates to inline documentation in default smb.conf file -- resolves: #483703 - -* Thu Oct 29 2009 Guenther Deschner - 3.4.3-48 -- Update to 3.4.3 - -* Fri Oct 09 2009 Simo Sorce - 3.4.2-47 -- Spec file cleanup -- Fix sources upstream location -- Remove conditionals to build talloc and tdb, now they are completely indepent - packages in Fedora -- Add defattr() where missing -- Turn all tabs into 4 spaces -- Remove unused migration script -- Split winbind-clients out of main winbind package to avoid multilib to include - huge packages for no good reason - -* Thu Oct 01 2009 Guenther Deschner - 3.4.2-0.46 -- Update to 3.4.2 -- Security Release, fixes CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906 - -* Wed Sep 16 2009 Tomas Mraz - 3.4.1-0.45 -- Use password-auth common PAM configuration instead of system-auth - -* Wed Sep 09 2009 Guenther Deschner - 3.4.1-0.44 -- Update to 3.4.1 - -* Thu Aug 20 2009 Guenther Deschner - 3.4.0-0.43 -- Fix cli_read() -- resolves: #516165 - -* Thu Aug 06 2009 Guenther Deschner - 3.4.0-0.42 -- Fix required talloc version number -- resolves: #516086 - -* Sun Jul 26 2009 Fedora Release Engineering - 0:3.4.0-0.41.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild - -* Fri Jul 17 2009 Guenther Deschner - 3.4.0-0.41 -- Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX) -- Specify required talloc and tdb version for BuildRequires - -* Fri Jul 03 2009 Guenther Deschner - 3.4.0-0.40 -- Update to 3.4.0 - -* Fri Jun 19 2009 Guenther Deschner - 3.4.0rc1-0.39 -- Update to 3.4.0rc1 - -* Mon Jun 08 2009 Guenther Deschner - 3.4.0pre2-0.38 -- Update to 3.4.0pre2 - -* Thu Apr 30 2009 Guenther Deschner - 3.4.0pre1-0.37 -- Update to 3.4.0pre1 - -* Wed Apr 29 2009 Guenther Deschner - 3.3.4-0.36 -- Update to 3.3.4 - -* Mon Apr 20 2009 Guenther Deschner - 3.3.3-0.35 -- Enable build of idmap_tdb2 for clustered setups - -* Wed Apr 1 2009 Guenther Deschner - 3.3.3-0.34 -- Update to 3.3.3 - -* Thu Mar 26 2009 Simo Sorce - 3.3.2-0.33 -- Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the - configuration -- Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on - startup, causing your own machine not to show up in the network for 5 minutes - if it was the only client in that workgroup (fix committed upstream) - -* Thu Mar 12 2009 Guenther Deschner - 3.3.2-0.31 -- Update to 3.3.2 -- resolves: #489547 - -* Thu Mar 5 2009 Guenther Deschner - 3.3.1-0.30 -- Add libcap-devel to requires list (resolves: #488559) - -* Tue Mar 3 2009 Simo Sorce - 3.3.1-0.29 -- Make the talloc and ldb packages optionsl and disable their build within - the samba3 package, they are now built as part of the samba4 package - until they will both be released as independent packages. - -* Wed Feb 25 2009 Guenther Deschner - 3.3.1-0.28 -- Enable cluster support - -* Tue Feb 24 2009 Guenther Deschner - 3.3.1-0.27 -- Update to 3.3.1 - -* Sat Feb 21 2009 Simo Sorce - 3.3.0-0.26 -- Rename ldb* tools to ldb3* to avoid conflicts with newer ldb releases - -* Tue Feb 3 2009 Guenther Deschner - 3.3.0-0.25 -- Update to 3.3.0 final -- Add upstream fix for ldap connections to AD (Bug #6073) -- Remove bogus perl dependencies (resolves: #473051) - -* Fri Nov 28 2008 Guenther Deschner - 3.3.0-0rc1.24 -- Update to 3.3.0rc1 - -* Thu Nov 27 2008 Simo Sorce - 3.2.5-0.23 -- Security Release, fixes CVE-2008-4314 - -* Thu Sep 18 2008 Guenther Deschner - 3.2.4-0.22 -- Update to 3.2.4 -- resolves: #456889 -- move cifs.upcall to /usr/sbin - -* Wed Aug 27 2008 Guenther Deschner - 3.2.3-0.21 -- Security fix for CVE-2008-3789 - -* Mon Aug 25 2008 Guenther Deschner - 3.2.2-0.20 -- Update to 3.2.2 - -* Mon Aug 11 2008 Simo Sorce - 3.2.1-0.19 -- Add fix for CUPS problem, fixes bug #453951 - -* Wed Aug 6 2008 Simo Sorce - 3.2.1-0.18 -- Update to 3.2.1 - -* Tue Jul 1 2008 Guenther Deschner - 3.2.0-2.17 -- Update to 3.2.0 final -- resolves: #452622 - -* Tue Jun 10 2008 Guenther Deschner - 3.2.0-1.rc2.16 -- Update to 3.2.0rc2 -- resolves: #449522 -- resolves: #448107 - -* Fri May 30 2008 Guenther Deschner - 3.2.0-1.rc1.15 -- Fix security=server -- resolves: #449038, #449039 - -* Wed May 28 2008 Guenther Deschner - 3.2.0-1.rc1.14 -- Add fix for CVE-2008-1105 -- resolves: #446724 - -* Fri May 23 2008 Guenther Deschner - 3.2.0-1.rc1.13 -- Update to 3.2.0rc1 - -* Wed May 21 2008 Simo Sorce - 3.2.0-1.pre3.12 -- make it possible to print against Vista and XP SP3 as servers -- resolves: #439154 - -* Thu May 15 2008 Guenther Deschner - 3.2.0-1.pre3.11 -- Add "net ads join createcomputer=ou1/ou2/ou3" fix (BZO #5465) - -* Fri May 09 2008 Guenther Deschner - 3.2.0-1.pre3.10 -- Add smbclient fix (BZO #5452) - -* Fri Apr 25 2008 Guenther Deschner - 3.2.0-1.pre3.9 -- Update to 3.2.0pre3 - -* Tue Mar 18 2008 Guenther Deschner - 3.2.0-1.pre2.8 -- Add fixes for libsmbclient and support for r/o relocations - -* Mon Mar 10 2008 Guenther Deschner - 3.2.0-1.pre2.7 -- Fix libnetconf, libnetapi and msrpc DSSETUP call - -* Thu Mar 06 2008 Guenther Deschner - 3.2.0-1.pre2.6 -- Create separate packages for samba-winbind and samba-winbind-devel -- Add cifs.spnego helper - -* Wed Mar 05 2008 Guenther Deschner - 3.2.0-1.pre2.3 -- Update to 3.2.0pre2 -- Add talloc and tdb lib and devel packages -- Add domainjoin-gui package - -* Fri Feb 22 2008 Simo Sorce - 3.2.0-0.pre1.3 -- Try to fix GCC 4.3 build -- Add --with-dnsupdate flag and also make sure other flags are required just to - be sure the features are included without relying on autodetection to be - successful - -* Tue Feb 19 2008 Fedora Release Engineering - 0:3.2.0-1.pre1.2 -- Autorebuild for GCC 4.3 - -* Tue Dec 04 2007 Release Engineering - 3.2.0-0.pre1.2 -- Rebuild for openldap bump - -* Thu Oct 18 2007 Guenther Deschner 3.2.0-0.pre1.1.fc9 -- 32/64bit padding fix (affects multilib installations) - -* Mon Oct 8 2007 Simo Sorce 3.2.0-0.pre1.fc9 -- New major relase, minor switched from 0 to 2 -- License change, the code is now GPLv3+ -- Numerous improvements and bugfixes included -- package libsmbsharemodes too -- remove smbldap-tools as they are already packaged separately in Fedora -- Fix bug 245506 - -* Tue Oct 2 2007 Simo Sorce 3.0.26a-1.fc8 -- rebuild with AD DNS Update support - -* Tue Sep 11 2007 Simo Sorce 3.0.26a-0.fc8 -- upgrade to the latest upstream realease -- includes security fixes released today in 3.0.26 - -* Fri Aug 24 2007 Simo Sorce 3.0.25c-4.fc8 -- add fix reported upstream for heavy idmap_ldap memleak - -* Tue Aug 21 2007 Simo Sorce 3.0.25c-3.fc8 -- fix a few places were "open" is used an interfere with the new glibc - -* Tue Aug 21 2007 Simo Sorce 3.0.25c-2.fc8 -- remove old source -- add patch to fix samba bugzilla 4772 - -* Tue Aug 21 2007 Guenther Deschner 3.0.25c-0.fc8 -- update to 3.0.25c - -* Fri Jun 29 2007 Simo Sorce 3.0.25b-3.fc8 -- handle cases defined in #243766 - -* Tue Jun 26 2007 Simo Sorce 3.0.25b-2.fc8 -- update to 3.0.25b -- better error codes for init scripts: #244823 - -* Tue May 29 2007 Günther Deschner -- fix pam_smbpass patch. - -* Fri May 25 2007 Simo Sorce -- update to 3.0.25a as it contains many fixes -- add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut. - -* Mon May 14 2007 Simo Sorce -- final 3.0.25 -- includes security fixes for CVE-2007-2444,CVE-2007-2446,CVE-2007-2447 - -* Mon Apr 30 2007 Günther Deschner -- move to 3.0.25rc3 - -* Thu Apr 19 2007 Simo Sorce -- fixes in the spec file -- moved to 3.0.25rc1 -- addedd patches (merged upstream so they will be removed in 3.0.25rc2) - -* Wed Apr 4 2007 Simo Sorce 3.0.24-12.fc7 -- fixes in smb.conf -- advice in smb.conf to put scripts in /var/lib/samba/scripts -- create /var/lib/samba/scripts so that selinux can be happy -- fix Vista problems with msdfs errors - -* Tue Apr 03 2007 Guenther Deschner 3.0.24-11.fc7 -- enable PAM and NSS dlopen checks during build -- fix unresolved symbols in libnss_wins.so (bug #198230) - -* Fri Mar 30 2007 Simo Sorce 3.0.24-10.fc7 -- set passdb backend = tdbsam as default in smb.conf -- remove samba-docs dependency from swat, that was a mistake -- put back COPYING and other files in samba-common -- put examples in samba not in samba-docs -- leave only stuff under docs/ in samba-doc - -* Thu Mar 29 2007 Simo Sorce 3.0.24-9.fc7 -- integrate most of merge review proposed changes (bug #226387) -- remove libsmbclient-devel-static and simply stop shipping the - static version of smbclient as it seem this is deprecated and - actively discouraged - -* Wed Mar 28 2007 Simo Sorce 3.0.24-8.fc7 -- fix for bug #176649 - -* Mon Mar 26 2007 Simo Sorce -- remove patch for bug 106483 as it introduces a new bug that prevents - the use of a credentials file with the smbclient tar command -- move the samba private dir from being the same as the config dir - (/etc/samba) to /var/lib/samba/private - -* Mon Mar 26 2007 Simo Sorce 3.0.24-7.fc7 -- make winbindd start earlier in the init process, at the same time - ypbind is usually started as well -- add a sepoarate init script for nmbd called nmb, we need to be able - to restart nmbd without dropping al smbd connections unnecessarily - -* Fri Mar 23 2007 Simo Sorce -- add samba.schema to /etc/openldap/schema - -* Thu Mar 22 2007 Florian La Roche -- adjust the Requires: for the scripts, add "chkconfig --add smb" - -* Tue Mar 20 2007 Simo Sorce 3.0.24-6.fc7 -- do not put comments inline on smb.conf options, they may be read - as part of the value (for example log files names) - -* Mon Mar 19 2007 Simo Sorce 3.0.24-5.fc7 -- actually use the correct samba.pamd file not the old samba.pamd.stack file -- fix logifles and use upstream convention of log.* instead of our old *.log - Winbindd creates its own log.* files anyway so we will be more consistent -- install our own (enhanced) default smb.conf file -- Fix pam_winbind acct_mgmt PAM result code (prevented local users from - logging in). Fixed by Guenther. -- move some files from samba to samba-common as they are used with winbindd - as well - -* Fri Mar 16 2007 Guenther Deschner 3.0.24-4.fc7 -- fix arch macro which reported Vista to Samba clients. - -* Thu Mar 15 2007 Simo Sorce 3.0.24-3.fc7 -- Directories reorg, tdb files must go to /var/lib, not - to /var/cache, add migration script in %%post common -- Split out libsmbclient, devel and doc packages -- Remove libmsrpc.[h|so] for now as they are not really usable -- Remove kill -HUP from rotate, samba use -HUP for other things - noit to reopen logs - -* Tue Feb 20 2007 Simo Sorce 3.0.24-2.fc7 -- New upstream release -- Fix packaging issue wrt idmap modules used only by smbd -- Addedd Vista Patchset for compatibility with Windows Vista -- Change default of "msdfs root", it seem to cause problems with - some applications and it has been proposed to change it for - 3.0.25 upstream - -* Fri Sep 1 2006 Jay Fenlason 3.0.23c-2 -- New upstream release. - -* Tue Aug 8 2006 Jay Fenlason 3.0.23b-2 -- New upstream release. - -* Mon Jul 24 2006 Jay Fenlason 3.0.23a-3 -- Fix the -logfiles patch to close - bz#199607 Samba compiled with wrong log path. - bz#199206 smb.conf has incorrect log file path - -* Mon Jul 24 2006 Jay Fenlason 3.0.23a-2 -- Upgrade to new upstream 3.0.23a -- include upstream samr_alias patch - -* Tue Jul 11 2006 Jay Fenlason 3.0.23-2 -- New upstream release. -- Use modified filter-requires-samba.sh from packaging/RHEL/setup/ - to get rid of bogus dependency on perl(Unicode::MapUTF8) -- Update the -logfiles and -smb.conf patches to work with 3.0.23 - -* Thu Jul 6 2006 Jay Fenlason 3.0.23-0.RC3 -- New upstream RC release. -- Update the -logfiles, and -passwd patches for - 3.0.23rc3 -- Include the change to smb.init from Bastien Nocera ) - to close - bz#182560 Wrong retval for initscript when smbd is dead -- Update this spec file to build with 3.0.23rc3 -- Remove the -install.mount.smbfs patch, since we don't install - mount.smbfs any more. - -* Wed Jun 14 2006 Tomas Mraz - 2.0.21c-3 -- rebuilt with new gnutls - -* Fri Mar 17 2006 Jay Fenlason 2.0.21c-2 -- New upstream version. - -* Mon Feb 13 2006 Jay Fenlason 3.0.21b-2 -- New upstream version. -- Since the rawhide kernel has dropped support for smbfs, remove smbmount - and smbumount. Users should use mount.cifs instead. -- Upgrade to 3.0.21b - -* Fri Feb 10 2006 Jesse Keating - 0:3.0.20b-2.1.1 -- bump again for double-long bug on ppc(64) - -* Fri Dec 09 2005 Jesse Keating -- rebuilt - -* Sun Nov 13 2005 Jay Fenlason 3.0.20b-2 -- turn on -DLDAP_DEPRECATED to allow access to ldap functions that have - been depricated in 2.3.11, but which don't have well-documented - replacements (ldap_simple_bind_s(), for example). -- Upgrade to 3.0.20b, which includes all the previous upstream patches. -- Updated the -warnings patch for 3.0.20a. -- Include --with-shared-modules=idmap_ad,idmap_rid to close - bz#156810 --with-shared-modules=idmap_ad,idmap_rid -- Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close - bz#170259 pam_stack is deprecated - -* Sun Nov 13 2005 Warren Togami 3.0.20-3 -- epochs from deps, req exact release -- rebuild against new openssl - -* Mon Aug 22 2005 Jay Fenlason 3.0.20-2 -- New upstream release - Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3, - -regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1 - This obsoletes the -pie and -delim patches - the -warning and -gcc4 patches are obsolete too - The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1 - Also, the -quoting patch was implemented differently upstream - There is now a umount.cifs executable and manpage - We run autogen.sh as part of the build phase - The testprns command is now gone - libsmbclient now has a man page -- Include -bug106483 patch to close - bz#106483 smbclient: -N negates the provided password, despite documentation -- Added the -warnings patch to quiet some compiler warnings. -- Removed many obsolete patches from CVS. - -* Mon May 2 2005 Jay Fenlason 3.0.14a-2 -- New upstream release. -- the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1, - winbind_find_dc_v2 patches are now obsolete. - -* Thu Apr 7 2005 Jay Fenlason 3.0.13-2 -- New upstream release -- add my -quoting patch, to fix swat with strings that contain - html meta-characters, and to use correct quote characters in - lists, closing bz#134310 -- include the upstream winbindd_2k3sp1 patch -- include the -smbclient patch. -- include the -hang patch from upstream. - -* Thu Mar 24 2005 Florian La Roche -- add a "exit 0" to the postun of the main samba package - -* Wed Mar 2 2005 Tomas Mraz 3.0.11-5 -- rebuild with openssl-0.9.7e - -* Thu Feb 24 2005 Jay Fenlason 3.0.11-4 -- Use the updated filter-requires-samba.sh file, so we don't accidentally - pick up a dependency on perl(Crypt::SmbHash) - -* Fri Feb 18 2005 Jay Fenlason 3.0.11-3 -- add -gcc4 patch to compile with gcc 4. -- remove the now obsolete -smbclient-kerberos.patch -- Include four upstream patches from - http://samba.org/~jerry/patches/post-3.0.11/ - (Slightly modified the winbind_find_dc_v2 patch to apply easily with - rpmbuild). - -* Fri Feb 4 2005 Jay Fenlason 3.0.11-2 -- include -smbspool patch to close bz#104136 - -* Wed Jan 12 2005 Jay Fenlason 3.0.10-4 -- Update the -man patch to fix ntlm_auth.1 too. -- Move pam_smbpass.so to the -common package, so both the 32 - and 64-bit versions will be installed on multiarch platforms. - This closes bz#143617 -- Added new -delim patch to fix mount.cifs so it can accept - passwords with commas in them (via environment or credentials - file) to close bz#144198 - -* Wed Jan 12 2005 Tim Waugh 3.0.10-3 -- Rebuilt for new readline. - -* Fri Dec 17 2004 Jay Fenlason 3.0.10-2 -- New upstream release that closes CAN-2004-1154 bz#142544 -- Include the -64bit patch from Nalin. This closes bz#142873 -- Update the -logfiles patch to work with 3.0.10 -- Create /var/run/winbindd and make it part of the -common rpm to close - bz#142242 - -* Mon Nov 22 2004 Jay Fenlason 3.0.9-2 -- New upstream release. This obsoletes the -secret patch. - Include my changetrustpw patch to make "net ads changetrustpw" stop - aborting. This closes #134694 -- Remove obsolete triggers for ancient samba versions. -- Move /var/log/samba to the -common rpm. This closes #76628 -- Remove the hack needed to get around the bad docs files in the - 3.0.8 tarball. -- Change the comment in winbind.init to point at the correct pidfile. - This closes #76641 - -* Mon Nov 22 2004 Than Ngo 3.0.8-4 -- fix unresolved symbols in libsmbclient which caused applications - such as KDE's konqueror to fail when accessing smb:// URLs. #139894 - -* Thu Nov 11 2004 Jay Fenlason 3.0.8-3.1 -- Rescue the install.mount.smbfs patch from Juanjo Villaplana - (villapla@si.uji.es) to prevent building the srpm from trashing your - installed /usr/bin/smbmount - -* Tue Nov 9 2004 Jay Fenlason 3.0.8-3 -- Include the corrected docs tarball, and use it instead of the - obsolete docs from the upstream 3.0.8 tarball. -- Update the logfiles patch to work with the updated docs. - -* Mon Nov 8 2004 Jay Fenlason 3.0.8-2 -- New upstream version fixes CAN-2004-0930. This obsoletes the - disable-sendfile, salt, signing-shortkey and fqdn patches. -- Add my ugly non-ascii-domain patch. -- Updated the pie patch for 3.0.8. -- Updated the logfiles patch for 3.0.8. - -* Tue Oct 26 2004 Jay Fenlason 3.0.8-0.pre2 -- New upstream version -- Add Nalin's signing-shortkey patch. - -* Tue Oct 19 2004 Jay Fenlason 3.0.8-0.pre1.3 -- disable the -salt patch, because it causes undefined references in - libsmbclient that prevent gnome-vfs from building. - -* Fri Oct 15 2004 Jay Fenlason 3.0.8-0.pre1.2 -- Re-enable the x_fclose patch that was accidentally disabled - in 3.0.8-0.pre1.1. This closes #135832 -- include Nalin's -fqdn and -salt patches. - -* Wed Oct 13 2004 Jay Fenlason 3.0.8-0.pre1.1 -- Include disable-sendfile patch to default "use sendfile" to "no". - This closes #132779 - -* Wed Oct 6 2004 Jay Fenlason -- Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies - smbmnt to work with 32-bit uids. - -* Mon Sep 27 2004 Jay Fenlason 3.0.8-0.pre1 -- new upstream release. This obsoletes the ldapsam_compat patches. - -* Wed Sep 15 2004 Jay Fenlason 3.0.7-4 -- Update docs section to not carryover the docs/manpages directory - This moved many files from /usr/share/doc/samba-3.0.7/docs/* to - /usr/share/doc/samba-3.0.7/* -- Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu) - to correctly create libsmbclient.so.0 and to use %%_initrddir instead - of rolling our own. This closes #132642 -- Add patch to default "use sendfile" to no, since sendfile appears to - be broken -- Add patch from Volker Lendecke to help make - ldapsam_compat work again. -- Add patch from "Vince Brimhall" for ldapsam_compat - These two patches close bugzilla #132169 - -* Mon Sep 13 2004 Jay Fenlason 3.0.7-3 -- Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808 - This obsoletes the 3.0.6-schema patch. -- Update BuildRequires line to include openldap-devel openssl-devel - and cups-devel - -* Mon Aug 16 2004 Jay Fenlason 3.0.6-3 -- New upstream version. -- Include post 3.0.6 patch from "Gerald (Jerry) Carter" - to fix a duplicate in the LDAP schema. -- Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com) - to allow correct timestamp handling on 64-bit platforms and fix #126109. -- reenable the -pie patch. Samba is too widely used, and too vulnerable - to potential security holes to disable an important security feature - like -pie. The correct fix is to have the toolchain not create broken - executables when programs compiled -pie are stripped. -- Remove obsolete patches. -- Modify this spec file to put libsmbclient.{a,so} in the right place on - x86_64 machines. - -* Thu Aug 5 2004 Jason Vas Dias 3.0.5-3 -- Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination -- resulted in executables getting corrupt stacks, causing smbmnt to -- get a SIGBUS in the mount() call (bug 127420). - -* Fri Jul 30 2004 Jay Fenlason 3.0.5-2 -- Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a - security fix. -- Include the 3.0.4-backport patch from the 3E branch. This restores - some of the 3.0.5pre1 and 3.0.5rc1 functionality. - -* Tue Jul 20 2004 Jay Fenlason 3.0.5-0.pre1.1 -- Backport base64_decode patche to close CAN-2004-0500 -- Backport hash patch to close CAN-2004-0686 -- use_authtok patch from Nalin Dahyabhai -- smbclient-kerberos patch from Alexander Larsson -- passwd patch uses "*" instead of "x" for "hashed" passwords for - accounts created by winbind. "x" means "password is in /etc/shadow" to - brain-damaged pam_unix module. - -* Fri Jul 2 2004 Jay Fenlason 3.0.5.0pre1.0 -- New upstream version -- use %% { SOURCE1 } instead of a hardcoded path -- include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org) - https://bugzilla.samba.org/show_bug.cgi?id=1315 - to make winbindd work against Windows versions that do not have - 128 bit encryption enabled. -- Moved %%{_bindir}/net to the -common package, so that folks who just - want to use winbind, etc don't have to install -client in order to - "net join" their domain. -- New upstream version obsoletes the patches added in 3.0.3-5 -- Remove smbgetrc.5 man page, since we don't ship smbget. - -* Tue Jun 15 2004 Elliot Lee -- rebuilt - -* Tue May 4 2004 Jay Fenlason 3.0.3-5 -- Patch to allow password changes from machines patched with - Microsoft hotfix MS04-011. -- Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302 - and https://bugzilla.samba.org/show_bug.cgi?id=1309 - -* Thu Apr 29 2004 Jay Fenlason 3.0.3-4 -- Samba 3.0.3 released. - -* Wed Apr 21 2004 jay Fenlason 3.0.3-3.rc1 -- New upstream version -- updated spec file to make libsmbclient.so executable. This closes - bugzilla #121356 - -* Mon Apr 5 2004 Jay Fenlason 3.0.3-2.pre2 -- New upstream version -- Updated configure line to remove --with-fhs and to explicitly set all - the directories that --with-fhs was setting. We were overriding most of - them anyway. This closes #118598 - -* Mon Mar 15 2004 Jay Fenlason 3.0.3-1.pre1 -- New upstream version. -- Updated -pie and -logfiles patches for 3.0.3pre1 -- add krb5-devel to buildrequires, fixes #116560 -- Add patch from Miloslav Trmac (mitr@volny.cz) to allow non-root to run - "service smb status". This fixes #116559 - -* Tue Mar 02 2004 Elliot Lee -- rebuilt - -* Mon Feb 16 2004 Jay Fenlason 3.0.2a-1 -- Upgrade to 3.0.2a - -* Mon Feb 16 2004 Karsten Hopp 3.0.2-7 -- fix ownership in -common package - -* Fri Feb 13 2004 Elliot Lee -- rebuilt - -* Fri Feb 13 2004 Jay Fenlason -- Change all requires lines to list an explicit epoch. Closes #102715 -- Add an explicit Epoch so that %%{epoch} is defined. - -* Mon Feb 9 2004 Jay Fenlason 3.0.2-5 -- New upstream version: 3.0.2 final includes security fix for #114995 - (CAN-2004-0082) -- Edit postun script for the -common package to restart winbind when - appropriate. Fixes bugzilla #114051. - -* Mon Feb 2 2004 Jay Fenlason 3.0.2-3rc2 -- add %%dir entries for %%{_libdir}/samba and %%{_libdir}/samba/charset -- Upgrade to new upstream version -- build mount.cifs for the new cifs filesystem in the 2.6 kernel. - -* Mon Jan 19 2004 Jay Fenlason 3.0.2-1rc1 -- Upgrade to new upstream version - -* Wed Dec 17 2003 Felipe Alfaro Solana 3.0.1-1 -- Update to 3.0.1 -- Removed testparm patch as it's already merged -- Removed Samba.7* man pages -- Fixed .buildroot patch -- Fixed .pie patch -- Added new /usr/bin/tdbdump file - -* Thu Sep 25 2003 Jay Fenlason 3.0.0-15 -- New 3.0.0 final release -- merge nmbd-netbiosname and testparm patches from 3E branch -- updated the -logfiles patch to work against 3.0.0 -- updated the pie patch -- update the VERSION file during build -- use make -j if avaliable -- merge the winbindd_privileged change from 3E -- merge the "rm /usr/lib" patch that allows Samba to build on 64-bit - platforms despite the broken Makefile - -* Mon Aug 18 2003 Jay Fenlason -- Merge from samba-3E-branch after samba-3.0.0rc1 was released - -* Wed Jul 23 2003 Jay Fenlason 3.0.0-3beta3 -- Merge from 3.0.0-2beta3.3E -- (Correct log file names (#100981).) -- (Fix pidfile directory in samab.log) -- (Remove obsolete samba-3.0.0beta2.tar.bz2.md5 file) -- (Move libsmbclient to the -common package (#99449)) - -* Sun Jun 22 2003 Nalin Dahyabhai 2.2.8a-4 -- rebuild - -* Wed Jun 04 2003 Elliot Lee -- rebuilt - -* Wed May 28 2003 Jay Fenlason 2.2.8a-2 -- add libsmbclient.so for gnome-vfs-extras -- Edit specfile to specify /var/run for pid files -- Move /tmp/.winbindd/socket to /var/run/winbindd/socket - -* Wed May 14 2003 Florian La Roche -- add proper ldconfig calls - -* Thu Apr 24 2003 Jay Fenlason 2.2.8a-1 -- upgrade to 2.2.8a -- remove old .md5 files -- add "pid directory = /var/run" to the smb.conf file. Fixes #88495 -- Patch from jra@dp.samba.org to fix a delete-on-close regression - -* Mon Mar 24 2003 Jay Fenlason 2.2.8-0 -- Upgrade to 2.2.8 -- removed commented out patches. -- removed old patches and .md5 files from the repository. -- remove duplicate /sbin/chkconfig --del winbind which causes - warnings when removing samba. -- Fixed minor bug in smbprint that causes it to fail when called with - more than 10 parameters: the accounting file (and spool directory - derived from it) were being set wrong due to missing {}. This closes - bug #86473. -- updated smb.conf patch, includes new defaults to close bug #84822. - -* Mon Feb 24 2003 Elliot Lee -- rebuilt - -* Thu Feb 20 2003 Jonathan Blandford 2.2.7a-5 -- remove swat.desktop file - -* Thu Feb 20 2003 Nalin Dahyabhai 2.2.7a-4 -- relink libnss_wins.so with SHLD="%%{__cc} -lnsl" to force libnss_wins.so to - link with libnsl, avoiding unresolved symbol errors on functions in libnsl - -* Mon Feb 10 2003 Jay Fenlason 2.2.7a-3 -- edited spec file to put .so files in the correct directories - on 64-bit platforms that have 32-bit compatability issues - (sparc64, x86_64, etc). This fixes bugzilla #83782. -- Added samba-2.2.7a-error.patch from twaugh. This fixes - bugzilla #82454. - -* Wed Jan 22 2003 Tim Powers -- rebuilt - -* Thu Jan 9 2003 Jay Fenlason 2.2.7a-1 -- Update to 2.2.7a -- Change default printing system to CUPS -- Turn on pam_smbpass -- Turn on msdfs - -* Sat Jan 4 2003 Jeff Johnson 2.2.7-5 -- use internal dep generator. - -* Sat Dec 14 2002 Tim Powers 2.2.7-4 -- don't use rpms internal dep generator - -* Mon Dec 02 2002 Elliot Lee 2.2.7-3 -- Fix missing doc files. -- Fix multilib issues - -* Wed Nov 20 2002 Bill Nottingham 2.2.7-2 -- update to 2.2.7 -- add patch for LFS in smbclient () - -* Wed Aug 28 2002 Trond Eivind Glomsød 2.2.5-10 -- logrotate fixes (#65007) - -* Mon Aug 26 2002 Trond Eivind Glomsrød 2.2.5-9 -- /usr/lib was used in place of %%{_libdir} in three locations (#72554) - -* Mon Aug 5 2002 Trond Eivind Glomsrød 2.2.5-8 -- Initscript fix (#70720) - -* Fri Jul 26 2002 Trond Eivind Glomsrød 2.2.5-7 -- Enable VFS support and compile the "recycling" module (#69796) -- more selective includes of the examples dir - -* Tue Jul 23 2002 Trond Eivind Glomsrød 2.2.5-6 -- Fix the lpq parser for better handling of LPRng systems (#69352) - -* Tue Jul 23 2002 Trond Eivind Glomsrød 2.2.5-5 -- desktop file fixes (#69505) - -* Wed Jun 26 2002 Trond Eivind Glomsrød 2.2.5-4 -- Enable ACLs - -* Tue Jun 25 2002 Trond Eivind Glomsrød 2.2.5-3 -- Make it not depend on Net::LDAP - those are doc files and examples - -* Fri Jun 21 2002 Tim Powers -- automated rebuild - -* Thu Jun 20 2002 Trond Eivind Glomsrød 2.2.5-1 -- 2.2.5 - -* Fri Jun 14 2002 Trond Eivind Glomsrød 2.2.4-5 -- Move the post/preun of winbind into the -common subpackage, - where the script is (#66128) - -* Tue Jun 4 2002 Trond Eivind Glomsrød 2.2.4-4 -- Fix pidfile locations so it runs properly again (2.2.4 - added a new directtive - #65007) - -* Thu May 23 2002 Tim Powers -- automated rebuild - -* Tue May 14 2002 Trond Eivind Glomsrød 2.2.4-2 -- Fix #64804 - -* Thu May 9 2002 Trond Eivind Glomsrød 2.2.4-1 -- 2.2.4 -- Removed some zero-length and CVS internal files -- Make it build - -* Wed Apr 10 2002 Trond Eivind Glomsrød 2.2.3a-6 -- Don't use /etc/samba.d in smbadduser, it should be /etc/samba - -* Thu Apr 4 2002 Trond Eivind Glomsrød 2.2.3a-5 -- Add libsmbclient.a w/headerfile for KDE (#62202) - -* Tue Mar 26 2002 Trond Eivind Glomsrød 2.2.3a-4 -- Make the logrotate script look the correct place for the pid files - -* Thu Mar 14 2002 Nalin Dahyabhai 2.2.3a-3 -- include interfaces.o in pam_smbpass.so, which needs symbols from interfaces.o - (patch posted to samba-list by Ilia Chipitsine) - -* Thu Feb 21 2002 Trond Eivind Glomsrød 2.2.3a-2 -- Rebuild - -* Thu Feb 7 2002 Trond Eivind Glomsrød 2.2.3a-1 -- 2.2.3a - -* Mon Feb 4 2002 Trond Eivind Glomsrød 2.2.3-1 -- 2.2.3 - -* Thu Nov 29 2001 Trond Eivind Glomsrød 2.2.2-8 -- New pam configuration file for samba - -* Tue Nov 27 2001 Trond Eivind Glomsrød 2.2.2-7 -- Enable PAM session controll and password sync - -* Tue Nov 13 2001 Trond Eivind Glomsrød 2.2.2-6 -- Move winbind files to samba-common. Add separate initscript for - winbind -- Fixes for winbind - protect global variables with mutex, use - more secure getenv - -* Thu Nov 8 2001 Trond Eivind Glomsrød 2.2.2-5 -- Teach smbadduser about "getent passwd" -- Fix more pid-file references -- Add (conditional) winbindd startup to the initscript, configured in - /etc/sysconfig/samba - -* Wed Nov 7 2001 Trond Eivind Glomsrød 2.2.2-4 -- Fix pid-file reference in logrotate script -- include pam and nss modules for winbind - -* Mon Nov 5 2001 Trond Eivind Glomsrød 2.2.2-3 -- Add "--with-utmp" to configure options (#55372) -- Include winbind, pam_smbpass.so, rpcclient and smbcacls -- start using /var/cache/samba, we need to keep state and there is - more than just locks involved - -* Sat Nov 03 2001 Florian La Roche 2.2.2-2 -- add "reload" to the usage string in the startup script - -* Mon Oct 15 2001 Trond Eivind Glomsrød 2.2.2-1 -- 2.2.2 - -* Tue Sep 18 2001 Trond Eivind Glomsrød 2.2.1a-5 -- Add patch from Jeremy Allison to fix IA64 alignment problems (#51497) - -* Mon Aug 13 2001 Trond Eivind Glomsrød -- Don't include smbpasswd in samba, it's in samba-common (#51598) -- Add a disabled "obey pam restrictions" statement - it's not - active, as we use encrypted passwords, but if the admin turns - encrypted passwords off the choice is available. (#31351) - -* Wed Aug 8 2001 Trond Eivind Glomsrød -- Use /var/cache/samba instead of /var/lock/samba -- Remove "domain controller" keyword from smb.conf, it's - deprecated (from #13704) -- Sync some examples with smb.conf.default -- Fix password synchronization (#16987) - -* Fri Jul 20 2001 Trond Eivind Glomsrød -- Tweaks of BuildRequires (#49581) - -* Wed Jul 11 2001 Trond Eivind Glomsrød -- 2.2.1a bugfix release - -* Tue Jul 10 2001 Trond Eivind Glomsrød -- 2.2.1, which should work better for XP - -* Sat Jun 23 2001 Trond Eivind Glomsrød -- 2.2.0a security fix -- Mark lograte and pam configuration files as noreplace - -* Fri Jun 22 2001 Trond Eivind Glomsrød -- Add the /etc/samba directory to samba-common - -* Thu Jun 21 2001 Trond Eivind Glomsrød -- Add improvements to the smb.conf as suggested in #16931 - -* Tue Jun 19 2001 Trond Eivind Glomsrød -- (these changes are from the non-head version) -- Don't include /usr/sbin/samba, it's the same as the initscript -- unset TMPDIR, as samba can't write into a TMPDIR owned - by root (#41193) -- Add pidfile: lines for smbd and nmbd and a config: line - in the initscript (#15343) -- don't use make -j -- explicitly include /usr/share/samba, not just the files in it - -* Tue Jun 19 2001 Bill Nottingham -- mount.smb/mount.smbfs go in /sbin, *not* %%{_sbindir} - -* Fri Jun 8 2001 Preston Brown -- enable encypted passwords by default - -* Thu Jun 7 2001 Helge Deller -- build as 2.2.0-1 release -- skip the documentation-directories docbook, manpages and yodldocs -- don't include *.sgml documentation in package -- moved codepage-directory to /usr/share/samba/codepages -- make it compile with glibc-2.2.3-10 and kernel-headers-2.4.2-2 - -* Mon May 21 2001 Helge Deller -- updated to samba 2.2.0 -- moved codepages to %%{_datadir}/samba/codepages -- use all available CPUs for building rpm packages -- use %%{_xxx} defines at most places in spec-file -- "License:" replaces "Copyright:" -- dropped excludearch sparc -- de-activated japanese patches 100 and 200 for now - (they need to be fixed and tested wth 2.2.0) -- separated swat.desktop file from spec-file and added - german translations -- moved /etc/sysconfig/samba to a separate source-file -- use htmlview instead of direct call to netscape in - swat.desktop-file - -* Mon May 7 2001 Bill Nottingham -- device-remove security fix again () - -* Fri Apr 20 2001 Bill Nottingham -- fix tempfile security problems, officially () -- update to 2.0.8 - -* Sun Apr 8 2001 Bill Nottingham -- turn of SSL, kerberos - -* Thu Apr 5 2001 Bill Nottingham -- fix tempfile security problems (patch from ) - -* Thu Mar 29 2001 Bill Nottingham -- fix quota support, and quotas with the 2.4 kernel (#31362, #33915) - -* Mon Mar 26 2001 Nalin Dahyabhai -- tweak the PAM code some more to try to do a setcred() after initgroups() -- pull in all of the optflags on i386 and sparc -- don't explicitly enable Kerberos support -- it's only used for password - checking, and if PAM is enabled it's a no-op anyway - -* Mon Mar 5 2001 Tim Waugh -- exit successfully from preun script (bug #30644). - -* Fri Mar 2 2001 Nalin Dahyabhai -- rebuild in new environment - -* Wed Feb 14 2001 Bill Nottingham -- updated japanese stuff (#27683) - -* Fri Feb 9 2001 Bill Nottingham -- fix trigger (#26859) - -* Wed Feb 7 2001 Bill Nottingham -- add i18n support, japanese patch (#26253) - -* Wed Feb 7 2001 Trond Eivind Glomsrød -- i18n improvements in initscript (#26537) - -* Wed Jan 31 2001 Bill Nottingham -- put smbpasswd in samba-common (#25429) - -* Wed Jan 24 2001 Bill Nottingham -- new i18n stuff - -* Sun Jan 21 2001 Bill Nottingham -- rebuild - -* Thu Jan 18 2001 Bill Nottingham -- i18n-ize initscript -- add a sysconfig file for daemon options (#23550) -- clarify smbpasswd man page (#23370) -- build with LFS support (#22388) -- avoid extraneous pam error messages (#10666) -- add Urban Widmark's bug fixes for smbmount (#19623) -- fix setgid directory modes (#11911) -- split swat into subpackage (#19706) - -* Wed Oct 25 2000 Nalin Dahyabhai -- set a default CA certificate path in smb.conf (#19010) -- require openssl >= 0.9.5a-20 to make sure we have a ca-bundle.crt file - -* Mon Oct 16 2000 Bill Nottingham -- fix swat only_from line (#18726, others) -- fix attempt to write outside buildroot on install (#17943) - -* Mon Aug 14 2000 Bill Nottingham -- add smbspool back in (#15827) -- fix absolute symlinks (#16125) - -* Sun Aug 6 2000 Philipp Knirsch -- bugfix for smbadduser script (#15148) - -* Mon Jul 31 2000 Matt Wilson -- patch configure.ing (patch11) to disable cups test -- turn off swat by default - -* Fri Jul 28 2000 Bill Nottingham -- fix condrestart stuff - -* Fri Jul 21 2000 Bill Nottingham -- add copytruncate to logrotate file (#14360) -- fix init script (#13708) - -* Sat Jul 15 2000 Bill Nottingham -- move initscript back -- remove 'Using Samba' book from %%doc -- move stuff to /etc/samba (#13708) -- default configuration tweaks (#13704) -- some logrotate tweaks - -* Wed Jul 12 2000 Prospector -- automatic rebuild - -* Tue Jul 11 2000 Bill Nottingham -- fix logrotate script (#13698) - -* Thu Jul 6 2000 Bill Nottingham -- fix initscripts req (prereq /etc/init.d) - -* Wed Jul 5 2000 Than Ngo -- add initdir macro to handle the initscript directory -- add a new macro to handle /etc/pam.d/system-auth - -* Thu Jun 29 2000 Nalin Dahyabhai -- enable Kerberos 5 and SSL support -- patch for duplicate profile.h headers - -* Thu Jun 29 2000 Bill Nottingham -- fix init script - -* Tue Jun 27 2000 Bill Nottingham -- rename samba logs (#11606) - -* Mon Jun 26 2000 Bill Nottingham -- initscript munging - -* Fri Jun 16 2000 Bill Nottingham -- configure the swat stuff usefully -- re-integrate some specfile tweaks that got lost somewhere - -* Thu Jun 15 2000 Bill Nottingham -- rebuild to get rid of cups dependency - -* Wed Jun 14 2000 Nalin Dahyabhai -- tweak logrotate configurations to use the PID file in /var/lock/samba - -* Sun Jun 11 2000 Bill Nottingham -- rebuild in new environment - -* Thu Jun 1 2000 Nalin Dahyabhai -- change PAM setup to use system-auth - -* Mon May 8 2000 Bill Nottingham -- fixes for ia64 - -* Sat May 6 2000 Bill Nottingham -- switch to %%configure - -* Wed Apr 26 2000 Nils Philippsen -- version 2.0.7 - -* Sun Mar 26 2000 Florian La Roche -- simplify preun - -* Thu Mar 16 2000 Bill Nottingham -- fix yp_get_default_domain in autoconf -- only link against readline for smbclient -- fix log rotation (#9909) - -* Fri Feb 25 2000 Bill Nottingham -- fix trigger, again. - -* Mon Feb 7 2000 Bill Nottingham -- fix trigger. - -* Fri Feb 4 2000 Bill Nottingham -- turn on quota support - -* Mon Jan 31 2000 Cristian Gafton -- rebuild to fox dependencies -- man pages are compressed - -* Fri Jan 21 2000 Bill Nottingham -- munge post scripts slightly - -* Wed Jan 19 2000 Bill Nottingham -- turn on mmap again. Wheee. -- ship smbmount on alpha - -* Mon Dec 6 1999 Bill Nottingham -- turn off mmap. ;) - -* Wed Dec 1 1999 Bill Nottingham -- change /var/log/samba to 0700 -- turn on mmap support - -* Thu Nov 11 1999 Bill Nottingham -- update to 2.0.6 - -* Fri Oct 29 1999 Bill Nottingham -- add a %%defattr for -common - -* Tue Oct 5 1999 Bill Nottingham -- shift some files into -client -- remove /home/samba from package. - -* Tue Sep 28 1999 Bill Nottingham -- initscript oopsie. killproc -HUP, not other way around. - -* Sun Sep 26 1999 Bill Nottingham -- script cleanups. Again. - -* Wed Sep 22 1999 Bill Nottingham -- add a patch to fix dropped reconnection attempts - -* Mon Sep 6 1999 Jeff Johnson -- use cp rather than mv to preserve /etc/services perms (#4938 et al). -- use mktemp to generate /etc/tmp.XXXXXX file name. -- add prereqs on sed/mktemp/killall (need to move killall to /bin). -- fix trigger syntax (i.e. "samba < 1.9.18p7" not "samba < samba-1.9.18p7") - -* Mon Aug 30 1999 Bill Nottingham -- sed "s|nawk|gawk|" /usr/bin/convert_smbpasswd - -* Sat Aug 21 1999 Bill Nottingham -- fix typo in mount.smb - -* Fri Aug 20 1999 Bill Nottingham -- add a %%trigger to work around (sort of) broken scripts in - previous releases - -* Mon Aug 16 1999 Bill Nottingham -- initscript munging - -* Mon Aug 9 1999 Bill Nottingham -- add domain parsing to mount.smb - -* Fri Aug 6 1999 Bill Nottingham -- add a -common package, shuffle files around. - -* Fri Jul 23 1999 Bill Nottingham -- add a chmod in %%postun so /etc/services & inetd.conf don't become unreadable - -* Wed Jul 21 1999 Bill Nottingham -- update to 2.0.5 -- fix mount.smb - smbmount options changed again......... -- fix postun. oops. -- update some stuff from the samba team's spec file. - -* Fri Jun 18 1999 Bill Nottingham -- split off clients into separate package -- don't run samba by default - -* Mon Jun 14 1999 Bill Nottingham -- fix one problem with mount.smb script -- fix smbpasswd on sparc with a really ugly kludge - -* Thu Jun 10 1999 Dale Lovelace -- fixed logrotate script - -* Tue May 25 1999 Bill Nottingham -- turn of 64-bit locking on 32-bit platforms - -* Thu May 20 1999 Bill Nottingham -- so many releases, so little time -- explicitly uncomment 'printing = bsd' in sample config - -* Tue May 18 1999 Bill Nottingham -- update to 2.0.4a -- fix mount.smb arg ordering - -* Fri Apr 16 1999 Bill Nottingham -- go back to stop/start for restart (-HUP didn't work in testing) - -* Fri Mar 26 1999 Bill Nottingham -- add a mount.smb to make smb mounting a little easier. -- smb filesystems apparently don't work on alpha. Oops. - -* Thu Mar 25 1999 Bill Nottingham -- always create codepages - -* Tue Mar 23 1999 Bill Nottingham -- logrotate changes - -* Sun Mar 21 1999 Cristian Gafton -- auto rebuild in the new build environment (release 3) - -* Fri Mar 19 1999 Preston Brown -- updated init script to use graceful restart (not stop/start) - -* Tue Mar 9 1999 Bill Nottingham -- update to 2.0.3 - -* Thu Feb 18 1999 Bill Nottingham -- update to 2.0.2 - -* Mon Feb 15 1999 Bill Nottingham -- swat swat - -* Tue Feb 9 1999 Bill Nottingham -- fix bash2 breakage in post script - -* Fri Feb 5 1999 Bill Nottingham -- update to 2.0.0 - -* Mon Oct 12 1998 Cristian Gafton -- make sure all binaries are stripped - -* Thu Sep 17 1998 Jeff Johnson -- update to 1.9.18p10. -- fix %%triggerpostun. - -* Tue Jul 07 1998 Erik Troan -- updated postun triggerscript to check $0 -- clear /etc/codepages from %%preun instead of %%postun - -* Mon Jun 08 1998 Erik Troan -- made the %%postun script a tad less agressive; no reason to remove - the logs or lock file (after all, if the lock file is still there, - samba is still running) -- the %%postun and %%preun should only exectute if this is the final - removal -- migrated %%triggerpostun from Red Hat's samba package to work around - packaging problems in some Red Hat samba releases - -* Sun Apr 26 1998 John H Terpstra -- minor tidy up in preparation for release of 1.9.18p5 -- added findsmb utility from SGI package - -* Wed Mar 18 1998 John H Terpstra -- Updated version and codepage info. -- Release to test name resolve order - -* Sat Jan 24 1998 John H Terpstra -- Many optimisations (some suggested by Manoj Kasichainula -- Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb -- Compounded make line -- Updated smb.init restart mechanism -- Use compound mkdir -p line instead of individual calls to mkdir -- Fixed smb.conf file path for log files -- Fixed smb.conf file path for incoming smb print spool directory -- Added a number of options to smb.conf file -- Added smbadduser command (missed from all previous RPMs) - Doooh! -- Added smbuser file and smb.conf file updates for username map - +%autochangelog From 5ae3a0ccb0e0751ac40e276e86d0d6061d76b4bf Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 May 2024 09:54:05 +0200 Subject: [PATCH 187/295] Improve setting the version number for pre-releases [skip changelog] --- samba.spec | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 143402e..d13651e 100644 --- a/samba.spec +++ b/samba.spec @@ -148,14 +148,22 @@ %global samba_version 4.20.1 -# Use 'autorelease -b 100' to start counting at 100 +# The release field is extended: +# [.][.]%%{?dist}[.] +# Square brackets indicate an optional item. +# +# The autorelease macro accepts these parameters to allow packagers to specify +# those added fields: +# +# -p: Designates a pre-release, i.e. pkgrel will be prefixed with '0.'. +# -e : Allows specifying the extraver portion of the release. +# -b : Allows specifying a custom base release number (the +# default is 1). %global samba_release %autorelease %global pre_release %nil %if "x%{?pre_release}" != "x" -%global baserelease 1 -# This should be rc1 or %%nil -%global samba_release 0.%{baserelease}.%{pre_release}%{?dist} +%global samba_release %autorelease -p -e %pre_release %endif From e5c614494cb9ff14322c0070409adc6fb50ba996 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 10 Jun 2024 11:52:50 +0200 Subject: [PATCH 188/295] Rebuilt for Python 3.13 From 2588fdd81f38d423c73f8712ad3735685d54a0af Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 19 Jun 2024 16:43:35 +0200 Subject: [PATCH 189/295] resolves: #2293100 - Update to version 4.20.2 Guenther --- .gitignore | 2 ++ samba.spec | 6 ++++-- sources | 4 ++-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index fd0792f..e9c42cc 100644 --- a/.gitignore +++ b/.gitignore @@ -367,3 +367,5 @@ samba-3.6.0pre1.tar.gz /samba-4.20.0.tar.asc /samba-4.20.1.tar.xz /samba-4.20.1.tar.asc +/samba-4.20.2.tar.xz +/samba-4.20.2.tar.asc diff --git a/samba.spec b/samba.spec index d13651e..c48b206 100644 --- a/samba.spec +++ b/samba.spec @@ -146,7 +146,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.20.1 +%global samba_version 4.20.2 # The release field is extended: # [.][.]%%{?dist}[.] @@ -193,7 +193,7 @@ %global talloc_version 2.4.2 %global tdb_version 1.4.10 %global tevent_version 0.16.1 -%global ldb_version 2.9.0 +%global ldb_version 2.9.1 %global required_mit_krb5 1.20.1 @@ -3159,6 +3159,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_chunk.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_content.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/misc_dfs_widelink.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/ndrdump.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_dns.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/netads_json.*.pyc @@ -3181,6 +3182,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/http_chunk.py %{python3_sitearch}/samba/tests/blackbox/http_content.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py +%{python3_sitearch}/samba/tests/blackbox/misc_dfs_widelink.py %{python3_sitearch}/samba/tests/blackbox/ndrdump.py %{python3_sitearch}/samba/tests/blackbox/netads_dns.py %{python3_sitearch}/samba/tests/blackbox/netads_json.py diff --git a/sources b/sources index cfeeed8..9abdbb7 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.1.tar.xz) = 7cef945833516b305a2eb6bd4717cc4e8d895575e6dcf7a47d80fa1859847adeb4a9f32814bafdd5c732ce63d793ca168b7f4e0bdda89c56f10d1595ea45b5c0 -SHA512 (samba-4.20.1.tar.asc) = 5ce9f0e4358c1ff5ce991204aaf72e1dfe431ba2686d12f1668b15c7b48247666ecbf6354acbadbcf5e77e657ef93bc07fab0ff7ed7b8a7588f5bcc7bf6facef +SHA512 (samba-4.20.2.tar.xz) = cf07b12b6c1ac9bc3fd0df7fd658529ebd08309a0823f49c68dd3c55c0c80f412d6af50a0f78b8f4484635029aeb292a72dd0a6638edbd463e73baff404d5315 +SHA512 (samba-4.20.2.tar.asc) = a0051efdca684bc6c3e40367b0a8b862d0b1b988aa9c15ec6987d5f97440daa1f7609e6be61611aa9bbed56d89e0258b192c43028384899c75c4cd449cc99694 From 4b62d2684298370063a424705fedba764002d829 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 25 Jun 2024 14:27:11 +0200 Subject: [PATCH 190/295] resolves: #2293108 - Move LICENSE file to samba-common Guenther --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index c48b206..a9f0ff9 100644 --- a/samba.spec +++ b/samba.spec @@ -1657,7 +1657,6 @@ fi ### SAMBA %files -%license COPYING %doc README.md WHATSNEW.txt %doc examples/autofs examples/LDAP examples/misc %doc examples/printer-accounting examples/printing @@ -1995,6 +1994,7 @@ fi ### COMMON %files common +%license COPYING %{_tmpfilesdir}/samba.conf %{_sysusersdir}/samba.conf %dir %{_sysconfdir}/logrotate.d/ From 41e97d4a9dc82598b1840ee9d778db5fdbdfc9d0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 1 Jul 2024 11:41:48 +0200 Subject: [PATCH 191/295] Move README.md and WHATSNEW.txt to samba-common --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index a9f0ff9..3a8f7db 100644 --- a/samba.spec +++ b/samba.spec @@ -1657,7 +1657,6 @@ fi ### SAMBA %files -%doc README.md WHATSNEW.txt %doc examples/autofs examples/LDAP examples/misc %doc examples/printer-accounting examples/printing %doc packaging/README.downgrade @@ -1994,6 +1993,7 @@ fi ### COMMON %files common +%doc README.md WHATSNEW.txt %license COPYING %{_tmpfilesdir}/samba.conf %{_sysusersdir}/samba.conf From 44bb1d44388b6e844a4cde88be0c008b0caabc10 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 04:44:46 +0000 Subject: [PATCH 192/295] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From ac58d580e8ff60046b6600a1f6c843391ae1ffdd Mon Sep 17 00:00:00 2001 From: Christoph Erhardt Date: Mon, 5 Aug 2024 08:21:41 +0200 Subject: [PATCH 193/295] Re-enable linking with mold on i686 --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 3a8f7db..336f2ca 100644 --- a/samba.spec +++ b/samba.spec @@ -342,7 +342,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch i686 riscv64 +%ifnarch riscv64 %if 0%{?fedora} >= 37 BuildRequires: mold %endif @@ -1282,13 +1282,13 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" # Use the mold linker if possible export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -%ifnarch i686 riscv64 +%ifnarch riscv64 %if 0%{?fedora} >= 37 export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" #endif fedora >= 37 %endif -#endif narch i686 +#endif narch riscv64 %endif # Add support for mock ccache plugin From 3dd6bed73b9fff21ca4f7d01a56e3b749233ac9d Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sat, 17 Aug 2024 16:16:53 +0100 Subject: [PATCH 194/295] Update to version 4.20.4 --- .gitignore | 373 +---------------------------------------------------- samba.spec | 2 +- sources | 4 +- 3 files changed, 5 insertions(+), 374 deletions(-) diff --git a/.gitignore b/.gitignore index e9c42cc..a695288 100644 --- a/.gitignore +++ b/.gitignore @@ -1,371 +1,2 @@ -samba-3.5.4.tar.gz -samba-3.6.0pre1.tar.gz -/samba-3.6.0pre2.tar.gz -/samba-3.6.0pre3.tar.gz -/samba-3.6.0rc1.tar.gz -/samba-3.6.0rc2.tar.gz -/samba-3.6.0rc3.tar.gz -/samba-3.6.0.tar.gz -/samba-3.6.1.tar.gz -/samba-3.6.3.tar.gz -/samba-3.6.4.tar.gz -/samba-3.6.5.tar.gz -/samba-3.6.6.tar.gz -/samba-3.6.7.tar.gz -/samba-4.0.0rc1.tar.bz2 -/samba-4.0.0rc2.tar.bz2 -/samba-4.0.0rc3.tar.bz2 -/samba-4.0.0rc4.tar.bz2 -/samba-4.0.0rc5.tar.bz2 -/samba-4.0.0rc6.tar.bz2 -/samba-4.0.0.tar.bz2 -/samba-4.0.1.tar.bz2 -/samba-4.0.2.tar.bz2 -/samba-4.0.3.tar.bz2 -/samba-4.0.4.tar.bz2 -/samba-4.0.5.tar.bz2 -/samba-4.0.6.tar.bz2 -/samba-4.0.7.tar.xz -/samba-4.1.0rc1.tar.xz -/samba-4.1.0rc2.tar.xz -/samba-4.1.0rc3.tar.xz -/samba-4.1.0rc4.tar.xz -/samba-4.1.0.tar.xz -/samba-4.1.1.tar.xz -/samba-4.1.2.tar.xz -/samba-4.1.3.tar.xz -/samba-4.1.4.tar.xz -/samba-4.1.5.tar.xz -/samba-4.1.6.tar.xz -/samba-4.1.8.tar.xz -/samba-4.1.9.tar.xz -/samba-4.1.11.tar.gz -/samba-4.1.11.tar.xz -/samba-4.1.12.tar.xz -/samba-4.2.0rc2.tar.xz -/samba-4.2.0rc3.tar.xz -/samba-4.2.0rc4.tar.xz -/samba-4.2.0rc5.tar.xz -/samba-4.2.0.tar.xz -/samba-4.2.1.tar.xz -/samba-4.2.2.tar.xz -/samba-4.2.3.tar.xz -/samba-4.3.0rc3.tar.xz -/samba-4.3.0rc4.tar.xz -/samba-4.3.0.tar.xz -/samba-4.3.1.tar.xz -/samba-4.3.2.tar.xz -/samba-4.3.3.tar.xz -/samba-4.3.4.tar.xz -/samba-4.4.0rc1.tar.xz -/samba-4.4.0rc2.tar.xz -/samba-4.4.0rc3.tar.xz -/samba-4.4.0rc4.tar.xz -/samba-4.4.0rc5.tar.xz -/samba-4.4.0.tar.xz -/samba-4.4.2.tar.xz -/samba-4.4.3.tar.xz -/samba-4.4.4.tar.xz -/samba-4.4.5.tar.xz -/samba-4.5.0rc1.tar.xz -/samba-4.5.0rc2.tar.xz -/samba-4.5.0rc3.tar.xz -/samba-4.5.0.tar.xz -/samba-4.5.1.tar.xz -/samba-4.5.2.tar.xz -/samba-4.5.3.tar.xz -/samba-4.6.0rc1.tar.xz -/samba-4.6.0rc2.tar.xz -/samba-4.6.0rc2.tar.asc -/samba-4.6.0rc3.tar.asc -/samba-4.6.0rc3.tar.xz -/samba-4.6.0rc4.tar.xz -/samba-4.6.0rc4.tar.asc -/samba-4.6.0.tar.asc -/samba-4.6.0.tar.xz -/samba-4.6.1.tar.xz -/samba-4.6.1.tar.asc -/samba-4.6.2.tar.xz -/samba-4.6.2.tar.asc -/samba-4.6.3.tar.xz -/samba-4.6.3.tar.asc -/samba-4.6.4.tar.xz -/samba-4.6.4.tar.asc -/samba-4.6.5.tar.xz -/samba-4.6.5.tar.asc -/samba-4.7.0rc1.tar.xz -/samba-4.7.0rc1.tar.asc -/samba-4.7.0rc3.tar.xz -/samba-4.7.0rc3.tar.asc -/samba-4.7.0rc5.tar.xz -/samba-4.7.0rc5.tar.asc -/samba-4.7.0rc6.tar.xz -/samba-4.7.0rc6.tar.asc -/samba-4.7.0.tar.xz -/samba-4.7.0.tar.asc -/samba-4.7.1.tar.xz -/samba-4.7.1.tar.asc -/samba-4.7.2.tar.xz -/samba-4.7.2.tar.asc -/samba-4.7.3.tar.xz -/samba-4.7.3.tar.asc -/samba-4.7.4.tar.xz -/samba-4.7.4.tar.asc -/samba-4.8.0rc1.tar.xz -/samba-4.8.0rc1.tar.asc -/samba-4.8.0rc2.tar.xz -/samba-4.8.0rc2.tar.asc -/samba-4.8.0rc3.tar.xz -/samba-4.8.0rc3.tar.asc -/samba-4.8.0rc4.tar.xz -/samba-4.8.0rc4.tar.asc -/samba-4.8.0.tar.xz -/samba-4.8.0.tar.asc -/samba-4.8.1.tar.xz -/samba-4.8.1.tar.asc -/samba-4.8.2.tar.xz -/samba-4.8.2.tar.asc -/samba-4.8.3.tar.asc -/samba-4.8.3.tar.xz -/samba-4.9.0rc1.tar.xz -/samba-4.9.0rc1.tar.asc -/samba-4.9.0rc2.tar.xz -/samba-4.9.0rc2.tar.asc -/samba-4.9.0rc3.tar.xz -/samba-4.9.0rc3.tar.asc -/samba-4.9.0rc4.tar.xz -/samba-4.9.0rc4.tar.asc -/samba-4.9.0rc5.tar.asc -/samba-4.9.0rc5.tar.xz -/samba-4.9.0.tar.xz -/samba-4.9.0.tar.asc -/samba-4.9.1.tar.asc -/samba-4.9.1.tar.xz -/samba-4.9.2.tar.xz -/samba-4.9.2.tar.asc -/samba-4.9.3.tar.xz -/samba-4.9.3.tar.asc -/samba-4.9.4.tar.xz -/samba-4.9.4.tar.asc -/samba-4.10.0rc1.tar.xz -/samba-4.10.0rc1.tar.asc -/samba-4.10.0rc2.tar.xz -/samba-4.10.0rc2.tar.asc -/samba-4.10.0rc3.tar.xz -/samba-4.10.0rc3.tar.asc -/samba-4.10.0rc4.tar.xz -/samba-4.10.0rc4.tar.asc -/samba-4.10.0.tar.xz -/samba-4.10.0.tar.asc -/samba-4.10.1.tar.xz -/samba-4.10.1.tar.asc -/samba-4.10.2.tar.xz -/samba-4.10.2.tar.asc -/samba-4.10.3.tar.xz -/samba-4.10.3.tar.asc -/samba-4.10.4.tar.xz -/samba-4.10.4.tar.asc -/samba-4.10.5.tar.xz -/samba-4.10.5.tar.asc -/samba-4.10.6.tar.xz -/samba-4.10.6.tar.asc -/samba-4.11.0rc1.tar.xz -/samba-4.11.0rc1.tar.asc -/samba-4.11.0rc2.tar.xz -/samba-4.11.0rc2.tar.asc -/samba-4.11.0rc3.tar.xz -/samba-4.11.0rc3.tar.asc -/samba-4.11.0rc4.tar.xz -/samba-4.11.0rc4.tar.asc -/samba-4.11.0.tar.xz -/samba-4.11.0.tar.asc -/samba-4.11.1.tar.xz -/samba-4.11.1.tar.asc -/samba-4.11.2.tar.xz -/samba-4.11.2.tar.asc -/samba-4.11.3.tar.xz -/samba-4.11.3.tar.asc -/samba-4.11.4.tar.xz -/samba-4.11.4.tar.asc -/samba-4.11.5.tar.xz -/samba-4.11.5.tar.asc -/samba-4.12.0rc1.tar.xz -/samba-4.12.0rc1.tar.asc -/samba-4.12.0rc2.tar.xz -/samba-4.12.0rc2.tar.asc -/samba-4.12.0rc3.tar.xz -/samba-4.12.0rc3.tar.asc -/samba-4.12.0rc4.tar.xz -/samba-4.12.0rc4.tar.asc -/samba-4.12.0.tar.xz -/samba-4.12.0.tar.asc -/samba-4.12.1.tar.xz -/samba-4.12.1.tar.asc -/samba-4.12.2.tar.xz -/samba-4.12.2.tar.asc -/samba-4.12.3.tar.xz -/samba-4.12.3.tar.asc -/samba-4.12.4.tar.xz -/samba-4.12.4.tar.asc -/samba-4.12.5.tar.xz -/samba-4.12.5.tar.asc -/samba-4.13.0rc1.tar.xz -/samba-4.13.0rc1.tar.asc -/samba-4.13.0rc2.tar.xz -/samba-4.13.0rc2.tar.asc -/samba-4.13.0rc3.tar.xz -/samba-4.13.0rc3.tar.asc -/samba-4.13.0rc4.tar.xz -/samba-4.13.0rc4.tar.asc -/samba-4.13.0rc5.tar.xz -/samba-4.13.0rc5.tar.asc -/samba-4.13.0rc6.tar.xz -/samba-4.13.0rc6.tar.asc -/samba-4.13.0.tar.xz -/samba-4.13.0.tar.asc -/samba-4.13.1.tar.xz -/samba-4.13.1.tar.asc -/samba-4.13.2.tar.xz -/samba-4.13.2.tar.asc -/samba-4.13.3.tar.xz -/samba-4.13.3.tar.asc -/samba-4.13.4.tar.xz -/samba-4.13.4.tar.asc -/samba-4.14.0rc1.tar.xz -/samba-4.14.0rc1.tar.asc -/samba-4.14.0rc2.tar.xz -/samba-4.14.0rc2.tar.asc -/samba-4.14.0rc3.tar.xz -/samba-4.14.0rc3.tar.asc -/samba-4.14.0rc4.tar.xz -/samba-4.14.0rc4.tar.asc -/samba-4.14.0.tar.xz -/samba-4.14.0.tar.asc -/samba-4.14.1.tar.xz -/samba-4.14.1.tar.asc -/samba-4.14.2.tar.xz -/samba-4.14.2.tar.asc -/samba-4.14.3.tar.xz -/samba-4.14.3.tar.asc -/samba-4.14.4.tar.xz -/samba-4.14.4.tar.asc -/samba-4.14.5.tar.xz -/samba-4.14.5.tar.asc -/samba-4.14.6.tar.xz -/samba-4.14.6.tar.asc -/samba-4.15.0rc1.tar.xz -/samba-4.15.0rc1.tar.asc -/samba-4.15.0rc2.tar.xz -/samba-4.15.0rc2.tar.asc -/samba-4.15.0rc3.tar.xz -/samba-4.15.0rc3.tar.asc -/samba-4.15.0rc4.tar.xz -/samba-4.15.0rc4.tar.asc -/samba-4.15.0rc5.tar.xz -/samba-4.15.0rc5.tar.asc -/samba-4.15.0rc6.tar.xz -/samba-4.15.0rc6.tar.asc -/samba-4.15.0rc7.tar.xz -/samba-4.15.0rc7.tar.asc -/samba-4.15.0.tar.xz -/samba-4.15.0.tar.asc -/samba-4.15.1.tar.xz -/samba-4.15.1.tar.asc -/samba-4.15.2.tar.xz -/samba-4.15.2.tar.asc -/samba-4.15.3.tar.xz -/samba-4.15.3.tar.asc -/samba-4.15.4.tar.xz -/samba-4.15.4.tar.asc -/samba-4.16.0rc1.tar.xz -/samba-4.16.0rc1.tar.asc -/samba-4.16.0rc2.tar.xz -/samba-4.16.0rc2.tar.asc -/samba-4.16.0rc3.tar.xz -/samba-4.16.0rc3.tar.asc -/samba-4.16.0rc4.tar.xz -/samba-4.16.0rc4.tar.asc -/samba-4.16.0rc5.tar.xz -/samba-4.16.0rc5.tar.asc -/samba-4.16.0.tar.xz -/samba-4.16.0.tar.asc -/samba-4.16.1.tar.xz -/samba-4.16.1.tar.asc -/samba-4.16.2.tar.xz -/samba-4.16.2.tar.asc -/samba-4.16.3.tar.xz -/samba-4.16.3.tar.asc -/samba-4.16.4.tar.xz -/samba-4.16.4.tar.asc -/samba-4.17.0rc1.tar.xz -/samba-4.17.0rc1.tar.asc -/samba-4.17.0rc2.tar.xz -/samba-4.17.0rc2.tar.asc -/samba-4.17.0rc3.tar.asc -/samba-4.17.0rc3.tar.xz -/samba-4.17.0rc4.tar.xz -/samba-4.17.0rc4.tar.asc -/samba-4.17.0rc5.tar.xz -/samba-4.17.0rc5.tar.asc -/samba-4.17.0.tar.xz -/samba-4.17.0.tar.asc -/samba-4.17.1.tar.xz -/samba-4.17.1.tar.asc -/samba-4.17.2.tar.xz -/samba-4.17.2.tar.asc -/samba-4.17.3.tar.xz -/samba-4.17.3.tar.asc -/samba-4.17.4.tar.xz -/samba-4.17.4.tar.asc -/samba-4.18.0rc1.tar.xz -/samba-4.18.0rc1.tar.asc -/samba-4.18.0rc2.tar.xz -/samba-4.18.0rc2.tar.asc -/samba-4.18.0rc3.tar.xz -/samba-4.18.0rc3.tar.asc -/samba-4.18.0rc4.tar.xz -/samba-4.18.0rc4.tar.asc -/samba-4.18.0.tar.xz -/samba-4.18.0.tar.asc -/samba-4.18.1.tar.xz -/samba-4.18.1.tar.asc -/samba-4.18.2.tar.xz -/samba-4.18.2.tar.asc -/samba-4.18.3.tar.xz -/samba-4.18.3.tar.asc -/samba-4.18.4.tar.xz -/samba-4.18.4.tar.asc -/samba-4.18.5.tar.xz -/samba-4.18.5.tar.asc -/samba-4.19.0rc1.tar.xz -/samba-4.19.0rc1.tar.asc -/samba-4.19.0rc2.tar.xz -/samba-4.19.0rc2.tar.asc -/samba-4.19.0rc3.tar.xz -/samba-4.19.0rc3.tar.asc -/samba-4.19.0rc4.tar.xz -/samba-4.19.0rc4.tar.asc -/samba-4.19.0.tar.xz -/samba-4.19.0.tar.asc -/samba-4.19.1.tar.xz -/samba-4.19.1.tar.asc -/samba-4.19.2.tar.xz -/samba-4.19.2.tar.asc -/samba-4.19.3.tar.xz -/samba-4.19.3.tar.asc -/samba-4.19.4.tar.xz -/samba-4.19.4.tar.asc -/samba-4.20.0rc1.tar.xz -/samba-4.20.0rc1.tar.asc -/samba-4.20.0rc2.tar.xz -/samba-4.20.0rc2.tar.asc -/samba-4.20.0rc3.tar.xz -/samba-4.20.0rc3.tar.asc -/samba-4.20.0rc4.tar.xz -/samba-4.20.0rc4.tar.asc -/samba-4.20.0.tar.xz -/samba-4.20.0.tar.asc -/samba-4.20.1.tar.xz -/samba-4.20.1.tar.asc -/samba-4.20.2.tar.xz -/samba-4.20.2.tar.asc +/samba-*.tar.xz +/samba-*.tar.asc diff --git a/samba.spec b/samba.spec index 336f2ca..dcc42c3 100644 --- a/samba.spec +++ b/samba.spec @@ -146,7 +146,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.20.2 +%global samba_version 4.20.4 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 9abdbb7..fa51daa 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.2.tar.xz) = cf07b12b6c1ac9bc3fd0df7fd658529ebd08309a0823f49c68dd3c55c0c80f412d6af50a0f78b8f4484635029aeb292a72dd0a6638edbd463e73baff404d5315 -SHA512 (samba-4.20.2.tar.asc) = a0051efdca684bc6c3e40367b0a8b862d0b1b988aa9c15ec6987d5f97440daa1f7609e6be61611aa9bbed56d89e0258b192c43028384899c75c4cd449cc99694 +SHA512 (samba-4.20.4.tar.xz) = 390805d006c380e83f0a0f6f0c00cd6605c32c937f4cf11e7ac5b177abd4538b0be40c505d72c500855f28a625f60aaa007c4466c316c3f93bfb5baa583f384f +SHA512 (samba-4.20.4.tar.asc) = ff8369bf307e56fe842a101b05dcbf382779a3812763e67b573449412195777fce25864ca4e0d89c126bc46cf3a2d359c5d5bda68b60af8849cd91f9d418ee98 From d04728829da7462c35ceaf0fdbc43107ad9fd72c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Jul 2024 18:15:46 +0200 Subject: [PATCH 195/295] Update to Samba 4.21.0rc2 - Package libldb a public library - resolves: #2300469 Pair-Programmed-With: Andreas Schneider --- samba.spec | 384 +++++++++++++++------ sources | 4 +- sync_machine_password_script_install.patch | 91 +++++ 3 files changed, 376 insertions(+), 103 deletions(-) create mode 100644 sync_machine_password_script_install.patch diff --git a/samba.spec b/samba.spec index dcc42c3..22d0376 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ # %bcond_with testsuite -# Build with internal talloc, tevent, tdb and ldb. +# Build with internal talloc, tevent, tdb # # fedpkg mockbuild --with=testsuite --with=includelibs # or @@ -144,9 +144,15 @@ %bcond_with gpupdate %endif +%ifarch aarch64 ppc64le s390x x86_64 +%bcond lmdb 1 +%else +%bcond lmdb 0 +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.20.4 +%global samba_version 4.21.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -161,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -174,13 +180,14 @@ %global libdcerpc_so_version 0 %global libndr_krb5pac_so_version 0 %global libndr_nbt_so_version 0 -%global libndr_so_version 4 +%global libndr_so_version 5 %global libndr_standard_so_version 0 %global libnetapi_so_version 1 %global libsamba_credentials_so_version 1 %global libsamba_errors_so_version 1 %global libsamba_hostconfig_so_version 0 %global libsamba_passdb_so_version 0 +%global libsamba_policy_so_version 0 %global libsamba_util_so_version 0 %global libsamdb_so_version 0 %global libsmbconf_so_version 0 @@ -191,9 +198,8 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.2 -%global tdb_version 1.4.10 +%global tdb_version 1.4.11 %global tevent_version 0.16.1 -%global ldb_version 2.9.1 %global required_mit_krb5 1.20.1 @@ -248,6 +254,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: sync_machine_password_script_install.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -291,6 +299,7 @@ BuildRequires: bison BuildRequires: cups-devel BuildRequires: dbus-devel BuildRequires: docbook-style-xsl +BuildRequires: doxygen BuildRequires: e2fsprogs-devel BuildRequires: flex BuildRequires: gawk @@ -309,7 +318,10 @@ BuildRequires: libcmocka-devel BuildRequires: libtirpc-devel BuildRequires: libuuid-devel BuildRequires: libxslt +%if %{with lmdb} BuildRequires: lmdb +BuildRequires: lmdb-devel >= 0.9.16 +%endif %if %{with winexe} BuildRequires: mingw32-gcc BuildRequires: mingw64-gcc @@ -389,17 +401,6 @@ BuildRequires: python3-tevent >= %{tevent_version} BuildRequires: libtdb-devel >= %{tdb_version} BuildRequires: python3-tdb >= %{tdb_version} - -BuildRequires: libldb-devel >= %{ldb_version} -BuildRequires: python3-ldb >= %{ldb_version} -BuildRequires: python3-ldb-devel >= %{ldb_version} -%endif - -%if %{with includelibs} || %{with testsuite} -# lmdb-devel is required for the mdb ldb module, if samba is configured -# to build includelibs we need lmdb-devel for building that module on our own -BuildRequires: lmdb-devel -#endif without includelibs %endif %if %{with dc} || %{with testsuite} @@ -417,7 +418,6 @@ BuildRequires: python3-setproctitle %if %{without includelibs} BuildRequires: tdb-tools -BuildRequires: ldb-tools #endif without includelibs %endif @@ -559,7 +559,9 @@ Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} %if %{with dc} # samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision +%if %{with lmdb} Requires: lmdb +%endif Requires: tdb-tools Requires: python3-gpg %endif @@ -603,11 +605,7 @@ Requires: libwbclient = %{samba_depver} Requires: ldb-tools Requires: python3-setproctitle -# Force using libldb version to be the same as build version -# Otherwise LDB modules will not be loaded and samba-tool will fail -# See bug 1507420 -%samba_requires_eq libldb - +Requires: libldb = %{samba_depver} Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} Requires: krb5-server >= %{required_mit_krb5} @@ -896,13 +894,6 @@ Provides: bundled(libreplace) The python3-%{name} package contains the Python 3 libraries needed by programs that use SMB, RPC and other Samba provided protocols in Python 3 programs. -%package -n python3-%{name}-devel -Summary: Samba python devel files -Requires: python3-%{name} = %{samba_depver} - -%description -n python3-%{name}-devel -The python3-%{name}-devel package contains the Python 3 devel files. - %package -n python3-samba-test Summary: Samba Python libraries Requires: python3-%{name} = %{samba_depver} @@ -1221,7 +1212,79 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB #endif with clustering %endif +### LIBLDB +%package -n libldb +Summary: A schema-less, ldap like, API and database +License: LGPL-3.0-or-later +Requires: libtalloc%{?_isa} >= %{talloc_version} +Requires: libtdb%{?_isa} >= %{tdb_version} +Requires: libtevent%{?_isa} >= %{tevent_version} +Provides: bundled(libreplace) +Obsoletes: libldb < 2.10 +Provides: libldb = %{samba_depver} + +%description -n libldb +An extensible library that implements an LDAP like API to access remote LDAP +servers, or use local tdb databases. + +### LIBLDB-DEVEL +%package -n libldb-devel +Summary: Developer tools for the LDB library +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libtdb-devel%{?_isa} >= %{tdb_version} +Requires: libtalloc-devel%{?_isa} >= %{talloc_version} +Requires: libtevent-devel%{?_isa} >= %{tevent_version} + +Obsoletes: libldb-devel < 2.10 +Provides: libldb-devel = %{samba_depver} + +%description -n libldb-devel +Header files needed to develop programs that link against the LDB library. + +### LDB-TOOLS +%package -n ldb-tools +Summary: Tools to manage LDB files +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{samba_release} +Obsoletes: ldb-tools < 2.10 +Provides: ldb-tools = %{samba_depver} + +%description -n ldb-tools +Tools to manage LDB files + +### PYTHON3-LDB-DEVEL-COMMON +%package -n python-ldb-devel-common +Summary: Common development files for the Python bindings for the LDB library +License: LGPL-3.0-or-later + +Provides: pyldb-devel%{?_isa} = %{version}-%{release} +%{?python_provide:%python_provide python2-ldb-devel} + +Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = %{samba_depver} + +%description -n python-ldb-devel-common +Development files for the Python bindings for the LDB library. +This package includes files that aren't specific to a Python version. + +### PYTHON3-LDB +%package -n python3-ldb +Summary: Python bindings for the LDB library +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{version}-%{release} +Requires: python3-tdb%{?_isa} >= %{tdb_version} +%{?python_provide:%python_provide python3-ldb} + +Obsoletes: python3-ldb < 2.10 +Provides: python3-ldb = %{samba_depver} +# These were the C bindings, only used by Samba +Obsoletes: python3-ldb-devel < 2.10 +Provides: python3-ldb-devel = %{samba_depver} + +%description -n python3-ldb +Python bindings for the LDB library %prep %if 0%{?fedora} || 0%{?rhel} >= 9 @@ -1239,16 +1302,14 @@ rm -rfv third_party/heimdal %global _talloc_lib ,talloc,pytalloc,pytalloc-util %global _tevent_lib ,tevent,pytevent %global _tdb_lib ,tdb,pytdb -%global _ldb_lib ,ldb,pyldb,pyldb-util %else %global _talloc_lib ,!talloc,!pytalloc,!pytalloc-util %global _tevent_lib ,!tevent,!pytevent %global _tdb_lib ,!tdb,!pytdb -%global _ldb_lib ,!ldb,!pyldb,!pyldb-util #endif with includelibs %endif -%global _samba_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib}%{_ldb_lib} +%global _samba_bundled_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib} %global _samba_idmap_modules idmap_ad,idmap_rid,idmap_ldap,idmap_hash,idmap_tdb2 %global _samba_pdb_modules pdb_tdbsam,pdb_ldap,pdb_smbpasswd,pdb_wbc_sam,pdb_samba4 @@ -1274,7 +1335,8 @@ rm -rfv third_party/heimdal %global _libwbclient wbclient, %endif -%global _samba_private_libraries %{_libsmbclient}%{_libwbclient} +%global _default_private_libraries !ldb,!dcerpc-samr,!samba-policy,!tevent-util,!dcerpc,!samba-hostconfig,!samba-credentials,!dcerpc_server,!samdb, +%global _samba_private_libraries %{_default_private_libraries}%{_libsmbclient}%{_libwbclient} # TODO: resolve underlinked python modules export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" @@ -1311,14 +1373,12 @@ fi --with-cachedir=/var/lib/samba \ --disable-rpath-install \ --with-shared-modules=%{_samba_modules} \ - --bundled-libraries=%{_samba_libraries} \ + --bundled-libraries=%{_samba_bundled_libraries} \ + --private-libraries=%{_samba_private_libraries} \ --with-pam \ --with-pie \ --with-relro \ --without-fam \ -%if (%{without libsmbclient}) || (%{without libwbclient}) - --private-libraries=%{_samba_private_libraries} \ -%endif --with-system-mitkrb5 \ --with-experimental-mit-ad-dc \ %if %{without dc} && %{without testsuite} @@ -1364,6 +1424,10 @@ pushd pidl %make_build popd +pushd lib/ldb +doxygen Doxyfile +popd + %install # Do not use %%make_install, make is just a wrapper around waf in Samba! %{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot} @@ -1472,8 +1536,8 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* /sbin/ldconfig -N -n %{buildroot}%{_libdir} %if %{without dc} && %{without testsuite} -for f in samba/libsamba-net-samba4.so \ - samba/libsamba-python-samba4.so \ +for f in samba/libsamba-net-private-samba.so \ + samba/libsamba-python-private-samba.so \ libsamba-policy.so* \ pkgconfig/samba-policy.pc ; do rm -f %{buildroot}%{_libdir}/$f @@ -1496,6 +1560,10 @@ rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist rm -rf %{buildroot}%{perl_vendorlib}/Parse/Yapp popd +# libldb manpages +cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} +rm -f %{buildroot}%{_mandir}/man3/_* + %if %{with testsuite} %check # @@ -1654,6 +1722,8 @@ fi %systemd_postun_with_restart ctdb.service %endif +%ldconfig_scriptlets -n libldb +%ldconfig_scriptlets -n python3-ldb ### SAMBA %files @@ -1954,7 +2024,6 @@ fi %{_libdir}/samba/libtdb-wrap-private-samba.so %{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so -%{_libdir}/samba/libtrusts-util-private-samba.so %{_libdir}/samba/libutil-reg-private-samba.so %{_libdir}/samba/libutil-setid-private-samba.so %{_libdir}/samba/libutil-tdb-private-samba.so @@ -1976,16 +2045,6 @@ fi %{_libdir}/samba/libtdb-private-samba.so %{_libdir}/samba/libtevent-private-samba.so -%{_libdir}/samba/ldb/asq.so -%{_libdir}/samba/ldb/ldb.so -%{_libdir}/samba/ldb/mdb.so -%{_libdir}/samba/ldb/paged_searches.so -%{_libdir}/samba/ldb/rdn_name.so -%{_libdir}/samba/ldb/sample.so -%{_libdir}/samba/ldb/server_sort.so -%{_libdir}/samba/ldb/skel.so -%{_libdir}/samba/ldb/tdb.so - %{_mandir}/man3/ldb.3.gz %{_mandir}/man3/talloc.3.gz #endif with includelibs @@ -2150,6 +2209,8 @@ fi %endif ### DC-LIBS %files dc-libs +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* +%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libauth4-private-samba.so %if %{with dc} || %{with testsuite} @@ -2299,6 +2360,7 @@ fi %{_libdir}/libsamba-credentials.so %{_libdir}/libsamba-errors.so %{_libdir}/libsamba-hostconfig.so +%{_libdir}/libsamba-policy.so %{_libdir}/libsamba-util.so %{_libdir}/libsamdb.so %{_libdir}/libsmbconf.so @@ -2311,6 +2373,7 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc +%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so @@ -2336,8 +2399,10 @@ fi %if %{with vfs_cephfs} %files vfs-cephfs %{_libdir}/samba/vfs/ceph.so +%{_libdir}/samba/vfs/ceph_new.so %{_libdir}/samba/vfs/ceph_snapshots.so %{_mandir}/man8/vfs_ceph.8* +%{_mandir}/man8/vfs_ceph_new.8* %{_mandir}/man8/vfs_ceph_snapshots.8* %endif @@ -2372,6 +2437,7 @@ fi %files ldb-ldap-modules %{_libdir}/samba/ldb/ldbsamba_extensions.so %{_libdir}/samba/ldb/ildap.so +%{_libdir}/samba/ldb/ldap.so ### LIBS %files libs @@ -2491,6 +2557,7 @@ fi %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/__pycache__/idmap.*.pyc %{python3_sitearch}/samba/__pycache__/join.*.pyc +%{python3_sitearch}/samba/__pycache__/lsa_utils.*.pyc %{python3_sitearch}/samba/__pycache__/logger.*.pyc %{python3_sitearch}/samba/__pycache__/mdb_util.*.pyc %{python3_sitearch}/samba/__pycache__/ms_display_specifiers.*.pyc @@ -2504,7 +2571,6 @@ fi %{python3_sitearch}/samba/__pycache__/sites.*.pyc %{python3_sitearch}/samba/__pycache__/subnets.*.pyc %{python3_sitearch}/samba/__pycache__/tdb_util.*.pyc -%{python3_sitearch}/samba/__pycache__/trust_utils.*.pyc %{python3_sitearch}/samba/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/__pycache__/upgradehelpers.*.pyc %{python3_sitearch}/samba/__pycache__/xattr.*.pyc @@ -2570,6 +2636,53 @@ fi %{python3_sitearch}/samba/dcerpc/xattr.*.so %{python3_sitearch}/samba/descriptor.py %{python3_sitearch}/samba/dnsresolver.py +%dir %{python3_sitearch}/samba/domain +%{python3_sitearch}/samba/domain/__init__.py +%{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/domain/models/__init__.py +%{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/claim_type.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/computer.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/constants.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/container.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/exceptions.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/fields.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/group.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/model.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/org.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/person.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/query.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/registry.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/site.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/subnet.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/types.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/user.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/value_type.*.pyc +%{python3_sitearch}/samba/domain/models/auth_policy.py +%{python3_sitearch}/samba/domain/models/auth_silo.py +%{python3_sitearch}/samba/domain/models/claim_type.py +%{python3_sitearch}/samba/domain/models/computer.py +%{python3_sitearch}/samba/domain/models/constants.py +%{python3_sitearch}/samba/domain/models/container.py +%{python3_sitearch}/samba/domain/models/exceptions.py +%{python3_sitearch}/samba/domain/models/fields.py +%{python3_sitearch}/samba/domain/models/gmsa.py +%{python3_sitearch}/samba/domain/models/group.py +%{python3_sitearch}/samba/domain/models/model.py +%{python3_sitearch}/samba/domain/models/org.py +%{python3_sitearch}/samba/domain/models/person.py +%{python3_sitearch}/samba/domain/models/query.py +%{python3_sitearch}/samba/domain/models/registry.py +%{python3_sitearch}/samba/domain/models/schema.py +%{python3_sitearch}/samba/domain/models/site.py +%{python3_sitearch}/samba/domain/models/subnet.py +%{python3_sitearch}/samba/domain/models/types.py +%{python3_sitearch}/samba/domain/models/user.py +%{python3_sitearch}/samba/domain/models/value_type.py %{python3_sitearch}/samba/drs_utils.py %{python3_sitearch}/samba/dsdb.*.so %{python3_sitearch}/samba/dsdb_dns.*.so @@ -2581,6 +2694,7 @@ fi %{python3_sitearch}/samba/hostconfig.py %{python3_sitearch}/samba/idmap.py %{python3_sitearch}/samba/join.py +%{python3_sitearch}/samba/lsa_utils.py %{python3_sitearch}/samba/messaging.*.so %{python3_sitearch}/samba/ndr.py %{python3_sitearch}/samba/net.*.so @@ -2733,12 +2847,30 @@ fi %{python3_sitearch}/samba/netcmd/domain/auth/__init__.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/policy.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo_member.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/policy.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo_member.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/policy +%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/silo +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py +%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py %{python3_sitearch}/samba/netcmd/domain/backup.py %dir %{python3_sitearch}/samba/netcmd/domain/claim %{python3_sitearch}/samba/netcmd/domain/claim/__init__.py @@ -2755,39 +2887,15 @@ fi %{python3_sitearch}/samba/netcmd/domain/functional_prep.py %{python3_sitearch}/samba/netcmd/domain/info.py %{python3_sitearch}/samba/netcmd/domain/join.py +%dir %{python3_sitearch}/samba/netcmd/domain/kds +%{python3_sitearch}/samba/netcmd/domain/kds/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/kds/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/kds/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/kds/__pycache__/root_key.*.pyc +%{python3_sitearch}/samba/netcmd/domain/kds/root_key.py %{python3_sitearch}/samba/netcmd/domain/keytab.py %{python3_sitearch}/samba/netcmd/domain/leave.py %{python3_sitearch}/samba/netcmd/domain/level.py -%dir %{python3_sitearch}/samba/netcmd/domain/models -%{python3_sitearch}/samba/netcmd/domain/models/__init__.py -%dir %{python3_sitearch}/samba/netcmd/domain/models/__pycache__ -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/__init__.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_policy.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_silo.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/claim_type.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/exceptions.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/fields.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/group.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/model.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/query.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/schema.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/site.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/subnet.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/user.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/value_type.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/auth_policy.py -%{python3_sitearch}/samba/netcmd/domain/models/auth_silo.py -%{python3_sitearch}/samba/netcmd/domain/models/claim_type.py -%{python3_sitearch}/samba/netcmd/domain/models/exceptions.py -%{python3_sitearch}/samba/netcmd/domain/models/fields.py -%{python3_sitearch}/samba/netcmd/domain/models/group.py -%{python3_sitearch}/samba/netcmd/domain/models/model.py -%{python3_sitearch}/samba/netcmd/domain/models/query.py -%{python3_sitearch}/samba/netcmd/domain/models/schema.py -%{python3_sitearch}/samba/netcmd/domain/models/site.py -%{python3_sitearch}/samba/netcmd/domain/models/subnet.py -%{python3_sitearch}/samba/netcmd/domain/models/user.py -%{python3_sitearch}/samba/netcmd/domain/models/value_type.py %{python3_sitearch}/samba/netcmd/domain/passwordsettings.py %{python3_sitearch}/samba/netcmd/domain/provision.py %{python3_sitearch}/samba/netcmd/domain/samba3upgrade.py @@ -2812,6 +2920,13 @@ fi %{python3_sitearch}/samba/netcmd/pso.py %{python3_sitearch}/samba/netcmd/rodc.py %{python3_sitearch}/samba/netcmd/schema.py +%dir %{python3_sitearch}/samba/netcmd/service_account +%{python3_sitearch}/samba/netcmd/service_account/__init__.py +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/group_msa_membership.py +%{python3_sitearch}/samba/netcmd/service_account/service_account.py %{python3_sitearch}/samba/netcmd/shell.py %{python3_sitearch}/samba/netcmd/sites.py %{python3_sitearch}/samba/netcmd/spn.py @@ -2908,20 +3023,17 @@ fi %{python3_sitearch}/samba/subunit/__pycache__/run.*.pyc %{python3_sitearch}/samba/subunit/run.py %{python3_sitearch}/samba/tdb_util.py -%{python3_sitearch}/samba/trust_utils.py %{python3_sitearch}/samba/upgrade.py %{python3_sitearch}/samba/upgradehelpers.py %{python3_sitearch}/samba/werror.*.so %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so %{python3_sitearch}/samba/xattr_tdb.*.so -%{_libdir}/libsamba-policy.cpython*.so.* -%{_libdir}/samba/libsamba-net.cpython*.so +%{_libdir}/samba/libsamba-net-join.cpython*.so %{_libdir}/samba/libsamba-python.cpython*.so %if %{with includelibs} %{_libdir}/samba/libpyldb-util.cpython*.so -%{_libdir}/samba/libpytalloc-util.cpython*.so %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -2930,16 +3042,13 @@ fi %{python3_sitearch}/_tdb_text.py %{python3_sitearch}/_tevent.cpython*.so %{python3_sitearch}/ldb.cpython*.so -%{python3_sitearch}/talloc.cpython*.so +#FIXME why is it missing? +#%{python3_sitearch}/talloc.cpython*.so %{python3_sitearch}/tdb.cpython*.so %{python3_sitearch}/tevent.py #endif with includelibs %endif -%files -n python3-%{name}-devel -%{_libdir}/libsamba-policy.*.so -%{_libdir}/pkgconfig/samba-policy.*.pc - %files -n python3-%{name}-dc %{python3_sitearch}/samba/samdb.py %{python3_sitearch}/samba/schema.py @@ -3038,6 +3147,8 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_env_tests.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_provision_tests.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc %{python3_sitearch}/samba/tests/__pycache__/docs.*.pyc %{python3_sitearch}/samba/tests/__pycache__/domain_backup.*.pyc @@ -3156,6 +3267,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/claims.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/gmsa.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_chunk.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_content.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc @@ -3179,6 +3291,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/check_output.py %{python3_sitearch}/samba/tests/blackbox/claims.py %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py +%{python3_sitearch}/samba/tests/blackbox/gmsa.py %{python3_sitearch}/samba/tests/blackbox/http_chunk.py %{python3_sitearch}/samba/tests/blackbox/http_content.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py @@ -3213,11 +3326,11 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc -%{python3_sitearch}/samba/tests/dcerpc/__pycache__/createtrustrelax.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa_utils.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc @@ -3234,10 +3347,10 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py -%{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/lsa.py +%{python3_sitearch}/samba/tests/dcerpc/lsa_utils.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py %{python3_sitearch}/samba/tests/dcerpc/misc.py %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py @@ -3268,6 +3381,8 @@ fi %{python3_sitearch}/samba/tests/dsdb_dns.py %{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py +%{python3_sitearch}/samba/tests/dsdb_quiet_env_tests.py +%{python3_sitearch}/samba/tests/dsdb_quiet_provision_tests.py %{python3_sitearch}/samba/tests/docs.py %{python3_sitearch}/samba/tests/domain_backup.py %{python3_sitearch}/samba/tests/domain_backup_offline.py @@ -3318,6 +3433,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/gkdi_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/gmsa_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/group_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc @@ -3359,6 +3475,7 @@ fi %{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/gkdi_tests.py +%{python3_sitearch}/samba/tests/krb5/gmsa_tests.py %{python3_sitearch}/samba/tests/krb5/group_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py @@ -3462,6 +3579,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_policy.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_silo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_claim.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_kds_root_key.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_models.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/drs_clone_dc_data_lmdb_size.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dsacl.*.pyc @@ -3484,6 +3602,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_userPassword_crypt.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/rodc.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/service_account.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/silo_base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/sites.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/timecmd.*.pyc @@ -3508,6 +3627,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/domain_auth_policy.py %{python3_sitearch}/samba/tests/samba_tool/domain_auth_silo.py %{python3_sitearch}/samba/tests/samba_tool/domain_claim.py +%{python3_sitearch}/samba/tests/samba_tool/domain_kds_root_key.py %{python3_sitearch}/samba/tests/samba_tool/domain_models.py %{python3_sitearch}/samba/tests/samba_tool/drs_clone_dc_data_lmdb_size.py %{python3_sitearch}/samba/tests/samba_tool/dsacl.py @@ -3530,6 +3650,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/provision_userPassword_crypt.py %{python3_sitearch}/samba/tests/samba_tool/rodc.py %{python3_sitearch}/samba/tests/samba_tool/schema.py +%{python3_sitearch}/samba/tests/samba_tool/service_account.py %{python3_sitearch}/samba/tests/samba_tool/silo_base.py %{python3_sitearch}/samba/tests/samba_tool/sites.py %{python3_sitearch}/samba/tests/samba_tool/timecmd.py @@ -3667,7 +3788,6 @@ fi %{_sysconfdir}/ctdb/functions %{_sysconfdir}/ctdb/nfs-linux-kernel-callout %{_sysconfdir}/ctdb/statd-callout -%config %{_sysconfdir}/sudoers.d/ctdb # CTDB scripts, no config files # script with executable bit means activated @@ -3707,6 +3827,8 @@ fi %{_libexecdir}/ctdb/ctdb_recovery_helper %{_libexecdir}/ctdb/ctdb_takeover_helper %{_libexecdir}/ctdb/smnotify +%{_libexecdir}/ctdb/statd_callout +%{_libexecdir}/ctdb/statd_callout_helper %{_libexecdir}/ctdb/tdb_mutex_check %dir %{_localstatedir}/lib/ctdb/ @@ -3737,7 +3859,6 @@ fi %{_datadir}/ctdb/events/legacy/00.ctdb.script %{_datadir}/ctdb/events/legacy/01.reclock.script %{_datadir}/ctdb/events/legacy/05.system.script -%{_datadir}/ctdb/events/legacy/06.nfs.script %{_datadir}/ctdb/events/legacy/10.interface.script %{_datadir}/ctdb/events/legacy/11.natgw.script %{_datadir}/ctdb/events/legacy/11.routing.script @@ -3746,6 +3867,7 @@ fi %{_datadir}/ctdb/events/legacy/31.clamd.script %{_datadir}/ctdb/events/legacy/40.vsftpd.script %{_datadir}/ctdb/events/legacy/41.httpd.script +%{_datadir}/ctdb/events/legacy/46.update-keytabs.script %{_datadir}/ctdb/events/legacy/47.samba-dcerpcd.script %{_datadir}/ctdb/events/legacy/48.netbios.script %{_datadir}/ctdb/events/legacy/49.winbind.script @@ -3753,6 +3875,8 @@ fi %{_datadir}/ctdb/events/legacy/60.nfs.script %{_datadir}/ctdb/events/legacy/70.iscsi.script %{_datadir}/ctdb/events/legacy/91.lvs.script +%dir %{_datadir}/ctdb/scripts +%{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh %if %{with testsuite} %files -n ctdb-tests @@ -4605,5 +4729,63 @@ fi %{_mandir}/man1/winexe.1.gz %endif +%files -n libldb +%{_libdir}/libldb.so.* +%dir %{_libdir}/samba +%{_libdir}/samba/libldb-key-value-private-samba.so +%{_libdir}/samba/libldb-tdb-err-map-private-samba.so +%{_libdir}/samba/libldb-tdb-int-private-samba.so +%if %{with lmdb} +%{_libdir}/samba/libldb-mdb-int-private-samba.so +%endif + +%dir %{_libdir}/samba/ldb +%{_libdir}/samba/ldb/asq.so +%{_libdir}/samba/ldb/ldb.so +%{_libdir}/samba/ldb/mdb.so +%{_libdir}/samba/ldb/paged_searches.so +%{_libdir}/samba/ldb/rdn_name.so +%{_libdir}/samba/ldb/sample.so +%{_libdir}/samba/ldb/server_sort.so +%{_libdir}/samba/ldb/skel.so +%{_libdir}/samba/ldb/tdb.so + +%files -n libldb-devel +%{_includedir}/samba-4.0/ldb_module.h +%{_includedir}/samba-4.0/ldb_handlers.h +%{_includedir}/samba-4.0/ldb_errors.h +%{_includedir}/samba-4.0/ldb_version.h +%{_includedir}/samba-4.0/ldb.h +%{_libdir}/libldb.so + +%{_libdir}/pkgconfig/ldb.pc +%{_mandir}/man3/ldb*.gz +%{_mandir}/man3/ldif*.gz + +%files -n ldb-tools +%{_bindir}/ldbadd +%{_bindir}/ldbdel +%{_bindir}/ldbedit +%{_bindir}/ldbmodify +%{_bindir}/ldbrename +%{_bindir}/ldbsearch +%{_libdir}/samba/libldb-cmdline-private-samba.so +%{_mandir}/man1/ldbadd.1.* +%{_mandir}/man1/ldbdel.1.* +%{_mandir}/man1/ldbedit.1.* +%{_mandir}/man1/ldbmodify.1.* +%{_mandir}/man1/ldbrename.1.* +%{_mandir}/man1/ldbsearch.1.* + +%files -n python-ldb-devel-common +#{_includedir}/pyldb.h +%{_mandir}/man*/Py*.gz + +%files -n python3-ldb +%{python3_sitearch}/ldb.cpython-*.so +%{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so +%{python3_sitearch}/_ldb_text.py +%{python3_sitearch}/__pycache__/_ldb_text.cpython-*.py* + %changelog %autochangelog diff --git a/sources b/sources index fa51daa..153969e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.4.tar.xz) = 390805d006c380e83f0a0f6f0c00cd6605c32c937f4cf11e7ac5b177abd4538b0be40c505d72c500855f28a625f60aaa007c4466c316c3f93bfb5baa583f384f -SHA512 (samba-4.20.4.tar.asc) = ff8369bf307e56fe842a101b05dcbf382779a3812763e67b573449412195777fce25864ca4e0d89c126bc46cf3a2d359c5d5bda68b60af8849cd91f9d418ee98 +SHA512 (samba-4.21.0rc2.tar.xz) = c561a1cff99fd23baa738ce304efacfab1f7033880c6b5da6c6d2fc821a751be4f3a11b6e98700192490df17a87b9d9ba24e1ce7ed17bf6710a80d3a24ee3639 +SHA512 (samba-4.21.0rc2.tar.asc) = 415abad180a9771765a3f17978b9aa8008088ef60aee4fa98a278a8d21fa8fc2cdde4d8b8b6b23ff7476d63f642ba2a0d028e63d12f8d27eddd66030dc1068b2 diff --git a/sync_machine_password_script_install.patch b/sync_machine_password_script_install.patch new file mode 100644 index 0000000..ea70c82 --- /dev/null +++ b/sync_machine_password_script_install.patch @@ -0,0 +1,91 @@ +From 7fedd0925965705e435a4bd411fdbd0e73d8b6a6 Mon Sep 17 00:00:00 2001 +From: Anoop C S +Date: Wed, 14 Aug 2024 19:47:35 +0530 +Subject: [PATCH 1/2] source3/script: Fix installation of + winbind_ctdb_updatekeytab.sh + +winbind_ctdb_updatekeytab.sh assumes the presence `onnode` utility to +execute `net ads` command on all nodes in the cluster. But `onnode` +is only built when configured with clustering support. Therefore perform +the script installation only with ctdb configuration. Also fix the +installation path to /usr/share/ctdb/scripts. + +Signed-off-by: Anoop C S +Reviewed-by: Guenther Deschner +--- + source3/script/wscript_build | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/source3/script/wscript_build b/source3/script/wscript_build +index 2b0643b0876..a634ece7ec1 100644 +--- a/source3/script/wscript_build ++++ b/source3/script/wscript_build +@@ -6,7 +6,8 @@ bld.INSTALL_FILES('${BINDIR}', + 'smbtar', + chmod=MODE_755, flat=True) + bld.INSTALL_FILES('${BINDIR}', 'samba-log-parser', chmod=MODE_755, flat=True) +-bld.INSTALL_FILES('${DATADIR}', 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) ++if conf.env.with_ctdb: ++ bld.INSTALL_FILES(bld.env.CTDB_DATADIR+"/scripts", 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) + + # Callout scripts for use in selftest environment + bld.SAMBA_SCRIPT('smbaddshare', pattern='smbaddshare', installdir='.') +-- +2.46.0 + + +From 24d5b7d711566297ce5db92ebc2f56ec100b1dca Mon Sep 17 00:00:00 2001 +From: Anoop C S +Date: Wed, 14 Aug 2024 19:49:04 +0530 +Subject: [PATCH 2/2] docs-xml: Fix script location in + syncmachinepasswordscript.xml + +Update the change in installation path for winbind_ctdb_updatekeytab.sh +from SAMBA_DATADIR to newly defined CTDB_DATADIR. + +Signed-off-by: Anoop C S +Reviewed-by: Guenther Deschner +--- + docs-xml/smbdotconf/security/syncmachinepasswordscript.xml | 4 ++-- + dynconfig/wscript | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml +index 9a7731930d5..df98610cf36 100644 +--- a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml ++++ b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml +@@ -11,7 +11,7 @@ + + + If keytabs should be generated in clustered environments it is recommended to update them on all nodes. +- You can set the config option to &pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. ++ You can set the config option to &pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. + It is also needed to activate the 46.update-keytabs.script in ctdb, + it re-creates the keytab during the ctdb recovered event: + +@@ -22,5 +22,5 @@ + + + +-&pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh ++&pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh + +diff --git a/dynconfig/wscript b/dynconfig/wscript +index 2041d881546..a784dac4e6c 100644 +--- a/dynconfig/wscript ++++ b/dynconfig/wscript +@@ -105,6 +105,11 @@ dynconfig = { + 'FHS-PATH': '${DATADIR}', + 'OVERWRITE': True, + }, ++ 'CTDB_DATADIR' : { ++ 'STD-PATH': '${DATADIR}/ctdb', ++ 'FHS-PATH': '${DATADIR}/ctdb', ++ 'OVERWRITE': True, ++ }, + 'SAMBA_DATADIR' : { + 'STD-PATH': '${DATADIR}/samba', + 'FHS-PATH': '${DATADIR}/samba', +-- +2.46.0 + From 22760e8157b79d2bb5dd4e150d49be93050da5e0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 07:49:11 +0200 Subject: [PATCH 196/295] Remove also python-ldb-devel-common - related: rhbz#230046 This was only used internally. --- samba.spec | 25 +++++-------------------- 1 file changed, 5 insertions(+), 20 deletions(-) diff --git a/samba.spec b/samba.spec index 22d0376..79d5769 100644 --- a/samba.spec +++ b/samba.spec @@ -1254,21 +1254,6 @@ Provides: ldb-tools = %{samba_depver} %description -n ldb-tools Tools to manage LDB files -### PYTHON3-LDB-DEVEL-COMMON -%package -n python-ldb-devel-common -Summary: Common development files for the Python bindings for the LDB library -License: LGPL-3.0-or-later - -Provides: pyldb-devel%{?_isa} = %{version}-%{release} -%{?python_provide:%python_provide python2-ldb-devel} - -Obsoletes: python-ldb-devel-common < 2.10 -Provides: python-ldb-devel-common = %{samba_depver} - -%description -n python-ldb-devel-common -Development files for the Python bindings for the LDB library. -This package includes files that aren't specific to a Python version. - ### PYTHON3-LDB %package -n python3-ldb Summary: Python bindings for the LDB library @@ -1280,6 +1265,8 @@ Requires: python3-tdb%{?_isa} >= %{tdb_version} Obsoletes: python3-ldb < 2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba +Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = %{samba_depver} Obsoletes: python3-ldb-devel < 2.10 Provides: python3-ldb-devel = %{samba_depver} @@ -1560,9 +1547,11 @@ rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist rm -rf %{buildroot}%{perl_vendorlib}/Parse/Yapp popd -# libldb manpages +# Install libldb manpages cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} +# Remove manpages we don't want rm -f %{buildroot}%{_mandir}/man3/_* +rm -f %{buildroot}%{_mandir}/man*/Py*.gz %if %{with testsuite} %check @@ -4777,10 +4766,6 @@ fi %{_mandir}/man1/ldbrename.1.* %{_mandir}/man1/ldbsearch.1.* -%files -n python-ldb-devel-common -#{_includedir}/pyldb.h -%{_mandir}/man*/Py*.gz - %files -n python3-ldb %{python3_sitearch}/ldb.cpython-*.so %{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so From 49d714c02974d2989ea1ff9129ffd90bfaa98ea2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 08:02:37 +0200 Subject: [PATCH 197/295] Update to version 4.21.0rc3 - related: rhbz#230046 --- samba.spec | 6 +- sources | 4 +- sync_machine_password_script_install.patch | 91 ---------------------- 3 files changed, 5 insertions(+), 96 deletions(-) delete mode 100644 sync_machine_password_script_install.patch diff --git a/samba.spec b/samba.spec index 79d5769..3465b9e 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -254,8 +254,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: sync_machine_password_script_install.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4731,7 +4729,9 @@ fi %dir %{_libdir}/samba/ldb %{_libdir}/samba/ldb/asq.so %{_libdir}/samba/ldb/ldb.so +%if %{with lmdb} %{_libdir}/samba/ldb/mdb.so +%endif %{_libdir}/samba/ldb/paged_searches.so %{_libdir}/samba/ldb/rdn_name.so %{_libdir}/samba/ldb/sample.so diff --git a/sources b/sources index 153969e..f42760a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc2.tar.xz) = c561a1cff99fd23baa738ce304efacfab1f7033880c6b5da6c6d2fc821a751be4f3a11b6e98700192490df17a87b9d9ba24e1ce7ed17bf6710a80d3a24ee3639 -SHA512 (samba-4.21.0rc2.tar.asc) = 415abad180a9771765a3f17978b9aa8008088ef60aee4fa98a278a8d21fa8fc2cdde4d8b8b6b23ff7476d63f642ba2a0d028e63d12f8d27eddd66030dc1068b2 +SHA512 (samba-4.21.0rc3.tar.xz) = 8f4bd550e922beb4af4ddbc1a3e96169c35a348ccaa6bd5de51cc0ce9545952c5262ecbd0e3e9e37576a8346b1e0c5ab27baccf6d015208a8ed2629df64e553b +SHA512 (samba-4.21.0rc3.tar.asc) = a2cdd7d9e53f58ecd32df0d41a928a103fdf78a3885a5d74cf48b7a6e40eed263853f0fa8161f4524844391ef443736659a6c6419aad41345cdc59192db704d3 diff --git a/sync_machine_password_script_install.patch b/sync_machine_password_script_install.patch deleted file mode 100644 index ea70c82..0000000 --- a/sync_machine_password_script_install.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 7fedd0925965705e435a4bd411fdbd0e73d8b6a6 Mon Sep 17 00:00:00 2001 -From: Anoop C S -Date: Wed, 14 Aug 2024 19:47:35 +0530 -Subject: [PATCH 1/2] source3/script: Fix installation of - winbind_ctdb_updatekeytab.sh - -winbind_ctdb_updatekeytab.sh assumes the presence `onnode` utility to -execute `net ads` command on all nodes in the cluster. But `onnode` -is only built when configured with clustering support. Therefore perform -the script installation only with ctdb configuration. Also fix the -installation path to /usr/share/ctdb/scripts. - -Signed-off-by: Anoop C S -Reviewed-by: Guenther Deschner ---- - source3/script/wscript_build | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/source3/script/wscript_build b/source3/script/wscript_build -index 2b0643b0876..a634ece7ec1 100644 ---- a/source3/script/wscript_build -+++ b/source3/script/wscript_build -@@ -6,7 +6,8 @@ bld.INSTALL_FILES('${BINDIR}', - 'smbtar', - chmod=MODE_755, flat=True) - bld.INSTALL_FILES('${BINDIR}', 'samba-log-parser', chmod=MODE_755, flat=True) --bld.INSTALL_FILES('${DATADIR}', 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) -+if conf.env.with_ctdb: -+ bld.INSTALL_FILES(bld.env.CTDB_DATADIR+"/scripts", 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) - - # Callout scripts for use in selftest environment - bld.SAMBA_SCRIPT('smbaddshare', pattern='smbaddshare', installdir='.') --- -2.46.0 - - -From 24d5b7d711566297ce5db92ebc2f56ec100b1dca Mon Sep 17 00:00:00 2001 -From: Anoop C S -Date: Wed, 14 Aug 2024 19:49:04 +0530 -Subject: [PATCH 2/2] docs-xml: Fix script location in - syncmachinepasswordscript.xml - -Update the change in installation path for winbind_ctdb_updatekeytab.sh -from SAMBA_DATADIR to newly defined CTDB_DATADIR. - -Signed-off-by: Anoop C S -Reviewed-by: Guenther Deschner ---- - docs-xml/smbdotconf/security/syncmachinepasswordscript.xml | 4 ++-- - dynconfig/wscript | 5 +++++ - 2 files changed, 7 insertions(+), 2 deletions(-) - -diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -index 9a7731930d5..df98610cf36 100644 ---- a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -+++ b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -@@ -11,7 +11,7 @@ - - - If keytabs should be generated in clustered environments it is recommended to update them on all nodes. -- You can set the config option to &pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. -+ You can set the config option to &pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. - It is also needed to activate the 46.update-keytabs.script in ctdb, - it re-creates the keytab during the ctdb recovered event: - -@@ -22,5 +22,5 @@ - - - --&pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh -+&pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh - -diff --git a/dynconfig/wscript b/dynconfig/wscript -index 2041d881546..a784dac4e6c 100644 ---- a/dynconfig/wscript -+++ b/dynconfig/wscript -@@ -105,6 +105,11 @@ dynconfig = { - 'FHS-PATH': '${DATADIR}', - 'OVERWRITE': True, - }, -+ 'CTDB_DATADIR' : { -+ 'STD-PATH': '${DATADIR}/ctdb', -+ 'FHS-PATH': '${DATADIR}/ctdb', -+ 'OVERWRITE': True, -+ }, - 'SAMBA_DATADIR' : { - 'STD-PATH': '${DATADIR}/samba', - 'FHS-PATH': '${DATADIR}/samba', --- -2.46.0 - From bcb3974e312f6d84a8f23246dc0c65121a2199b5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 09:29:46 +0200 Subject: [PATCH 198/295] Fix manpages for libldb related: rhbz#230046 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 3465b9e..792808a 100644 --- a/samba.spec +++ b/samba.spec @@ -1549,7 +1549,7 @@ popd cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} # Remove manpages we don't want rm -f %{buildroot}%{_mandir}/man3/_* -rm -f %{buildroot}%{_mandir}/man*/Py*.gz +rm -f %{buildroot}%{_mandir}/man3/PyLdb* %if %{with testsuite} %check From 4c2a193110ff7a9048ce27321cfdaed9dad37bf4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 14:55:13 +0200 Subject: [PATCH 199/295] Fix ldb requires and provides - related: rhbz#230046 --- samba.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 792808a..2c36f16 100644 --- a/samba.spec +++ b/samba.spec @@ -1220,6 +1220,7 @@ Requires: libtevent%{?_isa} >= %{tevent_version} Provides: bundled(libreplace) Obsoletes: libldb < 2.10 +Provides: libldb = 2.10 Provides: libldb = %{samba_depver} %description -n libldb @@ -1230,12 +1231,13 @@ servers, or use local tdb databases. %package -n libldb-devel Summary: Developer tools for the LDB library License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libldb%{?_isa} = %{samba_depver} Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} Obsoletes: libldb-devel < 2.10 +Provides: libldb-devel = 2.10 Provides: libldb-devel = %{samba_depver} %description -n libldb-devel @@ -1245,7 +1247,7 @@ Header files needed to develop programs that link against the LDB library. %package -n ldb-tools Summary: Tools to manage LDB files License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{samba_release} +Requires: libldb%{?_isa} = %{samba_depver} Obsoletes: ldb-tools < 2.10 Provides: ldb-tools = %{samba_depver} @@ -1256,7 +1258,7 @@ Tools to manage LDB files %package -n python3-ldb Summary: Python bindings for the LDB library License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} %{?python_provide:%python_provide python3-ldb} @@ -1264,8 +1266,10 @@ Obsoletes: python3-ldb < 2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = 2.10 Provides: python-ldb-devel-common = %{samba_depver} Obsoletes: python3-ldb-devel < 2.10 +Provides: python3-ldb-devel = 2.10 Provides: python3-ldb-devel = %{samba_depver} %description -n python3-ldb From 11eed52070ab5a7afa578bdc5adf776ab691f09b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 28 Aug 2024 13:54:34 +0200 Subject: [PATCH 200/295] Update to version 4.21.0rc4 - resolves: rhbz#2300469 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 2c36f16..9c94887 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index f42760a..f6fbb9e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc3.tar.xz) = 8f4bd550e922beb4af4ddbc1a3e96169c35a348ccaa6bd5de51cc0ce9545952c5262ecbd0e3e9e37576a8346b1e0c5ab27baccf6d015208a8ed2629df64e553b -SHA512 (samba-4.21.0rc3.tar.asc) = a2cdd7d9e53f58ecd32df0d41a928a103fdf78a3885a5d74cf48b7a6e40eed263853f0fa8161f4524844391ef443736659a6c6419aad41345cdc59192db704d3 +SHA512 (samba-4.21.0rc4.tar.xz) = bbf3e6506b15d7a386292e84c189a8dd2136cb016df9bdb07066359b4bbce5da7e1c7f889a2de223ed83bbd8760a0e5232f5986bfd1c368b1beead4ed25c1076 +SHA512 (samba-4.21.0rc4.tar.asc) = 8a646d3e4b79886e723ad0558f0412e5033d8481ae0d9e04606204ce6af47e2eee2028a32ecd342572ee882aae798a702675d7e4e0593c83dda69edd23b30850 From b363a4cfec680b18ab6f2b0659899d8485e3d993 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 2 Sep 2024 15:25:28 +0200 Subject: [PATCH 201/295] Update to version 4.21.0 - resolves: rhbz#2309153 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 9c94887..554fa54 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index f6fbb9e..3e8e284 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc4.tar.xz) = bbf3e6506b15d7a386292e84c189a8dd2136cb016df9bdb07066359b4bbce5da7e1c7f889a2de223ed83bbd8760a0e5232f5986bfd1c368b1beead4ed25c1076 -SHA512 (samba-4.21.0rc4.tar.asc) = 8a646d3e4b79886e723ad0558f0412e5033d8481ae0d9e04606204ce6af47e2eee2028a32ecd342572ee882aae798a702675d7e4e0593c83dda69edd23b30850 +SHA512 (samba-4.21.0.tar.xz) = d05c823afc04669766130745c139e7d129eb9961525453d6da8b5ee6693d4c08192496d07e5c211e86d553956504fb9df16611cc9268111b71b95c7f2fa868a0 +SHA512 (samba-4.21.0.tar.asc) = 7fffbd0b88b42dd7f340e4bcae17da4a68a0f8de86a1e71534a4a02a477a746e4cdb16df7c0da33aaf13278cefb452bd9b7c61ed029e248576f7158e8bec339e From 63dc1a2f19c43bd88f085b39457d3c9f2609e101 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Sep 2024 00:19:59 +0200 Subject: [PATCH 202/295] Update required tdb version - related: rhbz#2309153 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 554fa54..2a18182 100644 --- a/samba.spec +++ b/samba.spec @@ -198,7 +198,7 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.2 -%global tdb_version 1.4.11 +%global tdb_version 1.4.12 %global tevent_version 0.16.1 %global required_mit_krb5 1.20.1 From 19fdf21ce657e81bc5a06bca1fbaeeacbcd1eb48 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Fri, 13 Sep 2024 16:28:34 +0300 Subject: [PATCH 203/295] Fix Samba integration with FreeIPA - resolves: rhbz#2309199 Signed-off-by: Alexander Bokovoy --- samba-4.21.0-backport-freeipa-support.patch | 132 ++++++++++++++++++++ samba.spec | 2 + 2 files changed, 134 insertions(+) create mode 100644 samba-4.21.0-backport-freeipa-support.patch diff --git a/samba-4.21.0-backport-freeipa-support.patch b/samba-4.21.0-backport-freeipa-support.patch new file mode 100644 index 0000000..d1c5776 --- /dev/null +++ b/samba-4.21.0-backport-freeipa-support.patch @@ -0,0 +1,132 @@ +From 26797d7bd2662718b3eb795f1b8e6100d51e3ab7 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 3 Sep 2024 08:48:24 +0300 +Subject: [PATCH] sync machine password to keytab: handle FreeIPA use case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +FreeIPA uses own procedure to retrieve keytabs and during the setup of +Samba on FreeIPA client the keytab is already present, only machine +account needs to be set in the secrets database. + +'sync machine password to keytab' option handling broke this use case by +always attempting to contact a domain controller and failing to do so +(Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199). + +The original synchronizing machine account password to keytab feature +did not have a mechanism to disable its logic at all. + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Alexander Bokovoy +Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224 + +(cherry picked from commit 4f577c7b6894132be4842944f2f950b087312b16) +--- + .../security/syncmachinepasswordtokeytab.xml | 29 +++++++++++++++++-- + source3/libads/kerberos_keytab.c | 5 ++++ + source3/utils/net.c | 8 +++++ + source3/utils/testparm.c | 3 +- + 4 files changed, 41 insertions(+), 4 deletions(-) + +diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml +index 4cad9da73f2..f7dc30023d4 100644 +--- a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml ++++ b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml +@@ -18,7 +18,11 @@ or by winbindd doing regular updates (see ++If no value is present and is different from ++'secrets only', the behavior differs between winbind and net utility: ++ ++ ++ ++ winbind uses value ++ /path/to/keytab:sync_spns:sync_kvno:machine_password ++ where the path to the keytab is obtained either from the krb5 library or from ++ . ++ ++ ++ ++ net changesecretpw -f command uses the default 'disabled' value. ++ ++ No other net subcommands use the 'disabled' value. ++ ++ ++ ++If a single value 'disabled' is present, the synchronization process is ++disabled. This is required for FreeIPA domain member setup where keytab ++synchronization uses a protocol not implemented by Samba. + + + +diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c +index 6ede567b75f..dbf8af44c1f 100644 +--- a/source3/libads/kerberos_keytab.c ++++ b/source3/libads/kerberos_keytab.c +@@ -904,6 +904,11 @@ NTSTATUS sync_pw2keytabs(void) + goto params_ready; + } + ++ if ((*lp_ptr != NULL) && strequal_m(*lp_ptr, "disabled")) { ++ DBG_DEBUG("'sync machine password to keytab' is explicitly disabled.\n"); ++ return NT_STATUS_OK; ++ } ++ + line = lp_ptr; + while (*line) { + DBG_DEBUG("Scanning line: %s\n", *line); +diff --git a/source3/utils/net.c b/source3/utils/net.c +index 7b40d2bee95..c432ebe991f 100644 +--- a/source3/utils/net.c ++++ b/source3/utils/net.c +@@ -207,6 +207,14 @@ static int net_changesecretpw(struct net_context *c, int argc, + struct timeval tv = timeval_current(); + NTTIME now = timeval_to_nttime(&tv); + ++#ifdef HAVE_ADS ++ if (USE_KERBEROS_KEYTAB) { ++ if (lp_sync_machine_password_to_keytab() == NULL) { ++ lp_do_parameter(-1, "sync machine password to keytab", "disabled"); ++ } ++ } ++#endif ++ + if (c->opt_stdin) { + set_line_buffering(stdin); + set_line_buffering(stdout); +diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c +index e3ed336a79a..a31a7a8a30a 100644 +--- a/source3/utils/testparm.c ++++ b/source3/utils/testparm.c +@@ -803,7 +803,8 @@ static int do_global_checks(void) + "instead of 'kerberos method'.\n\n"); + } + +- if (lp_ptr != NULL) { ++ if (lp_ptr != NULL && ++ ((*lp_ptr != NULL) && !strequal_m(*lp_ptr, "disabled"))) { + while (*lp_ptr) { + ret |= pw2kt_check_line(*lp_ptr++); + } +-- +2.46.0 + diff --git a/samba.spec b/samba.spec index 2a18182..6c5f6b3 100644 --- a/samba.spec +++ b/samba.spec @@ -254,6 +254,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.21.0-backport-freeipa-support.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From b16ff1f961129810587ac3074f8f6ffaa83ee934 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Sep 2024 12:58:24 +0200 Subject: [PATCH 204/295] Add cert directories to samba-common Those are created by gpupdate and we need to have them packaged that selinux can label them correctly. --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index 6c5f6b3..a5bcf9e 100644 --- a/samba.spec +++ b/samba.spec @@ -1426,9 +1426,11 @@ popd install -d -m 0755 %{buildroot}/usr/{sbin,bin} install -d -m 0755 %{buildroot}%{_libdir}/security install -d -m 0755 %{buildroot}/var/lib/samba +install -d -m 0755 %{buildroot}/var/lib/samba/certs install -d -m 0755 %{buildroot}/var/lib/samba/drivers install -d -m 0755 %{buildroot}/var/lib/samba/lock install -d -m 0755 %{buildroot}/var/lib/samba/private +install -d -m 0755 %{buildroot}/var/lib/samba/private/certs install -d -m 0755 %{buildroot}/var/lib/samba/scripts install -d -m 0755 %{buildroot}/var/lib/samba/sysvol install -d -m 0755 %{buildroot}/var/lib/samba/usershares @@ -2056,7 +2058,9 @@ fi %ghost %dir /run/samba %ghost %dir /run/winbindd %dir /var/lib/samba +%dir /var/lib/samba/certs %attr(700,root,root) %dir /var/lib/samba/private +%attr(700,root,root) %dir /var/lib/samba/private/certs %dir /var/lib/samba/lock %attr(755,root,root) %dir %{_sysconfdir}/samba %config(noreplace) %{_sysconfdir}/samba/smb.conf From 6ad66947912c84943cf8533cdd0f82583ca21446 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 23 Sep 2024 19:35:26 -0400 Subject: [PATCH 205/295] Fix ELN build libsamba-policy is only built with the AD DC, but the LDB LMDB components should be built regardless: https://gitlab.com/samba-team/samba/-/merge_requests/3807 --- samba-4.21.0-ldb-lmdb.patch | 55 +++++++++++++++++++++++++++++++++++++ samba.spec | 10 ++++--- 2 files changed, 61 insertions(+), 4 deletions(-) create mode 100644 samba-4.21.0-ldb-lmdb.patch diff --git a/samba-4.21.0-ldb-lmdb.patch b/samba-4.21.0-ldb-lmdb.patch new file mode 100644 index 0000000..894014a --- /dev/null +++ b/samba-4.21.0-ldb-lmdb.patch @@ -0,0 +1,55 @@ +From 9f265d6f3b852a9eed9f19147585fe2801507f63 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 24 Sep 2024 15:48:23 +0200 +Subject: [PATCH] ldb: Build lmdb backend also in non-AD case + +We should build with lmdb support also if it is not in AD case. The lmdb +backend is also used e.g. by sssd. + +If you don't want to build it, you can always specify --without-ldb-lmdb + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15721 + +Signed-off-by: Andreas Schneider +--- + lib/ldb/wscript | 22 +++++++++------------- + 1 file changed, 9 insertions(+), 13 deletions(-) + +diff --git a/lib/ldb/wscript b/lib/ldb/wscript +index 87aa3bb6d77..f234fa79c10 100644 +--- a/lib/ldb/wscript ++++ b/lib/ldb/wscript +@@ -33,21 +33,17 @@ def configure(conf): + conf.CONFIG_GET('ENABLE_SELFTEST'): + Logs.warn("NOTE: Some AD DC parts of selftest will fail") + ++ conf.env.REQUIRE_LMDB = False ++ elif Options.options.without_ldb_lmdb: ++ if not Options.options.without_ad_dc and \ ++ conf.CONFIG_GET('ENABLE_SELFTEST'): ++ raise Errors.WafError('--without-ldb-lmdb conflicts ' ++ 'with --enable-selftest while ' ++ 'building the AD DC') ++ + conf.env.REQUIRE_LMDB = False + else: +- if Options.options.without_ad_dc: +- conf.env.REQUIRE_LMDB = False +- else: +- if Options.options.without_ldb_lmdb: +- if not Options.options.without_ad_dc and \ +- conf.CONFIG_GET('ENABLE_SELFTEST'): +- raise Errors.WafError('--without-ldb-lmdb conflicts ' +- 'with --enable-selftest while ' +- 'building the AD DC') +- +- conf.env.REQUIRE_LMDB = False +- else: +- conf.env.REQUIRE_LMDB = True ++ conf.env.REQUIRE_LMDB = True + + # if lmdb support is enabled then we require lmdb + # is present, build the mdb back end and enable lmdb support in +-- +GitLab + diff --git a/samba.spec b/samba.spec index a5bcf9e..4465c44 100644 --- a/samba.spec +++ b/samba.spec @@ -255,6 +255,8 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-4.21.0-backport-freeipa-support.patch +# https://gitlab.com/samba-team/samba/-/merge_requests/3807 +Patch1: samba-4.21.0-ldb-lmdb.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -2206,14 +2208,14 @@ fi %endif ### DC-LIBS %files dc-libs -%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* -%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libauth4-private-samba.so %if %{with dc} || %{with testsuite} +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so +%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libservice-private-samba.so %if %{with testsuite} @@ -2357,7 +2359,6 @@ fi %{_libdir}/libsamba-credentials.so %{_libdir}/libsamba-errors.so %{_libdir}/libsamba-hostconfig.so -%{_libdir}/libsamba-policy.so %{_libdir}/libsamba-util.so %{_libdir}/libsamdb.so %{_libdir}/libsmbconf.so @@ -2370,7 +2371,6 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc -%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so @@ -2379,7 +2379,9 @@ fi %if %{with dc} || %{with testsuite} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so +%{_libdir}/libsamba-policy.so %{_libdir}/pkgconfig/dcerpc_server.pc +%{_libdir}/pkgconfig/samba-policy.pc %endif %if %{without libsmbclient} From a4001d23ea32acfe66586fa9a612e60c6615f60a Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 25 Sep 2024 18:06:49 -0400 Subject: [PATCH 206/295] Always include libsamba-policy and libsamba-net-private-samba As of 4.21, these were converted to regular C libraries to which their respective Python modules depend: https://gitlab.com/samba-team/samba/-/commit/d11b281aefa98e6850053ccd6142253c6cf0d04f https://gitlab.com/samba-team/samba/-/commit/829b52f99d5a9c9df19c9eb67611618095967edd --- samba.spec | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/samba.spec b/samba.spec index 4465c44..8ee8df5 100644 --- a/samba.spec +++ b/samba.spec @@ -1531,10 +1531,7 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* /sbin/ldconfig -N -n %{buildroot}%{_libdir} %if %{without dc} && %{without testsuite} -for f in samba/libsamba-net-private-samba.so \ - samba/libsamba-python-private-samba.so \ - libsamba-policy.so* \ - pkgconfig/samba-policy.pc ; do +for f in samba/libsamba-python-private-samba.so; do rm -f %{buildroot}%{_libdir}/$f done #endif without dc @@ -2208,14 +2205,14 @@ fi %endif ### DC-LIBS %files dc-libs +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libauth4-private-samba.so +%{_libdir}/samba/libsamba-net-private-samba.so %if %{with dc} || %{with testsuite} -%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so -%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libservice-private-samba.so %if %{with testsuite} @@ -2371,17 +2368,17 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc +%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so +%{_libdir}/libsamba-policy.so %{_libdir}/libsmbldap.so %if %{with dc} || %{with testsuite} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so -%{_libdir}/libsamba-policy.so %{_libdir}/pkgconfig/dcerpc_server.pc -%{_libdir}/pkgconfig/samba-policy.pc %endif %if %{without libsmbclient} From 8f40e555ff762fd56d2d2ec0dc0e0c30f0f558e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 27 Sep 2024 13:59:42 +0200 Subject: [PATCH 207/295] Build with ceph again for ppc64le This is fixed https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 in gcc >= 11.3. It is ok to enable for rhel-9, rhel-10 and f41: gcc-11.5.0-2.el9 gcc-14.2.1-2.el10 gcc-14.2.1-3.fc41 --- samba.spec | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 8ee8df5..06a1376 100644 --- a/samba.spec +++ b/samba.spec @@ -55,9 +55,7 @@ # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} -# ppc64le excluded pending resolution of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 -#%%ifarch aarch64 ppc64le s390x x86_64 -%ifarch aarch64 s390x x86_64 riscv64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond_without vfs_cephfs %bcond_without ceph_mutex %else From 92d190c9b671b656cdccf53479443211be887f77 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Oct 2024 14:11:48 +0200 Subject: [PATCH 208/295] Don't use RTLD_DEEPBIND by default in libldb - resolves: rhbz#2278016 --- samba-4-21-fix-libldb-deepbind.patch | 286 +++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 287 insertions(+) create mode 100644 samba-4-21-fix-libldb-deepbind.patch diff --git a/samba-4-21-fix-libldb-deepbind.patch b/samba-4-21-fix-libldb-deepbind.patch new file mode 100644 index 0000000..9593482 --- /dev/null +++ b/samba-4-21-fix-libldb-deepbind.patch @@ -0,0 +1,286 @@ +From e2d3bf09d6d75c7dc009aff36119e51ea59371fc Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:19:17 +0200 +Subject: [PATCH 1/4] lib:ldb: Remove trailing spaces from ldb_modules.c + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 8d6b5183770895fef002b6cce84902d1874fa502) +--- + lib/ldb/common/ldb_modules.c | 34 +++++++++++++++++----------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c +index b5627b0d04f..5c970626206 100644 +--- a/lib/ldb/common/ldb_modules.c ++++ b/lib/ldb/common/ldb_modules.c +@@ -631,9 +631,9 @@ int ldb_next_start_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "start_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -650,9 +650,9 @@ int ldb_next_end_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "end_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -720,9 +720,9 @@ int ldb_next_prepare_commit(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "prepare_commit error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -739,9 +739,9 @@ int ldb_next_del_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "del_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -777,17 +777,17 @@ int ldb_module_send_entry(struct ldb_request *req, + req->handle->nesting == 0) { + char *s; + struct ldb_ldif ldif; +- ++ + ldif.changetype = LDB_CHANGETYPE_NONE; + ldif.msg = discard_const_p(struct ldb_message, msg); + + ldb_debug_add(req->handle->ldb, "ldb_trace_response: ENTRY\n"); + +- /* ++ /* + * The choice to call + * ldb_ldif_write_redacted_trace_string() is CRITICAL + * for security. It ensures that we do not output +- * passwords into debug logs ++ * passwords into debug logs + */ + + s = ldb_ldif_write_redacted_trace_string(req->handle->ldb, msg, &ldif); +@@ -1104,8 +1104,8 @@ static int ldb_modules_load_dir(const char *modules_dir, const char *version) + return LDB_SUCCESS; + } + +-/* +- load any additional modules from the given directory ++/* ++ load any additional modules from the given directory + */ + void ldb_set_modules_dir(struct ldb_context *ldb, const char *path) + { +-- +2.46.1 + + +From d0ec464cfced2654d74672846d83c19f69af622b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:19:44 +0200 +Subject: [PATCH 2/4] lib:ldb: Don't use RTLD_DEEPBIND by default + +It should be off by default, as this is not needed by default. It +crashes named on startup, if bind is built with jemalloc support. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit dc6927fdca2ad77dbcf212ef4d3ba0d118ec7bdf) +--- + lib/ldb/common/ldb_modules.c | 21 ++++++--------------- + selftest/selftest.pl | 6 ------ + selftest/wscript | 5 ++--- + 3 files changed, 8 insertions(+), 24 deletions(-) + +diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c +index 5c970626206..08d251f9bdd 100644 +--- a/lib/ldb/common/ldb_modules.c ++++ b/lib/ldb/common/ldb_modules.c +@@ -945,7 +945,7 @@ static int ldb_modules_load_path(const char *path, const char *version) + int dlopen_flags; + + #ifdef RTLD_DEEPBIND +- bool deepbind_enabled = (getenv("LDB_MODULES_DISABLE_DEEPBIND") == NULL); ++ bool deepbind_enabled = (getenv("LDB_MODULES_ENABLE_DEEPBIND") != NULL); + #endif + + ret = stat(path, &st); +@@ -981,21 +981,12 @@ static int ldb_modules_load_path(const char *path, const char *version) + dlopen_flags = RTLD_NOW; + #ifdef RTLD_DEEPBIND + /* +- * use deepbind if possible, to avoid issues with different +- * system library variants, for example ldb modules may be linked +- * against Heimdal while the application may use MIT kerberos. ++ * On systems where e.g. different kerberos libraries are used, like a ++ * mix of Heimdal and MIT Kerberos, LDB_MODULES_ENABLE_DEEPBIND should ++ * be set to avoid issues. + * +- * See the dlopen manpage for details. +- * +- * One typical user is the bind_dlz module of Samba, +- * but symbol versioning might be enough... +- * +- * We need a way to disable this in order to allow the +- * ldb_*ldap modules to work with a preloaded socket wrapper. +- * +- * So in future we may remove this completely +- * or at least invert the default behavior. +- */ ++ * By default Linux distributions only have one Kerberos library. ++ */ + if (deepbind_enabled) { + dlopen_flags |= RTLD_DEEPBIND; + } +diff --git a/selftest/selftest.pl b/selftest/selftest.pl +index 26b1663b5b6..a0c4ec80f59 100755 +--- a/selftest/selftest.pl ++++ b/selftest/selftest.pl +@@ -433,12 +433,6 @@ $ENV{UID_WRAPPER} = 1; + # We are already hitting the limit, so double it. + $ENV{NSS_WRAPPER_MAX_HOSTENTS} = 200; + +-# Disable RTLD_DEEPBIND hack for Samba bind dlz module +-# +-# This is needed in order to allow the ldb_*ldap module +-# to work with a preloaded socket wrapper. +-$ENV{LDB_MODULES_DISABLE_DEEPBIND} = 1; +- + my $socket_wrapper_dir; + if ($opt_socket_wrapper) { + $socket_wrapper_dir = SocketWrapper::setup_dir("$prefix_abs/w", $opt_socket_wrapper_pcap); +diff --git a/selftest/wscript b/selftest/wscript +index 52c34dcb88d..95e70706e63 100644 +--- a/selftest/wscript ++++ b/selftest/wscript +@@ -333,9 +333,8 @@ def cmd_testonly(opt): + asan_options += ":suppressions=${srcdir}/selftest/sanitizer/asan.supp" + asan_options += " " + +- # And we need to disable RTLD_DEEPBIND in ldb and socket wrapper +- no_leak_check = "LDB_MODULES_DISABLE_DEEPBIND=1 " +- no_leak_check += "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" ++ # We need to disable RTLD_DEEPBIND in socket wrapper ++ no_leak_check = "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" + no_leak_check += " " + env.CORE_COMMAND = asan_options + no_leak_check + env.CORE_COMMAND + +-- +2.46.1 + + +From e6745b1444b28904258710dff1dddd18a8b9f662 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:40:23 +0200 +Subject: [PATCH 3/4] lib:ldb: Remove trailing spaces from ldb.3.xml + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit d6ff05cb5708fb6746176821bee5f713195efa54) +--- + lib/ldb/man/ldb.3.xml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml +index 1c0a2ece552..1dd8b2462d4 100644 +--- a/lib/ldb/man/ldb.3.xml ++++ b/lib/ldb/man/ldb.3.xml +@@ -247,7 +247,7 @@ ldb_search(3) manual pages. + Author + + +- ldb was written by ++ ldb was written by + Andrew Tridgell. + + +-- +2.46.1 + + +From ba9918d45820fbdb864b5a1e058136eeb0cf1ce7 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:22:08 +0200 +Subject: [PATCH 4/4] lib:ldb: Document environment variables in ldb manpage + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Fri Sep 27 09:06:43 UTC 2024 on atb-devel-224 + +(cherry picked from commit 20a3a94e06a2294206ec233ccc7f873d6ef2aca0) +--- + lib/ldb/man/ldb.3.xml | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml +index 1dd8b2462d4..f8d3cb50446 100644 +--- a/lib/ldb/man/ldb.3.xml ++++ b/lib/ldb/man/ldb.3.xml +@@ -243,6 +243,27 @@ ldb_search(3) manual pages. + + + ++ ++ ENVIRONMENT VARIABLES ++ ++ ++ ++ LDB_URL ++ - connect to the provided URL (cmdline tools only) ++ ++ ++ ++ LDB_MODULES_PATH ++ - path where to load ldb modules from ++ ++ ++ ++ LDB_MODULES_ENABLE_DEEPBIND ++ - enable RTLD_DEEPBIND when loading ldb modules ++ ++ ++ ++ + + Author + +-- +2.46.1 + diff --git a/samba.spec b/samba.spec index 06a1376..67e3895 100644 --- a/samba.spec +++ b/samba.spec @@ -255,6 +255,7 @@ Source202: samba.abignore Patch0: samba-4.21.0-backport-freeipa-support.patch # https://gitlab.com/samba-team/samba/-/merge_requests/3807 Patch1: samba-4.21.0-ldb-lmdb.patch +Patch2: samba-4-21-fix-libldb-deepbind.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 2535a64d3408af19f390482a87aabf0f148c6683 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 14 Oct 2024 14:29:04 +0200 Subject: [PATCH 209/295] Update to version 4.21.1 - resolves: rhbz#2318518 --- samba-4-21-fix-libldb-deepbind.patch | 286 ----------- samba-4.21.0-backport-freeipa-support.patch | 132 ----- samba-4.21.0-ldb-lmdb.patch | 55 --- samba-4.21.0-s3-notifyd.patch | 513 ++++++++++++++++++++ samba.spec | 7 +- sources | 4 +- 6 files changed, 517 insertions(+), 480 deletions(-) delete mode 100644 samba-4-21-fix-libldb-deepbind.patch delete mode 100644 samba-4.21.0-backport-freeipa-support.patch delete mode 100644 samba-4.21.0-ldb-lmdb.patch create mode 100644 samba-4.21.0-s3-notifyd.patch diff --git a/samba-4-21-fix-libldb-deepbind.patch b/samba-4-21-fix-libldb-deepbind.patch deleted file mode 100644 index 9593482..0000000 --- a/samba-4-21-fix-libldb-deepbind.patch +++ /dev/null @@ -1,286 +0,0 @@ -From e2d3bf09d6d75c7dc009aff36119e51ea59371fc Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:19:17 +0200 -Subject: [PATCH 1/4] lib:ldb: Remove trailing spaces from ldb_modules.c - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 8d6b5183770895fef002b6cce84902d1874fa502) ---- - lib/ldb/common/ldb_modules.c | 34 +++++++++++++++++----------------- - 1 file changed, 17 insertions(+), 17 deletions(-) - -diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c -index b5627b0d04f..5c970626206 100644 ---- a/lib/ldb/common/ldb_modules.c -+++ b/lib/ldb/common/ldb_modules.c -@@ -631,9 +631,9 @@ int ldb_next_start_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "start_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -650,9 +650,9 @@ int ldb_next_end_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "end_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -720,9 +720,9 @@ int ldb_next_prepare_commit(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "prepare_commit error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -739,9 +739,9 @@ int ldb_next_del_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "del_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -777,17 +777,17 @@ int ldb_module_send_entry(struct ldb_request *req, - req->handle->nesting == 0) { - char *s; - struct ldb_ldif ldif; -- -+ - ldif.changetype = LDB_CHANGETYPE_NONE; - ldif.msg = discard_const_p(struct ldb_message, msg); - - ldb_debug_add(req->handle->ldb, "ldb_trace_response: ENTRY\n"); - -- /* -+ /* - * The choice to call - * ldb_ldif_write_redacted_trace_string() is CRITICAL - * for security. It ensures that we do not output -- * passwords into debug logs -+ * passwords into debug logs - */ - - s = ldb_ldif_write_redacted_trace_string(req->handle->ldb, msg, &ldif); -@@ -1104,8 +1104,8 @@ static int ldb_modules_load_dir(const char *modules_dir, const char *version) - return LDB_SUCCESS; - } - --/* -- load any additional modules from the given directory -+/* -+ load any additional modules from the given directory - */ - void ldb_set_modules_dir(struct ldb_context *ldb, const char *path) - { --- -2.46.1 - - -From d0ec464cfced2654d74672846d83c19f69af622b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:19:44 +0200 -Subject: [PATCH 2/4] lib:ldb: Don't use RTLD_DEEPBIND by default - -It should be off by default, as this is not needed by default. It -crashes named on startup, if bind is built with jemalloc support. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit dc6927fdca2ad77dbcf212ef4d3ba0d118ec7bdf) ---- - lib/ldb/common/ldb_modules.c | 21 ++++++--------------- - selftest/selftest.pl | 6 ------ - selftest/wscript | 5 ++--- - 3 files changed, 8 insertions(+), 24 deletions(-) - -diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c -index 5c970626206..08d251f9bdd 100644 ---- a/lib/ldb/common/ldb_modules.c -+++ b/lib/ldb/common/ldb_modules.c -@@ -945,7 +945,7 @@ static int ldb_modules_load_path(const char *path, const char *version) - int dlopen_flags; - - #ifdef RTLD_DEEPBIND -- bool deepbind_enabled = (getenv("LDB_MODULES_DISABLE_DEEPBIND") == NULL); -+ bool deepbind_enabled = (getenv("LDB_MODULES_ENABLE_DEEPBIND") != NULL); - #endif - - ret = stat(path, &st); -@@ -981,21 +981,12 @@ static int ldb_modules_load_path(const char *path, const char *version) - dlopen_flags = RTLD_NOW; - #ifdef RTLD_DEEPBIND - /* -- * use deepbind if possible, to avoid issues with different -- * system library variants, for example ldb modules may be linked -- * against Heimdal while the application may use MIT kerberos. -+ * On systems where e.g. different kerberos libraries are used, like a -+ * mix of Heimdal and MIT Kerberos, LDB_MODULES_ENABLE_DEEPBIND should -+ * be set to avoid issues. - * -- * See the dlopen manpage for details. -- * -- * One typical user is the bind_dlz module of Samba, -- * but symbol versioning might be enough... -- * -- * We need a way to disable this in order to allow the -- * ldb_*ldap modules to work with a preloaded socket wrapper. -- * -- * So in future we may remove this completely -- * or at least invert the default behavior. -- */ -+ * By default Linux distributions only have one Kerberos library. -+ */ - if (deepbind_enabled) { - dlopen_flags |= RTLD_DEEPBIND; - } -diff --git a/selftest/selftest.pl b/selftest/selftest.pl -index 26b1663b5b6..a0c4ec80f59 100755 ---- a/selftest/selftest.pl -+++ b/selftest/selftest.pl -@@ -433,12 +433,6 @@ $ENV{UID_WRAPPER} = 1; - # We are already hitting the limit, so double it. - $ENV{NSS_WRAPPER_MAX_HOSTENTS} = 200; - --# Disable RTLD_DEEPBIND hack for Samba bind dlz module --# --# This is needed in order to allow the ldb_*ldap module --# to work with a preloaded socket wrapper. --$ENV{LDB_MODULES_DISABLE_DEEPBIND} = 1; -- - my $socket_wrapper_dir; - if ($opt_socket_wrapper) { - $socket_wrapper_dir = SocketWrapper::setup_dir("$prefix_abs/w", $opt_socket_wrapper_pcap); -diff --git a/selftest/wscript b/selftest/wscript -index 52c34dcb88d..95e70706e63 100644 ---- a/selftest/wscript -+++ b/selftest/wscript -@@ -333,9 +333,8 @@ def cmd_testonly(opt): - asan_options += ":suppressions=${srcdir}/selftest/sanitizer/asan.supp" - asan_options += " " - -- # And we need to disable RTLD_DEEPBIND in ldb and socket wrapper -- no_leak_check = "LDB_MODULES_DISABLE_DEEPBIND=1 " -- no_leak_check += "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" -+ # We need to disable RTLD_DEEPBIND in socket wrapper -+ no_leak_check = "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" - no_leak_check += " " - env.CORE_COMMAND = asan_options + no_leak_check + env.CORE_COMMAND - --- -2.46.1 - - -From e6745b1444b28904258710dff1dddd18a8b9f662 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:40:23 +0200 -Subject: [PATCH 3/4] lib:ldb: Remove trailing spaces from ldb.3.xml - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit d6ff05cb5708fb6746176821bee5f713195efa54) ---- - lib/ldb/man/ldb.3.xml | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml -index 1c0a2ece552..1dd8b2462d4 100644 ---- a/lib/ldb/man/ldb.3.xml -+++ b/lib/ldb/man/ldb.3.xml -@@ -247,7 +247,7 @@ ldb_search(3) manual pages. - Author - - -- ldb was written by -+ ldb was written by - Andrew Tridgell. - - --- -2.46.1 - - -From ba9918d45820fbdb864b5a1e058136eeb0cf1ce7 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:22:08 +0200 -Subject: [PATCH 4/4] lib:ldb: Document environment variables in ldb manpage - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Fri Sep 27 09:06:43 UTC 2024 on atb-devel-224 - -(cherry picked from commit 20a3a94e06a2294206ec233ccc7f873d6ef2aca0) ---- - lib/ldb/man/ldb.3.xml | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml -index 1dd8b2462d4..f8d3cb50446 100644 ---- a/lib/ldb/man/ldb.3.xml -+++ b/lib/ldb/man/ldb.3.xml -@@ -243,6 +243,27 @@ ldb_search(3) manual pages. - - - -+ -+ ENVIRONMENT VARIABLES -+ -+ -+ -+ LDB_URL -+ - connect to the provided URL (cmdline tools only) -+ -+ -+ -+ LDB_MODULES_PATH -+ - path where to load ldb modules from -+ -+ -+ -+ LDB_MODULES_ENABLE_DEEPBIND -+ - enable RTLD_DEEPBIND when loading ldb modules -+ -+ -+ -+ - - Author - --- -2.46.1 - diff --git a/samba-4.21.0-backport-freeipa-support.patch b/samba-4.21.0-backport-freeipa-support.patch deleted file mode 100644 index d1c5776..0000000 --- a/samba-4.21.0-backport-freeipa-support.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 26797d7bd2662718b3eb795f1b8e6100d51e3ab7 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Tue, 3 Sep 2024 08:48:24 +0300 -Subject: [PATCH] sync machine password to keytab: handle FreeIPA use case -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -FreeIPA uses own procedure to retrieve keytabs and during the setup of -Samba on FreeIPA client the keytab is already present, only machine -account needs to be set in the secrets database. - -'sync machine password to keytab' option handling broke this use case by -always attempting to contact a domain controller and failing to do so -(Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199). - -The original synchronizing machine account password to keytab feature -did not have a mechanism to disable its logic at all. - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Alexander Bokovoy -Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224 - -(cherry picked from commit 4f577c7b6894132be4842944f2f950b087312b16) ---- - .../security/syncmachinepasswordtokeytab.xml | 29 +++++++++++++++++-- - source3/libads/kerberos_keytab.c | 5 ++++ - source3/utils/net.c | 8 +++++ - source3/utils/testparm.c | 3 +- - 4 files changed, 41 insertions(+), 4 deletions(-) - -diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -index 4cad9da73f2..f7dc30023d4 100644 ---- a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -+++ b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -@@ -18,7 +18,11 @@ or by winbindd doing regular updates (see -+If no value is present and is different from -+'secrets only', the behavior differs between winbind and net utility: -+ -+ -+ -+ winbind uses value -+ /path/to/keytab:sync_spns:sync_kvno:machine_password -+ where the path to the keytab is obtained either from the krb5 library or from -+ . -+ -+ -+ -+ net changesecretpw -f command uses the default 'disabled' value. -+ -+ No other net subcommands use the 'disabled' value. -+ -+ -+ -+If a single value 'disabled' is present, the synchronization process is -+disabled. This is required for FreeIPA domain member setup where keytab -+synchronization uses a protocol not implemented by Samba. - - - -diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c -index 6ede567b75f..dbf8af44c1f 100644 ---- a/source3/libads/kerberos_keytab.c -+++ b/source3/libads/kerberos_keytab.c -@@ -904,6 +904,11 @@ NTSTATUS sync_pw2keytabs(void) - goto params_ready; - } - -+ if ((*lp_ptr != NULL) && strequal_m(*lp_ptr, "disabled")) { -+ DBG_DEBUG("'sync machine password to keytab' is explicitly disabled.\n"); -+ return NT_STATUS_OK; -+ } -+ - line = lp_ptr; - while (*line) { - DBG_DEBUG("Scanning line: %s\n", *line); -diff --git a/source3/utils/net.c b/source3/utils/net.c -index 7b40d2bee95..c432ebe991f 100644 ---- a/source3/utils/net.c -+++ b/source3/utils/net.c -@@ -207,6 +207,14 @@ static int net_changesecretpw(struct net_context *c, int argc, - struct timeval tv = timeval_current(); - NTTIME now = timeval_to_nttime(&tv); - -+#ifdef HAVE_ADS -+ if (USE_KERBEROS_KEYTAB) { -+ if (lp_sync_machine_password_to_keytab() == NULL) { -+ lp_do_parameter(-1, "sync machine password to keytab", "disabled"); -+ } -+ } -+#endif -+ - if (c->opt_stdin) { - set_line_buffering(stdin); - set_line_buffering(stdout); -diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c -index e3ed336a79a..a31a7a8a30a 100644 ---- a/source3/utils/testparm.c -+++ b/source3/utils/testparm.c -@@ -803,7 +803,8 @@ static int do_global_checks(void) - "instead of 'kerberos method'.\n\n"); - } - -- if (lp_ptr != NULL) { -+ if (lp_ptr != NULL && -+ ((*lp_ptr != NULL) && !strequal_m(*lp_ptr, "disabled"))) { - while (*lp_ptr) { - ret |= pw2kt_check_line(*lp_ptr++); - } --- -2.46.0 - diff --git a/samba-4.21.0-ldb-lmdb.patch b/samba-4.21.0-ldb-lmdb.patch deleted file mode 100644 index 894014a..0000000 --- a/samba-4.21.0-ldb-lmdb.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 9f265d6f3b852a9eed9f19147585fe2801507f63 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 24 Sep 2024 15:48:23 +0200 -Subject: [PATCH] ldb: Build lmdb backend also in non-AD case - -We should build with lmdb support also if it is not in AD case. The lmdb -backend is also used e.g. by sssd. - -If you don't want to build it, you can always specify --without-ldb-lmdb - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15721 - -Signed-off-by: Andreas Schneider ---- - lib/ldb/wscript | 22 +++++++++------------- - 1 file changed, 9 insertions(+), 13 deletions(-) - -diff --git a/lib/ldb/wscript b/lib/ldb/wscript -index 87aa3bb6d77..f234fa79c10 100644 ---- a/lib/ldb/wscript -+++ b/lib/ldb/wscript -@@ -33,21 +33,17 @@ def configure(conf): - conf.CONFIG_GET('ENABLE_SELFTEST'): - Logs.warn("NOTE: Some AD DC parts of selftest will fail") - -+ conf.env.REQUIRE_LMDB = False -+ elif Options.options.without_ldb_lmdb: -+ if not Options.options.without_ad_dc and \ -+ conf.CONFIG_GET('ENABLE_SELFTEST'): -+ raise Errors.WafError('--without-ldb-lmdb conflicts ' -+ 'with --enable-selftest while ' -+ 'building the AD DC') -+ - conf.env.REQUIRE_LMDB = False - else: -- if Options.options.without_ad_dc: -- conf.env.REQUIRE_LMDB = False -- else: -- if Options.options.without_ldb_lmdb: -- if not Options.options.without_ad_dc and \ -- conf.CONFIG_GET('ENABLE_SELFTEST'): -- raise Errors.WafError('--without-ldb-lmdb conflicts ' -- 'with --enable-selftest while ' -- 'building the AD DC') -- -- conf.env.REQUIRE_LMDB = False -- else: -- conf.env.REQUIRE_LMDB = True -+ conf.env.REQUIRE_LMDB = True - - # if lmdb support is enabled then we require lmdb - # is present, build the mdb back end and enable lmdb support in --- -GitLab - diff --git a/samba-4.21.0-s3-notifyd.patch b/samba-4.21.0-s3-notifyd.patch new file mode 100644 index 0000000..31463fd --- /dev/null +++ b/samba-4.21.0-s3-notifyd.patch @@ -0,0 +1,513 @@ +From c9a7bc3e8f36cb9d6746e23ea56f9c27b82dcf49 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 22 Jul 2024 12:26:55 +0200 +Subject: [PATCH] s3:notifyd: Use a watcher per db record +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This fixes a O(n²) performance regression in notifyd. The problem was +that we had a watcher per notify instance. This changes the code to have +a watcher per notify db entry. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14430 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit af011b987a4ad0d3753d83cc0b8d97ad64ba874a) +--- + source3/smbd/notifyd/notifyd.c | 214 ++++++++++++++++++------- + source3/smbd/notifyd/notifyd_db.c | 5 +- + source3/smbd/notifyd/notifyd_entry.c | 51 ++++-- + source3/smbd/notifyd/notifyd_private.h | 46 ++++-- + 4 files changed, 228 insertions(+), 88 deletions(-) + +diff --git a/source3/smbd/notifyd/notifyd.c b/source3/smbd/notifyd/notifyd.c +index 64dd26a7e11..0b07ab3e435 100644 +--- a/source3/smbd/notifyd/notifyd.c ++++ b/source3/smbd/notifyd/notifyd.c +@@ -337,6 +337,7 @@ static bool notifyd_apply_rec_change( + struct messaging_context *msg_ctx) + { + struct db_record *rec = NULL; ++ struct notifyd_watcher watcher = {}; + struct notifyd_instance *instances = NULL; + size_t num_instances; + size_t i; +@@ -344,6 +345,7 @@ static bool notifyd_apply_rec_change( + TDB_DATA value; + NTSTATUS status; + bool ok = false; ++ bool new_watcher = false; + + if (pathlen == 0) { + DBG_WARNING("pathlen==0\n"); +@@ -374,8 +376,12 @@ static bool notifyd_apply_rec_change( + value = dbwrap_record_get_value(rec); + + if (value.dsize != 0) { +- if (!notifyd_parse_entry(value.dptr, value.dsize, NULL, +- &num_instances)) { ++ ok = notifyd_parse_entry(value.dptr, ++ value.dsize, ++ &watcher, ++ NULL, ++ &num_instances); ++ if (!ok) { + goto fail; + } + } +@@ -390,8 +396,22 @@ static bool notifyd_apply_rec_change( + goto fail; + } + +- if (value.dsize != 0) { +- memcpy(instances, value.dptr, value.dsize); ++ if (num_instances > 0) { ++ struct notifyd_instance *tmp = NULL; ++ size_t num_tmp = 0; ++ ++ ok = notifyd_parse_entry(value.dptr, ++ value.dsize, ++ NULL, ++ &tmp, ++ &num_tmp); ++ if (!ok) { ++ goto fail; ++ } ++ ++ memcpy(instances, ++ tmp, ++ sizeof(struct notifyd_instance) * num_tmp); + } + + for (i=0; ifilter, +- .internal_subdir_filter = chg->subdir_filter + }; + + num_instances += 1; + } + +- if ((instance->instance.filter != 0) || +- (instance->instance.subdir_filter != 0)) { +- int ret; ++ /* ++ * Calculate an intersection of the instances filters for the watcher. ++ */ ++ if (instance->instance.filter > 0) { ++ uint32_t filter = instance->instance.filter; ++ ++ if ((watcher.filter & filter) != filter) { ++ watcher.filter |= filter; ++ ++ new_watcher = true; ++ } ++ } ++ ++ /* ++ * Calculate an intersection of the instances subdir_filters for the ++ * watcher. ++ */ ++ if (instance->instance.subdir_filter > 0) { ++ uint32_t subdir_filter = instance->instance.subdir_filter; + +- TALLOC_FREE(instance->sys_watch); ++ if ((watcher.subdir_filter & subdir_filter) != subdir_filter) { ++ watcher.subdir_filter |= subdir_filter; + +- ret = sys_notify_watch(entries, sys_notify_ctx, path, +- &instance->internal_filter, +- &instance->internal_subdir_filter, +- notifyd_sys_callback, msg_ctx, +- &instance->sys_watch); +- if (ret != 0) { +- DBG_WARNING("sys_notify_watch for [%s] returned %s\n", +- path, strerror(errno)); ++ new_watcher = true; + } + } + + if ((instance->instance.filter == 0) && + (instance->instance.subdir_filter == 0)) { ++ uint32_t tmp_filter = 0; ++ uint32_t tmp_subdir_filter = 0; ++ + /* This is a delete request */ +- TALLOC_FREE(instance->sys_watch); + *instance = instances[num_instances-1]; + num_instances -= 1; ++ ++ for (i = 0; i < num_instances; i++) { ++ struct notifyd_instance *tmp = &instances[i]; ++ ++ tmp_filter |= tmp->instance.filter; ++ tmp_subdir_filter |= tmp->instance.subdir_filter; ++ } ++ ++ /* ++ * If the filter has changed, register a new watcher with the ++ * changed filter. ++ */ ++ if (watcher.filter != tmp_filter || ++ watcher.subdir_filter != tmp_subdir_filter) ++ { ++ watcher.filter = tmp_filter; ++ watcher.subdir_filter = tmp_subdir_filter; ++ ++ new_watcher = true; ++ } ++ } ++ ++ if (new_watcher) { ++ /* ++ * In case we removed all notify instances, we want to remove ++ * the watcher. We won't register a new one, if no filters are ++ * set anymore. ++ */ ++ ++ TALLOC_FREE(watcher.sys_watch); ++ ++ watcher.sys_filter = watcher.filter; ++ watcher.sys_subdir_filter = watcher.subdir_filter; ++ ++ /* ++ * Only register a watcher if we have filter. ++ */ ++ if (watcher.filter != 0 || watcher.subdir_filter != 0) { ++ int ret = sys_notify_watch(entries, ++ sys_notify_ctx, ++ path, ++ &watcher.sys_filter, ++ &watcher.sys_subdir_filter, ++ notifyd_sys_callback, ++ msg_ctx, ++ &watcher.sys_watch); ++ if (ret != 0) { ++ DBG_WARNING("sys_notify_watch for [%s] " ++ "returned %s\n", ++ path, ++ strerror(errno)); ++ } ++ } + } + + DBG_DEBUG("%s has %zu instances\n", path, num_instances); + + if (num_instances == 0) { ++ TALLOC_FREE(watcher.sys_watch); ++ + status = dbwrap_record_delete(rec); + if (!NT_STATUS_IS_OK(status)) { + DBG_WARNING("dbwrap_record_delete returned %s\n", +@@ -456,13 +541,21 @@ static bool notifyd_apply_rec_change( + goto fail; + } + } else { +- value = make_tdb_data( +- (uint8_t *)instances, +- sizeof(struct notifyd_instance) * num_instances); ++ struct TDB_DATA iov[2] = { ++ { ++ .dptr = (uint8_t *)&watcher, ++ .dsize = sizeof(struct notifyd_watcher), ++ }, ++ { ++ .dptr = (uint8_t *)instances, ++ .dsize = sizeof(struct notifyd_instance) * ++ num_instances, ++ }, ++ }; + +- status = dbwrap_record_store(rec, value, 0); ++ status = dbwrap_record_storev(rec, iov, ARRAY_SIZE(iov), 0); + if (!NT_STATUS_IS_OK(status)) { +- DBG_WARNING("dbwrap_record_store returned %s\n", ++ DBG_WARNING("dbwrap_record_storev returned %s\n", + nt_errstr(status)); + goto fail; + } +@@ -706,12 +799,18 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, + .when = tstate->msg->when }; + struct iovec iov[2]; + size_t path_len = key.dsize; ++ struct notifyd_watcher watcher = {}; + struct notifyd_instance *instances = NULL; + size_t num_instances = 0; + size_t i; ++ bool ok; + +- if (!notifyd_parse_entry(data.dptr, data.dsize, &instances, +- &num_instances)) { ++ ok = notifyd_parse_entry(data.dptr, ++ data.dsize, ++ &watcher, ++ &instances, ++ &num_instances); ++ if (!ok) { + DBG_DEBUG("Could not parse notifyd_entry\n"); + return; + } +@@ -734,9 +833,11 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, + + if (tstate->covered_by_sys_notify) { + if (tstate->recursive) { +- i_filter = instance->internal_subdir_filter; ++ i_filter = watcher.sys_subdir_filter & ++ instance->instance.subdir_filter; + } else { +- i_filter = instance->internal_filter; ++ i_filter = watcher.sys_filter & ++ instance->instance.filter; + } + } else { + if (tstate->recursive) { +@@ -1146,46 +1247,39 @@ static int notifyd_add_proxy_syswatches(struct db_record *rec, + struct db_context *db = dbwrap_record_get_db(rec); + TDB_DATA key = dbwrap_record_get_key(rec); + TDB_DATA value = dbwrap_record_get_value(rec); +- struct notifyd_instance *instances = NULL; +- size_t num_instances = 0; +- size_t i; ++ struct notifyd_watcher watcher = {}; + char path[key.dsize+1]; + bool ok; ++ int ret; + + memcpy(path, key.dptr, key.dsize); + path[key.dsize] = '\0'; + +- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, +- &num_instances); ++ /* This is a remote database, we just need the watcher. */ ++ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); + if (!ok) { + DBG_WARNING("Could not parse notifyd entry for %s\n", path); + return 0; + } + +- for (i=0; iinstance.filter; +- uint32_t subdir_filter = instance->instance.subdir_filter; +- int ret; ++ watcher.sys_watch = NULL; ++ watcher.sys_filter = watcher.filter; ++ watcher.sys_subdir_filter = watcher.subdir_filter; + +- /* +- * This is a remote database. Pointers that we were +- * given don't make sense locally. Initialize to NULL +- * in case sys_notify_watch fails. +- */ +- instances[i].sys_watch = NULL; +- +- ret = state->sys_notify_watch( +- db, state->sys_notify_ctx, path, +- &filter, &subdir_filter, +- notifyd_sys_callback, state->msg_ctx, +- &instance->sys_watch); +- if (ret != 0) { +- DBG_WARNING("inotify_watch returned %s\n", +- strerror(errno)); +- } ++ ret = state->sys_notify_watch(db, ++ state->sys_notify_ctx, ++ path, ++ &watcher.filter, ++ &watcher.subdir_filter, ++ notifyd_sys_callback, ++ state->msg_ctx, ++ &watcher.sys_watch); ++ if (ret != 0) { ++ DBG_WARNING("inotify_watch returned %s\n", strerror(errno)); + } + ++ memcpy(value.dptr, &watcher, sizeof(struct notifyd_watcher)); ++ + return 0; + } + +@@ -1193,21 +1287,17 @@ static int notifyd_db_del_syswatches(struct db_record *rec, void *private_data) + { + TDB_DATA key = dbwrap_record_get_key(rec); + TDB_DATA value = dbwrap_record_get_value(rec); +- struct notifyd_instance *instances = NULL; +- size_t num_instances = 0; +- size_t i; ++ struct notifyd_watcher watcher = {}; + bool ok; + +- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, +- &num_instances); ++ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); + if (!ok) { + DBG_WARNING("Could not parse notifyd entry for %.*s\n", + (int)key.dsize, (char *)key.dptr); + return 0; + } +- for (i=0; ientries database + */ + +-bool notifyd_parse_entry( +- uint8_t *buf, +- size_t buflen, +- struct notifyd_instance **instances, +- size_t *num_instances) ++/** ++ * @brief Parse a notifyd database entry. ++ * ++ * The memory we pass down needs to be aligned. If it isn't aligned we can run ++ * into obscure errors as we just point into the data buffer. ++ * ++ * @param data The data to parse ++ * @param data_len The length of the data to parse ++ * @param watcher A pointer to store the watcher data or NULL. ++ * @param instances A pointer to store the array of notify instances or NULL. ++ * @param pnum_instances The number of elements in the array. If you just want ++ * the number of elements pass NULL for the watcher and instances pointers. ++ * ++ * @return true on success, false if an error occurred. ++ */ ++bool notifyd_parse_entry(uint8_t *data, ++ size_t data_len, ++ struct notifyd_watcher *watcher, ++ struct notifyd_instance **instances, ++ size_t *pnum_instances) + { +- if ((buflen % sizeof(struct notifyd_instance)) != 0) { +- DBG_WARNING("invalid buffer size: %zu\n", buflen); ++ size_t ilen; ++ ++ if (data_len < sizeof(struct notifyd_watcher)) { + return false; + } + +- if (instances != NULL) { +- *instances = (struct notifyd_instance *)buf; ++ if (watcher != NULL) { ++ *watcher = *((struct notifyd_watcher *)(uintptr_t)data); + } +- if (num_instances != NULL) { +- *num_instances = buflen / sizeof(struct notifyd_instance); ++ ++ ilen = data_len - sizeof(struct notifyd_watcher); ++ if ((ilen % sizeof(struct notifyd_instance)) != 0) { ++ return false; ++ } ++ ++ if (pnum_instances != NULL) { ++ *pnum_instances = ilen / sizeof(struct notifyd_instance); + } ++ if (instances != NULL) { ++ /* The (uintptr_t) cast removes a warning from -Wcast-align. */ ++ *instances = ++ (struct notifyd_instance *)(uintptr_t) ++ (data + sizeof(struct notifyd_watcher)); ++ } ++ + return true; + } +diff --git a/source3/smbd/notifyd/notifyd_private.h b/source3/smbd/notifyd/notifyd_private.h +index 36c08f47c54..db8e6e1c005 100644 +--- a/source3/smbd/notifyd/notifyd_private.h ++++ b/source3/smbd/notifyd/notifyd_private.h +@@ -20,30 +20,48 @@ + #include "lib/util/server_id.h" + #include "notifyd.h" + ++ + /* +- * notifyd's representation of a notify instance ++ * Representation of a watcher for a path ++ * ++ * This will be stored in the db. + */ +-struct notifyd_instance { +- struct server_id client; +- struct notify_instance instance; +- +- void *sys_watch; /* inotify/fam/etc handle */ ++struct notifyd_watcher { ++ /* ++ * This is an intersections of the filter the watcher is listening for. ++ */ ++ uint32_t filter; ++ uint32_t subdir_filter; + + /* +- * Filters after sys_watch took responsibility of some bits ++ * Those are inout variables passed to the sys_watcher. The sys_watcher ++ * will remove the bits it can't handle. + */ +- uint32_t internal_filter; +- uint32_t internal_subdir_filter; ++ uint32_t sys_filter; ++ uint32_t sys_subdir_filter; ++ ++ /* The handle for inotify/fam etc. */ ++ void *sys_watch; ++}; ++ ++/* ++ * Representation of a notifyd instance ++ * ++ * This will be stored in the db. ++ */ ++struct notifyd_instance { ++ struct server_id client; ++ struct notify_instance instance; + }; + + /* + * Parse an entry in the notifyd_context->entries database + */ + +-bool notifyd_parse_entry( +- uint8_t *buf, +- size_t buflen, +- struct notifyd_instance **instances, +- size_t *num_instances); ++bool notifyd_parse_entry(uint8_t *data, ++ size_t data_len, ++ struct notifyd_watcher *watcher, ++ struct notifyd_instance **instances, ++ size_t *num_instances); + + #endif +-- +2.46.1 + diff --git a/samba.spec b/samba.spec index 67e3895..0de5d76 100644 --- a/samba.spec +++ b/samba.spec @@ -150,7 +150,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.21.0 +%global samba_version 4.21.1 # The release field is extended: # [.][.]%%{?dist}[.] @@ -252,10 +252,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.21.0-backport-freeipa-support.patch -# https://gitlab.com/samba-team/samba/-/merge_requests/3807 -Patch1: samba-4.21.0-ldb-lmdb.patch -Patch2: samba-4-21-fix-libldb-deepbind.patch +Patch0: samba-4.21.0-s3-notifyd.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} diff --git a/sources b/sources index 3e8e284..a1c1a28 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0.tar.xz) = d05c823afc04669766130745c139e7d129eb9961525453d6da8b5ee6693d4c08192496d07e5c211e86d553956504fb9df16611cc9268111b71b95c7f2fa868a0 -SHA512 (samba-4.21.0.tar.asc) = 7fffbd0b88b42dd7f340e4bcae17da4a68a0f8de86a1e71534a4a02a477a746e4cdb16df7c0da33aaf13278cefb452bd9b7c61ed029e248576f7158e8bec339e +SHA512 (samba-4.21.1.tar.xz) = 182759820708c9df26fbcb09e755e81236ecacf543f3e18a05dbd0ea551ab072d338fe239eb99ff506f158ec45e981a893ce46eacdde6e073ee85ceb43e2669a +SHA512 (samba-4.21.1.tar.asc) = 2c1e4b347044e15a852ced8bb412a3f372fd2c2b5e0001b1a773f7283f2d8fa62942143b46cbc3f16b18882255cf0aac4426002453971361b0002357657484f1 From 16e2ea30c449f8a043680b12aaac21abe6af286a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 15 Oct 2024 11:33:45 +0200 Subject: [PATCH 210/295] rpminspect: Disable inspection of disttag rpminspect just reads the file an doesn't expand it so it doesn't understand: Release: %{samba_release} [skip changelog] --- rpminspect.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 75d7856..c1455e2 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,4 +1,7 @@ --- +inspections: + disttag: off + badfuncs: ignore: - /usr/bin/nmblookup From a55c2e04452fd163be78a5079c6dc77218e916fc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 15 Oct 2024 11:57:41 +0200 Subject: [PATCH 211/295] Fix several rpminspect warnings --- samba.spec | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 0de5d76..e44cdd5 100644 --- a/samba.spec +++ b/samba.spec @@ -261,6 +261,7 @@ Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dcerpc = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -438,6 +439,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif @@ -464,6 +466,7 @@ Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -498,6 +501,7 @@ Summary: Libraries used by both Samba servers and clients Requires(pre): samba-common = %{samba_depver} Requires: samba-common = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -538,6 +542,7 @@ Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -574,6 +579,7 @@ Summary: DCE RPC binaries Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -634,6 +640,7 @@ Summary: Samba AD Domain Controller Libraries Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} @@ -654,6 +661,7 @@ Requires: %{name}-dc-libs = %{samba_depver} Requires: %{name}-dc = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: bind +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -688,6 +696,7 @@ Summary: Samba VFS module for Ceph distributed storage system Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -703,6 +712,7 @@ Summary: Samba VFS module for io_uring Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -721,6 +731,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -772,6 +783,7 @@ the Kerberos credentials cache of the user issuing the print job. Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %description ldb-ldap-modules This package contains the ldb ldap modules required by samba-tool and @@ -782,6 +794,7 @@ samba-gpupdate. Summary: Samba libraries Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -802,6 +815,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %description -n libnetapi This contains the NETAPI library from the Samba suite. @@ -822,6 +836,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -879,6 +894,7 @@ Requires: python3-requests Requires: python3-talloc Requires: python3-tdb Requires: python3-tevent +Requires: libldb = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif @@ -909,6 +925,7 @@ Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # for ms_forest_updates_markdown.py and ms_schema_markdown.py Requires: python3-markdown +Requires: libldb = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs @@ -944,6 +961,7 @@ Requires: %{name}-test-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} %endif Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} @@ -969,6 +987,7 @@ Summary: Libraries need by the testing tools for Samba servers and clients Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -1006,6 +1025,7 @@ Requires: %{name}-libs = %{samba_depver} Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} Suggests: %{name}-tools = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -1034,6 +1054,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -1057,6 +1078,7 @@ Requires: %{name}-winbind = %{samba_depver} Requires: %{name}-libs = %{samba_depver} %endif Requires: samba-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: samba4-winbind-krb5-locator = %{samba_depver} Obsoletes: samba4-winbind-krb5-locator < %{samba_depver} @@ -1099,6 +1121,7 @@ Summary: Samba Winexe Windows Binary License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -1219,8 +1242,8 @@ Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} Provides: bundled(libreplace) -Obsoletes: libldb < 2.10 -Provides: libldb = 2.10 +Obsoletes: libldb < 0:2.10 +Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} %description -n libldb @@ -1236,8 +1259,8 @@ Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} -Obsoletes: libldb-devel < 2.10 -Provides: libldb-devel = 2.10 +Obsoletes: libldb-devel < 0:2.10 +Provides: libldb-devel = 0:2.10 Provides: libldb-devel = %{samba_depver} %description -n libldb-devel From 682be9e3984abd64b6bd10423d79e26f99bcf196 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 15 Oct 2024 13:19:08 +0200 Subject: [PATCH 212/295] Fix some more rpminspect warnings --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index e44cdd5..5258f94 100644 --- a/samba.spec +++ b/samba.spec @@ -1271,7 +1271,7 @@ Header files needed to develop programs that link against the LDB library. Summary: Tools to manage LDB files License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} -Obsoletes: ldb-tools < 2.10 +Obsoletes: ldb-tools < 0:2.10 Provides: ldb-tools = %{samba_depver} %description -n ldb-tools @@ -1285,7 +1285,7 @@ Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} %{?python_provide:%python_provide python3-ldb} -Obsoletes: python3-ldb < 2.10 +Obsoletes: python3-ldb < 0:2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba Obsoletes: python-ldb-devel-common < 2.10 From 6d5708b5e4b8e9be2742e147c52b1961198d0ef5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 16 Oct 2024 10:17:10 +0200 Subject: [PATCH 213/295] Fix even more rpminspect warnings --- samba.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/samba.spec b/samba.spec index 5258f94..acaed49 100644 --- a/samba.spec +++ b/samba.spec @@ -641,6 +641,7 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} @@ -662,6 +663,7 @@ Requires: %{name}-dc = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: bind Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -697,6 +699,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -713,6 +716,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -784,6 +788,7 @@ Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description ldb-ldap-modules This package contains the ldb ldap modules required by samba-tool and @@ -816,6 +821,7 @@ Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description -n libnetapi This contains the NETAPI library from the Samba suite. @@ -926,6 +932,7 @@ Requires: python3-%{name} = %{samba_depver} # for ms_forest_updates_markdown.py and ms_schema_markdown.py Requires: python3-markdown Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs @@ -1122,6 +1129,7 @@ License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -1283,6 +1291,7 @@ Summary: Python bindings for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} +Requires: samba-client-libs = %{samba_depver} %{?python_provide:%python_provide python3-ldb} Obsoletes: python3-ldb < 0:2.10 From 1caea566a46616d21248b4a2ce7c87b7abf3b131 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 17 Oct 2024 11:39:31 +0200 Subject: [PATCH 214/295] Revert "Re-enable linking with mold on i686" This reverts commit ac58d580e8ff60046b6600a1f6c843391ae1ffdd. This is to address debuginfo issue reported by rpminspect for i686: https://bugzilla.redhat.com/show_bug.cgi?id=2318727 --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index acaed49..4001c34 100644 --- a/samba.spec +++ b/samba.spec @@ -353,7 +353,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch riscv64 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 BuildRequires: mold %endif @@ -1365,13 +1365,13 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" # Use the mold linker if possible export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -%ifnarch riscv64 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" #endif fedora >= 37 %endif -#endif narch riscv64 +#endif narch i686 %endif # Add support for mock ccache plugin From a98899c6d21a92fdb6b5ab406297406e8c7af2d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 22 Oct 2024 11:02:58 +0200 Subject: [PATCH 215/295] Fix samba 4.20 -> 4.21 upgrade for the removed python3-samba-devel --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 4001c34..cee1bec 100644 --- a/samba.spec +++ b/samba.spec @@ -685,6 +685,8 @@ Requires: libnetapi = %{samba_depver} Provides: samba4-devel = %{samba_depver} Obsoletes: samba4-devel < %{samba_depver} +Provides: python3-samba-devel = %{samba_depver} +Obsoletes: python3-samba-devel < %{samba_depver} %description devel The %{name}-devel package contains the header files for the libraries From 4ae2996e49becec13fe8a30bed92b3a9a9330170 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 22 Oct 2024 13:42:50 +0100 Subject: [PATCH 216/295] Rebuild for Jansson 2.14 (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/) From 667e752f95dad7cfb1526eb3d0f54a65e0e38386 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 25 Oct 2024 19:42:31 +0200 Subject: [PATCH 217/295] Add always to samba-devel: Requires: samba-dc-libs --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index cee1bec..8867bf8 100644 --- a/samba.spec +++ b/samba.spec @@ -678,9 +678,7 @@ name server related details of Samba AD. Summary: Developer tools for Samba libraries Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -%if %{with dc} Requires: %{name}-dc-libs = %{samba_depver} -%endif Requires: libnetapi = %{samba_depver} Provides: samba4-devel = %{samba_depver} From f654bad3bbb3968dd029d795205d4879bda2e864 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 13 Nov 2024 11:29:47 +0530 Subject: [PATCH 218/295] Remove unused macro samba_requires_eq This was previously used to force the installation of a matching libldb version from build time. With libldb now versioned along with Samba as a public library its usage got removed in d0472882 but the definition remained as a left over. Signed-off-by: Anoop C S --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index 8867bf8..57b412a 100644 --- a/samba.spec +++ b/samba.spec @@ -148,8 +148,6 @@ %bcond lmdb 0 %endif -%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") - %global samba_version 4.21.1 # The release field is extended: From 438b8a6e95335df41efa69442b7aef2bc246f51c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 25 Nov 2024 18:55:39 +0100 Subject: [PATCH 219/295] Update to version 4.21.2 - resolves: rhbz#2328717 --- samba.spec | 11 +++++++++-- sources | 4 ++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 57b412a..c3a8da1 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.1 +%global samba_version 4.21.2 # The release field is extended: # [.][.]%%{?dist}[.] @@ -1584,6 +1584,12 @@ cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} rm -f %{buildroot}%{_mandir}/man3/_* rm -f %{buildroot}%{_mandir}/man3/PyLdb* +# CTDB +%if %{with clustering} +touch %{buildroot}%{_libexecdir}/ctdb/statd_callout +#endif with clustering +%endif + %if %{with testsuite} %check # @@ -2640,6 +2646,7 @@ fi %{python3_sitearch}/samba/dcerpc/ntlmssp.*.so %{python3_sitearch}/samba/dcerpc/preg.*.so %{python3_sitearch}/samba/dcerpc/samr.*.so +%{python3_sitearch}/samba/dcerpc/schannel.*.so %{python3_sitearch}/samba/dcerpc/security.*.so %{python3_sitearch}/samba/dcerpc/server_id.*.so %{python3_sitearch}/samba/dcerpc/smb_acl.*.so @@ -3809,7 +3816,7 @@ fi %{_sysconfdir}/ctdb/functions %{_sysconfdir}/ctdb/nfs-linux-kernel-callout -%{_sysconfdir}/ctdb/statd-callout +%ghost %{_sysconfdir}/ctdb/statd-callout # CTDB scripts, no config files # script with executable bit means activated diff --git a/sources b/sources index a1c1a28..285808c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.1.tar.xz) = 182759820708c9df26fbcb09e755e81236ecacf543f3e18a05dbd0ea551ab072d338fe239eb99ff506f158ec45e981a893ce46eacdde6e073ee85ceb43e2669a -SHA512 (samba-4.21.1.tar.asc) = 2c1e4b347044e15a852ced8bb412a3f372fd2c2b5e0001b1a773f7283f2d8fa62942143b46cbc3f16b18882255cf0aac4426002453971361b0002357657484f1 +SHA512 (samba-4.21.2.tar.xz) = c26311a60d3994561aa12c36e54bc37d1161ec1063aa9876ea03dee24984e9c827e5836dc86bc392e37193010275a642b960e775b5a9e029246ba56ae1697682 +SHA512 (samba-4.21.2.tar.asc) = f3da123d2e86a7e07c4fcb83924edd29195d865091d80125f3531c463662a8a38ba6d8c467932af8cd065d0cc4467131c83a4e3783573b757f6ed9c2bde0befc From e2b080c313ae5af530b0b830bd5bf9f6af216cad Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 Nov 2024 14:52:12 +0100 Subject: [PATCH 220/295] Add python3-crypt-r as requirement for samba-tool --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index c3a8da1..9fd763b 100644 --- a/samba.spec +++ b/samba.spec @@ -565,6 +565,9 @@ Requires: lmdb %endif Requires: tdb-tools Requires: python3-gpg +# The `crypt` module has been removed in Python 3.13, this is a copy +# See also python3-crypt-r.x86_64 +Requires: python3-crypt-r %endif %description tools From 1af6d0aa01aa45a9bca5051d056cb3cd5660777e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:45:39 +0100 Subject: [PATCH 221/295] Add missing BuildRequires for running the testsuite [skip changelog] --- samba.spec | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 9fd763b..771e79f 100644 --- a/samba.spec +++ b/samba.spec @@ -419,6 +419,36 @@ BuildRequires: tdb-tools %endif #endif with dc || with testsuite + +%if %{with testsuite} +BuildRequires: bind-utils +BuildRequires: glibc-langpack-en +BuildRequires: git +BuildRequires: gnutls-utils +BuildRequires: jq +BuildRequires: krb5-pkinit +BuildRequires: krb5-workstation +BuildRequires: lmdb +BuildRequires: nss_wrapper +BuildRequires: pam_wrapper +BuildRequires: perl-Archive-Tar +BuildRequires: perl-Digest-MD5 +BuildRequires: perl-ExtUtils-MakeMaker +BuildRequires: perl-JSON +BuildRequires: perl-JSON-Parse +BuildRequires: perl-Parse-Yapp +BuildRequires: perl-Test-Base +BuildRequires: psmisc +BuildRequires: python3-libpamtest +# The `crypt` module has been removed in Python 3.13, this is a copy +# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 +BuildRequires: python3-crypt-r +BuildRequires: resolv_wrapper +BuildRequires: rsync +BuildRequires: socket_wrapper +BuildRequires: sudo +BuildRequires: uid_wrapper +#endif with testsuite %endif # filter out perl requirements pulled in from examples in the docdir. @@ -566,7 +596,7 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg # The `crypt` module has been removed in Python 3.13, this is a copy -# See also python3-crypt-r.x86_64 +# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 Requires: python3-crypt-r %endif From a5688d299c0d43fe960e3e57535c3e1fdcb392bf Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:48:35 +0100 Subject: [PATCH 222/295] Rework 'with testsuite' In case we run the testsuite, the %install part will be skipped. Without the testsuite, the %check section will be skipped. [skip changelog] --- samba.spec | 896 ++--------------------------------------------------- 1 file changed, 21 insertions(+), 875 deletions(-) diff --git a/samba.spec b/samba.spec index 771e79f..039caad 100644 --- a/samba.spec +++ b/samba.spec @@ -400,7 +400,7 @@ BuildRequires: libtdb-devel >= %{tdb_version} BuildRequires: python3-tdb >= %{tdb_version} %endif -%if %{with dc} || %{with testsuite} +%if %{with dc} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} %if 0%{?fedora} || 0%{?rhel} >= 9 @@ -418,7 +418,8 @@ BuildRequires: tdb-tools #endif without includelibs %endif -#endif with dc || with testsuite +#endif with dc +%endif %if %{with testsuite} BuildRequires: bind-utils @@ -1206,30 +1207,6 @@ projects to store temporary data. If an application is already using TDB for temporary data it is very easy to convert that application to be cluster aware and use CTDB instead. -%if %{with testsuite} -### CTDB-TEST -%package -n ctdb-tests -Summary: CTDB clustered database test suite - -Requires: %{name}-common-libs = %{samba_depver} -Requires: %{name}-client-libs = %{samba_depver} - -Requires: ctdb = %{samba_depver} -Recommends: nc - -Provides: ctdb-devel = %{samba_depver} -Obsoletes: ctdb-devel < %{samba_depver} - -%description -n ctdb-tests -Test suite for CTDB. -CTDB is a cluster implementation of the TDB database used by Samba and other -projects to store temporary data. If an application is already using TDB for -temporary data it is very easy to convert that application to be cluster aware -and use CTDB instead. - -#endif with testsuite -%endif - %if %{with pcp_pmda} %package -n ctdb-pcp-pmda @@ -1481,6 +1458,7 @@ doxygen Doxyfile popd %install +%if !%{with testsuite} # Do not use %%make_install, make is just a wrapper around waf in Samba! %{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot} @@ -1623,8 +1601,11 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout #endif with clustering %endif -%if %{with testsuite} +#endif !with testsuite +%endif + %check +%if %{with testsuite} # # samba3.smb2.timestamps.*: # @@ -1648,6 +1629,7 @@ export WINBINDD_DONT_LOG_STDOUT=1 #endif with testsuite %endif +%if !%{with testsuite} %post %systemd_post samba-bgqd.service %systemd_post smb.service @@ -1691,7 +1673,7 @@ fi %ldconfig_scriptlets common-libs -%if %{with dc} || %{with testsuite} +%if %{with dc} %ldconfig_scriptlets dc-libs %post dc @@ -1793,7 +1775,7 @@ fi %{_sbindir}/eventlogadm %{_sbindir}/nmbd %{_sbindir}/smbd -%if %{with dc} || %{with testsuite} +%if %{with dc} # This is only used by vfs_dfs_samba4 %{_libdir}/samba/libdfs-server-ad-private-samba.so %endif @@ -1811,7 +1793,7 @@ fi %{_libdir}/samba/vfs/commit.so %{_libdir}/samba/vfs/crossrename.so %{_libdir}/samba/vfs/default_quota.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/vfs/dfs_samba4.so %endif %{_libdir}/samba/vfs/dirsort.so @@ -1844,10 +1826,6 @@ fi %{_libdir}/samba/vfs/worm.so %{_libdir}/samba/vfs/xattr_tdb.so -%if %{with testsuite} -%{_libdir}/samba/vfs/nfs4acl_xattr.so -%endif - %dir %{_libexecdir}/samba %{_libexecdir}/samba/samba-bgqd @@ -2179,16 +2157,13 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc -%if %{with testsuite} -%{_libexecdir}/samba/rpcd_rpcecho -%endif %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_libexecdir}/samba/rpcd_witness %{_mandir}/man8/samba-dcerpcd.8* ### DC -%if %{with dc} || %{with testsuite} +%if %{with dc} %files dc %{_unitdir}/samba.service %{_sbindir}/samba @@ -2266,7 +2241,7 @@ fi %license source4/setup/ad-schema/licence.txt %{_datadir}/samba/setup -#endif with dc || with testsuite +#endif with dc %endif ### DC-LIBS %files dc-libs @@ -2274,16 +2249,12 @@ fi %{_libdir}/samba/libauth4-private-samba.so %{_libdir}/samba/libsamba-net-private-samba.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so %{_libdir}/samba/libservice-private-samba.so -%if %{with testsuite} -%{_libdir}/samba/libntvfs-private-samba.so -%endif - %dir %{_libdir}/samba/process_model %{_libdir}/samba/process_model/prefork.so %{_libdir}/samba/process_model/standard.so @@ -2302,10 +2273,6 @@ fi %{_libdir}/samba/service/winbindd.so %{_libdir}/samba/service/wrepl.so -%if %{with testsuite} -%{_libdir}/samba/service/smb.so -%endif - %{_libdir}/libdcerpc-server.so.* %{_libdir}/samba/libad-claims-private-samba.so %{_libdir}/samba/libauthn-policy-util-private-samba.so @@ -2440,7 +2407,7 @@ fi %{_libdir}/libsamba-policy.so %{_libdir}/libsmbldap.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so %{_libdir}/pkgconfig/dcerpc_server.pc @@ -3126,7 +3093,7 @@ fi %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc %{python3_sitearch}/samba/dcerpc/dnsserver.*.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{python3_sitearch}/samba/dckeytab.*.so %endif %{python3_sitearch}/samba/domain_update.py @@ -3770,21 +3737,12 @@ fi %{_mandir}/man1/ndrdump.1* %{_mandir}/man1/smbtorture.1* -%if %{with testsuite} -%{_mandir}/man1/vfstest.1* -# files to ignore in testsuite mode -%{_libdir}/samba/libnss-wrapper.so -%{_libdir}/samba/libsocket-wrapper.so -%{_libdir}/samba/libuid-wrapper.so -%endif - ### TEST-LIBS %files test-libs -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so -%else -%{_libdir}/samba/libdsdb-module-private-samba.so %endif +%{_libdir}/samba/libdsdb-module-private-samba.so ### USERSHARES %files usershares @@ -3940,820 +3898,6 @@ fi %dir %{_datadir}/ctdb/scripts %{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh -%if %{with testsuite} -%files -n ctdb-tests -%doc ctdb/tests/README -%{_bindir}/ctdb_local_daemons -%{_bindir}/ctdb_run_tests -%{_bindir}/ctdb_run_cluster_tests - -%dir %{_libexecdir}/ctdb -%dir %{_libexecdir}/ctdb/tests -%{_libexecdir}/ctdb/tests/cluster_mutex_test -%{_libexecdir}/ctdb/tests/cmdline_test -%{_libexecdir}/ctdb/tests/comm_client_test -%{_libexecdir}/ctdb/tests/comm_server_test -%{_libexecdir}/ctdb/tests/comm_test -%{_libexecdir}/ctdb/tests/conf_test -%{_libexecdir}/ctdb/tests/ctdb-db-test -%{_libexecdir}/ctdb/tests/ctdb_io_test -%{_libexecdir}/ctdb/tests/ctdb_packet_parse -%{_libexecdir}/ctdb/tests/ctdb_takeover_tests -%{_libexecdir}/ctdb/tests/db_hash_test -%{_libexecdir}/ctdb/tests/dummy_client -%{_libexecdir}/ctdb/tests/errcode -%{_libexecdir}/ctdb/tests/event_protocol_test -%{_libexecdir}/ctdb/tests/event_script_test -%{_libexecdir}/ctdb/tests/fake_ctdbd -%{_libexecdir}/ctdb/tests/fetch_loop -%{_libexecdir}/ctdb/tests/fetch_loop_key -%{_libexecdir}/ctdb/tests/fetch_readonly -%{_libexecdir}/ctdb/tests/fetch_readonly_loop -%{_libexecdir}/ctdb/tests/fetch_ring -%{_libexecdir}/ctdb/tests/g_lock_loop -%{_libexecdir}/ctdb/tests/hash_count_test -%{_libexecdir}/ctdb/tests/line_test -%{_libexecdir}/ctdb/tests/lock_tdb -%{_libexecdir}/ctdb/tests/message_ring -%{_libexecdir}/ctdb/tests/pidfile_test -%{_libexecdir}/ctdb/tests/pkt_read_test -%{_libexecdir}/ctdb/tests/pkt_write_test -%{_libexecdir}/ctdb/tests/porting_tests -%{_libexecdir}/ctdb/tests/protocol_basic_test -%{_libexecdir}/ctdb/tests/protocol_ctdb_compat_test -%{_libexecdir}/ctdb/tests/protocol_ctdb_test -%{_libexecdir}/ctdb/tests/protocol_types_compat_test -%{_libexecdir}/ctdb/tests/protocol_types_test -%{_libexecdir}/ctdb/tests/protocol_util_test -%{_libexecdir}/ctdb/tests/rb_test -%{_libexecdir}/ctdb/tests/reqid_test -%{_libexecdir}/ctdb/tests/run_event_test -%{_libexecdir}/ctdb/tests/run_proc_test -%{_libexecdir}/ctdb/tests/sigcode -%{_libexecdir}/ctdb/tests/sock_daemon_test -%{_libexecdir}/ctdb/tests/sock_io_test -%{_libexecdir}/ctdb/tests/srvid_test -%{_libexecdir}/ctdb/tests/system_socket_test -%{_libexecdir}/ctdb/tests/tmon_ping_test -%{_libexecdir}/ctdb/tests/tmon_test -%{_libexecdir}/ctdb/tests/transaction_loop -%{_libexecdir}/ctdb/tests/tunable_test -%{_libexecdir}/ctdb/tests/tunnel_cmd -%{_libexecdir}/ctdb/tests/tunnel_test -%{_libexecdir}/ctdb/tests/update_record -%{_libexecdir}/ctdb/tests/update_record_persistent - -%dir %{_datadir}/ctdb/tests -%dir %{_datadir}/ctdb/tests/CLUSTER -%dir %{_datadir}/ctdb/tests/CLUSTER/complex -%{_datadir}/ctdb/tests/CLUSTER/complex/11_ctdb_delip_removes_ip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/18_ctdb_reloadips.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/30_nfs_tickle_killtcp.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/31_nfs_tickle.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/32_cifs_tickle.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/33_gratuitous_arp.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/34_nfs_tickle_restart.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/36_smb_reset_server.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/37_nfs_reset_server.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/41_failover_ping_discrete.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/42_failover_ssh_hostname.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/43_failover_nfs_basic.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/44_failover_nfs_oneway.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/45_failover_nfs_kill.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/60_rogueip_releaseip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/61_rogueip_takeip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/README - -%dir %{_datadir}/ctdb/tests/CLUSTER/complex/scripts -%{_datadir}/ctdb/tests/CLUSTER/complex/scripts/local.bash - -%dir %{_datadir}/ctdb/tests/etc-ctdb -%dir %{_datadir}/ctdb/tests/etc-ctdb/events -%dir %{_datadir}/ctdb/tests/etc-ctdb/events/legacy -%{_datadir}/ctdb/tests/etc-ctdb/events/legacy/00.test.script -%dir %{_datadir}/ctdb/tests/INTEGRATION -%dir %{_datadir}/ctdb/tests/INTEGRATION/database -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.001.attach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.002.attach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.003.detach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.004.wipe.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.010.backup_restore.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/fetch.001.ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/fetch.002.ring-hotkeys.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/readonly.001.basic.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.001.volatile.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.002.large.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.003.no_resurrect.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.010.persistent.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.011.continue.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/database/scripts -%{_datadir}/ctdb/tests/INTEGRATION/database/scripts/local.bash -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.001.ptrans.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.002.loop.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.003.loop_recovery.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.004.update_record.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.010.loop_recovery.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/traverse.001.one.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/traverse.002.many.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.001.fast.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.002.full.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.003.recreate.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.030.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.031.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.032.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.033.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.034.locked.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/failover -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.001.list.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.010.addip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.011.delip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.012.reloadips.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.013.failover_noop.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.014.iface_gc.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.020.moveip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.030.disable_enable.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.032.stop_continue.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.040.NoIPTakeover.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.050.missing_ip.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/simple -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.000.onnode.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.001.listnodes.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.002.tunables.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.003.ping.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.004.getpid.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.005.process_exists.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.010.statistics.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.011.statistics_reset.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.001.stop_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.002.ban_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.003.capability_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.006.stop_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.007.ban_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.008.capability_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.010.getrelock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.012.reclock_command.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.015.reclock_remove_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.016.reclock_move_lock_dir.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.020.message_ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.021.tunnel_ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.030.node_stall_leader_timeout.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.090.unreachable.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.091.version_check.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.001.getdebug.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.002.setdebug.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.003.dumpmemory.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/eventscripts.001.zero_scripts.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/eventscripts.090.debug_hung.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/README -%dir %{_datadir}/ctdb/tests/scripts -%{_datadir}/ctdb/tests/scripts/cluster.bash -%{_datadir}/ctdb/tests/scripts/common.sh -%{_datadir}/ctdb/tests/scripts/integration.bash -%{_datadir}/ctdb/tests/scripts/integration_local_daemons.bash -%{_datadir}/ctdb/tests/scripts/integration_real_cluster.bash -%{_datadir}/ctdb/tests/scripts/script_install_paths.sh -%{_datadir}/ctdb/tests/scripts/test_wrap -%{_datadir}/ctdb/tests/scripts/unit.sh -%dir %{_datadir}/ctdb/tests/UNIT -%dir %{_datadir}/ctdb/tests/UNIT/cunit -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cmdline_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/comm_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/comm_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/conf_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_004.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_005.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_006.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_007.sh -%{_datadir}/ctdb/tests/UNIT/cunit/ctdb_io_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/db_hash_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/event_protocol_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/event_script_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/hash_count_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/line_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/path_tests_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pidfile_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pkt_read_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pkt_write_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/porting_tests_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_012.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_101.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_111.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_201.sh -%{_datadir}/ctdb/tests/UNIT/cunit/rb_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/reqid_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/run_event_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/run_proc_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/sock_daemon_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/sock_io_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/srvid_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tunable_test_001.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventd -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/ctdb.conf -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/debug-script.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data/03.notalink.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/empty -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/empty/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/01.test.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/02.test.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/03.test.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/01.disabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/02.enabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/a.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/README.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data/01.dummy.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data/02.disabled.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/empty -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/empty/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/01.disabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/02.enabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/a.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/README.script -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_001.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_002.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_003.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_004.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_005.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_006.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_007.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_008.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_009.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_011.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_012.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_013.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_014.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_021.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_022.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_023.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_024.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_031.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_032.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_033.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_041.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_042.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_043.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_044.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_051.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_052.sh -%{_datadir}/ctdb/tests/UNIT/eventd/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/scripts -%{_datadir}/ctdb/tests/UNIT/eventd/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.016.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.multi.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.025.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.031.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.041.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.042.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.051.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.052.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.053.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.054.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.016.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.019.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/31.clamd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/31.clamd.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/48.netbios.shutdown.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/48.netbios.startup.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.monitor.102.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.103.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.104.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.105.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.106.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.110.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.111.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.112.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.113.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.startup.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.102.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.103.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.104.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.105.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.106.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.107.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.108.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.109.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.111.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.112.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.113.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.114.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.121.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.122.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.131.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.132.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.141.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.142.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.143.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.144.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.151.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.152.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.153.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.161.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.162.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.multi.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.multi.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.025.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.026.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.027.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.028.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb/public_addresses -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb/rc.local -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d/nfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d/nfslock -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/samba -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/samba/smb.conf -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/sysconfig -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/sysconfig/nfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/README -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/00.ctdb.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/01.reclock.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/05.system.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/06.nfs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/10.interface.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/11.natgw.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/13.per_ip_routing.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/20.multipathd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/31.clamd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/40.vsftpd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/41.httpd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/48.netbios.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/49.winbind.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/50.samba.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/60.nfs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/91.lvs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/debug_locks.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/statd-callout.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.007.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb-config -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_killtcp -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_lvs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_natgw -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/date -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/df -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ethtool -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/exportfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/gstack -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/id -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip6tables -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/iptables -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ipvsadm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/kill -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/killall -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/multipath -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/net -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfs-fake-callout -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pidof -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pkill -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ps -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.lockd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.mountd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.rquotad -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.statd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpcinfo -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/service -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/sleep -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/smnotify -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ss -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/stat -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdb_mutex_check -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbdump -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbtool -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/testparm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/timeout -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/wbinfo -%dir %{_datadir}/ctdb/tests/UNIT/onnode -%{_datadir}/ctdb/tests/UNIT/onnode/0001.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0002.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0003.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0004.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0005.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0006.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0010.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0011.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0070.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0071.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0072.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0075.sh -%dir %{_datadir}/ctdb/tests/UNIT/onnode/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/onnode/etc-ctdb/nodes -%dir %{_datadir}/ctdb/tests/UNIT/onnode/scripts -%{_datadir}/ctdb/tests/UNIT/onnode/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/onnode/stubs -%{_datadir}/ctdb/tests/UNIT/onnode/stubs/ctdb -%{_datadir}/ctdb/tests/UNIT/onnode/stubs/ssh -%dir %{_datadir}/ctdb/tests/UNIT/shellcheck -%{_datadir}/ctdb/tests/UNIT/shellcheck/base_scripts.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/ctdb_helpers.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/event_scripts.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/functions.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/init_script.sh -%dir %{_datadir}/ctdb/tests/UNIT/shellcheck/scripts -%{_datadir}/ctdb/tests/UNIT/shellcheck/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/tests.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/tools.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover -%{_datadir}/ctdb/tests/UNIT/takeover/det.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/det.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/det.003.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover_helper -%{_datadir}/ctdb/tests/UNIT/takeover_helper/000.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/010.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/011.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/012.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/013.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/014.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/016.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/017.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/018.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/019.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/021.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/022.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/023.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/024.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/025.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/026.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/027.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/028.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/030.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/031.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/110.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/111.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/120.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/121.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/122.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/130.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/131.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/132.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/140.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/150.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/160.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/210.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/211.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/220.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/230.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/240.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/250.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/260.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover_helper/scripts -%{_datadir}/ctdb/tests/UNIT/takeover_helper/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.003.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.004.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.005.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.006.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.007.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.008.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.009.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.010.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.011.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.012.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.013.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.014.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.015.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.016.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.024.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.025.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.027.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.028.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.029.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.030.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.031.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.032.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.033.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.034.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.035.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.003.sh -%{_datadir}/ctdb/tests/UNIT/takeover/README -%dir %{_datadir}/ctdb/tests/UNIT/takeover/scripts -%{_datadir}/ctdb/tests/UNIT/takeover/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/tool -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.catdb.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.catdb.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.cattdb.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.cattdb.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.deletekey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbmap.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbseqnum.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbseqnum.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbstatus.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbstatus.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getpid.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getpid.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getreclock.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getreclock.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getvar.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getvar.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ifaces.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listvars.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.008.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.008.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pdelete.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ping.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pnn.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pstore.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ptrans.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.readkey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.recover.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.011.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.012.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.013.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.014.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.015.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.016.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.017.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.018.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.019.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.020.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.021.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.023.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.024.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setifacelink.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setifacelink.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setvar.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setvar.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.uptime.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.writekey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/README -%dir %{_datadir}/ctdb/tests/UNIT/tool/scripts -%{_datadir}/ctdb/tests/UNIT/tool/scripts/local.sh -#endif with selftest -%endif - %if %{with pcp_pmda} %files -n ctdb-pcp-pmda %dir %{_localstatedir}/lib/pcp/pmdas/ctdb @@ -4846,6 +3990,8 @@ fi %{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so %{python3_sitearch}/_ldb_text.py %{python3_sitearch}/__pycache__/_ldb_text.cpython-*.py* +#endif !with testsuite +%endif %changelog %autochangelog From b0f6e67bbc2238f365056aa0f264c437c4e07159 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:50:17 +0100 Subject: [PATCH 223/295] Add missing SAMBA_DCERPCD_DONT_LOG_STDOUT=1 for the testsuite [skip changelog] --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 039caad..c45bb11 100644 --- a/samba.spec +++ b/samba.spec @@ -1625,6 +1625,7 @@ export TDB_NO_FSYNC=1 export NMBD_DONT_LOG_STDOUT=1 export SMBD_DONT_LOG_STDOUT=1 export WINBINDD_DONT_LOG_STDOUT=1 +export SAMBA_DCERPCD_DONT_LOG_STDOUT=1 %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 #endif with testsuite %endif From 6b05011701d1266df1099baf1daa6dd2c0d44f45 Mon Sep 17 00:00:00 2001 From: Pete Walter Date: Sun, 8 Dec 2024 22:44:21 +0000 Subject: [PATCH 224/295] Rebuild for ICU 76 From d70953a5edf7f4ccc6b9be7958d739e30f8f861c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 10:42:42 +0100 Subject: [PATCH 225/295] Update to version 4.21.3 - resolves: rhbz#2335911 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index c45bb11..b956d6d 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.2 +%global samba_version 4.21.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 285808c..1055c45 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.2.tar.xz) = c26311a60d3994561aa12c36e54bc37d1161ec1063aa9876ea03dee24984e9c827e5836dc86bc392e37193010275a642b960e775b5a9e029246ba56ae1697682 -SHA512 (samba-4.21.2.tar.asc) = f3da123d2e86a7e07c4fcb83924edd29195d865091d80125f3531c463662a8a38ba6d8c467932af8cd065d0cc4467131c83a4e3783573b757f6ed9c2bde0befc +SHA512 (samba-4.21.3.tar.xz) = 62eb3bfe1aa1cc8aa68055d4caf21bdea6d6f5b0f767566bef1da210100b5dd17b7d60f5c47da01b0123d3a2c1c3689b1960ef2c2cbd4f804ff998ead994fc3f +SHA512 (samba-4.21.3.tar.asc) = 11e40d32b783b7d57d3f35fe96a17e897719f65d796d965b371dfb58b8cf1f8ffe60c3047bea8c2b2b0d475fa55cd25237b9ba84d44b3d65a8cd53c6af760957 From a7c8b51b0f13bd381d5cab73a48f9583d6b5ae56 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 13:27:35 +0100 Subject: [PATCH 226/295] Use upstream Patch instead of python3-crypt-r --- samba-4-21-pycrypt.patch | 853 +++++++++++++++++++++++++++++++++++++++ samba.spec | 5 +- 2 files changed, 855 insertions(+), 3 deletions(-) create mode 100644 samba-4-21-pycrypt.patch diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch new file mode 100644 index 0000000..8c197fc --- /dev/null +++ b/samba-4-21-pycrypt.patch @@ -0,0 +1,853 @@ +From 93bc860e8f344a96d0496edbc5d463f2c5411fcd Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 5 Dec 2024 16:35:51 +1300 +Subject: [PATCH 01/10] util: add a crypt wrapper, derived from + dsdb:password_hash + +This is going to be used by the dsdb password_hash module, and exposed +to Python via pyglue. + +We're doing this because Python 3.13 has dropped crypt from the Python +standard library. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Reviewed-by: Andreas Schneider +--- + lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ + lib/util/util_crypt.h | 5 +++ + lib/util/wscript_build | 6 +++ + 3 files changed, 101 insertions(+) + create mode 100644 lib/util/util_crypt.c + create mode 100644 lib/util/util_crypt.h + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +new file mode 100644 +index 00000000000..0f7b2d0fd31 +--- /dev/null ++++ b/lib/util/util_crypt.c +@@ -0,0 +1,90 @@ ++#include ++#include "data_blob.h" ++#include ++#include ++#include "util_crypt.h" ++ ++ ++static int crypt_as_best_we_can(const char *phrase, ++ const char *setting, ++ const char **hashp) ++{ ++ int ret = 0; ++ const char *hash = NULL; ++ ++#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) ++ struct crypt_data crypt_data = { ++ .initialized = 0 /* working storage used by crypt */ ++ }; ++#endif ++ ++ /* ++ * crypt_r() and crypt() may return a null pointer upon error ++ * depending on how libcrypt was configured, so we prefer ++ * crypt_rn() from libcrypt / libxcrypt which always returns ++ * NULL on error. ++ * ++ * POSIX specifies returning a null pointer and setting ++ * errno. ++ * ++ * RHEL 7 (which does not use libcrypt / libxcrypt) returns a ++ * non-NULL pointer from crypt_r() on success but (always?) ++ * sets errno during internal processing in the NSS crypto ++ * subsystem. ++ * ++ * By preferring crypt_rn we avoid the 'return non-NULL but ++ * set-errno' that we otherwise cannot tell apart from the ++ * RHEL 7 behaviour. ++ */ ++ errno = 0; ++ ++#ifdef HAVE_CRYPT_RN ++ hash = crypt_rn(phrase, setting, ++ &crypt_data, ++ sizeof(crypt_data)); ++#elif HAVE_CRYPT_R ++ hash = crypt_r(phrase, setting, &crypt_data); ++#else ++ /* ++ * No crypt_r falling back to crypt, which is NOT thread safe ++ * Thread safety MT-Unsafe race:crypt ++ */ ++ hash = crypt(phrase, setting); ++#endif ++ /* ++ * On error, crypt() and crypt_r() may return a null pointer, ++ * or a pointer to an invalid hash beginning with a '*'. ++ */ ++ ret = errno; ++ errno = 0; ++ if (hash == NULL || hash[0] == '*') { ++ if (ret == 0) { ++ /* this is annoying */ ++ ret = ENOTRECOVERABLE; ++ } ++ } ++ ++ *hashp = hash; ++ return ret; ++} ++ ++ ++int talloc_crypt_blob(TALLOC_CTX *mem_ctx, ++ const char *phrase, ++ const char *setting, ++ DATA_BLOB *blob) ++{ ++ const char *hash = NULL; ++ int ret = crypt_as_best_we_can(phrase, setting, &hash); ++ if (ret != 0) { ++ blob->data = NULL; ++ blob->length = 0; ++ return ret; ++ } ++ blob->length = strlen(hash); ++ blob->data = talloc_memdup(mem_ctx, hash, blob->length); ++ if (blob->data == NULL) { ++ return ENOMEM; ++ } ++ return 0; ++} +diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h +new file mode 100644 +index 00000000000..8c289e489e8 +--- /dev/null ++++ b/lib/util/util_crypt.h +@@ -0,0 +1,5 @@ ++ ++int talloc_crypt_blob(TALLOC_CTX *mem_ctx, ++ const char *phrase, ++ const char *cmd, ++ DATA_BLOB *blob); +diff --git a/lib/util/wscript_build b/lib/util/wscript_build +index b4fcfeaba07..7de9c0b7b17 100644 +--- a/lib/util/wscript_build ++++ b/lib/util/wscript_build +@@ -253,6 +253,12 @@ else: + private_library=True, + local_include=False) + ++ bld.SAMBA_LIBRARY('util_crypt', ++ source='util_crypt.c', ++ deps='talloc crypt', ++ private_library=True, ++ local_include=False) ++ + + bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', + source='unix_privs.c', +-- +2.34.1 + + +From c8c1de1ac3b715e76cb987525197209e453cdd50 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:29:21 +1300 +Subject: [PATCH 02/10] dsdb:password_hash: move hash_blob allocation up + +This will make the next patch simpler. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index 1d1267624e2..c1902126a72 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -1649,6 +1649,13 @@ static int setup_primary_userPassword_hash( + } + } + ++ hash_blob = talloc_zero(ctx, DATA_BLOB); ++ ++ if (hash_blob == NULL) { ++ TALLOC_FREE(frame); ++ return ldb_oom(ldb); ++ } ++ + /* + * Relies on the assertion that cleartext_utf8->data is a zero + * terminated UTF-8 string +@@ -1712,15 +1719,10 @@ static int setup_primary_userPassword_hash( + scheme, + reason); + TALLOC_FREE(frame); ++ TALLOC_FREE(hash_blob); + return LDB_ERR_OPERATIONS_ERROR; + } + +- hash_blob = talloc_zero(ctx, DATA_BLOB); +- +- if (hash_blob == NULL) { +- TALLOC_FREE(frame); +- return ldb_oom(ldb); +- } + + *hash_blob = data_blob_talloc(hash_blob, + (const uint8_t *)hash, +-- +2.34.1 + + +From ac5008598e4a4d3dbf5d58f4b4a2c6fc25195775 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 11:16:22 +1300 +Subject: [PATCH 03/10] dsdb:password_hash: use talloc_crypt_blob() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- + .../samdb/ldb_modules/wscript_build_server | 2 +- + 2 files changed, 13 insertions(+), 57 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index c1902126a72..7a7114c1caa 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -51,6 +51,7 @@ + #include "auth/common_auth.h" + #include "lib/messaging/messaging.h" + #include "lib/param/loadparm.h" ++#include "lib/util/util_crypt.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -1592,16 +1593,11 @@ static int setup_primary_userPassword_hash( + struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module); + const char *salt = NULL; /* Randomly generated salt */ + const char *cmd = NULL; /* command passed to crypt */ +- const char *hash = NULL; /* password hash generated by crypt */ + int algorithm = 0; /* crypt hash algorithm number */ + int rounds = 0; /* The number of hash rounds */ ++ int ret; + DATA_BLOB *hash_blob = NULL; + TALLOC_CTX *frame = talloc_stackframe(); +-#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) +- struct crypt_data crypt_data = { +- .initialized = 0 /* working storage used by crypt */ +- }; +-#endif + + /* Generate a random password salt */ + salt = generate_random_str_list(frame, +@@ -1660,52 +1656,20 @@ static int setup_primary_userPassword_hash( + * Relies on the assertion that cleartext_utf8->data is a zero + * terminated UTF-8 string + */ +- +- /* +- * crypt_r() and crypt() may return a null pointer upon error +- * depending on how libcrypt was configured, so we prefer +- * crypt_rn() from libcrypt / libxcrypt which always returns +- * NULL on error. +- * +- * POSIX specifies returning a null pointer and setting +- * errno. +- * +- * RHEL 7 (which does not use libcrypt / libxcrypt) returns a +- * non-NULL pointer from crypt_r() on success but (always?) +- * sets errno during internal processing in the NSS crypto +- * subsystem. +- * +- * By preferring crypt_rn we avoid the 'return non-NULL but +- * set-errno' that we otherwise cannot tell apart from the +- * RHEL 7 behaviour. +- */ +- errno = 0; +- +-#ifdef HAVE_CRYPT_RN +- hash = crypt_rn((char *)io->n.cleartext_utf8->data, +- cmd, +- &crypt_data, +- sizeof(crypt_data)); +-#elif HAVE_CRYPT_R +- hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data); +-#else +- /* +- * No crypt_r falling back to crypt, which is NOT thread safe +- * Thread safety MT-Unsafe race:crypt +- */ +- hash = crypt((char *)io->n.cleartext_utf8->data, cmd); +-#endif +- /* +- * On error, crypt() and crypt_r() may return a null pointer, +- * or a pointer to an invalid hash beginning with a '*'. +- */ +- if (hash == NULL || hash[0] == '*') { ++ ret = talloc_crypt_blob(hash_blob, ++ (char *)io->n.cleartext_utf8->data, ++ cmd, ++ hash_blob); ++ if (ret != 0) { + char buf[1024]; + const char *reason = NULL; +- if (errno == ERANGE) { ++ if (ret == ERANGE) { + reason = "Password exceeds maximum length allowed for crypt() hashing"; ++ } else if (ret == ENOTRECOVERABLE) { ++ /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ ++ reason = "Unknown error"; + } else { +- int err = strerror_r(errno, buf, sizeof(buf)); ++ int err = strerror_r(ret, buf, sizeof(buf)); + if (err == 0) { + reason = buf; + } else { +@@ -1723,14 +1687,6 @@ static int setup_primary_userPassword_hash( + return LDB_ERR_OPERATIONS_ERROR; + } + +- +- *hash_blob = data_blob_talloc(hash_blob, +- (const uint8_t *)hash, +- strlen(hash)); +- if (hash_blob->data == NULL) { +- TALLOC_FREE(frame); +- return ldb_oom(ldb); +- } + hash_value->value = hash_blob; + TALLOC_FREE(frame); + return LDB_SUCCESS; +diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server +index 9c1eb12a7c2..16d9b31a982 100644 +--- a/source4/dsdb/samdb/ldb_modules/wscript_build_server ++++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server +@@ -195,7 +195,7 @@ bld.SAMBA_MODULE('ldb_password_hash', + init_function='ldb_password_hash_module_init', + module_init_name='ldb_init_module', + internal_module=False, +- deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS crypt db-glue' ++ deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS util_crypt db-glue' + ) + + +-- +2.34.1 + + +From 0f19a12e9f28dd78e5108eeb22950eff48202d97 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:30:04 +1300 +Subject: [PATCH 04/10] util: add a crypt strerror helper + +This will be used by Python also. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + lib/util/util_crypt.c | 24 +++++++++++++++++++ + lib/util/util_crypt.h | 2 ++ + .../dsdb/samdb/ldb_modules/password_hash.c | 16 +------------ + 3 files changed, 27 insertions(+), 15 deletions(-) + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +index 0f7b2d0fd31..09cd47597d1 100644 +--- a/lib/util/util_crypt.c ++++ b/lib/util/util_crypt.c +@@ -88,3 +88,27 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + } + return 0; + } ++ ++ ++char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error) ++{ ++ char buf[1024]; ++ int err; ++ if (error == ERANGE) { ++ return talloc_strdup( ++ mem_ctx, ++ "Password exceeds maximum length allowed for crypt() hashing"); ++ } ++ if (error == ENOTRECOVERABLE) { ++ /* probably weird RHEL7 crypt, see crypt_as_best_we_can() */ ++ goto unknown; ++ } ++ ++ err = strerror_r(error, buf, sizeof(buf)); ++ if (err != 0) { ++ goto unknown; ++ } ++ return talloc_strndup(mem_ctx, buf, sizeof(buf)); ++unknown: ++ return talloc_strdup(mem_ctx, "Unknown error"); ++} +diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h +index 8c289e489e8..ca1a58e922c 100644 +--- a/lib/util/util_crypt.h ++++ b/lib/util/util_crypt.h +@@ -3,3 +3,5 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + const char *phrase, + const char *cmd, + DATA_BLOB *blob); ++ ++char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error); +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index 7a7114c1caa..6949a92fc3e 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -1661,21 +1661,7 @@ static int setup_primary_userPassword_hash( + cmd, + hash_blob); + if (ret != 0) { +- char buf[1024]; +- const char *reason = NULL; +- if (ret == ERANGE) { +- reason = "Password exceeds maximum length allowed for crypt() hashing"; +- } else if (ret == ENOTRECOVERABLE) { +- /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ +- reason = "Unknown error"; +- } else { +- int err = strerror_r(ret, buf, sizeof(buf)); +- if (err == 0) { +- reason = buf; +- } else { +- reason = "Unknown error"; +- } +- } ++ const char *reason = talloc_crypt_errstring(frame, ret); + ldb_asprintf_errstring( + ldb, + "setup_primary_userPassword: generation of a %s " +-- +2.34.1 + + +From 354ea5b1e69e27bfdd2d0b5ae8157790ba1bb590 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:30:15 +1300 +Subject: [PATCH 05/10] pyglue: add crypt() function + +This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in +turn wraps the system crypt[_r[n]]. + +We want this because the Python standard library crypt module is going +away. That one also wrapped the system crypt or crypt_r, so there +should be no change. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ + python/wscript | 1 + + 2 files changed, 42 insertions(+) + +diff --git a/python/pyglue.c b/python/pyglue.c +index 042bf9e14f3..fcccb849f5e 100644 +--- a/python/pyglue.c ++++ b/python/pyglue.c +@@ -18,6 +18,7 @@ + */ + + #include "lib/replace/system/python.h" ++#include "pyerrors.h" + #include "python/py3compat.h" + #include "includes.h" + #include "python/modules.h" +@@ -25,6 +26,7 @@ + #include "param/pyparam.h" + #include "lib/socket/netif.h" + #include "lib/util/debug.h" ++#include "lib/util/util_crypt.h" + #include "librpc/ndr/ndr_private.h" + #include "lib/cmdline/cmdline.h" + #include "lib/crypto/gkdi.h" +@@ -519,6 +521,42 @@ static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args) + return ret; + } + ++static PyObject *py_crypt(PyObject *self, PyObject *args) ++{ ++ PyObject *py_hash = NULL; ++ char *phrase = NULL; ++ char *setting = NULL; ++ TALLOC_CTX *frame = NULL; ++ int ret; ++ DATA_BLOB hash = {}; ++ ++ if (!PyArg_ParseTuple(args, "ss", &phrase, &setting)) { ++ TALLOC_FREE(frame); ++ return NULL; ++ } ++ frame = talloc_stackframe(); ++ ret = talloc_crypt_blob(frame, phrase, setting, &hash); ++ if (ret != 0) { ++ const char *errstr = talloc_crypt_errstring(frame, ret); ++ if (ret == EINVAL || ret == ERANGE || ret == ENOTRECOVERABLE) { ++ PyErr_Format(PyExc_ValueError, ++ "could not crypt(): %s", ++ errstr); ++ } else { ++ PyErr_Format(PyExc_OSError, ++ "could not crypt(): %s", ++ errstr); ++ } ++ TALLOC_FREE(frame); ++ return NULL; ++ } ++ ++ py_hash = PyUnicode_FromStringAndSize((char *)hash.data, hash.length); ++ TALLOC_FREE(frame); ++ return py_hash; ++} ++ ++ + static PyMethodDef py_misc_methods[] = { + { "generate_random_str", (PyCFunction)py_generate_random_str, METH_VARARGS, + "generate_random_str(len) -> string\n" +@@ -580,6 +618,9 @@ static PyMethodDef py_misc_methods[] = { + METH_NOARGS, "How many NDR internal tokens is too many for this build?" }, + { "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline, + METH_VARARGS, "Return a redacted commandline to feed to setproctitle (None if no redaction required)" }, ++ { "crypt", (PyCFunction)py_crypt, ++ METH_VARARGS, ++ "encrypt as phrase, per crypt(3), as determined by setting." }, + {0} + }; + +diff --git a/python/wscript b/python/wscript +index 3e6439930e9..7c17e390dc7 100644 +--- a/python/wscript ++++ b/python/wscript +@@ -119,6 +119,7 @@ def build(bld): + ndr + cmdline + gkdi ++ util_crypt + %s + ''' % (pyparam_util, pytalloc_util), + realname='samba/_glue.so') +-- +2.34.1 + + +From fec10dfe574a8acef0646a666fd4ff54ef11adf6 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 10:44:07 +1300 +Subject: [PATCH 06/10] pytest: test that _glue.crypt works + +The test vectors were generated via Python 3.10 crypt module, which +directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. + +We mainly test the sha256 and sha512 vectors, which seems to be all we +use, and which are said to be widely supported. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 65 insertions(+) + +diff --git a/python/samba/tests/glue.py b/python/samba/tests/glue.py +index ac504b3f366..824f5ca0c81 100644 +--- a/python/samba/tests/glue.py ++++ b/python/samba/tests/glue.py +@@ -88,3 +88,68 @@ class GlueTests(samba.tests.TestCase): + self.assertEqual(_glue.strstr_m(string, '_'), '_string_num__one') + self.assertEqual(_glue.strstr_m(string, '__'), '__one') + self.assertEqual(_glue.strstr_m(string, 'ring'), 'ring_num__one') ++ ++ def test_crypt(self): ++ # We hopefully only use schemes 5 and 6 (sha256 and sha512), ++ # which are OK and also quite widely supported according to ++ # https://en.wikipedia.org/wiki/Crypt_(C) ++ for phrase, setting, expected in [ ++ ("a", "$5$aaaaaa", ++ "$5$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6"), ++ # with scheme 5, 5000 rounds is default, so hash is the same as above ++ ('a', '$5$rounds=5000$aaaaaa', ++ '$5$rounds=5000$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6'), ++ ('a', ++ '$5$rounds=4999$aaaaaa', ++ '$5$rounds=4999$aaaaaa$FiP70gtxOJUFLokUJvET06E7jbL6aNmF6Wtv2ddzjY8'), ++ ('a', '$5$aaaaab', ++ '$5$aaaaab$e9qR2F833/JyuMu.nkQc9kn184vBWLo0ODqnCe./mj0'), ++ ++ ('', '$5$aaaaaa', '$5$aaaaaa$5B4WTdWp5n/v/aNUw2N8RsEitqvlZJEaAKhH/pOkGg4'), ++ ++ ("a", "$6$aaaaaa", ++ "$6$aaaaaa$KHs/Ez7X/I5/K.V8FR7kEsx9rOvjXnEDUmGC.dLBWP87XWy.oUEAM7QYcZQRVhiDwGepOF2pKrCVETYLyASh60"), ++ ++ ('', '$5$', '$5$$3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.'), ++ ++ # scheme 1 (md5) should be supported if not used ++ ('a', '$1$aaaaaa', ++ '$1$aaaaaa$MUMWPbGfzrHFCNm7ZHg31.'), ++ ++ ('', '$6$', ++ '$6$$/chiBau24cE26QQVW3IfIe68Xu5.JQ4E8Ie7lcRLwqxO5cxGuBhqF2HmTL.zWJ9zjChg3yJYFXeGBQ2y3Ba1d1'), ++ (' ', ++ '$6$6', ++ '$6$6$asLnbxf0obyuv3ybNvDE9ZcdwGFkDhLe7uW.wzdOdKCm4/M3vGFKq4Ttk1tBQrOn4wALZ3tj1L8IarIu5i8hR/'), ++ ++ # original DES scheme, 12 bits of salt ++ ("a", "lalala", "laKGbFzgh./R2"), ++ ("a", "lalalaLALALAla", "laKGbFzgh./R2"), ++ ("a", "arrgh", "ar7VUiUvDhX2c"), ++ ("a", "arrggghhh", "ar7VUiUvDhX2c"), ++ ]: ++ hash = _glue.crypt(phrase, setting) ++ self.assertEqual(hash, expected) ++ ++ def test_crypt_bad(self): ++ # We can't be too strident in our assertions, because every ++ # system allows a different set of algorithms, and some have ++ # different ideas of how to parse. ++ for phrase, setting, exception in [ ++ ("a", "$5", ValueError), ++ ("a", "$0$", ValueError), ++ ("a", None, TypeError), ++ (None, "", TypeError), ++ ('a', '$66$', ValueError), ++ ('a', '$$', ValueError), ++ ('a', '*0', ValueError), ++ ('a', '*', ValueError), ++ ('a', '++', ValueError), ++ # this next one is too long, except on Rocky Linux 8. ++ #('a' * 10000, '$5$5', ValueError), ++ # this is invalid, except on Debian 11. ++ # (' ', '$6$ ', ValueError), ++ ]: ++ with self.assertRaises(exception, ++ msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): ++ _glue.crypt(phrase, setting) +-- +2.34.1 + + +From 7d1fa8cdc52423bd53de4314a62e2c2b2e0b2aa7 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 15:54:48 +1300 +Subject: [PATCH 07/10] samba-tool user: use _glue.crypt, not crypt.crypt + +Because we know we have _glue.crypt, and we know it raises exceptions +rather than returning None, we can simplify the checks. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py +index 7944d4e1682..68befb3f356 100644 +--- a/python/samba/netcmd/user/readpasswords/common.py ++++ b/python/samba/netcmd/user/readpasswords/common.py +@@ -37,6 +37,7 @@ from samba.netcmd import Command, CommandError + from samba.samdb import SamDB + from samba.nt_time import timedelta_from_nt_time_delta, nt_time_from_datetime + from samba.gkdi import MAX_CLOCK_SKEW ++from samba._glue import crypt + + # python[3]-gpgme is abandoned since ubuntu 1804 and debian 9 + # have to use python[3]-gpg instead +@@ -132,9 +133,7 @@ def get_crypt_value(alg, utf8pw, rounds=0): + else: + crypt_salt = "$%s$%s$" % (alg, b64salt) + +- crypt_value = crypt.crypt(utf8pw, crypt_salt) +- if crypt_value is None: +- raise NotImplementedError("crypt.crypt(%s) returned None" % (crypt_salt)) ++ crypt_value = crypt(utf8pw, crypt_salt) + expected_len = len(crypt_salt) + algs[alg]["length"] + if len(crypt_value) != expected_len: + raise NotImplementedError("crypt.crypt(%s) returned a value with length %d, expected length is %d" % ( +@@ -156,21 +155,13 @@ except ImportError as e: + + for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: + try: +- import crypt + get_crypt_value(alg, "") +- virtual_attributes[attr] = { +- } +- except ImportError as e: +- reason = "crypt" +- reason += " required" +- disabled_virtual_attributes[attr] = { +- "reason": reason, +- } +- except NotImplementedError as e: +- reason = "modern '$%s$' salt in crypt(3) required" % (alg) ++ except (ValueError, OSError): + disabled_virtual_attributes[attr] = { +- "reason": reason, ++ "reason": f"modern '${alg}$' salt in crypt(3) required" + } ++ continue ++ virtual_attributes[attr] = {} + + # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 + for x in range(1, 30): +-- +2.34.1 + + +From dde9d1c473ac2fccfc123cfe2ca224da59042c6d Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 15:56:20 +1300 +Subject: [PATCH 08/10] samba-tool user: hashlib.sha1 is always present + +We maybe thought we were checking that sha1 was in hashlib, but we were +only checking that hashlib is in the Python library (`hashlib.sha1()` +would not raise ImportError). + +The documentation says hashlib always contains sha1 -- if that +changes, it is better we know by failing noisily with the import error +at the top of the file. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py +index 68befb3f356..3043525874e 100644 +--- a/python/samba/netcmd/user/readpasswords/common.py ++++ b/python/samba/netcmd/user/readpasswords/common.py +@@ -26,6 +26,7 @@ import datetime + import errno + import io + import os ++from hashlib import sha1 + + import ldb + from samba import credentials, nttime2float +@@ -141,17 +142,8 @@ def get_crypt_value(alg, utf8pw, rounds=0): + return crypt_value + + +-try: +- import hashlib +- hashlib.sha1() +- virtual_attributes["virtualSSHA"] = { +- } +-except ImportError as e: +- reason = "hashlib.sha1()" +- reason += " required" +- disabled_virtual_attributes["virtualSSHA"] = { +- "reason": reason, +- } ++ ++virtual_attributes["virtualSSHA"] = {} + + for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: + try: +@@ -736,7 +728,7 @@ class GetPasswordCommand(Command): + if u8 is None: + continue + salt = os.urandom(4) +- h = hashlib.sha1() ++ h = sha1() + h.update(u8) + h.update(salt) + bv = h.digest() + salt +-- +2.34.1 + + +From 361a7bcfc203c8cf4884c3f35e7147b59c0e4116 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 10:46:16 +1300 +Subject: [PATCH 09/10] pytest: password_hash uses internal _glue.crypt + +This will remove an external dependency. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/tests/password_hash.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/python/samba/tests/password_hash.py b/python/samba/tests/password_hash.py +index 1b7af7de7b8..39ef13fd7b2 100644 +--- a/python/samba/tests/password_hash.py ++++ b/python/samba/tests/password_hash.py +@@ -30,11 +30,11 @@ from samba.dcerpc.samr import DOMAIN_PASSWORD_STORE_CLEARTEXT + from samba.dsdb import UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED + from samba.tests import delete_force + from samba.tests.password_test import PasswordCommon ++from samba._glue import crypt + import ldb + import samba + import binascii + from hashlib import md5 +-import crypt + + + USER_NAME = "PasswordHashTestUser" +@@ -321,7 +321,7 @@ class PassWordHashTests(TestCase): + cmd = "$%s$rounds=%d$%s" % (alg, rounds, data[3]) + + # Calculate the expected hash value +- expected = crypt.crypt(USER_PASS, cmd) ++ expected = crypt(USER_PASS, cmd) + self.assertEqual(expected, up.hashes[i].value.decode('utf8')) + i += 1 + +-- +2.34.1 + + +From 11ec542b49c4fe165ce717b0f978439ed717f3e0 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:31:18 +1300 +Subject: [PATCH 10/10] util:datablob: data_blob_pad checks its alignment + assumption + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 +--- + lib/util/data_blob.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/util/data_blob.c b/lib/util/data_blob.c +index b5b78bc7a8a..0522e7755af 100644 +--- a/lib/util/data_blob.c ++++ b/lib/util/data_blob.c +@@ -286,7 +286,7 @@ _PUBLIC_ bool data_blob_pad(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, + size_t old_len = blob->length; + size_t new_len = (old_len + pad - 1) & ~(pad - 1); + +- if (new_len < old_len) { ++ if (new_len < old_len || (pad & (pad - 1)) != 0) { + return false; + } + +-- +2.34.1 + diff --git a/samba.spec b/samba.spec index b956d6d..68977a3 100644 --- a/samba.spec +++ b/samba.spec @@ -251,6 +251,7 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-4.21.0-s3-notifyd.patch +Patch1: samba-4-21-pycrypt.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -441,9 +442,6 @@ BuildRequires: perl-Parse-Yapp BuildRequires: perl-Test-Base BuildRequires: psmisc BuildRequires: python3-libpamtest -# The `crypt` module has been removed in Python 3.13, this is a copy -# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 -BuildRequires: python3-crypt-r BuildRequires: resolv_wrapper BuildRequires: rsync BuildRequires: socket_wrapper @@ -2062,6 +2060,7 @@ fi %{_libdir}/samba/libtdb-wrap-private-samba.so %{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libutil-crypt-private-samba.so %{_libdir}/samba/libutil-reg-private-samba.so %{_libdir}/samba/libutil-setid-private-samba.so %{_libdir}/samba/libutil-tdb-private-samba.so From 99bcb0cab84201e9f7154c4bf58ebe206f30e112 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 14:23:35 +0100 Subject: [PATCH 227/295] Remove 'Requires: python3-crypt-r' also from samba-tools --- samba.spec | 3 --- 1 file changed, 3 deletions(-) diff --git a/samba.spec b/samba.spec index 68977a3..30fdeb5 100644 --- a/samba.spec +++ b/samba.spec @@ -594,9 +594,6 @@ Requires: lmdb %endif Requires: tdb-tools Requires: python3-gpg -# The `crypt` module has been removed in Python 3.13, this is a copy -# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 -Requires: python3-crypt-r %endif %description tools From 09d4509590333c14fe063ef4115f51c81a512f04 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 09:54:56 +0000 Subject: [PATCH 228/295] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From c6899c34b0abb2e408216e19c317e5a5949b37e3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jan 2025 09:00:27 +0100 Subject: [PATCH 229/295] Fix stack use after return in new crypt module --- samba-4-21-pycrypt.patch | 150 +++++++++++++++++++++++++++++++-------- 1 file changed, 120 insertions(+), 30 deletions(-) diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch index 8c197fc..bf4c1e5 100644 --- a/samba-4-21-pycrypt.patch +++ b/samba-4-21-pycrypt.patch @@ -1,7 +1,7 @@ -From 93bc860e8f344a96d0496edbc5d463f2c5411fcd Mon Sep 17 00:00:00 2001 +From 07fe7b437c695c7a715418d4414c930b72758dab Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 5 Dec 2024 16:35:51 +1300 -Subject: [PATCH 01/10] util: add a crypt wrapper, derived from +Subject: [PATCH 01/11] util: add a crypt wrapper, derived from dsdb:password_hash This is going to be used by the dsdb password_hash module, and exposed @@ -13,6 +13,7 @@ standard library. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Reviewed-by: Andreas Schneider +(cherry picked from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b) --- lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ lib/util/util_crypt.h | 5 +++ @@ -146,13 +147,13 @@ index b4fcfeaba07..7de9c0b7b17 100644 bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', source='unix_privs.c', -- -2.34.1 +2.48.1 -From c8c1de1ac3b715e76cb987525197209e453cdd50 Mon Sep 17 00:00:00 2001 +From adf180613e4172292090d4c3573a439388a09788 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:29:21 +1300 -Subject: [PATCH 02/10] dsdb:password_hash: move hash_blob allocation up +Subject: [PATCH 02/11] dsdb:password_hash: move hash_blob allocation up This will make the next patch simpler. @@ -160,6 +161,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6) --- source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) @@ -200,18 +202,19 @@ index 1d1267624e2..c1902126a72 100644 *hash_blob = data_blob_talloc(hash_blob, (const uint8_t *)hash, -- -2.34.1 +2.48.1 -From ac5008598e4a4d3dbf5d58f4b4a2c6fc25195775 Mon Sep 17 00:00:00 2001 +From 9d43e4d649db23549bbb230ed60426fa286b7ab7 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 11:16:22 +1300 -Subject: [PATCH 03/10] dsdb:password_hash: use talloc_crypt_blob() +Subject: [PATCH 03/11] dsdb:password_hash: use talloc_crypt_blob() BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034) --- .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- .../samdb/ldb_modules/wscript_build_server | 2 +- @@ -339,13 +342,13 @@ index 9c1eb12a7c2..16d9b31a982 100644 -- -2.34.1 +2.48.1 -From 0f19a12e9f28dd78e5108eeb22950eff48202d97 Mon Sep 17 00:00:00 2001 +From 1c94645881bd5130c67bfee96aa463f360df300a Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:30:04 +1300 -Subject: [PATCH 04/10] util: add a crypt strerror helper +Subject: [PATCH 04/11] util: add a crypt strerror helper This will be used by Python also. @@ -353,6 +356,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2) --- lib/util/util_crypt.c | 24 +++++++++++++++++++ lib/util/util_crypt.h | 2 ++ @@ -429,13 +433,13 @@ index 7a7114c1caa..6949a92fc3e 100644 ldb, "setup_primary_userPassword: generation of a %s " -- -2.34.1 +2.48.1 -From 354ea5b1e69e27bfdd2d0b5ae8157790ba1bb590 Mon Sep 17 00:00:00 2001 +From ce70e852783ec69104d274def931e7d39f17576a Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:30:15 +1300 -Subject: [PATCH 05/10] pyglue: add crypt() function +Subject: [PATCH 05/11] pyglue: add crypt() function This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in turn wraps the system crypt[_r[n]]. @@ -448,6 +452,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a) --- python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ python/wscript | 1 + @@ -539,13 +544,13 @@ index 3e6439930e9..7c17e390dc7 100644 ''' % (pyparam_util, pytalloc_util), realname='samba/_glue.so') -- -2.34.1 +2.48.1 -From fec10dfe574a8acef0646a666fd4ff54ef11adf6 Mon Sep 17 00:00:00 2001 +From 9a0dc2db7cde22f36583159c0d697a3de6640990 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 10:44:07 +1300 -Subject: [PATCH 06/10] pytest: test that _glue.crypt works +Subject: [PATCH 06/11] pytest: test that _glue.crypt works The test vectors were generated via Python 3.10 crypt module, which directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. @@ -557,6 +562,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963) --- python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) @@ -635,13 +641,13 @@ index ac504b3f366..824f5ca0c81 100644 + msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): + _glue.crypt(phrase, setting) -- -2.34.1 +2.48.1 -From 7d1fa8cdc52423bd53de4314a62e2c2b2e0b2aa7 Mon Sep 17 00:00:00 2001 +From 6425e2514052027ee2269e15e0e0dff1686fa34e Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 15:54:48 +1300 -Subject: [PATCH 07/10] samba-tool user: use _glue.crypt, not crypt.crypt +Subject: [PATCH 07/11] samba-tool user: use _glue.crypt, not crypt.crypt Because we know we have _glue.crypt, and we know it raises exceptions rather than returning None, we can simplify the checks. @@ -650,6 +656,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180) --- .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- 1 file changed, 6 insertions(+), 15 deletions(-) @@ -704,13 +711,13 @@ index 7944d4e1682..68befb3f356 100644 # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 for x in range(1, 30): -- -2.34.1 +2.48.1 -From dde9d1c473ac2fccfc123cfe2ca224da59042c6d Mon Sep 17 00:00:00 2001 +From a2a04286e13676177c952e67363fc7502f544861 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 15:56:20 +1300 -Subject: [PATCH 08/10] samba-tool user: hashlib.sha1 is always present +Subject: [PATCH 08/11] samba-tool user: hashlib.sha1 is always present We maybe thought we were checking that sha1 was in hashlib, but we were only checking that hashlib is in the Python library (`hashlib.sha1()` @@ -724,6 +731,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98) --- python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) @@ -770,13 +778,13 @@ index 68befb3f356..3043525874e 100644 h.update(salt) bv = h.digest() + salt -- -2.34.1 +2.48.1 -From 361a7bcfc203c8cf4884c3f35e7147b59c0e4116 Mon Sep 17 00:00:00 2001 +From e9a8748f3cc4ba74f8b0d75e7a01866e7c12a0a4 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 10:46:16 +1300 -Subject: [PATCH 09/10] pytest: password_hash uses internal _glue.crypt +Subject: [PATCH 09/11] pytest: password_hash uses internal _glue.crypt This will remove an external dependency. @@ -784,6 +792,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d) --- python/samba/tests/password_hash.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) @@ -815,13 +824,13 @@ index 1b7af7de7b8..39ef13fd7b2 100644 i += 1 -- -2.34.1 +2.48.1 -From 11ec542b49c4fe165ce717b0f978439ed717f3e0 Mon Sep 17 00:00:00 2001 +From 0e01dc4f1fabfd2c3f21f724c05d94227a278b20 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:31:18 +1300 -Subject: [PATCH 10/10] util:datablob: data_blob_pad checks its alignment +Subject: [PATCH 10/11] util:datablob: data_blob_pad checks its alignment assumption BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 @@ -831,6 +840,8 @@ Reviewed-by: Andreas Schneider Autobuild-User(master): Andreas Schneider Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 + +(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb) --- lib/util/data_blob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) @@ -849,5 +860,84 @@ index b5b78bc7a8a..0522e7755af 100644 } -- -2.34.1 +2.48.1 + + +From 8cfae9f33fb1c170c3fe937be200490597e9e4c2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 17 Jan 2025 13:28:30 +0100 +Subject: [PATCH 11/11] lib:util: Fix stack-use-after-return in + crypt_as_best_we_can() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784 + +Signed-off-by: Andreas Schneider +Reviewed-by: Douglas Bagnall +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Douglas Bagnall +Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224 + +(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53) +--- + lib/util/util_crypt.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +index 09cd47597d1..9ac6e1cfd0e 100644 +--- a/lib/util/util_crypt.c ++++ b/lib/util/util_crypt.c +@@ -1,11 +1,13 @@ + #include + #include "data_blob.h" ++#include "discard.h" + #include + #include + #include "util_crypt.h" + + +-static int crypt_as_best_we_can(const char *phrase, ++static int crypt_as_best_we_can(TALLOC_CTX *mem_ctx, ++ const char *phrase, + const char *setting, + const char **hashp) + { +@@ -63,8 +65,14 @@ static int crypt_as_best_we_can(const char *phrase, + ret = ENOTRECOVERABLE; + } + } ++ if (ret != 0) { ++ return ret; ++ } + +- *hashp = hash; ++ *hashp = talloc_strdup(mem_ctx, hash); ++ if (*hashp == NULL) { ++ ret = -1; ++ } + return ret; + } + +@@ -75,14 +83,14 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + DATA_BLOB *blob) + { + const char *hash = NULL; +- int ret = crypt_as_best_we_can(phrase, setting, &hash); ++ int ret = crypt_as_best_we_can(mem_ctx, phrase, setting, &hash); + if (ret != 0) { + blob->data = NULL; + blob->length = 0; + return ret; + } + blob->length = strlen(hash); +- blob->data = talloc_memdup(mem_ctx, hash, blob->length); ++ blob->data = discard_const_p(uint8_t, hash); + if (blob->data == NULL) { + return ENOMEM; + } +-- +2.48.1 From 7bc49d20ad6345bd820bb043262db005c422b535 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jan 2025 09:03:43 +0100 Subject: [PATCH 230/295] Fix building with gcc 15 --- samba-4-21-fix-smbreadline.patch | 112 +++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 113 insertions(+) create mode 100644 samba-4-21-fix-smbreadline.patch diff --git a/samba-4-21-fix-smbreadline.patch b/samba-4-21-fix-smbreadline.patch new file mode 100644 index 0000000..9fd288d --- /dev/null +++ b/samba-4-21-fix-smbreadline.patch @@ -0,0 +1,112 @@ +From 36e3944418789f5d2018063fa3988c318baa0a35 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 21 Jan 2025 17:59:12 +0100 +Subject: [PATCH 1/2] lib:replace: Remove trailing spaces from readline.h + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7) +--- + lib/replace/system/readline.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h +index 29379626e0d..9a9af266ca6 100644 +--- a/lib/replace/system/readline.h ++++ b/lib/replace/system/readline.h +@@ -1,14 +1,14 @@ + #ifndef _system_readline_h + #define _system_readline_h +-/* ++/* + Unix SMB/CIFS implementation. + + Readline wrappers +- ++ + ** NOTE! The following LGPL license applies to the replace + ** library. This does NOT imply that all of Samba is released + ** under the LGPL +- ++ + This library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either +-- +2.48.1 + + +From 6944f700dcd4ad795652070dfb04135d602622a2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 21 Jan 2025 17:59:27 +0100 +Subject: [PATCH 2/2] lib:replace: Don't use deprecated readline CPPFunction + cast +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right +function. + +libcli/smbreadline/smbreadline.c: In function ‘smb_readline’: +libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations] + 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int, int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types] + 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; + | ^ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224 + +(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821) +--- + lib/replace/system/readline.h | 4 +++- + libcli/smbreadline/wscript_configure | 8 +++++--- + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h +index 9a9af266ca6..ac3604fc12e 100644 +--- a/lib/replace/system/readline.h ++++ b/lib/replace/system/readline.h +@@ -46,7 +46,9 @@ + #endif + + #ifdef HAVE_NEW_LIBREADLINE +-#ifdef HAVE_CPPFUNCTION ++#if defined(HAVE_RL_COMPLETION_FUNC_T) ++# define RL_COMPLETION_CAST (rl_completion_func_t *) ++#elif defined(HAVE_CPPFUNCTION) + # define RL_COMPLETION_CAST (CPPFunction *) + #elif defined(HAVE_RL_COMPLETION_T) + # define RL_COMPLETION_CAST (rl_completion_t *) +diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure +index 912ff53a150..f5a401ebae0 100644 +--- a/libcli/smbreadline/wscript_configure ++++ b/libcli/smbreadline/wscript_configure +@@ -51,10 +51,12 @@ conf.CHECK_CODE(''' + # endif + # endif + #endif +-int main(void) {rl_completion_t f; return 0;} ++int main(void) {rl_completion_func_t f; return 0;} + ''', +-'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False, +-msg='Checking for rl_completion_t') ++ 'HAVE_RL_COMPLETION_FUNC_T', ++ execute=False, ++ addmain=False, ++ msg='Checking for rl_completion_func_t') + + conf.CHECK_CODE(''' + #ifdef HAVE_READLINE_READLINE_H +-- +2.48.1 + diff --git a/samba.spec b/samba.spec index 30fdeb5..0852641 100644 --- a/samba.spec +++ b/samba.spec @@ -252,6 +252,7 @@ Source202: samba.abignore Patch0: samba-4.21.0-s3-notifyd.patch Patch1: samba-4-21-pycrypt.patch +Patch2: samba-4-21-fix-smbreadline.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From e52328b755e2fe92cf0c6d2455aea7b42b47848e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 1 Feb 2025 19:57:20 +0100 Subject: [PATCH 231/295] Add explicit BR: libxcrypt-devel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 0852641..ba9f3ed 100644 --- a/samba.spec +++ b/samba.spec @@ -316,6 +316,7 @@ BuildRequires: libicu-devel BuildRequires: libcmocka-devel BuildRequires: libtirpc-devel BuildRequires: libuuid-devel +BuildRequires: libxcrypt-devel BuildRequires: libxslt %if %{with lmdb} BuildRequires: lmdb From f24bbdaf786f2f75a82df28ddffb5491d7db6b35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 8 Feb 2025 23:02:27 +0100 Subject: [PATCH 232/295] Update to version 4.22.0rc1 - resolves: rhbz#2344189 Guenther --- samba-4-21-fix-smbreadline.patch | 112 ---- samba-4-21-pycrypt.patch | 943 ------------------------------- samba-4.21.0-s3-notifyd.patch | 513 ----------------- samba.spec | 36 +- sources | 4 +- 5 files changed, 23 insertions(+), 1585 deletions(-) delete mode 100644 samba-4-21-fix-smbreadline.patch delete mode 100644 samba-4-21-pycrypt.patch delete mode 100644 samba-4.21.0-s3-notifyd.patch diff --git a/samba-4-21-fix-smbreadline.patch b/samba-4-21-fix-smbreadline.patch deleted file mode 100644 index 9fd288d..0000000 --- a/samba-4-21-fix-smbreadline.patch +++ /dev/null @@ -1,112 +0,0 @@ -From 36e3944418789f5d2018063fa3988c318baa0a35 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:12 +0100 -Subject: [PATCH 1/2] lib:replace: Remove trailing spaces from readline.h - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7) ---- - lib/replace/system/readline.h | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 29379626e0d..9a9af266ca6 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -1,14 +1,14 @@ - #ifndef _system_readline_h - #define _system_readline_h --/* -+/* - Unix SMB/CIFS implementation. - - Readline wrappers -- -+ - ** NOTE! The following LGPL license applies to the replace - ** library. This does NOT imply that all of Samba is released - ** under the LGPL -- -+ - This library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either --- -2.48.1 - - -From 6944f700dcd4ad795652070dfb04135d602622a2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:27 +0100 -Subject: [PATCH 2/2] lib:replace: Don't use deprecated readline CPPFunction - cast -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right -function. - -libcli/smbreadline/smbreadline.c: In function ‘smb_readline’: -libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int, int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224 - -(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821) ---- - lib/replace/system/readline.h | 4 +++- - libcli/smbreadline/wscript_configure | 8 +++++--- - 2 files changed, 8 insertions(+), 4 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 9a9af266ca6..ac3604fc12e 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -46,7 +46,9 @@ - #endif - - #ifdef HAVE_NEW_LIBREADLINE --#ifdef HAVE_CPPFUNCTION -+#if defined(HAVE_RL_COMPLETION_FUNC_T) -+# define RL_COMPLETION_CAST (rl_completion_func_t *) -+#elif defined(HAVE_CPPFUNCTION) - # define RL_COMPLETION_CAST (CPPFunction *) - #elif defined(HAVE_RL_COMPLETION_T) - # define RL_COMPLETION_CAST (rl_completion_t *) -diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure -index 912ff53a150..f5a401ebae0 100644 ---- a/libcli/smbreadline/wscript_configure -+++ b/libcli/smbreadline/wscript_configure -@@ -51,10 +51,12 @@ conf.CHECK_CODE(''' - # endif - # endif - #endif --int main(void) {rl_completion_t f; return 0;} -+int main(void) {rl_completion_func_t f; return 0;} - ''', --'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False, --msg='Checking for rl_completion_t') -+ 'HAVE_RL_COMPLETION_FUNC_T', -+ execute=False, -+ addmain=False, -+ msg='Checking for rl_completion_func_t') - - conf.CHECK_CODE(''' - #ifdef HAVE_READLINE_READLINE_H --- -2.48.1 - diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch deleted file mode 100644 index bf4c1e5..0000000 --- a/samba-4-21-pycrypt.patch +++ /dev/null @@ -1,943 +0,0 @@ -From 07fe7b437c695c7a715418d4414c930b72758dab Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 5 Dec 2024 16:35:51 +1300 -Subject: [PATCH 01/11] util: add a crypt wrapper, derived from - dsdb:password_hash - -This is going to be used by the dsdb password_hash module, and exposed -to Python via pyglue. - -We're doing this because Python 3.13 has dropped crypt from the Python -standard library. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Reviewed-by: Andreas Schneider -(cherry picked from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b) ---- - lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ - lib/util/util_crypt.h | 5 +++ - lib/util/wscript_build | 6 +++ - 3 files changed, 101 insertions(+) - create mode 100644 lib/util/util_crypt.c - create mode 100644 lib/util/util_crypt.h - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -new file mode 100644 -index 00000000000..0f7b2d0fd31 ---- /dev/null -+++ b/lib/util/util_crypt.c -@@ -0,0 +1,90 @@ -+#include -+#include "data_blob.h" -+#include -+#include -+#include "util_crypt.h" -+ -+ -+static int crypt_as_best_we_can(const char *phrase, -+ const char *setting, -+ const char **hashp) -+{ -+ int ret = 0; -+ const char *hash = NULL; -+ -+#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -+ struct crypt_data crypt_data = { -+ .initialized = 0 /* working storage used by crypt */ -+ }; -+#endif -+ -+ /* -+ * crypt_r() and crypt() may return a null pointer upon error -+ * depending on how libcrypt was configured, so we prefer -+ * crypt_rn() from libcrypt / libxcrypt which always returns -+ * NULL on error. -+ * -+ * POSIX specifies returning a null pointer and setting -+ * errno. -+ * -+ * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -+ * non-NULL pointer from crypt_r() on success but (always?) -+ * sets errno during internal processing in the NSS crypto -+ * subsystem. -+ * -+ * By preferring crypt_rn we avoid the 'return non-NULL but -+ * set-errno' that we otherwise cannot tell apart from the -+ * RHEL 7 behaviour. -+ */ -+ errno = 0; -+ -+#ifdef HAVE_CRYPT_RN -+ hash = crypt_rn(phrase, setting, -+ &crypt_data, -+ sizeof(crypt_data)); -+#elif HAVE_CRYPT_R -+ hash = crypt_r(phrase, setting, &crypt_data); -+#else -+ /* -+ * No crypt_r falling back to crypt, which is NOT thread safe -+ * Thread safety MT-Unsafe race:crypt -+ */ -+ hash = crypt(phrase, setting); -+#endif -+ /* -+ * On error, crypt() and crypt_r() may return a null pointer, -+ * or a pointer to an invalid hash beginning with a '*'. -+ */ -+ ret = errno; -+ errno = 0; -+ if (hash == NULL || hash[0] == '*') { -+ if (ret == 0) { -+ /* this is annoying */ -+ ret = ENOTRECOVERABLE; -+ } -+ } -+ -+ *hashp = hash; -+ return ret; -+} -+ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *setting, -+ DATA_BLOB *blob) -+{ -+ const char *hash = NULL; -+ int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ if (ret != 0) { -+ blob->data = NULL; -+ blob->length = 0; -+ return ret; -+ } -+ blob->length = strlen(hash); -+ blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ if (blob->data == NULL) { -+ return ENOMEM; -+ } -+ return 0; -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -new file mode 100644 -index 00000000000..8c289e489e8 ---- /dev/null -+++ b/lib/util/util_crypt.h -@@ -0,0 +1,5 @@ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *cmd, -+ DATA_BLOB *blob); -diff --git a/lib/util/wscript_build b/lib/util/wscript_build -index b4fcfeaba07..7de9c0b7b17 100644 ---- a/lib/util/wscript_build -+++ b/lib/util/wscript_build -@@ -253,6 +253,12 @@ else: - private_library=True, - local_include=False) - -+ bld.SAMBA_LIBRARY('util_crypt', -+ source='util_crypt.c', -+ deps='talloc crypt', -+ private_library=True, -+ local_include=False) -+ - - bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', - source='unix_privs.c', --- -2.48.1 - - -From adf180613e4172292090d4c3573a439388a09788 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:29:21 +1300 -Subject: [PATCH 02/11] dsdb:password_hash: move hash_blob allocation up - -This will make the next patch simpler. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6) ---- - source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 1d1267624e2..c1902126a72 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1649,6 +1649,13 @@ static int setup_primary_userPassword_hash( - } - } - -+ hash_blob = talloc_zero(ctx, DATA_BLOB); -+ -+ if (hash_blob == NULL) { -+ TALLOC_FREE(frame); -+ return ldb_oom(ldb); -+ } -+ - /* - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string -@@ -1712,15 +1719,10 @@ static int setup_primary_userPassword_hash( - scheme, - reason); - TALLOC_FREE(frame); -+ TALLOC_FREE(hash_blob); - return LDB_ERR_OPERATIONS_ERROR; - } - -- hash_blob = talloc_zero(ctx, DATA_BLOB); -- -- if (hash_blob == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - - *hash_blob = data_blob_talloc(hash_blob, - (const uint8_t *)hash, --- -2.48.1 - - -From 9d43e4d649db23549bbb230ed60426fa286b7ab7 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 11:16:22 +1300 -Subject: [PATCH 03/11] dsdb:password_hash: use talloc_crypt_blob() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034) ---- - .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- - .../samdb/ldb_modules/wscript_build_server | 2 +- - 2 files changed, 13 insertions(+), 57 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index c1902126a72..7a7114c1caa 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -51,6 +51,7 @@ - #include "auth/common_auth.h" - #include "lib/messaging/messaging.h" - #include "lib/param/loadparm.h" -+#include "lib/util/util_crypt.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -@@ -1592,16 +1593,11 @@ static int setup_primary_userPassword_hash( - struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module); - const char *salt = NULL; /* Randomly generated salt */ - const char *cmd = NULL; /* command passed to crypt */ -- const char *hash = NULL; /* password hash generated by crypt */ - int algorithm = 0; /* crypt hash algorithm number */ - int rounds = 0; /* The number of hash rounds */ -+ int ret; - DATA_BLOB *hash_blob = NULL; - TALLOC_CTX *frame = talloc_stackframe(); --#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -- struct crypt_data crypt_data = { -- .initialized = 0 /* working storage used by crypt */ -- }; --#endif - - /* Generate a random password salt */ - salt = generate_random_str_list(frame, -@@ -1660,52 +1656,20 @@ static int setup_primary_userPassword_hash( - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string - */ -- -- /* -- * crypt_r() and crypt() may return a null pointer upon error -- * depending on how libcrypt was configured, so we prefer -- * crypt_rn() from libcrypt / libxcrypt which always returns -- * NULL on error. -- * -- * POSIX specifies returning a null pointer and setting -- * errno. -- * -- * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -- * non-NULL pointer from crypt_r() on success but (always?) -- * sets errno during internal processing in the NSS crypto -- * subsystem. -- * -- * By preferring crypt_rn we avoid the 'return non-NULL but -- * set-errno' that we otherwise cannot tell apart from the -- * RHEL 7 behaviour. -- */ -- errno = 0; -- --#ifdef HAVE_CRYPT_RN -- hash = crypt_rn((char *)io->n.cleartext_utf8->data, -- cmd, -- &crypt_data, -- sizeof(crypt_data)); --#elif HAVE_CRYPT_R -- hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data); --#else -- /* -- * No crypt_r falling back to crypt, which is NOT thread safe -- * Thread safety MT-Unsafe race:crypt -- */ -- hash = crypt((char *)io->n.cleartext_utf8->data, cmd); --#endif -- /* -- * On error, crypt() and crypt_r() may return a null pointer, -- * or a pointer to an invalid hash beginning with a '*'. -- */ -- if (hash == NULL || hash[0] == '*') { -+ ret = talloc_crypt_blob(hash_blob, -+ (char *)io->n.cleartext_utf8->data, -+ cmd, -+ hash_blob); -+ if (ret != 0) { - char buf[1024]; - const char *reason = NULL; -- if (errno == ERANGE) { -+ if (ret == ERANGE) { - reason = "Password exceeds maximum length allowed for crypt() hashing"; -+ } else if (ret == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -+ reason = "Unknown error"; - } else { -- int err = strerror_r(errno, buf, sizeof(buf)); -+ int err = strerror_r(ret, buf, sizeof(buf)); - if (err == 0) { - reason = buf; - } else { -@@ -1723,14 +1687,6 @@ static int setup_primary_userPassword_hash( - return LDB_ERR_OPERATIONS_ERROR; - } - -- -- *hash_blob = data_blob_talloc(hash_blob, -- (const uint8_t *)hash, -- strlen(hash)); -- if (hash_blob->data == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - hash_value->value = hash_blob; - TALLOC_FREE(frame); - return LDB_SUCCESS; -diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server -index 9c1eb12a7c2..16d9b31a982 100644 ---- a/source4/dsdb/samdb/ldb_modules/wscript_build_server -+++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server -@@ -195,7 +195,7 @@ bld.SAMBA_MODULE('ldb_password_hash', - init_function='ldb_password_hash_module_init', - module_init_name='ldb_init_module', - internal_module=False, -- deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS crypt db-glue' -+ deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS util_crypt db-glue' - ) - - --- -2.48.1 - - -From 1c94645881bd5130c67bfee96aa463f360df300a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:04 +1300 -Subject: [PATCH 04/11] util: add a crypt strerror helper - -This will be used by Python also. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2) ---- - lib/util/util_crypt.c | 24 +++++++++++++++++++ - lib/util/util_crypt.h | 2 ++ - .../dsdb/samdb/ldb_modules/password_hash.c | 16 +------------ - 3 files changed, 27 insertions(+), 15 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 0f7b2d0fd31..09cd47597d1 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -88,3 +88,27 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - } - return 0; - } -+ -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error) -+{ -+ char buf[1024]; -+ int err; -+ if (error == ERANGE) { -+ return talloc_strdup( -+ mem_ctx, -+ "Password exceeds maximum length allowed for crypt() hashing"); -+ } -+ if (error == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see crypt_as_best_we_can() */ -+ goto unknown; -+ } -+ -+ err = strerror_r(error, buf, sizeof(buf)); -+ if (err != 0) { -+ goto unknown; -+ } -+ return talloc_strndup(mem_ctx, buf, sizeof(buf)); -+unknown: -+ return talloc_strdup(mem_ctx, "Unknown error"); -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -index 8c289e489e8..ca1a58e922c 100644 ---- a/lib/util/util_crypt.h -+++ b/lib/util/util_crypt.h -@@ -3,3 +3,5 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - const char *phrase, - const char *cmd, - DATA_BLOB *blob); -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error); -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 7a7114c1caa..6949a92fc3e 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1661,21 +1661,7 @@ static int setup_primary_userPassword_hash( - cmd, - hash_blob); - if (ret != 0) { -- char buf[1024]; -- const char *reason = NULL; -- if (ret == ERANGE) { -- reason = "Password exceeds maximum length allowed for crypt() hashing"; -- } else if (ret == ENOTRECOVERABLE) { -- /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -- reason = "Unknown error"; -- } else { -- int err = strerror_r(ret, buf, sizeof(buf)); -- if (err == 0) { -- reason = buf; -- } else { -- reason = "Unknown error"; -- } -- } -+ const char *reason = talloc_crypt_errstring(frame, ret); - ldb_asprintf_errstring( - ldb, - "setup_primary_userPassword: generation of a %s " --- -2.48.1 - - -From ce70e852783ec69104d274def931e7d39f17576a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:15 +1300 -Subject: [PATCH 05/11] pyglue: add crypt() function - -This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in -turn wraps the system crypt[_r[n]]. - -We want this because the Python standard library crypt module is going -away. That one also wrapped the system crypt or crypt_r, so there -should be no change. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a) ---- - python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ - python/wscript | 1 + - 2 files changed, 42 insertions(+) - -diff --git a/python/pyglue.c b/python/pyglue.c -index 042bf9e14f3..fcccb849f5e 100644 ---- a/python/pyglue.c -+++ b/python/pyglue.c -@@ -18,6 +18,7 @@ - */ - - #include "lib/replace/system/python.h" -+#include "pyerrors.h" - #include "python/py3compat.h" - #include "includes.h" - #include "python/modules.h" -@@ -25,6 +26,7 @@ - #include "param/pyparam.h" - #include "lib/socket/netif.h" - #include "lib/util/debug.h" -+#include "lib/util/util_crypt.h" - #include "librpc/ndr/ndr_private.h" - #include "lib/cmdline/cmdline.h" - #include "lib/crypto/gkdi.h" -@@ -519,6 +521,42 @@ static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args) - return ret; - } - -+static PyObject *py_crypt(PyObject *self, PyObject *args) -+{ -+ PyObject *py_hash = NULL; -+ char *phrase = NULL; -+ char *setting = NULL; -+ TALLOC_CTX *frame = NULL; -+ int ret; -+ DATA_BLOB hash = {}; -+ -+ if (!PyArg_ParseTuple(args, "ss", &phrase, &setting)) { -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ frame = talloc_stackframe(); -+ ret = talloc_crypt_blob(frame, phrase, setting, &hash); -+ if (ret != 0) { -+ const char *errstr = talloc_crypt_errstring(frame, ret); -+ if (ret == EINVAL || ret == ERANGE || ret == ENOTRECOVERABLE) { -+ PyErr_Format(PyExc_ValueError, -+ "could not crypt(): %s", -+ errstr); -+ } else { -+ PyErr_Format(PyExc_OSError, -+ "could not crypt(): %s", -+ errstr); -+ } -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ -+ py_hash = PyUnicode_FromStringAndSize((char *)hash.data, hash.length); -+ TALLOC_FREE(frame); -+ return py_hash; -+} -+ -+ - static PyMethodDef py_misc_methods[] = { - { "generate_random_str", (PyCFunction)py_generate_random_str, METH_VARARGS, - "generate_random_str(len) -> string\n" -@@ -580,6 +618,9 @@ static PyMethodDef py_misc_methods[] = { - METH_NOARGS, "How many NDR internal tokens is too many for this build?" }, - { "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline, - METH_VARARGS, "Return a redacted commandline to feed to setproctitle (None if no redaction required)" }, -+ { "crypt", (PyCFunction)py_crypt, -+ METH_VARARGS, -+ "encrypt as phrase, per crypt(3), as determined by setting." }, - {0} - }; - -diff --git a/python/wscript b/python/wscript -index 3e6439930e9..7c17e390dc7 100644 ---- a/python/wscript -+++ b/python/wscript -@@ -119,6 +119,7 @@ def build(bld): - ndr - cmdline - gkdi -+ util_crypt - %s - ''' % (pyparam_util, pytalloc_util), - realname='samba/_glue.so') --- -2.48.1 - - -From 9a0dc2db7cde22f36583159c0d697a3de6640990 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:44:07 +1300 -Subject: [PATCH 06/11] pytest: test that _glue.crypt works - -The test vectors were generated via Python 3.10 crypt module, which -directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. - -We mainly test the sha256 and sha512 vectors, which seems to be all we -use, and which are said to be widely supported. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963) ---- - python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ - 1 file changed, 65 insertions(+) - -diff --git a/python/samba/tests/glue.py b/python/samba/tests/glue.py -index ac504b3f366..824f5ca0c81 100644 ---- a/python/samba/tests/glue.py -+++ b/python/samba/tests/glue.py -@@ -88,3 +88,68 @@ class GlueTests(samba.tests.TestCase): - self.assertEqual(_glue.strstr_m(string, '_'), '_string_num__one') - self.assertEqual(_glue.strstr_m(string, '__'), '__one') - self.assertEqual(_glue.strstr_m(string, 'ring'), 'ring_num__one') -+ -+ def test_crypt(self): -+ # We hopefully only use schemes 5 and 6 (sha256 and sha512), -+ # which are OK and also quite widely supported according to -+ # https://en.wikipedia.org/wiki/Crypt_(C) -+ for phrase, setting, expected in [ -+ ("a", "$5$aaaaaa", -+ "$5$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6"), -+ # with scheme 5, 5000 rounds is default, so hash is the same as above -+ ('a', '$5$rounds=5000$aaaaaa', -+ '$5$rounds=5000$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6'), -+ ('a', -+ '$5$rounds=4999$aaaaaa', -+ '$5$rounds=4999$aaaaaa$FiP70gtxOJUFLokUJvET06E7jbL6aNmF6Wtv2ddzjY8'), -+ ('a', '$5$aaaaab', -+ '$5$aaaaab$e9qR2F833/JyuMu.nkQc9kn184vBWLo0ODqnCe./mj0'), -+ -+ ('', '$5$aaaaaa', '$5$aaaaaa$5B4WTdWp5n/v/aNUw2N8RsEitqvlZJEaAKhH/pOkGg4'), -+ -+ ("a", "$6$aaaaaa", -+ "$6$aaaaaa$KHs/Ez7X/I5/K.V8FR7kEsx9rOvjXnEDUmGC.dLBWP87XWy.oUEAM7QYcZQRVhiDwGepOF2pKrCVETYLyASh60"), -+ -+ ('', '$5$', '$5$$3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.'), -+ -+ # scheme 1 (md5) should be supported if not used -+ ('a', '$1$aaaaaa', -+ '$1$aaaaaa$MUMWPbGfzrHFCNm7ZHg31.'), -+ -+ ('', '$6$', -+ '$6$$/chiBau24cE26QQVW3IfIe68Xu5.JQ4E8Ie7lcRLwqxO5cxGuBhqF2HmTL.zWJ9zjChg3yJYFXeGBQ2y3Ba1d1'), -+ (' ', -+ '$6$6', -+ '$6$6$asLnbxf0obyuv3ybNvDE9ZcdwGFkDhLe7uW.wzdOdKCm4/M3vGFKq4Ttk1tBQrOn4wALZ3tj1L8IarIu5i8hR/'), -+ -+ # original DES scheme, 12 bits of salt -+ ("a", "lalala", "laKGbFzgh./R2"), -+ ("a", "lalalaLALALAla", "laKGbFzgh./R2"), -+ ("a", "arrgh", "ar7VUiUvDhX2c"), -+ ("a", "arrggghhh", "ar7VUiUvDhX2c"), -+ ]: -+ hash = _glue.crypt(phrase, setting) -+ self.assertEqual(hash, expected) -+ -+ def test_crypt_bad(self): -+ # We can't be too strident in our assertions, because every -+ # system allows a different set of algorithms, and some have -+ # different ideas of how to parse. -+ for phrase, setting, exception in [ -+ ("a", "$5", ValueError), -+ ("a", "$0$", ValueError), -+ ("a", None, TypeError), -+ (None, "", TypeError), -+ ('a', '$66$', ValueError), -+ ('a', '$$', ValueError), -+ ('a', '*0', ValueError), -+ ('a', '*', ValueError), -+ ('a', '++', ValueError), -+ # this next one is too long, except on Rocky Linux 8. -+ #('a' * 10000, '$5$5', ValueError), -+ # this is invalid, except on Debian 11. -+ # (' ', '$6$ ', ValueError), -+ ]: -+ with self.assertRaises(exception, -+ msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): -+ _glue.crypt(phrase, setting) --- -2.48.1 - - -From 6425e2514052027ee2269e15e0e0dff1686fa34e Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:54:48 +1300 -Subject: [PATCH 07/11] samba-tool user: use _glue.crypt, not crypt.crypt - -Because we know we have _glue.crypt, and we know it raises exceptions -rather than returning None, we can simplify the checks. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180) ---- - .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- - 1 file changed, 6 insertions(+), 15 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 7944d4e1682..68befb3f356 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -37,6 +37,7 @@ from samba.netcmd import Command, CommandError - from samba.samdb import SamDB - from samba.nt_time import timedelta_from_nt_time_delta, nt_time_from_datetime - from samba.gkdi import MAX_CLOCK_SKEW -+from samba._glue import crypt - - # python[3]-gpgme is abandoned since ubuntu 1804 and debian 9 - # have to use python[3]-gpg instead -@@ -132,9 +133,7 @@ def get_crypt_value(alg, utf8pw, rounds=0): - else: - crypt_salt = "$%s$%s$" % (alg, b64salt) - -- crypt_value = crypt.crypt(utf8pw, crypt_salt) -- if crypt_value is None: -- raise NotImplementedError("crypt.crypt(%s) returned None" % (crypt_salt)) -+ crypt_value = crypt(utf8pw, crypt_salt) - expected_len = len(crypt_salt) + algs[alg]["length"] - if len(crypt_value) != expected_len: - raise NotImplementedError("crypt.crypt(%s) returned a value with length %d, expected length is %d" % ( -@@ -156,21 +155,13 @@ except ImportError as e: - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -- import crypt - get_crypt_value(alg, "") -- virtual_attributes[attr] = { -- } -- except ImportError as e: -- reason = "crypt" -- reason += " required" -- disabled_virtual_attributes[attr] = { -- "reason": reason, -- } -- except NotImplementedError as e: -- reason = "modern '$%s$' salt in crypt(3) required" % (alg) -+ except (ValueError, OSError): - disabled_virtual_attributes[attr] = { -- "reason": reason, -+ "reason": f"modern '${alg}$' salt in crypt(3) required" - } -+ continue -+ virtual_attributes[attr] = {} - - # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 - for x in range(1, 30): --- -2.48.1 - - -From a2a04286e13676177c952e67363fc7502f544861 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:56:20 +1300 -Subject: [PATCH 08/11] samba-tool user: hashlib.sha1 is always present - -We maybe thought we were checking that sha1 was in hashlib, but we were -only checking that hashlib is in the Python library (`hashlib.sha1()` -would not raise ImportError). - -The documentation says hashlib always contains sha1 -- if that -changes, it is better we know by failing noisily with the import error -at the top of the file. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98) ---- - python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ - 1 file changed, 4 insertions(+), 12 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 68befb3f356..3043525874e 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -26,6 +26,7 @@ import datetime - import errno - import io - import os -+from hashlib import sha1 - - import ldb - from samba import credentials, nttime2float -@@ -141,17 +142,8 @@ def get_crypt_value(alg, utf8pw, rounds=0): - return crypt_value - - --try: -- import hashlib -- hashlib.sha1() -- virtual_attributes["virtualSSHA"] = { -- } --except ImportError as e: -- reason = "hashlib.sha1()" -- reason += " required" -- disabled_virtual_attributes["virtualSSHA"] = { -- "reason": reason, -- } -+ -+virtual_attributes["virtualSSHA"] = {} - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -@@ -736,7 +728,7 @@ class GetPasswordCommand(Command): - if u8 is None: - continue - salt = os.urandom(4) -- h = hashlib.sha1() -+ h = sha1() - h.update(u8) - h.update(salt) - bv = h.digest() + salt --- -2.48.1 - - -From e9a8748f3cc4ba74f8b0d75e7a01866e7c12a0a4 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:46:16 +1300 -Subject: [PATCH 09/11] pytest: password_hash uses internal _glue.crypt - -This will remove an external dependency. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d) ---- - python/samba/tests/password_hash.py | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/python/samba/tests/password_hash.py b/python/samba/tests/password_hash.py -index 1b7af7de7b8..39ef13fd7b2 100644 ---- a/python/samba/tests/password_hash.py -+++ b/python/samba/tests/password_hash.py -@@ -30,11 +30,11 @@ from samba.dcerpc.samr import DOMAIN_PASSWORD_STORE_CLEARTEXT - from samba.dsdb import UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED - from samba.tests import delete_force - from samba.tests.password_test import PasswordCommon -+from samba._glue import crypt - import ldb - import samba - import binascii - from hashlib import md5 --import crypt - - - USER_NAME = "PasswordHashTestUser" -@@ -321,7 +321,7 @@ class PassWordHashTests(TestCase): - cmd = "$%s$rounds=%d$%s" % (alg, rounds, data[3]) - - # Calculate the expected hash value -- expected = crypt.crypt(USER_PASS, cmd) -+ expected = crypt(USER_PASS, cmd) - self.assertEqual(expected, up.hashes[i].value.decode('utf8')) - i += 1 - --- -2.48.1 - - -From 0e01dc4f1fabfd2c3f21f724c05d94227a278b20 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:31:18 +1300 -Subject: [PATCH 10/11] util:datablob: data_blob_pad checks its alignment - assumption - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 - -(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb) ---- - lib/util/data_blob.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/util/data_blob.c b/lib/util/data_blob.c -index b5b78bc7a8a..0522e7755af 100644 ---- a/lib/util/data_blob.c -+++ b/lib/util/data_blob.c -@@ -286,7 +286,7 @@ _PUBLIC_ bool data_blob_pad(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, - size_t old_len = blob->length; - size_t new_len = (old_len + pad - 1) & ~(pad - 1); - -- if (new_len < old_len) { -+ if (new_len < old_len || (pad & (pad - 1)) != 0) { - return false; - } - --- -2.48.1 - - -From 8cfae9f33fb1c170c3fe937be200490597e9e4c2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 17 Jan 2025 13:28:30 +0100 -Subject: [PATCH 11/11] lib:util: Fix stack-use-after-return in - crypt_as_best_we_can() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784 - -Signed-off-by: Andreas Schneider -Reviewed-by: Douglas Bagnall -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Douglas Bagnall -Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224 - -(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53) ---- - lib/util/util_crypt.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 09cd47597d1..9ac6e1cfd0e 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -1,11 +1,13 @@ - #include - #include "data_blob.h" -+#include "discard.h" - #include - #include - #include "util_crypt.h" - - --static int crypt_as_best_we_can(const char *phrase, -+static int crypt_as_best_we_can(TALLOC_CTX *mem_ctx, -+ const char *phrase, - const char *setting, - const char **hashp) - { -@@ -63,8 +65,14 @@ static int crypt_as_best_we_can(const char *phrase, - ret = ENOTRECOVERABLE; - } - } -+ if (ret != 0) { -+ return ret; -+ } - -- *hashp = hash; -+ *hashp = talloc_strdup(mem_ctx, hash); -+ if (*hashp == NULL) { -+ ret = -1; -+ } - return ret; - } - -@@ -75,14 +83,14 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - DATA_BLOB *blob) - { - const char *hash = NULL; -- int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ int ret = crypt_as_best_we_can(mem_ctx, phrase, setting, &hash); - if (ret != 0) { - blob->data = NULL; - blob->length = 0; - return ret; - } - blob->length = strlen(hash); -- blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ blob->data = discard_const_p(uint8_t, hash); - if (blob->data == NULL) { - return ENOMEM; - } --- -2.48.1 - diff --git a/samba-4.21.0-s3-notifyd.patch b/samba-4.21.0-s3-notifyd.patch deleted file mode 100644 index 31463fd..0000000 --- a/samba-4.21.0-s3-notifyd.patch +++ /dev/null @@ -1,513 +0,0 @@ -From c9a7bc3e8f36cb9d6746e23ea56f9c27b82dcf49 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 22 Jul 2024 12:26:55 +0200 -Subject: [PATCH] s3:notifyd: Use a watcher per db record -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This fixes a O(n²) performance regression in notifyd. The problem was -that we had a watcher per notify instance. This changes the code to have -a watcher per notify db entry. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14430 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit af011b987a4ad0d3753d83cc0b8d97ad64ba874a) ---- - source3/smbd/notifyd/notifyd.c | 214 ++++++++++++++++++------- - source3/smbd/notifyd/notifyd_db.c | 5 +- - source3/smbd/notifyd/notifyd_entry.c | 51 ++++-- - source3/smbd/notifyd/notifyd_private.h | 46 ++++-- - 4 files changed, 228 insertions(+), 88 deletions(-) - -diff --git a/source3/smbd/notifyd/notifyd.c b/source3/smbd/notifyd/notifyd.c -index 64dd26a7e11..0b07ab3e435 100644 ---- a/source3/smbd/notifyd/notifyd.c -+++ b/source3/smbd/notifyd/notifyd.c -@@ -337,6 +337,7 @@ static bool notifyd_apply_rec_change( - struct messaging_context *msg_ctx) - { - struct db_record *rec = NULL; -+ struct notifyd_watcher watcher = {}; - struct notifyd_instance *instances = NULL; - size_t num_instances; - size_t i; -@@ -344,6 +345,7 @@ static bool notifyd_apply_rec_change( - TDB_DATA value; - NTSTATUS status; - bool ok = false; -+ bool new_watcher = false; - - if (pathlen == 0) { - DBG_WARNING("pathlen==0\n"); -@@ -374,8 +376,12 @@ static bool notifyd_apply_rec_change( - value = dbwrap_record_get_value(rec); - - if (value.dsize != 0) { -- if (!notifyd_parse_entry(value.dptr, value.dsize, NULL, -- &num_instances)) { -+ ok = notifyd_parse_entry(value.dptr, -+ value.dsize, -+ &watcher, -+ NULL, -+ &num_instances); -+ if (!ok) { - goto fail; - } - } -@@ -390,8 +396,22 @@ static bool notifyd_apply_rec_change( - goto fail; - } - -- if (value.dsize != 0) { -- memcpy(instances, value.dptr, value.dsize); -+ if (num_instances > 0) { -+ struct notifyd_instance *tmp = NULL; -+ size_t num_tmp = 0; -+ -+ ok = notifyd_parse_entry(value.dptr, -+ value.dsize, -+ NULL, -+ &tmp, -+ &num_tmp); -+ if (!ok) { -+ goto fail; -+ } -+ -+ memcpy(instances, -+ tmp, -+ sizeof(struct notifyd_instance) * num_tmp); - } - - for (i=0; ifilter, -- .internal_subdir_filter = chg->subdir_filter - }; - - num_instances += 1; - } - -- if ((instance->instance.filter != 0) || -- (instance->instance.subdir_filter != 0)) { -- int ret; -+ /* -+ * Calculate an intersection of the instances filters for the watcher. -+ */ -+ if (instance->instance.filter > 0) { -+ uint32_t filter = instance->instance.filter; -+ -+ if ((watcher.filter & filter) != filter) { -+ watcher.filter |= filter; -+ -+ new_watcher = true; -+ } -+ } -+ -+ /* -+ * Calculate an intersection of the instances subdir_filters for the -+ * watcher. -+ */ -+ if (instance->instance.subdir_filter > 0) { -+ uint32_t subdir_filter = instance->instance.subdir_filter; - -- TALLOC_FREE(instance->sys_watch); -+ if ((watcher.subdir_filter & subdir_filter) != subdir_filter) { -+ watcher.subdir_filter |= subdir_filter; - -- ret = sys_notify_watch(entries, sys_notify_ctx, path, -- &instance->internal_filter, -- &instance->internal_subdir_filter, -- notifyd_sys_callback, msg_ctx, -- &instance->sys_watch); -- if (ret != 0) { -- DBG_WARNING("sys_notify_watch for [%s] returned %s\n", -- path, strerror(errno)); -+ new_watcher = true; - } - } - - if ((instance->instance.filter == 0) && - (instance->instance.subdir_filter == 0)) { -+ uint32_t tmp_filter = 0; -+ uint32_t tmp_subdir_filter = 0; -+ - /* This is a delete request */ -- TALLOC_FREE(instance->sys_watch); - *instance = instances[num_instances-1]; - num_instances -= 1; -+ -+ for (i = 0; i < num_instances; i++) { -+ struct notifyd_instance *tmp = &instances[i]; -+ -+ tmp_filter |= tmp->instance.filter; -+ tmp_subdir_filter |= tmp->instance.subdir_filter; -+ } -+ -+ /* -+ * If the filter has changed, register a new watcher with the -+ * changed filter. -+ */ -+ if (watcher.filter != tmp_filter || -+ watcher.subdir_filter != tmp_subdir_filter) -+ { -+ watcher.filter = tmp_filter; -+ watcher.subdir_filter = tmp_subdir_filter; -+ -+ new_watcher = true; -+ } -+ } -+ -+ if (new_watcher) { -+ /* -+ * In case we removed all notify instances, we want to remove -+ * the watcher. We won't register a new one, if no filters are -+ * set anymore. -+ */ -+ -+ TALLOC_FREE(watcher.sys_watch); -+ -+ watcher.sys_filter = watcher.filter; -+ watcher.sys_subdir_filter = watcher.subdir_filter; -+ -+ /* -+ * Only register a watcher if we have filter. -+ */ -+ if (watcher.filter != 0 || watcher.subdir_filter != 0) { -+ int ret = sys_notify_watch(entries, -+ sys_notify_ctx, -+ path, -+ &watcher.sys_filter, -+ &watcher.sys_subdir_filter, -+ notifyd_sys_callback, -+ msg_ctx, -+ &watcher.sys_watch); -+ if (ret != 0) { -+ DBG_WARNING("sys_notify_watch for [%s] " -+ "returned %s\n", -+ path, -+ strerror(errno)); -+ } -+ } - } - - DBG_DEBUG("%s has %zu instances\n", path, num_instances); - - if (num_instances == 0) { -+ TALLOC_FREE(watcher.sys_watch); -+ - status = dbwrap_record_delete(rec); - if (!NT_STATUS_IS_OK(status)) { - DBG_WARNING("dbwrap_record_delete returned %s\n", -@@ -456,13 +541,21 @@ static bool notifyd_apply_rec_change( - goto fail; - } - } else { -- value = make_tdb_data( -- (uint8_t *)instances, -- sizeof(struct notifyd_instance) * num_instances); -+ struct TDB_DATA iov[2] = { -+ { -+ .dptr = (uint8_t *)&watcher, -+ .dsize = sizeof(struct notifyd_watcher), -+ }, -+ { -+ .dptr = (uint8_t *)instances, -+ .dsize = sizeof(struct notifyd_instance) * -+ num_instances, -+ }, -+ }; - -- status = dbwrap_record_store(rec, value, 0); -+ status = dbwrap_record_storev(rec, iov, ARRAY_SIZE(iov), 0); - if (!NT_STATUS_IS_OK(status)) { -- DBG_WARNING("dbwrap_record_store returned %s\n", -+ DBG_WARNING("dbwrap_record_storev returned %s\n", - nt_errstr(status)); - goto fail; - } -@@ -706,12 +799,18 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, - .when = tstate->msg->when }; - struct iovec iov[2]; - size_t path_len = key.dsize; -+ struct notifyd_watcher watcher = {}; - struct notifyd_instance *instances = NULL; - size_t num_instances = 0; - size_t i; -+ bool ok; - -- if (!notifyd_parse_entry(data.dptr, data.dsize, &instances, -- &num_instances)) { -+ ok = notifyd_parse_entry(data.dptr, -+ data.dsize, -+ &watcher, -+ &instances, -+ &num_instances); -+ if (!ok) { - DBG_DEBUG("Could not parse notifyd_entry\n"); - return; - } -@@ -734,9 +833,11 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, - - if (tstate->covered_by_sys_notify) { - if (tstate->recursive) { -- i_filter = instance->internal_subdir_filter; -+ i_filter = watcher.sys_subdir_filter & -+ instance->instance.subdir_filter; - } else { -- i_filter = instance->internal_filter; -+ i_filter = watcher.sys_filter & -+ instance->instance.filter; - } - } else { - if (tstate->recursive) { -@@ -1146,46 +1247,39 @@ static int notifyd_add_proxy_syswatches(struct db_record *rec, - struct db_context *db = dbwrap_record_get_db(rec); - TDB_DATA key = dbwrap_record_get_key(rec); - TDB_DATA value = dbwrap_record_get_value(rec); -- struct notifyd_instance *instances = NULL; -- size_t num_instances = 0; -- size_t i; -+ struct notifyd_watcher watcher = {}; - char path[key.dsize+1]; - bool ok; -+ int ret; - - memcpy(path, key.dptr, key.dsize); - path[key.dsize] = '\0'; - -- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, -- &num_instances); -+ /* This is a remote database, we just need the watcher. */ -+ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); - if (!ok) { - DBG_WARNING("Could not parse notifyd entry for %s\n", path); - return 0; - } - -- for (i=0; iinstance.filter; -- uint32_t subdir_filter = instance->instance.subdir_filter; -- int ret; -+ watcher.sys_watch = NULL; -+ watcher.sys_filter = watcher.filter; -+ watcher.sys_subdir_filter = watcher.subdir_filter; - -- /* -- * This is a remote database. Pointers that we were -- * given don't make sense locally. Initialize to NULL -- * in case sys_notify_watch fails. -- */ -- instances[i].sys_watch = NULL; -- -- ret = state->sys_notify_watch( -- db, state->sys_notify_ctx, path, -- &filter, &subdir_filter, -- notifyd_sys_callback, state->msg_ctx, -- &instance->sys_watch); -- if (ret != 0) { -- DBG_WARNING("inotify_watch returned %s\n", -- strerror(errno)); -- } -+ ret = state->sys_notify_watch(db, -+ state->sys_notify_ctx, -+ path, -+ &watcher.filter, -+ &watcher.subdir_filter, -+ notifyd_sys_callback, -+ state->msg_ctx, -+ &watcher.sys_watch); -+ if (ret != 0) { -+ DBG_WARNING("inotify_watch returned %s\n", strerror(errno)); - } - -+ memcpy(value.dptr, &watcher, sizeof(struct notifyd_watcher)); -+ - return 0; - } - -@@ -1193,21 +1287,17 @@ static int notifyd_db_del_syswatches(struct db_record *rec, void *private_data) - { - TDB_DATA key = dbwrap_record_get_key(rec); - TDB_DATA value = dbwrap_record_get_value(rec); -- struct notifyd_instance *instances = NULL; -- size_t num_instances = 0; -- size_t i; -+ struct notifyd_watcher watcher = {}; - bool ok; - -- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, -- &num_instances); -+ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); - if (!ok) { - DBG_WARNING("Could not parse notifyd entry for %.*s\n", - (int)key.dsize, (char *)key.dptr); - return 0; - } -- for (i=0; ientries database - */ - --bool notifyd_parse_entry( -- uint8_t *buf, -- size_t buflen, -- struct notifyd_instance **instances, -- size_t *num_instances) -+/** -+ * @brief Parse a notifyd database entry. -+ * -+ * The memory we pass down needs to be aligned. If it isn't aligned we can run -+ * into obscure errors as we just point into the data buffer. -+ * -+ * @param data The data to parse -+ * @param data_len The length of the data to parse -+ * @param watcher A pointer to store the watcher data or NULL. -+ * @param instances A pointer to store the array of notify instances or NULL. -+ * @param pnum_instances The number of elements in the array. If you just want -+ * the number of elements pass NULL for the watcher and instances pointers. -+ * -+ * @return true on success, false if an error occurred. -+ */ -+bool notifyd_parse_entry(uint8_t *data, -+ size_t data_len, -+ struct notifyd_watcher *watcher, -+ struct notifyd_instance **instances, -+ size_t *pnum_instances) - { -- if ((buflen % sizeof(struct notifyd_instance)) != 0) { -- DBG_WARNING("invalid buffer size: %zu\n", buflen); -+ size_t ilen; -+ -+ if (data_len < sizeof(struct notifyd_watcher)) { - return false; - } - -- if (instances != NULL) { -- *instances = (struct notifyd_instance *)buf; -+ if (watcher != NULL) { -+ *watcher = *((struct notifyd_watcher *)(uintptr_t)data); - } -- if (num_instances != NULL) { -- *num_instances = buflen / sizeof(struct notifyd_instance); -+ -+ ilen = data_len - sizeof(struct notifyd_watcher); -+ if ((ilen % sizeof(struct notifyd_instance)) != 0) { -+ return false; -+ } -+ -+ if (pnum_instances != NULL) { -+ *pnum_instances = ilen / sizeof(struct notifyd_instance); - } -+ if (instances != NULL) { -+ /* The (uintptr_t) cast removes a warning from -Wcast-align. */ -+ *instances = -+ (struct notifyd_instance *)(uintptr_t) -+ (data + sizeof(struct notifyd_watcher)); -+ } -+ - return true; - } -diff --git a/source3/smbd/notifyd/notifyd_private.h b/source3/smbd/notifyd/notifyd_private.h -index 36c08f47c54..db8e6e1c005 100644 ---- a/source3/smbd/notifyd/notifyd_private.h -+++ b/source3/smbd/notifyd/notifyd_private.h -@@ -20,30 +20,48 @@ - #include "lib/util/server_id.h" - #include "notifyd.h" - -+ - /* -- * notifyd's representation of a notify instance -+ * Representation of a watcher for a path -+ * -+ * This will be stored in the db. - */ --struct notifyd_instance { -- struct server_id client; -- struct notify_instance instance; -- -- void *sys_watch; /* inotify/fam/etc handle */ -+struct notifyd_watcher { -+ /* -+ * This is an intersections of the filter the watcher is listening for. -+ */ -+ uint32_t filter; -+ uint32_t subdir_filter; - - /* -- * Filters after sys_watch took responsibility of some bits -+ * Those are inout variables passed to the sys_watcher. The sys_watcher -+ * will remove the bits it can't handle. - */ -- uint32_t internal_filter; -- uint32_t internal_subdir_filter; -+ uint32_t sys_filter; -+ uint32_t sys_subdir_filter; -+ -+ /* The handle for inotify/fam etc. */ -+ void *sys_watch; -+}; -+ -+/* -+ * Representation of a notifyd instance -+ * -+ * This will be stored in the db. -+ */ -+struct notifyd_instance { -+ struct server_id client; -+ struct notify_instance instance; - }; - - /* - * Parse an entry in the notifyd_context->entries database - */ - --bool notifyd_parse_entry( -- uint8_t *buf, -- size_t buflen, -- struct notifyd_instance **instances, -- size_t *num_instances); -+bool notifyd_parse_entry(uint8_t *data, -+ size_t data_len, -+ struct notifyd_watcher *watcher, -+ struct notifyd_instance **instances, -+ size_t *num_instances); - - #endif --- -2.46.1 - diff --git a/samba.spec b/samba.spec index ba9f3ed..9dbc887 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.3 +%global samba_version 4.22.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -163,7 +163,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc1 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -176,7 +176,7 @@ %global libdcerpc_so_version 0 %global libndr_krb5pac_so_version 0 %global libndr_nbt_so_version 0 -%global libndr_so_version 5 +%global libndr_so_version 6 %global libndr_standard_so_version 0 %global libnetapi_so_version 1 %global libsamba_credentials_so_version 1 @@ -193,9 +193,9 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.4.2 -%global tdb_version 1.4.12 -%global tevent_version 0.16.1 +%global talloc_version 2.4.3 +%global tdb_version 1.4.13 +%global tevent_version 0.16.2 %global required_mit_krb5 1.20.1 @@ -250,10 +250,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.21.0-s3-notifyd.patch -Patch1: samba-4-21-pycrypt.patch -Patch2: samba-4-21-fix-smbreadline.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -2666,8 +2662,11 @@ fi %{python3_sitearch}/samba/dnsresolver.py %dir %{python3_sitearch}/samba/domain %{python3_sitearch}/samba/domain/__init__.py +%dir %{python3_sitearch}/samba/domain/__pycache__ %{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc +%dir %{python3_sitearch}/samba/domain/models %{python3_sitearch}/samba/domain/models/__init__.py +%dir %{python3_sitearch}/samba/domain/models/__pycache__ %{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc %{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc @@ -2876,28 +2875,28 @@ fi %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy -%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py -%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__ -%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo %{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py %{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py %{python3_sitearch}/samba/netcmd/domain/backup.py %dir %{python3_sitearch}/samba/netcmd/domain/claim @@ -2950,6 +2949,7 @@ fi %{python3_sitearch}/samba/netcmd/schema.py %dir %{python3_sitearch}/samba/netcmd/service_account %{python3_sitearch}/samba/netcmd/service_account/__init__.py +%dir %{python3_sitearch}/samba/netcmd/service_account/__pycache__ %{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc %{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc @@ -3238,6 +3238,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/py_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/registry.*.pyc %{python3_sitearch}/samba/tests/__pycache__/reparsepoints.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/rust.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3idmapdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3param.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3passdb.*.pyc @@ -3471,6 +3472,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/netlogon.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_tests.*.pyc @@ -3513,6 +3515,7 @@ fi %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/lockout_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py +%{python3_sitearch}/samba/tests/krb5/netlogon.py %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py %{python3_sitearch}/samba/tests/krb5/pkinit_tests.py @@ -3585,6 +3588,7 @@ fi %{python3_sitearch}/samba/tests/py_credentials.py %{python3_sitearch}/samba/tests/registry.py %{python3_sitearch}/samba/tests/reparsepoints.py +%{python3_sitearch}/samba/tests/rust.py %{python3_sitearch}/samba/tests/s3idmapdb.py %{python3_sitearch}/samba/tests/s3param.py %{python3_sitearch}/samba/tests/s3passdb.py @@ -3801,6 +3805,7 @@ fi %config(noreplace) %{_sysconfdir}/ctdb/ctdb.conf %config(noreplace) %{_sysconfdir}/ctdb/notify.sh %config(noreplace) %{_sysconfdir}/ctdb/debug-hung-script.sh +%config(noreplace) %{_sysconfdir}/ctdb/ctdb-backup-persistent-tdbs.sh %config(noreplace) %{_sysconfdir}/ctdb/ctdb-crash-cleanup.sh %config(noreplace) %{_sysconfdir}/ctdb/debug_locks.sh @@ -3844,8 +3849,8 @@ fi %{_libexecdir}/ctdb/ctdb_natgw %{_libexecdir}/ctdb/ctdb-path %{_libexecdir}/ctdb/ctdb_recovery_helper +%{_libexecdir}/ctdb/ctdb_smnotify_helper %{_libexecdir}/ctdb/ctdb_takeover_helper -%{_libexecdir}/ctdb/smnotify %{_libexecdir}/ctdb/statd_callout %{_libexecdir}/ctdb/statd_callout_helper %{_libexecdir}/ctdb/tdb_mutex_check @@ -3894,6 +3899,7 @@ fi %{_datadir}/ctdb/events/legacy/60.nfs.script %{_datadir}/ctdb/events/legacy/70.iscsi.script %{_datadir}/ctdb/events/legacy/91.lvs.script +%{_datadir}/ctdb/events/legacy/95.database.script %dir %{_datadir}/ctdb/scripts %{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh diff --git a/sources b/sources index 1055c45..300da04 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.3.tar.xz) = 62eb3bfe1aa1cc8aa68055d4caf21bdea6d6f5b0f767566bef1da210100b5dd17b7d60f5c47da01b0123d3a2c1c3689b1960ef2c2cbd4f804ff998ead994fc3f -SHA512 (samba-4.21.3.tar.asc) = 11e40d32b783b7d57d3f35fe96a17e897719f65d796d965b371dfb58b8cf1f8ffe60c3047bea8c2b2b0d475fa55cd25237b9ba84d44b3d65a8cd53c6af760957 +SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf +SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b From 67e7277c752d1795e50066139c904e3c7b62a162 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 13 Feb 2025 23:53:18 +0100 Subject: [PATCH 233/295] Update to Samba 4.22.0rc2 - resolves: rhbz#2345547 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 9dbc887..7e88c49 100644 --- a/samba.spec +++ b/samba.spec @@ -163,7 +163,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc1 +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index 300da04..b75ed0a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf -SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b +SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90 +SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd From cb85d85e0f490da7cf6ca5fe93a38852aabcaaaa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 11:52:05 +0100 Subject: [PATCH 234/295] Make %bcond switches easier to understand This also removes support for building on rhel8. --- samba.spec | 99 ++++++++++++++---------------------------------------- 1 file changed, 25 insertions(+), 74 deletions(-) diff --git a/samba.spec b/samba.spec index 7e88c49..680bd4f 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # or # rpmbuild --rebuild --with testsuite samba.src.rpm # -%bcond_with testsuite +%bcond testsuite 0 # Build with internal talloc, tevent, tdb # @@ -14,132 +14,97 @@ # or # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm # -%bcond_with includelibs +%bcond includelibs 0 # fedpkg mockbuild --with=ccache -%bcond_with ccache +%bcond ccache 0 # ctdb is enabled by default, you can disable it with: --without clustering -%bcond_without clustering +%bcond clustering 1 # Define _make_verbose if it doesn't exist (RHEL8) %{!?_make_verbose:%define _make_verbose V=1 VERBOSE=1} # Build with Active Directory Domain Controller support by default on Fedora %if 0%{?fedora} -%bcond_without dc +%bcond dc 1 %else -%bcond_with dc +%bcond dc 0 %endif # Build a libsmbclient package by default -%bcond_without libsmbclient +%bcond libsmbclient 1 # Build a libwbclient package by default -%bcond_without libwbclient +%bcond libwbclient 1 # Build with winexe by default %if 0%{?rhel} %ifarch x86_64 -%bcond_without winexe +%bcond winexe 1 %else -%bcond_with winexe +%bcond winexe 0 #endifarch %endif %else -%bcond_without winexe +%bcond winexe 1 %endif # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_cephfs -%bcond_without ceph_mutex +%bcond vfs_cephfs 1 +%bcond ceph_mutex 1 %else -%bcond_with vfs_cephfs -%bcond_with ceph_mutex +%bcond vfs_cephfs 0 +%bcond ceph_mutex 0 #endifarch %endif %else -%bcond_with vfs_cephfs -%bcond_with ceph_mutex +%bcond vfs_cephfs 0 +%bcond ceph_mutex 0 #endif fedora %endif -# Build vfs_gluster module by default on 64bit Fedora -%global is_rhgs 0 -%if "%{dist}" == ".el7rhgs" || "%{dist}" == ".el8rhgs" -%global is_rhgs 1 -%endif - %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_glusterfs +%bcond vfs_glusterfs 1 %else -%bcond_with vfs_glusterfs +%bcond vfs_glusterfs 0 #endifarch %endif -#else rhel -%else - -%if 0%{?is_rhgs} -# Enable on rhgs x86_64 -%ifarch x86_64 -%bcond_without vfs_glusterfs -%else -%bcond_with vfs_glusterfs -#endifarch -%endif -%else -%bcond_with vfs_glusterfs -#endif is_rhgs -%endif - #endif fedora %endif # Build vfs_io_uring module by default on 64bit Fedora -%if 0%{?fedora} || 0%{?rhel} >= 8 - %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_io_uring +%bcond vfs_io_uring 1 %else -%bcond_with vfs_io_uring +%bcond vfs_io_uring 0 #endifarch %endif -%else -%bcond_with vfs_io_uring -#endif fedora || rhel >= 8 -%endif - # Build the ctdb-pcp-pmda package by default on Fedora, except for i686 where # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 -%bcond_without pcp_pmda +%bcond pcp_pmda 1 %endif %else -%bcond_with pcp_pmda +%bcond pcp_pmda 0 %endif # Build the etcd helpers by default on Fedora %if 0%{?fedora} -%bcond_without etcd_mutex +%bcond etcd_mutex 1 %else -%bcond_with etcd_mutex -%endif - -%if 0%{?fedora} || 0%{?rhel} >= 9 -%bcond_without gpupdate -%else -%bcond_with gpupdate +%bcond etcd_mutex 0 %endif %ifarch aarch64 ppc64le s390x x86_64 @@ -379,9 +344,7 @@ BuildRequires: librados-devel BuildRequires: python3-etcd %endif -%if %{with gpupdate} BuildRequires: cepces-certmonger >= 0.3.8 -%endif # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) @@ -775,7 +738,6 @@ Samba VFS module for GlusterFS integration. %endif ### GPUPDATE -%if %{with gpupdate} %package gpupdate Summary: Samba GPO support for clients Requires: cepces-certmonger @@ -789,9 +751,6 @@ Requires: python3-%{name}-dc = %{samba_depver} This package provides the samba-gpupdate tool to apply Group Policy Objects (GPO) on Samba clients. -#endif with gpupdate -%endif - ### KRB5-PRINTING %package krb5-printing Summary: Samba CUPS backend for printing with Kerberos @@ -1542,11 +1501,6 @@ for i in \ done %endif -%if %{without gpupdate} -rm -f %{buildroot}%{_sbindir}/samba-gpupdate -rm -f %{buildroot}%{_mandir}/man8/samba-gpupdate.8* -%endif - %if %{without vfs_glusterfs} rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8* %endif @@ -2444,12 +2398,9 @@ fi %endif ### GPUPDATE -%if %{with gpupdate} %files gpupdate %{_mandir}/man8/samba-gpupdate.8* %{_sbindir}/samba-gpupdate -#endif with gpupdate -%endif ### KRB5-PRINTING %files krb5-printing From 314544c636c2987c2399dcbd87234d6d95459fb0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 14:30:24 +0100 Subject: [PATCH 235/295] Add LICENSE file of libldb --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 680bd4f..9c84080 100644 --- a/samba.spec +++ b/samba.spec @@ -3892,6 +3892,7 @@ fi %endif %files -n libldb +%license lib/ldb/LICENSE %{_libdir}/libldb.so.* %dir %{_libdir}/samba %{_libdir}/samba/libldb-key-value-private-samba.so From 036c40ef5eb24c660d9e2ac71dbbe80dcf7ddf63 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 19:05:42 +0100 Subject: [PATCH 236/295] Fix the '--with includelibs' build --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 9c84080..9e37fbb 100644 --- a/samba.spec +++ b/samba.spec @@ -3013,6 +3013,7 @@ fi %if %{with includelibs} %{_libdir}/samba/libpyldb-util.cpython*.so +%{_libdir}/samba/libpytalloc-util.cpython*.so %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -3021,8 +3022,7 @@ fi %{python3_sitearch}/_tdb_text.py %{python3_sitearch}/_tevent.cpython*.so %{python3_sitearch}/ldb.cpython*.so -#FIXME why is it missing? -#%{python3_sitearch}/talloc.cpython*.so +%{python3_sitearch}/talloc.cpython*.so %{python3_sitearch}/tdb.cpython*.so %{python3_sitearch}/tevent.py #endif with includelibs From 4e6ca9ecfb75a192cfc49ce7591e8afe88ca9fba Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Feb 2025 11:00:44 +0100 Subject: [PATCH 237/295] Fix libldb built with '--with includelibs' --- samba.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/samba.spec b/samba.spec index 9e37fbb..cc94374 100644 --- a/samba.spec +++ b/samba.spec @@ -1205,9 +1205,12 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB %package -n libldb Summary: A schema-less, ldap like, API and database License: LGPL-3.0-or-later +%if %{without includelibs} Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} +# /endif without includelibs +%endif Provides: bundled(libreplace) Obsoletes: libldb < 0:2.10 @@ -1223,9 +1226,12 @@ servers, or use local tdb databases. Summary: Developer tools for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} +%if %{without includelibs} Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} +# /endif without includelibs +%endif Obsoletes: libldb-devel < 0:2.10 Provides: libldb-devel = 0:2.10 @@ -1250,7 +1256,10 @@ Tools to manage LDB files Summary: Python bindings for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} +%if %{without includelibs} Requires: python3-tdb%{?_isa} >= %{tdb_version} +# /endif without includelibs +%endif Requires: samba-client-libs = %{samba_depver} %{?python_provide:%python_provide python3-ldb} From c4883ac1e7043a7ec8f3673b9d419c8e43290a7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 20 Feb 2025 18:39:08 +0100 Subject: [PATCH 238/295] Update to Samba 4.22.0rc3 - resolves: rhbz#2346803 Guenther --- samba.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index cc94374..71388b2 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -3511,9 +3511,11 @@ fi %dir %{python3_sitearch}/samba/tests/ndr %{python3_sitearch}/samba/tests/ndr/gkdi.py %{python3_sitearch}/samba/tests/ndr/gmsa.py +%{python3_sitearch}/samba/tests/ndr/sd.py %dir %{python3_sitearch}/samba/tests/ndr/__pycache__ %{python3_sitearch}/samba/tests/ndr/__pycache__/gkdi.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/tests/ndr/__pycache__/sd.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/wbint.*.pyc %{python3_sitearch}/samba/tests/ndr/wbint.py %{python3_sitearch}/samba/tests/netbios.py diff --git a/sources b/sources index b75ed0a..a7d3db0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90 -SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd +SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6 +SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222 From c295775181cbe26686635dadeb9feb38c16615be Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 27 Feb 2025 20:00:34 +0100 Subject: [PATCH 239/295] Update to Samba 4.22.0rc4 - resolves: rhbz#2348758 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 71388b2..1c9b659 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index a7d3db0..2a41d3e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6 -SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222 +SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca +SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c From 6744eb181dae65b117b56a7c9deae7a0cee98f23 Mon Sep 17 00:00:00 2001 From: David Abdurachmanov Date: Wed, 11 Dec 2024 17:45:11 +0200 Subject: [PATCH 240/295] Enable lmdb on riscv64 Solves configuration error: [..] Checking for a 64-bit host to support lmdb : ok Checking for lmdb >= 0.9.16 : not found Checking for header lmdb.h : no Checking for lmdb >= 0.9.16 via header check : not found Samba AD DC and --enable-selftest requires lmdb 0.9.16 or later [..] Signed-off-by: David Abdurachmanov --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 1c9b659..f40570f 100644 --- a/samba.spec +++ b/samba.spec @@ -107,7 +107,7 @@ %bcond etcd_mutex 0 %endif -%ifarch aarch64 ppc64le s390x x86_64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond lmdb 1 %else %bcond lmdb 0 From 947b0b72d5d1ec7e3f3e62b19bab6329ec182673 Mon Sep 17 00:00:00 2001 From: Andrea Bolognani Date: Tue, 25 Feb 2025 20:48:03 +0100 Subject: [PATCH 241/295] Re-enable mold on riscv64 mold didn't build successfully on riscv64 back when riscv64 support was added to samba, but that has changed since and today there is no longer any reason not to use it. Signed-off-by: Andrea Bolognani --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index f40570f..ac9f967 100644 --- a/samba.spec +++ b/samba.spec @@ -315,7 +315,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch i686 riscv64 +%ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold %endif From 7ebad9bdd168b4fce18a0ef2face757a5a4487ae Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:41:36 +0100 Subject: [PATCH 242/295] Set version for bundled libreplace --- samba.spec | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/samba.spec b/samba.spec index ac9f967..2aa6242 100644 --- a/samba.spec +++ b/samba.spec @@ -249,7 +249,7 @@ Obsoletes: samba-swat < %{samba_depver} Provides: samba4-swat = %{samba_depver} Obsoletes: samba4-swat < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} BuildRequires: make BuildRequires: gcc @@ -441,7 +441,7 @@ Obsoletes: samba4-client < %{samba_depver} Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description client The %{name}-client package provides some SMB/CIFS clients to complement @@ -494,7 +494,7 @@ Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} @@ -536,7 +536,7 @@ Requires: libnetapi = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description common-tools The samba-common-tools package contains tools for SMB/CIFS clients. @@ -606,7 +606,7 @@ Requires: bind-utils Provides: samba4-dc = %{samba_depver} Obsoletes: samba4-dc < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc The samba-dc package provides AD Domain Controller functionality @@ -634,7 +634,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc-libs The %{name}-dc-libs package contains the libraries needed by the DC to @@ -653,7 +653,7 @@ Requires: bind Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc-bind-dlz The %{name}-dc-bind-dlz package contains the libraries for bind to manage all @@ -689,7 +689,7 @@ Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-cephfs Samba VFS module for Ceph distributed storage system integration. @@ -706,7 +706,7 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-iouring Samba VFS module for io_uring instance integration. @@ -731,7 +731,7 @@ Requires: libwbclient = %{samba_depver} Obsoletes: samba-glusterfs < %{samba_depver} Provides: samba-glusterfs = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-glusterfs Samba VFS module for GlusterFS integration. @@ -791,7 +791,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-libs = %{samba_depver} Obsoletes: samba4-libs < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description libs The %{name}-libs package contains the libraries needed by programs that link @@ -892,7 +892,7 @@ Requires: libsmbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description -n python3-%{name} The python3-%{name} package contains the Python 3 libraries needed by programs @@ -966,7 +966,7 @@ Requires: perl(Archive::Tar) Provides: samba4-test = %{samba_depver} Obsoletes: samba4-test < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description test %{name}-test provides testing tools for both the server and client @@ -986,7 +986,7 @@ Requires: libwbclient = %{samba_depver} Provides: %{name}-test-devel = %{samba_depver} Obsoletes: %{name}-test-devel < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description test-libs %{name}-test-libs provides libraries required by the testing tools. @@ -1030,7 +1030,7 @@ Obsoletes: samba4-winbind < %{samba_depver} # Old NetworkManager expects the dispatcher scripts in a different place Conflicts: NetworkManager < 1.20 -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind The samba-winbind package provides the winbind NSS library, and some client @@ -1053,7 +1053,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-winbind-clients = %{samba_depver} Obsoletes: samba4-winbind-clients < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-clients The samba-winbind-clients package provides the wbinfo and ntlm_auth @@ -1083,7 +1083,7 @@ Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives Requires(preun): %{_sbindir}/update-alternatives -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-krb5-locator The winbind krb5 locator is a plugin for the system kerberos library to allow @@ -1099,7 +1099,7 @@ Requires: libwbclient = %{samba_depver} %endif Requires: pam -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-modules The samba-winbind-modules package provides the NSS library and a PAM module @@ -1115,7 +1115,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winexe Winexe is a Remote Windows-command executor @@ -1151,7 +1151,7 @@ Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description -n ctdb CTDB is a cluster implementation of the TDB database used by Samba and other @@ -1212,7 +1212,7 @@ Requires: libtevent%{?_isa} >= %{tevent_version} # /endif without includelibs %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} Obsoletes: libldb < 0:2.10 Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} From 1b2e68adffe00a7f5a881cc3901106a257e847f4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:43:32 +0100 Subject: [PATCH 243/295] Add missing /run/ctdb dir to files list --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 2aa6242..78d3c22 100644 --- a/samba.spec +++ b/samba.spec @@ -3835,6 +3835,8 @@ fi %{_mandir}/man7/ctdb-tunables.7.gz %{_mandir}/man7/ctdb-statistics.7.gz +%ghost %dir /run/ctdb + %{_tmpfilesdir}/ctdb.conf %{_unitdir}/ctdb.service From e1991f29eccc30163711bb8f4a0192697bd3c548 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:32:35 +0100 Subject: [PATCH 244/295] Set samba-usershare to noarch It only includes configuration files. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 78d3c22..605fedb 100644 --- a/samba.spec +++ b/samba.spec @@ -996,6 +996,7 @@ Provides: bundled(libreplace) = %{samba_depver} Summary: Provides support for non-root user shares Requires: %{name} = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} +BuildArch: noarch %description usershares Installing this package will provide a configuration file, group and From f00c21e2a89e49b9aeb5a4915869dc392f99e429 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:01:51 +0100 Subject: [PATCH 245/295] Set samba-tools to noarch This only include a python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 605fedb..03442a5 100644 --- a/samba.spec +++ b/samba.spec @@ -556,6 +556,7 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg %endif +BuildArch: noarch %description tools The samba-tools package contains tools for Samba servers From e4ac2d5dcb832c64a9c7ecf28fa61272d3497d16 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:02:47 +0100 Subject: [PATCH 246/295] Set samba-gpupdate to noarch This only includes python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 03442a5..8cfd96c 100644 --- a/samba.spec +++ b/samba.spec @@ -747,6 +747,7 @@ Requires: %{name}-ldb-ldap-modules = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} +BuildArch: noarch %description gpupdate This package provides the samba-gpupdate tool to apply Group Policy Objects From 8ee5558015bd0da1c51388fb219c4fb0f608a473 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:03:58 +0100 Subject: [PATCH 247/295] Set ctdb-etcd-mutex to noarch This only includes python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 8cfd96c..941ad1a 100644 --- a/samba.spec +++ b/samba.spec @@ -1182,6 +1182,7 @@ Performance Co-Pilot (PCP) support for CTDB Summary: CTDB ETCD mutex helper Requires: ctdb = %{samba_depver} Requires: python3-etcd +BuildArch: noarch %description -n ctdb-etcd-mutex Support for using an existing ETCD cluster as a mutex helper for CTDB From 417731acd07046213951b3614bf13d73dae3b8ee Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:06:07 +0100 Subject: [PATCH 248/295] Use spaces instead of tabs for krb5-printing scripts Removes rpmlint warnings --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 941ad1a..bde77c1 100644 --- a/samba.spec +++ b/samba.spec @@ -1650,12 +1650,12 @@ fi %post krb5-printing %{_sbindir}/update-alternatives --install %{_libexecdir}/samba/cups_backend_smb \ - cups_backend_smb \ - %{_libexecdir}/samba/smbspool_krb5_wrapper 50 + cups_backend_smb \ + %{_libexecdir}/samba/smbspool_krb5_wrapper 50 %postun krb5-printing if [ $1 -eq 0 ] ; then - %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper + %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper fi %ldconfig_scriptlets libs From 21e22997d47dd5c656e95a18ae8b8741fdf449c8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 14:01:29 +0100 Subject: [PATCH 249/295] Revert "Set samba-tools to noarch" This reverts commit f00c21e2a89e49b9aeb5a4915869dc392f99e429. We can't set it to noarch as koji complains that "Requires: lmdb" is present on some arches and not on others. --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index bde77c1..bd6a4ec 100644 --- a/samba.spec +++ b/samba.spec @@ -556,7 +556,6 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg %endif -BuildArch: noarch %description tools The samba-tools package contains tools for Samba servers From 30ff8554df8fb3435491d5959145abd59a60ecb6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:10:31 +0100 Subject: [PATCH 250/295] Update to Samba 4.22.0 - resolves: rhbz#2350342 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index bd6a4ec..d6d6e9d 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index 2a41d3e..914331f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca -SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c +SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88 +SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900 From 0cb9860a40530163c1f6893ed04e7e4d59d5757a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:23:22 +0100 Subject: [PATCH 251/295] Turn on SMB 3.1.1 Unix Extensions in default smb.conf Guenther --- smb.conf.example | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/smb.conf.example b/smb.conf.example index 4e6b5d4..271f13b 100644 --- a/smb.conf.example +++ b/smb.conf.example @@ -269,6 +269,13 @@ ; map system = no ; store dos attributes = yes +# Turn on SMB 3.1.1 Unix Extensions by default +# +# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default, +# find more info in man mount.smb3(8). Linux 6.13 will finally support special +# filetypes and symlink handling. + + smb3 unix extensions = yes #============================ Share Definitions ============================== From b508f2ed7a9797fcbf82c9e2eee69832c5d20282 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:23:22 +0100 Subject: [PATCH 252/295] Turn on SMB 3.1.1 Unix Extensions in vendor smb.conf as well... Guenther --- smb.conf.vendor | 2 ++ 1 file changed, 2 insertions(+) diff --git a/smb.conf.vendor b/smb.conf.vendor index e45384d..748c6e5 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,6 +18,8 @@ load printers = yes cups options = raw + smb3 unix extensions = yes + # Install samba-usershares package for support include = /etc/samba/usershares.conf From 40bd3a26e8685d077cf7818dbc8e3e16a2181d5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 18 Apr 2025 02:26:37 +0200 Subject: [PATCH 253/295] Update to Samba 4.22.1 - resolves: rhbz#2360776 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index d6d6e9d..531958b 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.0 +%global samba_version 4.22.1 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 914331f..8e2875d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88 -SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900 +SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67 +SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341 From b8a889b232cd2519d49fa87dbda960fa19f18f3e Mon Sep 17 00:00:00 2001 From: Python Maint Date: Thu, 5 Jun 2025 00:08:08 +0200 Subject: [PATCH 254/295] Rebuilt for Python 3.14 From eb8dac413e347d2b662b93045d9fcf964d6b45f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 5 Jun 2025 19:14:20 +0200 Subject: [PATCH 255/295] Update to Samba 4.22.2 - resolves: rhbz#2370468 - resolves: rhbz#2370455 - Security fix for CVE-2025-0620 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 531958b..a4eca83 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.1 +%global samba_version 4.22.2 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 8e2875d..d93d58f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67 -SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341 +SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351 +SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe From e9a8536578eda0bae0a91d467b271f5c86e033fa Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 6 Jun 2025 09:34:20 +0200 Subject: [PATCH 256/295] Rebuilt for Python 3.14 From 64f8b2a48455f504c8018a6f929c672170d6aa98 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 10 Jun 2025 14:08:56 +0200 Subject: [PATCH 257/295] Install /run/ctdb Fix following report: rpm --verify ctdb-0:4.22.2-3.el9.x86_64 .M....... g /run/ctdb M Mode differs (includes permissions and file type) --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index a4eca83..d044cbd 100644 --- a/samba.spec +++ b/samba.spec @@ -1439,6 +1439,7 @@ install -d -m 0755 %{buildroot}/var/lib/samba/sysvol install -d -m 0755 %{buildroot}/var/lib/samba/usershares install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged install -d -m 0755 %{buildroot}/var/log/samba/old +install -d -m 0755 %{buildroot}/run/ctdb install -d -m 0755 %{buildroot}/run/samba install -d -m 0755 %{buildroot}/run/winbindd install -d -m 0755 %{buildroot}/%{_libdir}/samba From ac5f4a1f4b8f3ed80469febdf56c7dd2519162cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 10 Jun 2025 14:11:41 +0200 Subject: [PATCH 258/295] Move libreplace-private-samba.so to samba-common-libs Fix this rpmdeps report: VERIFY Subpackage libldb on x86_64 carries 'Requires: libreplace-private-samba.so()(64bit)' which comes from subpackage samba-client-libs but does not carry an explicit package version requirement. Please add 'Requires: samba-client-libs = %{version}-%{release}' to the spec file to avoid the need to test interoperability between various combinations of old and new subpackages. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index d044cbd..68508b7 100644 --- a/samba.spec +++ b/samba.spec @@ -1212,10 +1212,10 @@ License: LGPL-3.0-or-later Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} +Requires: samba-common-libs = %{samba_depver} # /endif without includelibs %endif -Provides: bundled(libreplace) = %{samba_depver} Obsoletes: libldb < 0:2.10 Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} @@ -1997,7 +1997,6 @@ fi %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so %{_libdir}/samba/libprinting-migrate-private-samba.so -%{_libdir}/samba/libreplace-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so %{_libdir}/samba/libsamba-debug-private-samba.so @@ -2080,6 +2079,7 @@ fi %files common-libs # common libraries %{_libdir}/samba/libcmdline-private-samba.so +%{_libdir}/samba/libreplace-private-samba.so %dir %{_libdir}/samba/ldb From 060552411c704e9f5f965ded37e9b1c9e8373692 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jun 2025 10:14:07 +0200 Subject: [PATCH 259/295] smb.conf: Remove the '@' for NIX groups, we removed NIS support --- smb.conf.vendor | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/smb.conf.vendor b/smb.conf.vendor index 748c6e5..cbb2e0f 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -40,7 +40,8 @@ [print$] comment = Printer Drivers path = /var/lib/samba/drivers - write list = @printadmin root - force group = @printadmin + # printadmin is a local group + write list = printadmin root + force group = printadmin create mask = 0664 directory mask = 0775 From d5056e867a933be92f93c22c7e3c47f37af380b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 8 Jul 2025 00:50:10 +0200 Subject: [PATCH 260/295] Update to Samba 4.22.3 - resolves: #2376873 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 68508b7..f59cd87 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.2 +%global samba_version 4.22.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index d93d58f..c47ad40 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351 -SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe +SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c +SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e From b40f280be5c9cc340c245d69dfd554891cedd4ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 10 Jul 2025 21:46:16 +0200 Subject: [PATCH 261/295] Fix get_kdc_ip_string handling for secondary KDCs - resolves: bzso#15881 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ++++++++++++++++++++++++++++ samba.spec | 2 ++ 2 files changed, 36 insertions(+) create mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch new file mode 100644 index 0000000..9277c9b --- /dev/null +++ b/samba-4.22.x-get_kdc_ip_string.patch @@ -0,0 +1,34 @@ +From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Fri, 4 Jul 2025 17:50:40 +0200 +Subject: [PATCH] libads: fix get_kdc_ip_string() ... +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 + +Signed-off-by: Ralph Boehme +Reviewed-by: Guenther Deschner + +Autobuild-User(master): Günther Deschner +Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 +--- + source3/libads/kerberos.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c +index 75803500d31..145bc36cdb2 100644 +--- a/source3/libads/kerberos.c ++++ b/source3/libads/kerberos.c +@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, + + if (!NT_STATUS_IS_OK(status)) { + DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); ++ result = talloc_move(mem_ctx, &kdc_str); + goto out; + } + +-- +2.50.0 + diff --git a/samba.spec b/samba.spec index f59cd87..7da5ef4 100644 --- a/samba.spec +++ b/samba.spec @@ -215,6 +215,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.22.x-get_kdc_ip_string.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From 5c93354123f7302192a52b305334853f6d2ef56d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 17:53:14 +0000 Subject: [PATCH 262/295] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From ad5439e191ee3e9dab69e76b148b78207e66fb19 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20Zatloukal?= Date: Wed, 6 Aug 2025 09:57:46 +0200 Subject: [PATCH 263/295] Rebuilt for icu 77.1 From 052edc4ab62c26380f1865674a88047a41201db4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 12 Aug 2025 22:09:33 +0200 Subject: [PATCH 264/295] Update to Samba 4.23.0rc1 - resolves: #2387090 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ------------ samba.spec | 78 +++++++++++++++++++++++++--- sources | 4 +- 3 files changed, 73 insertions(+), 43 deletions(-) delete mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch deleted file mode 100644 index 9277c9b..0000000 --- a/samba-4.22.x-get_kdc_ip_string.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Fri, 4 Jul 2025 17:50:40 +0200 -Subject: [PATCH] libads: fix get_kdc_ip_string() ... -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 - -Signed-off-by: Ralph Boehme -Reviewed-by: Guenther Deschner - -Autobuild-User(master): Günther Deschner -Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 ---- - source3/libads/kerberos.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c -index 75803500d31..145bc36cdb2 100644 ---- a/source3/libads/kerberos.c -+++ b/source3/libads/kerberos.c -@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, - - if (!NT_STATUS_IS_OK(status)) { - DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); -+ result = talloc_move(mem_ctx, &kdc_str); - goto out; - } - --- -2.50.0 - diff --git a/samba.spec b/samba.spec index 7da5ef4..bebd14a 100644 --- a/samba.spec +++ b/samba.spec @@ -107,13 +107,20 @@ %bcond etcd_mutex 0 %endif +# Build the prometheus exporter by default on Fedora +%if 0%{?fedora} +%bcond prometheus 1 +%else +%bcond prometheus 0 +%endif + %ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond lmdb 1 %else %bcond lmdb 0 %endif -%global samba_version 4.22.3 +%global samba_version 4.23.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -128,7 +135,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc1 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -159,8 +166,8 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.3 -%global tdb_version 1.4.13 -%global tevent_version 0.16.2 +%global tdb_version 1.4.14 +%global tevent_version 0.17.1 %global required_mit_krb5 1.20.1 @@ -215,8 +222,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.22.x-get_kdc_ip_string.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -345,6 +350,9 @@ BuildRequires: librados-devel %if %{with etcd_mutex} BuildRequires: python3-etcd %endif +%if %{with prometheus} +BuildRequires: libevent-devel +%endif BuildRequires: cepces-certmonger >= 0.3.8 @@ -1206,6 +1214,18 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB #endif with clustering %endif +%if %{with prometheus} + +%package prometheus +Summary: SMB Prometheus exporter +Requires: samba = %{samba_depver} + +%description prometheus +Support for exporting metrics via Prometheus + +#endif with prometheus +%endif + ### LIBLDB %package -n libldb Summary: A schema-less, ldap like, API and database @@ -1357,6 +1377,8 @@ if [ -n "${CCACHE}" ]; then fi %endif +# workaround https://gitlab.com/ita1024/waf/-/issues/2472 +export PYTHONARCHDIR=%{python3_sitearch} %configure \ --enable-fhs \ --with-piddir=/run \ @@ -1396,6 +1418,9 @@ fi %endif %if %{with etcd_mutex} --enable-etcd-reclock \ +%endif +%if %{with prometheus} + --with-prometheus-exporter \ %endif --with-profiling-data \ --with-systemd \ @@ -1995,22 +2020,25 @@ fi %{_libdir}/samba/libndr-samba4-private-samba.so %{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so +%{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so +%{_libdir}/samba/libngtcp2-private-samba.so %{_libdir}/samba/libnpa-tstream-private-samba.so %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so %{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so %{_libdir}/samba/libsamba-debug-private-samba.so %{_libdir}/samba/libsamba-modules-private-samba.so %{_libdir}/samba/libsamba-security-private-samba.so +%{_libdir}/samba/libsamba-security-trusts-private-samba.so %{_libdir}/samba/libsamba-sockets-private-samba.so %{_libdir}/samba/libsamba3-util-private-samba.so %{_libdir}/samba/libsamdb-common-private-samba.so %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so %{_libdir}/samba/libserver-role-private-samba.so -%{_libdir}/samba/libsmb-transport-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so %{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so @@ -2106,6 +2134,7 @@ fi %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* %{_mandir}/man8/smbpasswd.8* +%{_datadir}/locale/*/LC_MESSAGES/net.mo ### TOOLS %files tools @@ -2228,6 +2257,7 @@ fi %{_libdir}/samba/service/dns.so %{_libdir}/samba/service/dns_update.so %{_libdir}/samba/service/drepl.so +%{_libdir}/samba/service/ft_scanner.so %{_libdir}/samba/service/kcc.so %{_libdir}/samba/service/kdc.so %{_libdir}/samba/service/ldap.so @@ -2580,6 +2610,7 @@ fi %{python3_sitearch}/samba/dcerpc/atsvc.*.so %{python3_sitearch}/samba/dcerpc/auth.*.so %{python3_sitearch}/samba/dcerpc/base.*.so +%{python3_sitearch}/samba/dcerpc/bcrypt_rsakey_blob.*.so %{python3_sitearch}/samba/dcerpc/claims.*.so %{python3_sitearch}/samba/dcerpc/conditional_ace.*.so %{python3_sitearch}/samba/dcerpc/dcerpc.*.so @@ -2595,6 +2626,7 @@ fi %{python3_sitearch}/samba/dcerpc/idmap.*.so %{python3_sitearch}/samba/dcerpc/initshutdown.*.so %{python3_sitearch}/samba/dcerpc/irpc.*.so +%{python3_sitearch}/samba/dcerpc/keycredlink.*.so %{python3_sitearch}/samba/dcerpc/krb5ccache.*.so %{python3_sitearch}/samba/dcerpc/krb5pac.*.so %{python3_sitearch}/samba/dcerpc/lsa.*.so @@ -2616,6 +2648,7 @@ fi %{python3_sitearch}/samba/dcerpc/spoolss.*.so %{python3_sitearch}/samba/dcerpc/srvsvc.*.so %{python3_sitearch}/samba/dcerpc/svcctl.*.so +%{python3_sitearch}/samba/dcerpc/tpm20_rsakey_blob.*.so %{python3_sitearch}/samba/dcerpc/unixinfo.*.so %{python3_sitearch}/samba/dcerpc/winbind.*.so %{python3_sitearch}/samba/dcerpc/windows_event_ids.*.so @@ -3119,6 +3152,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/auth_log_netlogon_bad_creds.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_samlogon.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_winbind.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/bcrypt_rsakey_blob.*.pyc %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc %{python3_sitearch}/samba/tests/__pycache__/compression.*.pyc @@ -3160,6 +3194,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/tests/__pycache__/imports.*.pyc %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/key_credential_link.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc @@ -3237,6 +3272,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc %{python3_sitearch}/samba/tests/__pycache__/tdb_util.*.pyc %{python3_sitearch}/samba/tests/__pycache__/token_factory.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/tpm20_rsakey_blob.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovision.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovisionneeddc.*.pyc @@ -3254,6 +3290,7 @@ fi %{python3_sitearch}/samba/tests/auth_log_pass_change.py %{python3_sitearch}/samba/tests/auth_log_samlogon.py %{python3_sitearch}/samba/tests/auth_log_winbind.py +%{python3_sitearch}/samba/tests/bcrypt_rsakey_blob.py %dir %{python3_sitearch}/samba/tests/blackbox %{python3_sitearch}/samba/tests/blackbox/__init__.py %dir %{python3_sitearch}/samba/tests/blackbox/__pycache__ @@ -3414,6 +3451,7 @@ fi %{python3_sitearch}/samba/tests/kcc/graph_utils.py %{python3_sitearch}/samba/tests/kcc/kcc_utils.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py +%{python3_sitearch}/samba/tests/key_credential_link.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc @@ -3529,6 +3567,12 @@ fi %{python3_sitearch}/samba/tests/net_join_no_spnego.py %{python3_sitearch}/samba/tests/net_join.py %{python3_sitearch}/samba/tests/netlogonsvc.py +%dir %{python3_sitearch}/samba/tests/nss +%dir %{python3_sitearch}/samba/tests/nss/__pycache__ +%{python3_sitearch}/samba/tests/nss/__pycache__/base.*.pyc +%{python3_sitearch}/samba/tests/nss/__pycache__/group.*.pyc +%{python3_sitearch}/samba/tests/nss/base.py +%{python3_sitearch}/samba/tests/nss/group.py %{python3_sitearch}/samba/tests/ntacls.py %{python3_sitearch}/samba/tests/ntacls_backup.py %{python3_sitearch}/samba/tests/ntlmdisabled.py @@ -3689,10 +3733,21 @@ fi %{python3_sitearch}/samba/tests/subunitrun.py %{python3_sitearch}/samba/tests/tdb_util.py %{python3_sitearch}/samba/tests/token_factory.py +%{python3_sitearch}/samba/tests/tpm20_rsakey_blob.py %{python3_sitearch}/samba/tests/upgrade.py %{python3_sitearch}/samba/tests/upgradeprovision.py %{python3_sitearch}/samba/tests/upgradeprovisionneeddc.py %{python3_sitearch}/samba/tests/usage.py +%dir %{python3_sitearch}/samba/tests/varlink +%dir %{python3_sitearch}/samba/tests/varlink/__pycache__ +%{python3_sitearch}/samba/tests/varlink/__pycache__/base.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getgrouprecord.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getmemberships.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getuserrecord.*.pyc +%{python3_sitearch}/samba/tests/varlink/base.py +%{python3_sitearch}/samba/tests/varlink/getgrouprecord.py +%{python3_sitearch}/samba/tests/varlink/getmemberships.py +%{python3_sitearch}/samba/tests/varlink/getuserrecord.py %{python3_sitearch}/samba/tests/xattr.py ### TEST @@ -3761,6 +3816,7 @@ fi %config(noreplace) %{_sysconfdir}/security/pam_winbind.conf %{_mandir}/man5/pam_winbind.conf.5* %{_mandir}/man8/pam_winbind.8* +%{_datadir}/locale/*/LC_MESSAGES/pam_winbind.mo %if %{with clustering} %files -n ctdb @@ -3910,6 +3966,13 @@ fi %{_mandir}/man1/winexe.1.gz %endif +%if %{with prometheus} +%files prometheus +%{_bindir}/smb_prometheus_endpoint +%{_mandir}/man8/smb_prometheus_endpoint.8.gz +#endif with prometheus + +%endif %files -n libldb %license lib/ldb/LICENSE %{_libdir}/libldb.so.* @@ -3933,6 +3996,7 @@ fi %{_libdir}/samba/ldb/server_sort.so %{_libdir}/samba/ldb/skel.so %{_libdir}/samba/ldb/tdb.so +%{_libdir}/samba/ldb/trust_notify.so %files -n libldb-devel %{_includedir}/samba-4.0/ldb_module.h diff --git a/sources b/sources index c47ad40..ddc3910 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c -SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e +SHA512 (samba-4.23.0rc1.tar.xz) = 6472b7445c138abb69185954c2ba86164fa500d8e267cf26ca6208f78599abcd6af282c19a7609cb72dc2d40d68956cdef3599d27dbf7e30d6b9b1f02d0cddea +SHA512 (samba-4.23.0rc1.tar.asc) = 56c9f8a4357599c52ad62e5ddf342c7e0eee4eb3f3c874f77280f06684e00aaf19d3a6d8bea9da8e63f8f79c4f6f28b0bdf3997dbe5213b17b3b4679e5fe5441 From c2bf86b8d2dc38adaded41822a69127cce364e47 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Sun, 17 Aug 2025 23:05:41 -0400 Subject: [PATCH 265/295] Move trust_notify module to -dc subpackage This module is not built in ELN, resulting in a file not found error when packaging libldb. Its build conditions are the same as the dns_notify module already in -dc. --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index bebd14a..5811a12 100644 --- a/samba.spec +++ b/samba.spec @@ -2212,6 +2212,7 @@ fi %{_libdir}/samba/ldb/subtree_delete.so %{_libdir}/samba/ldb/subtree_rename.so %{_libdir}/samba/ldb/tombstone_reanimate.so +%{_libdir}/samba/ldb/trust_notify.so %{_libdir}/samba/ldb/unique_object_sids.so %{_libdir}/samba/ldb/update_keytab.so %{_libdir}/samba/ldb/vlv.so @@ -3996,7 +3997,6 @@ fi %{_libdir}/samba/ldb/server_sort.so %{_libdir}/samba/ldb/skel.so %{_libdir}/samba/ldb/tdb.so -%{_libdir}/samba/ldb/trust_notify.so %files -n libldb-devel %{_includedir}/samba-4.0/ldb_module.h From c108db5e55fd5b9b4e9a5b8062744e4b7796dac6 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 18 Aug 2025 13:57:35 +0200 Subject: [PATCH 266/295] Rebuilt for Python 3.14.0rc2 bytecode From e6a975e42205afdb48c4c0e56c7ae97d61630788 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 22 Aug 2025 21:51:03 +0200 Subject: [PATCH 267/295] Update to Samba 4.23.0rc2 - resolves: #2387090 Guenther --- samba.spec | 5 +++-- sources | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 5811a12..76df67c 100644 --- a/samba.spec +++ b/samba.spec @@ -102,7 +102,8 @@ # Build the etcd helpers by default on Fedora %if 0%{?fedora} -%bcond etcd_mutex 1 +# disable etcd mutex helper as etcd is orphaned in Fedora now +%bcond etcd_mutex 0 %else %bcond etcd_mutex 0 %endif @@ -135,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc1 +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index ddc3910..24013e1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc1.tar.xz) = 6472b7445c138abb69185954c2ba86164fa500d8e267cf26ca6208f78599abcd6af282c19a7609cb72dc2d40d68956cdef3599d27dbf7e30d6b9b1f02d0cddea -SHA512 (samba-4.23.0rc1.tar.asc) = 56c9f8a4357599c52ad62e5ddf342c7e0eee4eb3f3c874f77280f06684e00aaf19d3a6d8bea9da8e63f8f79c4f6f28b0bdf3997dbe5213b17b3b4679e5fe5441 +SHA512 (samba-4.23.0rc2.tar.xz) = 44c8fab0523038270295b1d4ea9d535df04deb91dfe08680e1bde0b621eb6146ff9157ec97e9c0f0fb95ae33aaf66903a192b486b2df35899b6c5d4a57e09ee9 +SHA512 (samba-4.23.0rc2.tar.asc) = 7bdc54eb7bf4736123ea889f18ff0aa29eca91d2ab25fbfaeed431a0c7d193167526312bf051e58c70d2d9de0dfa9a5cdc9d8177f6f144c1b2d32c8ed2d0631d From 83273a97b1fb10bb6db374215af67549ef94637a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 29 Aug 2025 23:32:47 +0200 Subject: [PATCH 268/295] Update to Samba 4.23.0rc3 - resolves: #2387090 Guenther --- samba.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 76df67c..3e1a5fd 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -3361,6 +3361,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/dfs.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc @@ -3381,6 +3382,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py +%{python3_sitearch}/samba/tests/dcerpc/dfs.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/lsa.py diff --git a/sources b/sources index 24013e1..168a85d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc2.tar.xz) = 44c8fab0523038270295b1d4ea9d535df04deb91dfe08680e1bde0b621eb6146ff9157ec97e9c0f0fb95ae33aaf66903a192b486b2df35899b6c5d4a57e09ee9 -SHA512 (samba-4.23.0rc2.tar.asc) = 7bdc54eb7bf4736123ea889f18ff0aa29eca91d2ab25fbfaeed431a0c7d193167526312bf051e58c70d2d9de0dfa9a5cdc9d8177f6f144c1b2d32c8ed2d0631d +SHA512 (samba-4.23.0rc3.tar.xz) = 1e8b9bec0e42d387a0b4665d395ec63bcb9b84353c62be0ed253dfe79c1ff44f13a8a1825f2a1eba4c8f209cae55e0b3ed7f89b39884ec73b05383b0008a5249 +SHA512 (samba-4.23.0rc3.tar.asc) = 727d328c0f4bd075d927bcfdb86083c3e6e9f066c938d5232e655c676d78f936453bc0d39bf271d0f8371f33e8ffe30aa376ad6461ca0be8d34ebca01553c3ab From a6119e2bb3d77153a87af9be96ca2140a9da6316 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 2 Sep 2025 10:47:58 +0300 Subject: [PATCH 269/295] Fix FreeIPA trust to AD - resolves: rhbz#2392626 Signed-off-by: Alexander Bokovoy --- samba-bz15902.patch | 167 ++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 168 insertions(+) create mode 100644 samba-bz15902.patch diff --git a/samba-bz15902.patch b/samba-bz15902.patch new file mode 100644 index 0000000..659eecc --- /dev/null +++ b/samba-bz15902.patch @@ -0,0 +1,167 @@ +From 00b900e82ac0d859562ec88825975a2d9fbe1040 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 2 Sep 2025 10:36:11 +0300 +Subject: [PATCH] krb5: handle GSS-Proxy credentials lifetime +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +GSS-Proxy stores its credential in encrypted form in the Kerberos ccache +with a start and end time of 0 and a server principal in the realm named +'X-GSSPROXY:'. This credential is accessed through GSS-Proxy interposer +mechanism in MIT Kerberos and cannot be analysed with raw krb5 API. + +As MIT Kerberos has no krb5_cc_get_lifetime() implementation, add check +for the GSS-Proxy credential to smb_krb5_cc_get_lifetime() wrapper to +return KRB5_PLUGIN_NO_HANDLE. The two places where +smb_krb5_cc_get_lifetime() is used then handle this return code to avoid +deciding on the 'expired' lifetime to cause a kinit. + +This fixes FreeIPA use case where an IPA API endpoint uses Samba Python +bindings with a GSS-Proxy-controlled credential cache. + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=15902 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Pavel Filipensky +Autobuild-Date(master): Wed Sep 3 10:15:50 UTC 2025 on atb-devel-224 + +(cherry picked from commit c00b98ad840706cda222bb610d0d4860b98c72d4) +--- + auth/credentials/credentials_krb5.c | 36 +++++++++++++++++++++-------- + lib/krb5_wrap/krb5_samba.c | 35 ++++++++++++++++++++++++++-- + 2 files changed, 59 insertions(+), 12 deletions(-) + +diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c +index 4dc7e7be67e..8d289e26781 100644 +--- a/auth/credentials/credentials_krb5.c ++++ b/auth/credentials/credentials_krb5.c +@@ -687,7 +687,14 @@ _PUBLIC_ int cli_credentials_get_named_ccache(struct cli_credentials *cred, + bool kinit_required = false; + ret = smb_krb5_cc_get_lifetime(cred->ccache->smb_krb5_context->krb5_context, + cred->ccache->ccache, &lifetime); +- if (ret == KRB5_CC_END || ret == ENOENT) { ++ if (ret == KRB5_PLUGIN_NO_HANDLE) { ++ /* ++ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted ++ * GSSProxy credential. We don't know its lifetime but assume it ++ * is a valid one. Acquiring it will show the lifetime. ++ */ ++ kinit_required = false; ++ } else if (ret == KRB5_CC_END || ret == ENOENT) { + kinit_required = true; + } else if (ret == 0) { + if (lifetime == 0) { +@@ -800,18 +807,27 @@ _PUBLIC_ bool cli_credentials_get_ccache_name_obtained( + if (ret == KRB5_CC_END || ret == ENOENT) { + return false; + } +- if (ret != 0) { ++ ++ /* ++ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted ++ * GSSProxy credential. We don't know its lifetime but assume it ++ * is a valid one. Acquiring it will show the lifetime. ++ * */ ++ if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE) { + return false; + } +- if (lifetime == 0) { +- return false; +- } else if (lifetime < 300) { +- if (cred->password_obtained >= cred->ccache_obtained) { +- /* +- * we have a password to re-kinit +- * so let the caller try that. +- */ ++ ++ if (ret == 0) { ++ if (lifetime == 0) { + return false; ++ } else if (lifetime < 300) { ++ if (cred->password_obtained >= cred->ccache_obtained) { ++ /* ++ * we have a password to re-kinit ++ * so let the caller try that. ++ */ ++ return false; ++ } + } + } + +diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c +index f9d91a4f0c1..dcf91348d1a 100644 +--- a/lib/krb5_wrap/krb5_samba.c ++++ b/lib/krb5_wrap/krb5_samba.c +@@ -3025,6 +3025,8 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + krb5_creds cred; + krb5_timestamp endtime = 0; + krb5_timestamp now; ++ char *realm = NULL; ++ TALLOC_CTX *mem_ctx = NULL; + + *t = 0; + +@@ -3038,12 +3040,37 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + return kerr; + } + ++ mem_ctx = talloc_stackframe(); ++ if (mem_ctx == NULL) { ++ krb5_cc_end_seq_get(context, id, &cursor); ++ return ENOMEM; ++ } ++ + while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) { + if (krb5_is_config_principal(context, cred.server)) { + krb5_free_cred_contents(context, &cred); + continue; + } + ++ realm = smb_krb5_principal_get_realm(mem_ctx, context, cred.server); ++ if (realm == NULL) { ++ krb5_free_cred_contents(context, &cred); ++ kerr = ENOMEM; ++ break; ++ } ++ ++ /* ++ * 'X-GSSPROXY:' is the realm for an encrypted credential stored ++ * by the GSSProxy. There are no other creds in such ccache and ++ * we cannot see the actual lifetime (it is set to 0), ++ * indicate to the caller they need to handle this themselves. ++ */ ++ if (strcmp(realm, "X-GSSPROXY:") == 0) { ++ krb5_free_cred_contents(context, &cred); ++ kerr = KRB5_PLUGIN_NO_HANDLE; ++ break; ++ } ++ + #ifndef HAVE_FLAGS_IN_KRB5_CREDS + if (cred.ticket_flags & TKT_FLG_INITIAL) { + #else +@@ -3073,13 +3100,17 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + krb5_free_cred_contents(context, &cred); + } + ++ krb5_cc_end_seq_get(context, id, &cursor); ++ talloc_free(mem_ctx); ++ if (kerr == ENOMEM || kerr == KRB5_PLUGIN_NO_HANDLE) { ++ return kerr; ++ } ++ + if (now < endtime) { + *t = (time_t) (endtime - now); + kerr = 0; + } + +- krb5_cc_end_seq_get(context, id, &cursor); +- + return kerr; + } + #endif /* HAVE_KRB5_CC_GET_LIFETIME */ +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index 3e1a5fd..aa68a70 100644 --- a/samba.spec +++ b/samba.spec @@ -222,6 +222,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-bz15902.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 5a96c9042742117afd7b42a742495e578ae06db4 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 3 Sep 2025 15:44:06 +0300 Subject: [PATCH 270/295] Disable PCP 7.0.0 support PCP 7.0.0 API has changed, needs more work in ctdb https://bugzilla.samba.org/show_bug.cgi?id=15904 - resolves: rhbz#2392879 Signed-off-by: Alexander Bokovoy --- samba-pcp-7.0.0.patch | 63 +++++++++++++++++++++++++++++++++++++++++++ samba.spec | 3 +++ 2 files changed, 66 insertions(+) create mode 100644 samba-pcp-7.0.0.patch diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch new file mode 100644 index 0000000..953bc46 --- /dev/null +++ b/samba-pcp-7.0.0.patch @@ -0,0 +1,63 @@ +From edede7256f7bfa25186e22b3c5f1aab9a56ac141 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 3 Sep 2025 15:42:46 +0300 +Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 + +Signed-off-by: Alexander Bokovoy +--- + ctdb/utils/pmda/pmda_ctdb.c | 4 ++++ + ctdb/wscript | 20 +++++++++----------- + 2 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c +index 7ac8a3b38d1..a8d6704c8a9 100644 +--- a/ctdb/utils/pmda/pmda_ctdb.c ++++ b/ctdb/utils/pmda/pmda_ctdb.c +@@ -39,9 +39,13 @@ + + #define pmID_cluster(id) id->cluster + #define pmID_item(id) id->item ++#ifndef pmGetProgname + #define pmGetProgname() pmProgname ++#endif ++#ifndef pmSetProgname + #define pmSetProgname(a) __pmSetProgname(a) + #endif ++#endif + + #include "domain.h" + +diff --git a/ctdb/wscript b/ctdb/wscript +index e9cd89436a3..15dedb1c432 100644 +--- a/ctdb/wscript ++++ b/ctdb/wscript +@@ -226,17 +226,15 @@ def configure(conf): + + have_pmda = False + if Options.options.ctdb_pmda: +- pmda_support = True +- +- if not conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', +- together=True): +- pmda_support = False +- if not conf.CHECK_FUNCS_IN('pmProgname', 'pcp'): +- pmda_support = False +- if not conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda'): +- pmda_support = False +- if pmda_support: +- conf.CHECK_TYPE_IN('__pmID_int', 'pcp/pmapi.h pcp/impl.h') ++ checks = [conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', ++ together=True), ++ conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda')] ++ ++ have_progname = [conf.CHECK_FUNCS_IN('pmProgname', 'pcp'), ++ conf.CHECK_FUNCS_IN('pmGetProgname', 'pcp')] ++ ++ if all(checks) and any(have_progname): ++ conf.CHECK_TYPE_IN('__pmID_int', 'libpcp.h pcp/pmapi.h pcp/impl.h') + have_pmda = True + else: + Logs.error("PMDA support not available") +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index aa68a70..8a8a21e 100644 --- a/samba.spec +++ b/samba.spec @@ -94,8 +94,10 @@ # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 +%if 0%{?fedora} < 43 %bcond pcp_pmda 1 %endif +%endif %else %bcond pcp_pmda 0 %endif @@ -223,6 +225,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore Patch0: samba-bz15902.patch +Patch1: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From beb6a110890db1bd1c6d5f1ef7602cc21d84ec6b Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 4 Sep 2025 09:25:26 +0300 Subject: [PATCH 271/295] Restore PCP support - resolves: rhbz#2392879 Signed-off-by: Alexander Bokovoy --- samba-pcp-7.0.0.patch | 17 +++++++++++++---- samba.spec | 2 -- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch index 953bc46..1b2c6a5 100644 --- a/samba-pcp-7.0.0.patch +++ b/samba-pcp-7.0.0.patch @@ -1,16 +1,16 @@ -From edede7256f7bfa25186e22b3c5f1aab9a56ac141 Mon Sep 17 00:00:00 2001 +From 4b74db174b92e00eb4c342c77adcb8140851d025 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 3 Sep 2025 15:42:46 +0300 Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 Signed-off-by: Alexander Bokovoy --- - ctdb/utils/pmda/pmda_ctdb.c | 4 ++++ + ctdb/utils/pmda/pmda_ctdb.c | 6 +++++- ctdb/wscript | 20 +++++++++----------- - 2 files changed, 13 insertions(+), 11 deletions(-) + 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 7ac8a3b38d1..a8d6704c8a9 100644 +index 7ac8a3b38d1..75ae1079dc4 100644 --- a/ctdb/utils/pmda/pmda_ctdb.c +++ b/ctdb/utils/pmda/pmda_ctdb.c @@ -39,9 +39,13 @@ @@ -27,6 +27,15 @@ index 7ac8a3b38d1..a8d6704c8a9 100644 #include "domain.h" +@@ -450,7 +454,7 @@ err_out: + * instance domain evaluation. + */ + static int +-pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmResult **resp, pmdaExt *pmda) ++pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmdaResult **resp, pmdaExt *pmda) + { + int ret; + diff --git a/ctdb/wscript b/ctdb/wscript index e9cd89436a3..15dedb1c432 100644 --- a/ctdb/wscript diff --git a/samba.spec b/samba.spec index 8a8a21e..1d9ef9a 100644 --- a/samba.spec +++ b/samba.spec @@ -94,10 +94,8 @@ # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 -%if 0%{?fedora} < 43 %bcond pcp_pmda 1 %endif -%endif %else %bcond pcp_pmda 0 %endif From e0762b936f9c379833168f93bde983aa8b82131c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 10 Sep 2025 10:28:22 +0200 Subject: [PATCH 272/295] Update to Samba 4.23.0rc4 - resolves: #2393434 Guenther --- samba-bz15902.patch | 167 -------------------------------------------- samba.spec | 5 +- sources | 4 +- 3 files changed, 4 insertions(+), 172 deletions(-) delete mode 100644 samba-bz15902.patch diff --git a/samba-bz15902.patch b/samba-bz15902.patch deleted file mode 100644 index 659eecc..0000000 --- a/samba-bz15902.patch +++ /dev/null @@ -1,167 +0,0 @@ -From 00b900e82ac0d859562ec88825975a2d9fbe1040 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Tue, 2 Sep 2025 10:36:11 +0300 -Subject: [PATCH] krb5: handle GSS-Proxy credentials lifetime -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -GSS-Proxy stores its credential in encrypted form in the Kerberos ccache -with a start and end time of 0 and a server principal in the realm named -'X-GSSPROXY:'. This credential is accessed through GSS-Proxy interposer -mechanism in MIT Kerberos and cannot be analysed with raw krb5 API. - -As MIT Kerberos has no krb5_cc_get_lifetime() implementation, add check -for the GSS-Proxy credential to smb_krb5_cc_get_lifetime() wrapper to -return KRB5_PLUGIN_NO_HANDLE. The two places where -smb_krb5_cc_get_lifetime() is used then handle this return code to avoid -deciding on the 'expired' lifetime to cause a kinit. - -This fixes FreeIPA use case where an IPA API endpoint uses Samba Python -bindings with a GSS-Proxy-controlled credential cache. - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=15902 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Pavel Filipensky -Autobuild-Date(master): Wed Sep 3 10:15:50 UTC 2025 on atb-devel-224 - -(cherry picked from commit c00b98ad840706cda222bb610d0d4860b98c72d4) ---- - auth/credentials/credentials_krb5.c | 36 +++++++++++++++++++++-------- - lib/krb5_wrap/krb5_samba.c | 35 ++++++++++++++++++++++++++-- - 2 files changed, 59 insertions(+), 12 deletions(-) - -diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c -index 4dc7e7be67e..8d289e26781 100644 ---- a/auth/credentials/credentials_krb5.c -+++ b/auth/credentials/credentials_krb5.c -@@ -687,7 +687,14 @@ _PUBLIC_ int cli_credentials_get_named_ccache(struct cli_credentials *cred, - bool kinit_required = false; - ret = smb_krb5_cc_get_lifetime(cred->ccache->smb_krb5_context->krb5_context, - cred->ccache->ccache, &lifetime); -- if (ret == KRB5_CC_END || ret == ENOENT) { -+ if (ret == KRB5_PLUGIN_NO_HANDLE) { -+ /* -+ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted -+ * GSSProxy credential. We don't know its lifetime but assume it -+ * is a valid one. Acquiring it will show the lifetime. -+ */ -+ kinit_required = false; -+ } else if (ret == KRB5_CC_END || ret == ENOENT) { - kinit_required = true; - } else if (ret == 0) { - if (lifetime == 0) { -@@ -800,18 +807,27 @@ _PUBLIC_ bool cli_credentials_get_ccache_name_obtained( - if (ret == KRB5_CC_END || ret == ENOENT) { - return false; - } -- if (ret != 0) { -+ -+ /* -+ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted -+ * GSSProxy credential. We don't know its lifetime but assume it -+ * is a valid one. Acquiring it will show the lifetime. -+ * */ -+ if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE) { - return false; - } -- if (lifetime == 0) { -- return false; -- } else if (lifetime < 300) { -- if (cred->password_obtained >= cred->ccache_obtained) { -- /* -- * we have a password to re-kinit -- * so let the caller try that. -- */ -+ -+ if (ret == 0) { -+ if (lifetime == 0) { - return false; -+ } else if (lifetime < 300) { -+ if (cred->password_obtained >= cred->ccache_obtained) { -+ /* -+ * we have a password to re-kinit -+ * so let the caller try that. -+ */ -+ return false; -+ } - } - } - -diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index f9d91a4f0c1..dcf91348d1a 100644 ---- a/lib/krb5_wrap/krb5_samba.c -+++ b/lib/krb5_wrap/krb5_samba.c -@@ -3025,6 +3025,8 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - krb5_creds cred; - krb5_timestamp endtime = 0; - krb5_timestamp now; -+ char *realm = NULL; -+ TALLOC_CTX *mem_ctx = NULL; - - *t = 0; - -@@ -3038,12 +3040,37 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - return kerr; - } - -+ mem_ctx = talloc_stackframe(); -+ if (mem_ctx == NULL) { -+ krb5_cc_end_seq_get(context, id, &cursor); -+ return ENOMEM; -+ } -+ - while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) { - if (krb5_is_config_principal(context, cred.server)) { - krb5_free_cred_contents(context, &cred); - continue; - } - -+ realm = smb_krb5_principal_get_realm(mem_ctx, context, cred.server); -+ if (realm == NULL) { -+ krb5_free_cred_contents(context, &cred); -+ kerr = ENOMEM; -+ break; -+ } -+ -+ /* -+ * 'X-GSSPROXY:' is the realm for an encrypted credential stored -+ * by the GSSProxy. There are no other creds in such ccache and -+ * we cannot see the actual lifetime (it is set to 0), -+ * indicate to the caller they need to handle this themselves. -+ */ -+ if (strcmp(realm, "X-GSSPROXY:") == 0) { -+ krb5_free_cred_contents(context, &cred); -+ kerr = KRB5_PLUGIN_NO_HANDLE; -+ break; -+ } -+ - #ifndef HAVE_FLAGS_IN_KRB5_CREDS - if (cred.ticket_flags & TKT_FLG_INITIAL) { - #else -@@ -3073,13 +3100,17 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - krb5_free_cred_contents(context, &cred); - } - -+ krb5_cc_end_seq_get(context, id, &cursor); -+ talloc_free(mem_ctx); -+ if (kerr == ENOMEM || kerr == KRB5_PLUGIN_NO_HANDLE) { -+ return kerr; -+ } -+ - if (now < endtime) { - *t = (time_t) (endtime - now); - kerr = 0; - } - -- krb5_cc_end_seq_get(context, id, &cursor); -- - return kerr; - } - #endif /* HAVE_KRB5_CC_GET_LIFETIME */ --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 1d9ef9a..5cebd13 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -222,8 +222,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-bz15902.patch -Patch1: samba-pcp-7.0.0.patch +Patch0: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} diff --git a/sources b/sources index 168a85d..a13eeba 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc3.tar.xz) = 1e8b9bec0e42d387a0b4665d395ec63bcb9b84353c62be0ed253dfe79c1ff44f13a8a1825f2a1eba4c8f209cae55e0b3ed7f89b39884ec73b05383b0008a5249 -SHA512 (samba-4.23.0rc3.tar.asc) = 727d328c0f4bd075d927bcfdb86083c3e6e9f066c938d5232e655c676d78f936453bc0d39bf271d0f8371f33e8ffe30aa376ad6461ca0be8d34ebca01553c3ab +SHA512 (samba-4.23.0rc4.tar.xz) = 0e31cce7b6627d07c0d6caa4be6e7e962c5c32bb426532584f5d429c9354c5e9a3180c6cb6c2cabe0daad130c78fb43cf0b304b515d1e0a92e67e0e581539dba +SHA512 (samba-4.23.0rc4.tar.asc) = 068891e289c62ce8602ea6524c05c0348cc21853597e3e192bf932d3a4b7fb514925950828bc97375492aa30e5937761911f0ade2af202ddaec504f105fec580 From 86832ccc3983caa58af6bcc646f1bccabaa9b7e5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 14:55:35 +0200 Subject: [PATCH 273/295] Update to version 4.23.0 - resolves: rhbz#2394791 --- samba-pcp-7.0.0.patch | 72 ------------------------------------------- samba.spec | 8 +++-- 2 files changed, 6 insertions(+), 74 deletions(-) delete mode 100644 samba-pcp-7.0.0.patch diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch deleted file mode 100644 index 1b2c6a5..0000000 --- a/samba-pcp-7.0.0.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 4b74db174b92e00eb4c342c77adcb8140851d025 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Wed, 3 Sep 2025 15:42:46 +0300 -Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 - -Signed-off-by: Alexander Bokovoy ---- - ctdb/utils/pmda/pmda_ctdb.c | 6 +++++- - ctdb/wscript | 20 +++++++++----------- - 2 files changed, 14 insertions(+), 12 deletions(-) - -diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 7ac8a3b38d1..75ae1079dc4 100644 ---- a/ctdb/utils/pmda/pmda_ctdb.c -+++ b/ctdb/utils/pmda/pmda_ctdb.c -@@ -39,9 +39,13 @@ - - #define pmID_cluster(id) id->cluster - #define pmID_item(id) id->item -+#ifndef pmGetProgname - #define pmGetProgname() pmProgname -+#endif -+#ifndef pmSetProgname - #define pmSetProgname(a) __pmSetProgname(a) - #endif -+#endif - - #include "domain.h" - -@@ -450,7 +454,7 @@ err_out: - * instance domain evaluation. - */ - static int --pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmResult **resp, pmdaExt *pmda) -+pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmdaResult **resp, pmdaExt *pmda) - { - int ret; - -diff --git a/ctdb/wscript b/ctdb/wscript -index e9cd89436a3..15dedb1c432 100644 ---- a/ctdb/wscript -+++ b/ctdb/wscript -@@ -226,17 +226,15 @@ def configure(conf): - - have_pmda = False - if Options.options.ctdb_pmda: -- pmda_support = True -- -- if not conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', -- together=True): -- pmda_support = False -- if not conf.CHECK_FUNCS_IN('pmProgname', 'pcp'): -- pmda_support = False -- if not conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda'): -- pmda_support = False -- if pmda_support: -- conf.CHECK_TYPE_IN('__pmID_int', 'pcp/pmapi.h pcp/impl.h') -+ checks = [conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', -+ together=True), -+ conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda')] -+ -+ have_progname = [conf.CHECK_FUNCS_IN('pmProgname', 'pcp'), -+ conf.CHECK_FUNCS_IN('pmGetProgname', 'pcp')] -+ -+ if all(checks) and any(have_progname): -+ conf.CHECK_TYPE_IN('__pmID_int', 'libpcp.h pcp/pmapi.h pcp/impl.h') - have_pmda = True - else: - Logs.error("PMDA support not available") --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 5cebd13..dca57e4 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -222,7 +222,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -323,6 +322,11 @@ BuildRequires: xz BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) +# TODO FIXME This is not in RHEL yet +%if 0%{?fedora} >= 34 +BuildRequires: pkgconfig(libngtcp2) +BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) +%endif %ifnarch i686 %if 0%{?fedora} >= 37 From 0bc0416ee8ae7375d809c566d6ecfcba9b2beb04 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 15:03:30 +0200 Subject: [PATCH 274/295] Remove `smb3 unix extensions = yes` from smb.conf This is enabled by default now. --- smb.conf.vendor | 2 -- sources | 4 ++-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/smb.conf.vendor b/smb.conf.vendor index cbb2e0f..f237c86 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,8 +18,6 @@ load printers = yes cups options = raw - smb3 unix extensions = yes - # Install samba-usershares package for support include = /etc/samba/usershares.conf diff --git a/sources b/sources index a13eeba..e69f8ff 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc4.tar.xz) = 0e31cce7b6627d07c0d6caa4be6e7e962c5c32bb426532584f5d429c9354c5e9a3180c6cb6c2cabe0daad130c78fb43cf0b304b515d1e0a92e67e0e581539dba -SHA512 (samba-4.23.0rc4.tar.asc) = 068891e289c62ce8602ea6524c05c0348cc21853597e3e192bf932d3a4b7fb514925950828bc97375492aa30e5937761911f0ade2af202ddaec504f105fec580 +SHA512 (samba-4.23.0.tar.xz) = 660b35a99544a868b11b24ea3c2ed58de5f68c7fc12d3ea71bc84724285eee4375d13ccf357f0248352fab344d76303660e09598f5f1988f3d0f8e76c535a781 +SHA512 (samba-4.23.0.tar.asc) = 508587816e941cd8dc9f65b7f05c828ce859fb7f74a01a200f685c5188c79c916b4d5b167b71298c53cc8a01d6e17a272ea773980488af532a85308fd1142156 From 54c3bbd3f168e8816d279498b3d18435d9a4081b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 18:04:02 +0200 Subject: [PATCH 275/295] Fix building ctdb with PCP 7.0.0 --- samba-fix-ctdb-pcp-7-support.patch | 36 ++++++++++++++++++++++++++++++ samba.spec | 6 ++++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 samba-fix-ctdb-pcp-7-support.patch diff --git a/samba-fix-ctdb-pcp-7-support.patch b/samba-fix-ctdb-pcp-7-support.patch new file mode 100644 index 0000000..116a4ff --- /dev/null +++ b/samba-fix-ctdb-pcp-7-support.patch @@ -0,0 +1,36 @@ +From 56be6583e8a32cd4dcdfcd3a1f072cc7642668e4 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 12 Sep 2025 15:37:38 +0200 +Subject: [PATCH] ctdb: Fix redefinitoin of pmdaResult + +../../ctdb/utils/pmda/pmda_ctdb.c:52:9: warning: 'pmdaResult' redefined + 52 | #define pmdaResult pmResult + | ^~~~~~~~~~ +In file included from ../../ctdb/utils/pmda/pmda_ctdb.c:35: +/usr/include/pcp/pmda.h:30:9: note: this is the location of the previous definition + 30 | #define pmdaResult pmResult_v2 + | ^~~~~~~~~~ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15904 + +Signed-off-by: Andreas Schneider +--- + ctdb/utils/pmda/pmda_ctdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c +index 9845f26defb..5c09aca7b84 100644 +--- a/ctdb/utils/pmda/pmda_ctdb.c ++++ b/ctdb/utils/pmda/pmda_ctdb.c +@@ -48,7 +48,7 @@ + #define pmSetProgname(a) __pmSetProgname(a) + #endif + +-#ifdef HAVE_STRUCT_PMRESULT ++#if !defined(pmdaResult) && defined(HAVE_STRUCT_PMRESULT) + #define pmdaResult pmResult + #endif + +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index dca57e4..a68adfa 100644 --- a/samba.spec +++ b/samba.spec @@ -223,6 +223,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-fix-ctdb-pcp-7-support.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -323,7 +325,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) # TODO FIXME This is not in RHEL yet -%if 0%{?fedora} >= 34 +%if 0%{?fedora} >= 43 BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) %endif @@ -2026,8 +2028,10 @@ fi %{_libdir}/samba/libndr-samba4-private-samba.so %{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so +%if 0%{?rhel} %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so %{_libdir}/samba/libngtcp2-private-samba.so +%endif %{_libdir}/samba/libnpa-tstream-private-samba.so %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so From b40a7310d3f6cc89d9b97bd587235793ad42a4b9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 15 Sep 2025 10:43:55 +0200 Subject: [PATCH 276/295] Build with systemd-userdb support --- samba.spec | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/samba.spec b/samba.spec index a68adfa..406e975 100644 --- a/samba.spec +++ b/samba.spec @@ -121,6 +121,12 @@ %bcond lmdb 0 %endif +%if 0%{?fedora} >= 43 +%bcond varlink 1 +%else +%bcond varlink 0 +%endif + %global samba_version 4.23.0 # The release field is extended: @@ -330,6 +336,10 @@ BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) %endif +%if %{with varlink} +BuildRequires: pkgconfig(libvarlink) >= 24 +%endif + %ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold @@ -1429,6 +1439,9 @@ export PYTHONARCHDIR=%{python3_sitearch} %endif %if %{with prometheus} --with-prometheus-exporter \ +%endif +%if %{with varlink} + --with-systemd-userdb \ %endif --with-profiling-data \ --with-systemd \ From 07953f426e3bacaaab66308f0cc460811ce9a29d Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 23 Sep 2025 11:40:30 +0300 Subject: [PATCH 277/295] Fix DLZ crash on unconfigured Samba AD system and rebuild against Python 3.14.0rc3 - Resolves: rhbz#2396621 - Resolves: rhbz#2397242 Signed-off-by: Alexander Bokovoy --- samba-dlz-crash-fix.patch | 53 +++++++++++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 54 insertions(+) create mode 100644 samba-dlz-crash-fix.patch diff --git a/samba-dlz-crash-fix.patch b/samba-dlz-crash-fix.patch new file mode 100644 index 0000000..e3e84b2 --- /dev/null +++ b/samba-dlz-crash-fix.patch @@ -0,0 +1,53 @@ +From 821cf798d87162b1f3b5d7388891d15fea0a969a Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Fri, 19 Sep 2025 16:23:41 +0300 +Subject: [PATCH] Fix crash in DLZ plugin for incorrect setup + +When bind is not yet setup properly, logging errors should be done +through the temporary handle. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15920 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Douglas Bagnall + +Autobuild-User(master): Douglas Bagnall +Autobuild-Date(master): Sat Sep 20 06:49:37 UTC 2025 on atb-devel-224 +--- + source4/dns_server/dlz_bind9.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c +index e5c9679835e..2a2430caba2 100644 +--- a/source4/dns_server/dlz_bind9.c ++++ b/source4/dns_server/dlz_bind9.c +@@ -671,6 +671,9 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, + } + va_end(ap); + ++ /* starting from here, we can only use state->log() until ++ * dlz_bind9_state is assigned */ ++ + /* Do not install samba signal handlers */ + fault_setup_disable(); + +@@ -727,11 +730,11 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, + } + + if (!file_exist(state->options.url)) { +- dlz_bind9_state->log(ISC_LOG_ERROR, +- "samba_dlz: dlz_create could not find '%s'; " +- "trying old location '%s/dns/sam.ldb' instead", +- state->options.url, +- lpcfg_private_dir(state->lp)); ++ state->log(ISC_LOG_ERROR, ++ "samba_dlz: dlz_create could not find '%s'; " ++ "trying old location '%s/dns/sam.ldb' instead", ++ state->options.url, ++ lpcfg_private_dir(state->lp)); + state->options.url = talloc_asprintf(state, + "%s/dns/sam.ldb", + lpcfg_private_dir(state->lp)); +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index 406e975..4846712 100644 --- a/samba.spec +++ b/samba.spec @@ -230,6 +230,7 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-fix-ctdb-pcp-7-support.patch +Patch1: samba-dlz-crash-fix.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 4e3699d8b510bcd13d65116dca74012906d32a31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Sep 2025 14:14:11 +0200 Subject: [PATCH 278/295] Update to Samba 4.23.1 - resolves: #2399755 Guenther --- samba-dlz-crash-fix.patch | 53 ------------------------------ samba-fix-ctdb-pcp-7-support.patch | 36 -------------------- samba.spec | 5 +-- sources | 4 +-- 4 files changed, 3 insertions(+), 95 deletions(-) delete mode 100644 samba-dlz-crash-fix.patch delete mode 100644 samba-fix-ctdb-pcp-7-support.patch diff --git a/samba-dlz-crash-fix.patch b/samba-dlz-crash-fix.patch deleted file mode 100644 index e3e84b2..0000000 --- a/samba-dlz-crash-fix.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 821cf798d87162b1f3b5d7388891d15fea0a969a Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Fri, 19 Sep 2025 16:23:41 +0300 -Subject: [PATCH] Fix crash in DLZ plugin for incorrect setup - -When bind is not yet setup properly, logging errors should be done -through the temporary handle. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15920 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Douglas Bagnall - -Autobuild-User(master): Douglas Bagnall -Autobuild-Date(master): Sat Sep 20 06:49:37 UTC 2025 on atb-devel-224 ---- - source4/dns_server/dlz_bind9.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c -index e5c9679835e..2a2430caba2 100644 ---- a/source4/dns_server/dlz_bind9.c -+++ b/source4/dns_server/dlz_bind9.c -@@ -671,6 +671,9 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, - } - va_end(ap); - -+ /* starting from here, we can only use state->log() until -+ * dlz_bind9_state is assigned */ -+ - /* Do not install samba signal handlers */ - fault_setup_disable(); - -@@ -727,11 +730,11 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, - } - - if (!file_exist(state->options.url)) { -- dlz_bind9_state->log(ISC_LOG_ERROR, -- "samba_dlz: dlz_create could not find '%s'; " -- "trying old location '%s/dns/sam.ldb' instead", -- state->options.url, -- lpcfg_private_dir(state->lp)); -+ state->log(ISC_LOG_ERROR, -+ "samba_dlz: dlz_create could not find '%s'; " -+ "trying old location '%s/dns/sam.ldb' instead", -+ state->options.url, -+ lpcfg_private_dir(state->lp)); - state->options.url = talloc_asprintf(state, - "%s/dns/sam.ldb", - lpcfg_private_dir(state->lp)); --- -2.51.0 - diff --git a/samba-fix-ctdb-pcp-7-support.patch b/samba-fix-ctdb-pcp-7-support.patch deleted file mode 100644 index 116a4ff..0000000 --- a/samba-fix-ctdb-pcp-7-support.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 56be6583e8a32cd4dcdfcd3a1f072cc7642668e4 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 12 Sep 2025 15:37:38 +0200 -Subject: [PATCH] ctdb: Fix redefinitoin of pmdaResult - -../../ctdb/utils/pmda/pmda_ctdb.c:52:9: warning: 'pmdaResult' redefined - 52 | #define pmdaResult pmResult - | ^~~~~~~~~~ -In file included from ../../ctdb/utils/pmda/pmda_ctdb.c:35: -/usr/include/pcp/pmda.h:30:9: note: this is the location of the previous definition - 30 | #define pmdaResult pmResult_v2 - | ^~~~~~~~~~ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15904 - -Signed-off-by: Andreas Schneider ---- - ctdb/utils/pmda/pmda_ctdb.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 9845f26defb..5c09aca7b84 100644 ---- a/ctdb/utils/pmda/pmda_ctdb.c -+++ b/ctdb/utils/pmda/pmda_ctdb.c -@@ -48,7 +48,7 @@ - #define pmSetProgname(a) __pmSetProgname(a) - #endif - --#ifdef HAVE_STRUCT_PMRESULT -+#if !defined(pmdaResult) && defined(HAVE_STRUCT_PMRESULT) - #define pmdaResult pmResult - #endif - --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 4846712..493c0bf 100644 --- a/samba.spec +++ b/samba.spec @@ -127,7 +127,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.0 +%global samba_version 4.23.1 # The release field is extended: # [.][.]%%{?dist}[.] @@ -229,9 +229,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-fix-ctdb-pcp-7-support.patch -Patch1: samba-dlz-crash-fix.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} diff --git a/sources b/sources index e69f8ff..1bea503 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0.tar.xz) = 660b35a99544a868b11b24ea3c2ed58de5f68c7fc12d3ea71bc84724285eee4375d13ccf357f0248352fab344d76303660e09598f5f1988f3d0f8e76c535a781 -SHA512 (samba-4.23.0.tar.asc) = 508587816e941cd8dc9f65b7f05c828ce859fb7f74a01a200f685c5188c79c916b4d5b167b71298c53cc8a01d6e17a272ea773980488af532a85308fd1142156 +SHA512 (samba-4.23.1.tar.xz) = d6e2863dc729b2c4feb337634ad80d9f8cb244455dbdb035f6d164ed722c07e507d2018d68221beada429d6e2c00aa36bfbfcc788e96e34225bb963beb2e017e +SHA512 (samba-4.23.1.tar.asc) = cea22d67e374b4350bd78e941ec60655b4176b7c24dc3514f476608f91c5806f1dc11aed66a237dec82ed31979eeeacac91f2191c3b9fe415920f762a0085118 From c05bf06122c9f8f630c5435c3ebe7d04046472c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 15 Oct 2025 23:27:11 +0200 Subject: [PATCH 279/295] Update to Samba 4.23.2 - resolves: rhbz#2404204 - resolves: rhbz#2391698 - Security fix for CVE-2025-9640 - resolves: rhbz#2394377 - Security fix for CVE-2025-10230 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 493c0bf..d6e2912 100644 --- a/samba.spec +++ b/samba.spec @@ -127,7 +127,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.1 +%global samba_version 4.23.2 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 1bea503..4af6c05 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.1.tar.xz) = d6e2863dc729b2c4feb337634ad80d9f8cb244455dbdb035f6d164ed722c07e507d2018d68221beada429d6e2c00aa36bfbfcc788e96e34225bb963beb2e017e -SHA512 (samba-4.23.1.tar.asc) = cea22d67e374b4350bd78e941ec60655b4176b7c24dc3514f476608f91c5806f1dc11aed66a237dec82ed31979eeeacac91f2191c3b9fe415920f762a0085118 +SHA512 (samba-4.23.2.tar.xz) = ffc9415d76244a199ef23cb39da7b97ec07b7fd061f84ba6185ac3a45e6b6942d0196945ac6d7e72f137787eafb2811220227c2c72a006fdfc903f90caa4673f +SHA512 (samba-4.23.2.tar.asc) = 775a8e321ea63193b027e6c2f351f9532b93cb6662571dc30bf2150624649afc425d3c9a0bfdea92ac093d25a1aee71d7ff6e4a47d44b2286074cf7ac6cdea98 From efaa5fdc6d2a13fc842f453c360f76a8f8ed587e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 20:08:17 +0100 Subject: [PATCH 280/295] Fix --with testsuite [skip changelog] --- samba.spec | 48 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/samba.spec b/samba.spec index d6e2912..08d2cb9 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,17 @@ # or # rpmbuild --rebuild --with testsuite samba.src.rpm # +# If you just want to run a single test, you can use: +# fedpkg mockbuild --with testsuite -- --define 'SAMBA_TESTS regex' samba.src.rpm +# or +# rpmbuild --rebuild --with testsuite --define='SAMBA_TESTS regex' samba.src.rpm +# %bcond testsuite 0 +%if %{with testsuite} +# As the file list is empty for running just the tests, we have empty debuginfo +# package. Disable it to avoid error reporting. +%global debug_package %{nil} +%endif # Build with internal talloc, tevent, tdb # @@ -1328,6 +1338,13 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - # Make sure we do not build with heimdal code rm -rfv third_party/heimdal +%if %{with testsuite} +# WARNING: Don't change that for production! +# +# Shorten the priviliged dir, as unix sockets only have 108 chars +sed -i 's/#define WINBINDD_PRIV_SOCKET_SUBDIR.*/#define WINBINDD_PRIV_SOCKET_SUBDIR "wb_priv"/' nsswitch/winbind_struct_protocol.h +%endif + %build %if %{with includelibs} %global _talloc_lib ,talloc,pytalloc,pytalloc-util @@ -1619,20 +1636,37 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout # in the timestamp so the year 2038 problem is deferred till 2446. # https://bugzilla.samba.org/show_bug.cgi?id=14546 # -for t in samba3.smb2.timestamps.time_t_15032385535 \ - samba3.smb2.timestamps.time_t_10000000000 \ - samba3.smb2.timestamps.time_t_4294967295 \ - ; do - echo "^$t" >> selftest/knownfail.d/fedora.%{dist} -done -cat selftest/knownfail.d/fedora.%{dist} +if [ "$(df --portability --print-type "$(pwd)" | grep -c ext4)" == "1" ]; then + cat > selftest/knownfail.d/fedora%{dist} << EOF +^samba3.smb2.timestamps.time_t_15032385535 +^samba3.smb2.timestamps.time_t_10000000000 +^samba3.smb2.timestamps.time_t_4294967295 +EOF +fi + +echo +echo "Content of selftest/knownfail.d/fedora%{dist}:" +cat selftest/knownfail.d/fedora%{dist} || true + +cat >> selftest/skip << EOF +# FIXME: Investigate why it fails. Might be CUPS is not running? +^samba3.rpc.spoolss.printserver +EOF + +echo +echo "Content of selftest/skip:" +cat selftest/skip export TDB_NO_FSYNC=1 export NMBD_DONT_LOG_STDOUT=1 export SMBD_DONT_LOG_STDOUT=1 export WINBINDD_DONT_LOG_STDOUT=1 export SAMBA_DCERPCD_DONT_LOG_STDOUT=1 +%if "x%{?SAMBA_TESTS}" != "x" +%{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 TESTS="%{SAMBA_TESTS}" +%else %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 +%endif #endif with testsuite %endif From 80c8f322115895534520fe5a4c6159ff629fe13a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 7 Nov 2025 16:41:40 +0100 Subject: [PATCH 281/295] Update to Samba 4.23.3 - resolves: #2413362 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 08d2cb9..25b8dbc 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.2 +%global samba_version 4.23.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 4af6c05..d966a50 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.2.tar.xz) = ffc9415d76244a199ef23cb39da7b97ec07b7fd061f84ba6185ac3a45e6b6942d0196945ac6d7e72f137787eafb2811220227c2c72a006fdfc903f90caa4673f -SHA512 (samba-4.23.2.tar.asc) = 775a8e321ea63193b027e6c2f351f9532b93cb6662571dc30bf2150624649afc425d3c9a0bfdea92ac093d25a1aee71d7ff6e4a47d44b2286074cf7ac6cdea98 +SHA512 (samba-4.23.3.tar.xz) = 5cb15c8eeda14dc4317b239864a4b7aa50b9c16a49ac9aefdc06ba6bde9b869fee2955eb21ed4620b73bb68682d368821869594fd106f3387e9ced9978483e7e +SHA512 (samba-4.23.3.tar.asc) = 27804ead26f8363d2a84b8ad37495a60b28c80b002e3c7420d434792c893355bd2652a8222825dbc877acbba65db18c4a648eaec218d69f275428b6f6d8a990e From 4af627337110534bd4de9e18adc758c2e7c1b093 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Nov 2025 13:20:07 +0100 Subject: [PATCH 282/295] Update gitignore [skip changelog] --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index a695288..47652a9 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ /samba-*.tar.xz /samba-*.tar.asc +/*.rpm +/results_samba From fb14cf225b29844693fd6240ba590d7c77622d00 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Nov 2025 19:10:30 +0100 Subject: [PATCH 283/295] Add hint that we bundle ngtcp2 if not provided by the system --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 25b8dbc..789eb43 100644 --- a/samba.spec +++ b/samba.spec @@ -342,6 +342,8 @@ BuildRequires: pkgconfig(libsystemd) %if 0%{?fedora} >= 43 BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) +%else +Provides: bundled(ngtcp2) %endif %if %{with varlink} From 8c46386794df75e98db1520c6f03cc26e14e8c1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 12 Dec 2025 17:04:18 +0100 Subject: [PATCH 284/295] Update to Samba 4.23.4 - resolves: #2421764 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 789eb43..9b87190 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.3 +%global samba_version 4.23.4 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index d966a50..01648ec 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.3.tar.xz) = 5cb15c8eeda14dc4317b239864a4b7aa50b9c16a49ac9aefdc06ba6bde9b869fee2955eb21ed4620b73bb68682d368821869594fd106f3387e9ced9978483e7e -SHA512 (samba-4.23.3.tar.asc) = 27804ead26f8363d2a84b8ad37495a60b28c80b002e3c7420d434792c893355bd2652a8222825dbc877acbba65db18c4a648eaec218d69f275428b6f6d8a990e +SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac +SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce From a170fadc8dd6bcea5ed3839b6086643e43d06f71 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 12 Jan 2026 10:05:53 +0100 Subject: [PATCH 285/295] Do not redeclare cmocka functions This might cause issues when compiling with newer cmocka versions. --- samba-4.23-fix-cmocka.patch | 38 +++++++++++++++++++++++++++++++++++++ samba.spec | 2 ++ 2 files changed, 40 insertions(+) create mode 100644 samba-4.23-fix-cmocka.patch diff --git a/samba-4.23-fix-cmocka.patch b/samba-4.23-fix-cmocka.patch new file mode 100644 index 0000000..26289d6 --- /dev/null +++ b/samba-4.23-fix-cmocka.patch @@ -0,0 +1,38 @@ +From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 21 Nov 2025 15:33:32 +0100 +Subject: [PATCH] s4:dsdb: Do not declare cm_print_error() + +This is part of the cmocka.h header file. + +Signed-off-by: Andreas Schneider +Reviewed-by: Martin Schwenke +Reviewed-by: Volker Lendecke + +Autobuild-User(master): Volker Lendecke +Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224 + +(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a) +--- + source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c +index f7075f3485e..12c464b49c7 100644 +--- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c ++++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c +@@ -103,11 +103,6 @@ void audit_message_send( + + #define check_group_change_message(m, u, a, e) \ + _check_group_change_message(m, u, a, e, __FILE__, __LINE__); +-/* +- * declare the internal cmocka cm_print_error so that we can output messages +- * in sub unit format +- */ +-void cm_print_error(const char * const format, ...); + + /* + * Validate a group change JSON audit message +-- +2.52.0 + diff --git a/samba.spec b/samba.spec index 9b87190..2e3fe75 100644 --- a/samba.spec +++ b/samba.spec @@ -239,6 +239,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.23-fix-cmocka.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From 4a23ce5b7a021fac72e887bf4f71f843b150c987 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 08:01:17 +0100 Subject: [PATCH 286/295] Remove unneeded dependency to samba-common-libs --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 2e3fe75..647fc92 100644 --- a/samba.spec +++ b/samba.spec @@ -1264,7 +1264,6 @@ License: LGPL-3.0-or-later Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} -Requires: samba-common-libs = %{samba_depver} # /endif without includelibs %endif From b8395d93a751e2417fd1dd28e5cc09501ac2bb24 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 10:53:10 +0100 Subject: [PATCH 287/295] Create a core-libs sub-package to split up library dependencies --- samba.spec | 135 +++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 100 insertions(+), 35 deletions(-) diff --git a/samba.spec b/samba.spec index 647fc92..c72ba68 100644 --- a/samba.spec +++ b/samba.spec @@ -488,12 +488,26 @@ The %{name}-client package provides some SMB/CIFS clients to complement the built-in SMB/CIFS filesystem in Linux. These clients allow access of SMB/CIFS shares and printing to SMB/CIFS printers. +### CORE-LIBS +%package core-libs +Summary: Samba core libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} + +Provides: bundled(libreplace) = %{samba_depver} + +%description core-libs +The samba-core-libs package contains foundational libraries needed by +both Samba servers and clients. This includes error handling, utilities, +and NDR serialization support. + ### CLIENT-LIBS %package client-libs Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -528,7 +542,7 @@ packages of Samba. Summary: Libraries used by both Samba servers and clients Requires(pre): samba-common = %{samba_depver} Requires: samba-common = %{samba_depver} -Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -890,7 +904,7 @@ suite. %if %{with libwbclient} %package -n libwbclient Summary: The winbind client library -Requires: %{name}-client-libs = %{samba_depver} +# libwbclient.so only links to libc - no samba library dependencies needed Conflicts: sssd-libwbclient %description -n libwbclient @@ -2009,6 +2023,45 @@ fi #endif with includelibs %endif +### CORE-LIBS +%files core-libs +%dir %{_libdir}/samba + +# +# Tier 0: Private libraries - libc only dependencies +# +%{_libdir}/samba/libreplace-private-samba.so +%{_libdir}/samba/libsocket-blocking-private-samba.so +%{_libdir}/samba/libsys-rw-private-samba.so +%{_libdir}/samba/libtime-basic-private-samba.so + +# +# Tier 1: Private libraries - system libs (libtalloc, libsystemd) +# +%{_libdir}/samba/libsamba-debug-private-samba.so +%{_libdir}/samba/libserver-role-private-samba.so + +# +# Tier 1: Public libraries - system libs (libtalloc) +# +%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* + +# +# Tier 2: Private libraries - adds gnutls +# +%{_libdir}/samba/libgenrand-private-samba.so + +# +# Tier 2: Public libraries - adds gnutls, icu, tevent +# +%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* +%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* + +# +# Tier 3: Public libraries - NDR serialization (depends on Tier 1-2) +# +%{_libdir}/libndr.so.%{libndr_so_version}* + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* @@ -2017,18 +2070,12 @@ fi %{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* %{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* %{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* -%{_libdir}/libndr.so.%{libndr_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* -%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* -%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* %{_libdir}/libsamdb.so.%{libsamdb_so_version}* %{_libdir}/libsmbconf.so.%{libsmbconf_so_version}* %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* -%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* - -%dir %{_libdir}/samba %{_libdir}/samba/libCHARSET3-private-samba.so %{_libdir}/samba/libMESSAGING-SEND-private-samba.so %{_libdir}/samba/libMESSAGING-private-samba.so @@ -2049,19 +2096,14 @@ fi %{_libdir}/samba/libcmdline-contexts-private-samba.so %{_libdir}/samba/libcommon-auth-private-samba.so %{_libdir}/samba/libctdb-event-client-private-samba.so -%{_libdir}/samba/libdbwrap-private-samba.so %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so %{_libdir}/samba/libdcerpc-samba-private-samba.so %{_libdir}/samba/libevents-private-samba.so -%{_libdir}/samba/libflag-mapping-private-samba.so -%{_libdir}/samba/libgenrand-private-samba.so %{_libdir}/samba/libgensec-private-samba.so %{_libdir}/samba/libgpext-private-samba.so %{_libdir}/samba/libgpo-private-samba.so %{_libdir}/samba/libgse-private-samba.so %{_libdir}/samba/libhttp-private-samba.so -%{_libdir}/samba/libinterfaces-private-samba.so -%{_libdir}/samba/libiov-buf-private-samba.so %{_libdir}/samba/libkrb5samba-private-samba.so %{_libdir}/samba/libldbsamba-private-samba.so %{_libdir}/samba/liblibcli-lsa3-private-samba.so @@ -2087,32 +2129,32 @@ fi %{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so -%{_libdir}/samba/libsamba-debug-private-samba.so %{_libdir}/samba/libsamba-modules-private-samba.so -%{_libdir}/samba/libsamba-security-private-samba.so %{_libdir}/samba/libsamba-security-trusts-private-samba.so %{_libdir}/samba/libsamba-sockets-private-samba.so -%{_libdir}/samba/libsamba3-util-private-samba.so %{_libdir}/samba/libsamdb-common-private-samba.so %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so -%{_libdir}/samba/libserver-role-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so %{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so %{_libdir}/samba/libsmbldaphelper-private-samba.so -%{_libdir}/samba/libstable-sort-private-samba.so -%{_libdir}/samba/libsys-rw-private-samba.so -%{_libdir}/samba/libsocket-blocking-private-samba.so -%{_libdir}/samba/libtalloc-report-printf-private-samba.so -%{_libdir}/samba/libtalloc-report-private-samba.so -%{_libdir}/samba/libtdb-wrap-private-samba.so -%{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so %{_libdir}/samba/libutil-crypt-private-samba.so -%{_libdir}/samba/libutil-reg-private-samba.so -%{_libdir}/samba/libutil-setid-private-samba.so -%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Command line library +# +%{_libdir}/samba/libcmdline-private-samba.so + +# +# Password database modules (depend on libsamba-passdb) +# +%dir %{_libdir}/samba/ldb +%dir %{_libdir}/samba/pdb +%{_libdir}/samba/pdb/ldapsam.so +%{_libdir}/samba/pdb/smbpasswd.so +%{_libdir}/samba/pdb/tdbsam.so %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* @@ -2165,16 +2207,39 @@ fi ### COMMON-LIBS %files common-libs -# common libraries -%{_libdir}/samba/libcmdline-private-samba.so -%{_libdir}/samba/libreplace-private-samba.so -%dir %{_libdir}/samba/ldb +# +# Tier 0: libc only dependencies +# +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so -%dir %{_libdir}/samba/pdb -%{_libdir}/samba/pdb/ldapsam.so -%{_libdir}/samba/pdb/smbpasswd.so -%{_libdir}/samba/pdb/tdbsam.so +# +# Tier 1: system libs only (libtalloc) +# +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so + +# +# Tier 2: depends on core-libs (debug, replace) +# +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so + +# +# Tier 3: depends on core-libs (util, errors, ndr) +# +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so + +# +# Tier 4: depends on core-libs + Tier 3 libs +# +%{_libdir}/samba/libsamba-security-private-samba.so ### COMMON-TOOLS %files common-tools From fcd8668e55e701de2421c6b27425a4c942673bd7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 11:24:56 +0100 Subject: [PATCH 288/295] Add gating test to detect dependency changes in samba libraries [skip changelog] --- gating.yaml | 6 ++ tests/deps-check.fmf | 13 +++++ tests/deps-check.sh | 133 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 152 insertions(+) create mode 100644 gating.yaml create mode 100644 tests/deps-check.fmf create mode 100755 tests/deps-check.sh diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..c2182c7 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,6 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf new file mode 100644 index 0000000..878b8b2 --- /dev/null +++ b/tests/deps-check.fmf @@ -0,0 +1,13 @@ +summary: Check samba package dependency structure +description: | + Verify that samba library packages maintain correct dependency hierarchy: + - samba-core-libs has no samba-*-libs dependencies + - samba-common-libs depends on samba-core-libs (not samba-client-libs) + - libwbclient has no samba-*-libs dependencies +test: ./deps-check.sh +framework: shell +require: + - samba-core-libs + - samba-common-libs + - samba-client-libs + - libwbclient diff --git a/tests/deps-check.sh b/tests/deps-check.sh new file mode 100755 index 0000000..622e88a --- /dev/null +++ b/tests/deps-check.sh @@ -0,0 +1,133 @@ +#!/bin/bash +# +# Samba package dependency structure verification +# +# This test ensures that the samba library package dependencies don't regress. +# The expected hierarchy is: +# +# samba-core-libs (no samba-*-libs dependencies) +# ^ +# | +# samba-common-libs (depends on samba-core-libs only) +# ^ +# | +# samba-client-libs (depends on samba-core-libs + samba-common-libs) +# +# libwbclient (no samba-*-libs dependencies - only links to libc) +# +# NOTE: This test checks RESOLVED dependencies, not just explicit Requires. +# A library requirement like 'libfoo.so' is resolved to the package that +# provides it, ensuring we catch indirect dependencies. +# + +set -e + +ERRORS=0 + +# Get all packages that a package depends on (resolved) +# This resolves library deps like 'libfoo.so' to actual package names +get_resolved_deps() { + local pkg="$1" + + rpm -qR "$pkg" 2>/dev/null | while read -r req; do + # Skip rpmlib and config requirements + [[ "$req" =~ ^rpmlib ]] && continue + [[ "$req" =~ ^config ]] && continue + [[ "$req" =~ ^/ ]] && continue + + # Get the package that provides this requirement + provider=$(rpm -q --whatprovides "$req" 2>/dev/null | head -1) + if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then + # Extract just the package name (remove version-release.arch) + echo "${provider%%-[0-9]*}" + fi + done | sort -u +} + +# Check that a package does NOT depend on packages matching a pattern +# This checks RESOLVED dependencies (what packages actually get pulled in) +check_no_resolved_dep() { + local pkg="$1" + local pattern="$2" + local description="$3" + + if ! rpm -q "$pkg" &>/dev/null; then + echo "SKIP: $pkg not installed" + return 0 + fi + + local bad_deps + # Exclude the package itself from the check + bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true) + + if [ -n "$bad_deps" ]; then + echo "FAIL: $pkg depends on $description" + echo " Found: $bad_deps" + ERRORS=$((ERRORS + 1)) + return 1 + fi + echo "PASS: $pkg does not depend on $description" + return 0 +} + +# Check that a package DOES depend on a specific package +check_has_resolved_dep() { + local pkg="$1" + local expected="$2" + + if ! rpm -q "$pkg" &>/dev/null; then + echo "SKIP: $pkg not installed" + return 0 + fi + + if get_resolved_deps "$pkg" | grep -qF "$expected"; then + echo "PASS: $pkg depends on $expected" + return 0 + fi + echo "FAIL: $pkg does not depend on $expected" + ERRORS=$((ERRORS + 1)) + return 1 +} + +echo "=== Samba Package Dependency Checks ===" +echo "" +echo "Checking resolved dependencies (library deps resolved to packages)" +echo "" + +# 1. samba-core-libs must NOT depend on any samba-*-libs packages +echo "--- samba-core-libs ---" +check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba-*-libs package" + +echo "" + +# 2. samba-common-libs must depend on samba-core-libs +# but NOT samba-client-libs +echo "--- samba-common-libs ---" +check_has_resolved_dep samba-common-libs "samba-core-libs" +check_no_resolved_dep samba-common-libs "^samba-client-libs$" "samba-client-libs" + +echo "" + +# 3. samba-client-libs must depend on samba-core-libs and samba-common-libs +# but NOT samba-libs +echo "--- samba-client-libs ---" +check_has_resolved_dep samba-client-libs "samba-core-libs" +check_has_resolved_dep samba-client-libs "samba-common-libs" +check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs" + +echo "" + +# 4. libwbclient must NOT depend on any samba-*-libs packages +echo "--- libwbclient ---" +check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" + +echo "" +echo "=== Summary ===" + +if [ $ERRORS -gt 0 ]; then + echo "FAILED: $ERRORS dependency check(s) failed" + exit 1 +fi + +echo "All dependency checks passed" +exit 0 From baa9e6f8c0c9594e05f953d54cf2e8fd720404c6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 12:23:39 +0100 Subject: [PATCH 289/295] Move libraries from samba-client-libs to samba-libs --- samba.spec | 30 +++++++++++++++++------------- tests/deps-check.fmf | 7 +++++++ tests/deps-check.sh | 26 ++++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 13 deletions(-) diff --git a/samba.spec b/samba.spec index c72ba68..ccb55fc 100644 --- a/samba.spec +++ b/samba.spec @@ -2078,11 +2078,9 @@ fi %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* %{_libdir}/samba/libCHARSET3-private-samba.so %{_libdir}/samba/libMESSAGING-SEND-private-samba.so -%{_libdir}/samba/libMESSAGING-private-samba.so %{_libdir}/samba/libaddns-private-samba.so %{_libdir}/samba/libads-private-samba.so %{_libdir}/samba/libasn1util-private-samba.so -%{_libdir}/samba/libauth-private-samba.so %{_libdir}/samba/libauthkrb5-private-samba.so %{_libdir}/samba/libcli-cldap-private-samba.so %{_libdir}/samba/libcli-ldap-common-private-samba.so @@ -2095,13 +2093,10 @@ fi %{_libdir}/samba/libcluster-private-samba.so %{_libdir}/samba/libcmdline-contexts-private-samba.so %{_libdir}/samba/libcommon-auth-private-samba.so -%{_libdir}/samba/libctdb-event-client-private-samba.so %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so %{_libdir}/samba/libdcerpc-samba-private-samba.so %{_libdir}/samba/libevents-private-samba.so %{_libdir}/samba/libgensec-private-samba.so -%{_libdir}/samba/libgpext-private-samba.so -%{_libdir}/samba/libgpo-private-samba.so %{_libdir}/samba/libgse-private-samba.so %{_libdir}/samba/libhttp-private-samba.so %{_libdir}/samba/libkrb5samba-private-samba.so @@ -2116,16 +2111,12 @@ fi %{_libdir}/samba/libmsrpc3-private-samba.so %{_libdir}/samba/libndr-samba-private-samba.so %{_libdir}/samba/libndr-samba4-private-samba.so -%{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so %if 0%{?rhel} %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so %{_libdir}/samba/libngtcp2-private-samba.so %endif %{_libdir}/samba/libnpa-tstream-private-samba.so -%{_libdir}/samba/libposix-eadb-private-samba.so -%{_libdir}/samba/libprinter-driver-private-samba.so -%{_libdir}/samba/libprinting-migrate-private-samba.so %{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so @@ -2136,11 +2127,7 @@ fi %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so -%{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so -%{_libdir}/samba/libsmbldaphelper-private-samba.so -%{_libdir}/samba/libtorture-private-samba.so -%{_libdir}/samba/libutil-crypt-private-samba.so # # Command line library @@ -2597,6 +2584,23 @@ fi %{_libdir}/samba/libRPC-SERVER-LOOP-private-samba.so %{_libdir}/samba/libRPC-WORKER-private-samba.so +# +# Server-side libraries (not used by libsmbclient) +# +%{_libdir}/samba/libauth-private-samba.so +%{_libdir}/samba/libctdb-event-client-private-samba.so +%{_libdir}/samba/libgpext-private-samba.so +%{_libdir}/samba/libgpo-private-samba.so +%{_libdir}/samba/libMESSAGING-private-samba.so +%{_libdir}/samba/libnet-keytab-private-samba.so +%{_libdir}/samba/libposix-eadb-private-samba.so +%{_libdir}/samba/libprinter-driver-private-samba.so +%{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libsmbd-base-private-samba.so +%{_libdir}/samba/libsmbldaphelper-private-samba.so +%{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libutil-crypt-private-samba.so + ### LIBNETAPI %files -n libnetapi %{_libdir}/libnetapi.so.%{libnetapi_so_version}* diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf index 878b8b2..959093e 100644 --- a/tests/deps-check.fmf +++ b/tests/deps-check.fmf @@ -3,11 +3,18 @@ description: | Verify that samba library packages maintain correct dependency hierarchy: - samba-core-libs has no samba-*-libs dependencies - samba-common-libs depends on samba-core-libs (not samba-client-libs) + - samba-client-libs depends on core-libs + common-libs (not samba-libs) - libwbclient has no samba-*-libs dependencies + - samba-client depends on samba-client-libs (not samba-libs) + - libsmbclient depends on samba-client-libs (not samba-libs) + - libldb has no samba-*-libs dependencies test: ./deps-check.sh framework: shell require: - samba-core-libs - samba-common-libs - samba-client-libs + - samba-client - libwbclient + - libsmbclient + - libldb diff --git a/tests/deps-check.sh b/tests/deps-check.sh index 622e88a..017c01d 100755 --- a/tests/deps-check.sh +++ b/tests/deps-check.sh @@ -15,6 +15,9 @@ # # libwbclient (no samba-*-libs dependencies - only links to libc) # +# samba-client (depends on samba-client-libs, NOT samba-libs) +# libsmbclient (depends on samba-client-libs, NOT samba-libs) +# # NOTE: This test checks RESOLVED dependencies, not just explicit Requires. # A library requirement like 'libfoo.so' is resolved to the package that # provides it, ensuring we catch indirect dependencies. @@ -121,6 +124,29 @@ echo "" echo "--- libwbclient ---" check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" +echo "" + +# 5. samba-client must depend on samba-client-libs but NOT samba-libs +# (client tools should not pull in server libraries) +echo "--- samba-client ---" +check_has_resolved_dep samba-client "samba-client-libs" +check_no_resolved_dep samba-client "^samba-libs$" "samba-libs" + +echo "" + +# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs +# (SMB client library should not pull in server libraries) +echo "--- libsmbclient ---" +check_has_resolved_dep libsmbclient "samba-client-libs" +check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs" + +echo "" + +# 7. libldb must NOT depend on any samba-*-libs packages +# (libldb is a standalone database library) +echo "--- libldb ---" +check_no_resolved_dep libldb "^samba-.*-libs$" "any samba-*-libs package" + echo "" echo "=== Summary ===" From dab569ad7194d1c3a2b51e50df08b20fdb00ce60 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 12:46:37 +0100 Subject: [PATCH 290/295] Create a samba-ndr-libs package and drop samba-common-libs This should help sssd to reduce some of its dependencies. --- samba.spec | 216 ++++++++++++++++++++++--------------------- tests/deps-check.fmf | 10 +- tests/deps-check.sh | 40 ++++---- 3 files changed, 141 insertions(+), 125 deletions(-) diff --git a/samba.spec b/samba.spec index ccb55fc..da855ba 100644 --- a/samba.spec +++ b/samba.spec @@ -243,7 +243,7 @@ Patch0: samba-4.23-fix-cmocka.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -465,7 +465,7 @@ Unix. Summary: Samba client programs Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libsmbclient} @@ -496,18 +496,54 @@ Requires: %{name}-common = %{samba_depver} Provides: bundled(libreplace) = %{samba_depver} +%if %{without dc} && %{without testsuite} +Obsoletes: samba-dc < %{samba_depver} +Obsoletes: samba-dc-libs < %{samba_depver} +Obsoletes: samba-dc-bind-dlz < %{samba_depver} +%endif + +# ctdb-tests package has been dropped if we do not build the testsuite +%if %{with clustering} +%if %{without testsuite} +Obsoletes: ctdb-tests < %{samba_depver} +Obsoletes: ctdb-tests-debuginfo < %{samba_depver} +# endif without testsuite +%endif +# endif with clustering +%endif + +# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions +# of the distro +%if %{without vfs_glusterfs} +Obsoletes: samba-vfs-glusterfs < %{samba_depver} +# endif without vfs_glusterfs +%endif + %description core-libs The samba-core-libs package contains foundational libraries needed by both Samba servers and clients. This includes error handling, utilities, -and NDR serialization support. +and basic support libraries. + +### NDR-LIBS +%package ndr-libs +Summary: Samba NDR libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} + +Provides: %{name}-common-libs = %{samba_depver} +Obsoletes: %{name}-common-libs < %{samba_depver} + +%description ndr-libs +The samba-ndr-libs package contains NDR (Network Data Representation) +encoding libraries used by both Samba servers and clients. ### CLIENT-LIBS %package client-libs Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -537,50 +573,10 @@ Obsoletes: samba4-common < %{samba_depver} samba-common provides files necessary for both the server and client packages of Samba. -### COMMON-LIBS -%package common-libs -Summary: Libraries used by both Samba servers and clients -Requires(pre): samba-common = %{samba_depver} -Requires: samba-common = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} -Requires: libldb = %{samba_depver} -%if %{with libwbclient} -Requires: libwbclient = %{samba_depver} -%endif - -Provides: bundled(libreplace) = %{samba_depver} - -%if %{without dc} && %{without testsuite} -Obsoletes: samba-dc < %{samba_depver} -Obsoletes: samba-dc-libs < %{samba_depver} -Obsoletes: samba-dc-bind-dlz < %{samba_depver} -%endif - -# ctdb-tests package has been dropped if we do not build the testsuite -%if %{with clustering} -%if %{without testsuite} -Obsoletes: ctdb-tests < %{samba_depver} -Obsoletes: ctdb-tests-debuginfo < %{samba_depver} -# endif without testsuite -%endif -# endif with clustering -%endif - -# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions -# of the distro -%if %{without vfs_glusterfs} -Obsoletes: samba-vfs-glusterfs < %{samba_depver} -# endif without vfs_glusterfs -%endif - -%description common-libs -The samba-common-libs package contains internal libraries needed by the -SMB/CIFS clients. - ### COMMON-TOOLS %package common-tools Summary: Tools for Samba clients -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} @@ -618,7 +614,7 @@ and for GPO management on domain members. ### RPC %package dcerpc Summary: DCE RPC binaries -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -636,7 +632,7 @@ The samba-dcerpc package contains binaries that serve DCERPC over named pipes. Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -680,7 +676,7 @@ The samba-dc-provision package provides files to setup a domain controller %package dc-libs Summary: Samba AD Domain Controller Libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -718,8 +714,10 @@ name server related details of Samba AD. ### DEVEL %package devel Summary: Developer tools for Samba libraries -Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: libnetapi = %{samba_depver} @@ -774,7 +772,7 @@ Summary: Samba VFS module for GlusterFS Requires: glusterfs-api >= 3.4.0.16 Requires: glusterfs >= 3.4.0.16 Requires: %{name} = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -825,7 +823,7 @@ the Kerberos credentials cache of the user issuing the print job. %package ldb-ldap-modules Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -836,7 +834,7 @@ samba-gpupdate. ### LIBS %package libs Summary: Samba libraries -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -857,7 +855,7 @@ against the SMB, RPC and other protocols provided by the Samba suite. Summary: The NETAPI library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -879,7 +877,7 @@ develop programs that link against the NETAPI library in the Samba suite. Summary: The SMB client library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -929,7 +927,7 @@ library. %package -n python3-%{name} Summary: Samba Python3 libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-cryptography @@ -999,7 +997,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-test-libs = %{samba_depver} @@ -1030,7 +1028,7 @@ packages of Samba. ### TEST-LIBS %package test-libs Summary: Libraries need by the testing tools for Samba servers and clients -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -1063,8 +1061,8 @@ as a user using the `net usershare` command. Summary: Samba winbind Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} -Requires(post): %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires(post): %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires(post): %{name}-client-libs = %{samba_depver} @@ -1097,7 +1095,7 @@ Windows user and group accounts on Linux. %package winbind-clients Summary: Samba winbind clients Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} @@ -1167,7 +1165,7 @@ necessary to communicate to the Winbind Daemon Summary: Samba Winexe Windows Binary License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -1182,7 +1180,7 @@ Winexe is a Remote Windows-command executor %package -n ctdb Summary: A Clustered Database based on Samba's Trivial Database (TDB) -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-winbind-clients = %{samba_depver} @@ -1729,7 +1727,7 @@ fi %ldconfig_scriptlets client-libs -%ldconfig_scriptlets common-libs +%ldconfig_scriptlets ndr-libs %if %{with dc} %ldconfig_scriptlets dc-libs @@ -2057,19 +2055,59 @@ fi %{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* %{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* +### NDR-LIBS +%files ndr-libs + # -# Tier 3: Public libraries - NDR serialization (depends on Tier 1-2) +# Core NDR library # %{_libdir}/libndr.so.%{libndr_so_version}* +# +# Tier 0: libc only dependencies +# +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Tier 1: system libs only (libtalloc) +# +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so + +# +# Tier 2: depends on core-libs (debug, replace) +# +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so + +# +# Tier 3: depends on core-libs (util, errors, ndr) +# +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so + +# +# Tier 4: depends on core-libs + Tier 3 libs +# +%{_libdir}/samba/libsamba-security-private-samba.so + +# +# NDR encoding libraries +# +%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* +%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* +%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* %{_libdir}/libdcerpc-server-core.so.%{libdcerpc_server_core_so_version}* %{_libdir}/libdcerpc.so.%{libdcerpc_so_version}* -%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* -%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* -%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* @@ -2139,7 +2177,6 @@ fi # %dir %{_libdir}/samba/ldb %dir %{_libdir}/samba/pdb -%{_libdir}/samba/pdb/ldapsam.so %{_libdir}/samba/pdb/smbpasswd.so %{_libdir}/samba/pdb/tdbsam.so @@ -2192,42 +2229,6 @@ fi %{_mandir}/man5/smbpasswd.5* %{_mandir}/man7/samba.7* -### COMMON-LIBS -%files common-libs - -# -# Tier 0: libc only dependencies -# -%{_libdir}/samba/libutil-setid-private-samba.so -%{_libdir}/samba/libutil-tdb-private-samba.so - -# -# Tier 1: system libs only (libtalloc) -# -%{_libdir}/samba/libiov-buf-private-samba.so -%{_libdir}/samba/libstable-sort-private-samba.so -%{_libdir}/samba/libtalloc-report-private-samba.so -%{_libdir}/samba/libtalloc-report-printf-private-samba.so - -# -# Tier 2: depends on core-libs (debug, replace) -# -%{_libdir}/samba/libflag-mapping-private-samba.so -%{_libdir}/samba/libinterfaces-private-samba.so -%{_libdir}/samba/libtdb-wrap-private-samba.so - -# -# Tier 3: depends on core-libs (util, errors, ndr) -# -%{_libdir}/samba/libdbwrap-private-samba.so -%{_libdir}/samba/libsamba3-util-private-samba.so -%{_libdir}/samba/libutil-reg-private-samba.so - -# -# Tier 4: depends on core-libs + Tier 3 libs -# -%{_libdir}/samba/libsamba-security-private-samba.so - ### COMMON-TOOLS %files common-tools %{_bindir}/net @@ -2601,6 +2602,11 @@ fi %{_libdir}/samba/libtorture-private-samba.so %{_libdir}/samba/libutil-crypt-private-samba.so +# +# Password database modules (server-side, links to libsmbldaphelper) +# +%{_libdir}/samba/pdb/ldapsam.so + ### LIBNETAPI %files -n libnetapi %{_libdir}/libnetapi.so.%{libnetapi_so_version}* diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf index 959093e..c1452d0 100644 --- a/tests/deps-check.fmf +++ b/tests/deps-check.fmf @@ -2,18 +2,20 @@ summary: Check samba package dependency structure description: | Verify that samba library packages maintain correct dependency hierarchy: - samba-core-libs has no samba-*-libs dependencies - - samba-common-libs depends on samba-core-libs (not samba-client-libs) - - samba-client-libs depends on core-libs + common-libs (not samba-libs) - - libwbclient has no samba-*-libs dependencies + - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs) + - samba-client-libs depends on core-libs + ndr-libs (not samba-libs) - samba-client depends on samba-client-libs (not samba-libs) + - samba-libs does not depend on samba-dc-libs - libsmbclient depends on samba-client-libs (not samba-libs) + - libwbclient has no samba-*-libs dependencies - libldb has no samba-*-libs dependencies test: ./deps-check.sh framework: shell require: - samba-core-libs - - samba-common-libs + - samba-ndr-libs - samba-client-libs + - samba-libs - samba-client - libwbclient - libsmbclient diff --git a/tests/deps-check.sh b/tests/deps-check.sh index 017c01d..ce49074 100755 --- a/tests/deps-check.sh +++ b/tests/deps-check.sh @@ -8,10 +8,10 @@ # samba-core-libs (no samba-*-libs dependencies) # ^ # | -# samba-common-libs (depends on samba-core-libs only) +# samba-ndr-libs (depends on samba-core-libs only) # ^ # | -# samba-client-libs (depends on samba-core-libs + samba-common-libs) +# samba-client-libs (depends on samba-core-libs + samba-ndr-libs) # # libwbclient (no samba-*-libs dependencies - only links to libc) # @@ -32,14 +32,14 @@ ERRORS=0 get_resolved_deps() { local pkg="$1" - rpm -qR "$pkg" 2>/dev/null | while read -r req; do + rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do # Skip rpmlib and config requirements [[ "$req" =~ ^rpmlib ]] && continue [[ "$req" =~ ^config ]] && continue [[ "$req" =~ ^/ ]] && continue # Get the package that provides this requirement - provider=$(rpm -q --whatprovides "$req" 2>/dev/null | head -1) + provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1) if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then # Extract just the package name (remove version-release.arch) echo "${provider%%-[0-9]*}" @@ -54,7 +54,7 @@ check_no_resolved_dep() { local pattern="$2" local description="$3" - if ! rpm -q "$pkg" &>/dev/null; then + if ! rpm --query "$pkg" &>/dev/null; then echo "SKIP: $pkg not installed" return 0 fi @@ -78,7 +78,7 @@ check_has_resolved_dep() { local pkg="$1" local expected="$2" - if ! rpm -q "$pkg" &>/dev/null; then + if ! rpm --query "$pkg" &>/dev/null; then echo "SKIP: $pkg not installed" return 0 fi @@ -99,30 +99,31 @@ echo "" # 1. samba-core-libs must NOT depend on any samba-*-libs packages echo "--- samba-core-libs ---" -check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package" echo "" -# 2. samba-common-libs must depend on samba-core-libs -# but NOT samba-client-libs -echo "--- samba-common-libs ---" -check_has_resolved_dep samba-common-libs "samba-core-libs" -check_no_resolved_dep samba-common-libs "^samba-client-libs$" "samba-client-libs" +# 2. samba-ndr-libs must depend on samba-core-libs +# but NOT samba-client-libs or samba-libs +echo "--- samba-ndr-libs ---" +check_has_resolved_dep samba-ndr-libs "samba-core-libs" +check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs" +check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs" echo "" -# 3. samba-client-libs must depend on samba-core-libs and samba-common-libs +# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs # but NOT samba-libs echo "--- samba-client-libs ---" check_has_resolved_dep samba-client-libs "samba-core-libs" -check_has_resolved_dep samba-client-libs "samba-common-libs" +check_has_resolved_dep samba-client-libs "samba-ndr-libs" check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs" echo "" # 4. libwbclient must NOT depend on any samba-*-libs packages echo "--- libwbclient ---" -check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package" echo "" @@ -145,7 +146,14 @@ echo "" # 7. libldb must NOT depend on any samba-*-libs packages # (libldb is a standalone database library) echo "--- libldb ---" -check_no_resolved_dep libldb "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package" + +echo "" + +# 8. samba-libs must NOT depend on samba-dc-libs +# (server libraries should not pull in DC-specific libraries) +echo "--- samba-libs ---" +check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs" echo "" echo "=== Summary ===" From da7dc3fa610fd20c6e5a2776fc3bec213c1163b6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 14:28:18 +0100 Subject: [PATCH 291/295] Add missing tmt files [skip changelog] --- .fmf/version | 1 + plans.fmf | 4 ++++ 2 files changed, 5 insertions(+) create mode 100644 .fmf/version create mode 100644 plans.fmf diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..e6427de --- /dev/null +++ b/plans.fmf @@ -0,0 +1,4 @@ +discover: + how: fmf +execute: + how: tmt From 6af45b81d32d8b941a8bfcadc8cf302ad2bbdd0b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:11:15 +0100 Subject: [PATCH 292/295] Add /usr/bin/nmbd to rpminspect.yml /usr/sbin/nmbd is a symlink to /usr/bin/nmbd on Fedora. [skip changelog] --- rpminspect.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index c1455e2..b30fdbe 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -4,6 +4,7 @@ inspections: badfuncs: ignore: + - /usr/bin/nmbd - /usr/bin/nmblookup - /usr/bin/smbtorture - /usr/lib*/libndr.so.* From dca7b1cb88abf129b7f421b1b867d5eb068de56e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:35:54 +0100 Subject: [PATCH 293/295] Move Obsoletes to ndr-package which more or less was common-libs [skip changelog] --- samba.spec | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/samba.spec b/samba.spec index da855ba..cdeefca 100644 --- a/samba.spec +++ b/samba.spec @@ -496,6 +496,21 @@ Requires: %{name}-common = %{samba_depver} Provides: bundled(libreplace) = %{samba_depver} +%description core-libs +The samba-core-libs package contains foundational libraries needed by +both Samba servers and clients. This includes error handling, utilities, +and basic support libraries. + +### NDR-LIBS +%package ndr-libs +Summary: Samba NDR libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} + +Provides: %{name}-common-libs = %{samba_depver} +Obsoletes: %{name}-common-libs < %{samba_depver} + %if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} Obsoletes: samba-dc-libs < %{samba_depver} @@ -519,21 +534,6 @@ Obsoletes: samba-vfs-glusterfs < %{samba_depver} # endif without vfs_glusterfs %endif -%description core-libs -The samba-core-libs package contains foundational libraries needed by -both Samba servers and clients. This includes error handling, utilities, -and basic support libraries. - -### NDR-LIBS -%package ndr-libs -Summary: Samba NDR libraries -Requires(pre): %{name}-common = %{samba_depver} -Requires: %{name}-common = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} - -Provides: %{name}-common-libs = %{samba_depver} -Obsoletes: %{name}-common-libs < %{samba_depver} - %description ndr-libs The samba-ndr-libs package contains NDR (Network Data Representation) encoding libraries used by both Samba servers and clients. From 1f4ee5276f515f685bd1ba2f03eaed47402514ac Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:10:15 +0100 Subject: [PATCH 294/295] Remove duplicate libdsdb-module-private-samba.so --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index cdeefca..b49a21a 100644 --- a/samba.spec +++ b/samba.spec @@ -3904,7 +3904,6 @@ fi %if %{with dc} %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so %endif -%{_libdir}/samba/libdsdb-module-private-samba.so ### USERSHARES %files usershares From 58df5ed52bbd18e89ba9316f9f8a69ab4800910b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 15 Jan 2026 17:21:14 +0100 Subject: [PATCH 295/295] rpminspect: Don't run annocheck on test binaries [skip changelog] --- rpminspect.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index b30fdbe..f736bfa 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -26,3 +26,10 @@ abidiff: debuginfo: ignore: - /usr/lib*/libdcerpc-samr.so.* + +annocheck: + ignore: + - /usr/bin/gentest + - /usr/bin/locktest + - /usr/bin/masktest + - /usr/bin/smbtorture