From d04728829da7462c35ceaf0fdbc43107ad9fd72c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Jul 2024 18:15:46 +0200 Subject: [PATCH 001/101] Update to Samba 4.21.0rc2 - Package libldb a public library - resolves: #2300469 Pair-Programmed-With: Andreas Schneider --- samba.spec | 384 +++++++++++++++------ sources | 4 +- sync_machine_password_script_install.patch | 91 +++++ 3 files changed, 376 insertions(+), 103 deletions(-) create mode 100644 sync_machine_password_script_install.patch diff --git a/samba.spec b/samba.spec index dcc42c3..22d0376 100644 --- a/samba.spec +++ b/samba.spec @@ -8,7 +8,7 @@ # %bcond_with testsuite -# Build with internal talloc, tevent, tdb and ldb. +# Build with internal talloc, tevent, tdb # # fedpkg mockbuild --with=testsuite --with=includelibs # or @@ -144,9 +144,15 @@ %bcond_with gpupdate %endif +%ifarch aarch64 ppc64le s390x x86_64 +%bcond lmdb 1 +%else +%bcond lmdb 0 +%endif + %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.20.4 +%global samba_version 4.21.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -161,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -174,13 +180,14 @@ %global libdcerpc_so_version 0 %global libndr_krb5pac_so_version 0 %global libndr_nbt_so_version 0 -%global libndr_so_version 4 +%global libndr_so_version 5 %global libndr_standard_so_version 0 %global libnetapi_so_version 1 %global libsamba_credentials_so_version 1 %global libsamba_errors_so_version 1 %global libsamba_hostconfig_so_version 0 %global libsamba_passdb_so_version 0 +%global libsamba_policy_so_version 0 %global libsamba_util_so_version 0 %global libsamdb_so_version 0 %global libsmbconf_so_version 0 @@ -191,9 +198,8 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.2 -%global tdb_version 1.4.10 +%global tdb_version 1.4.11 %global tevent_version 0.16.1 -%global ldb_version 2.9.1 %global required_mit_krb5 1.20.1 @@ -248,6 +254,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: sync_machine_password_script_install.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -291,6 +299,7 @@ BuildRequires: bison BuildRequires: cups-devel BuildRequires: dbus-devel BuildRequires: docbook-style-xsl +BuildRequires: doxygen BuildRequires: e2fsprogs-devel BuildRequires: flex BuildRequires: gawk @@ -309,7 +318,10 @@ BuildRequires: libcmocka-devel BuildRequires: libtirpc-devel BuildRequires: libuuid-devel BuildRequires: libxslt +%if %{with lmdb} BuildRequires: lmdb +BuildRequires: lmdb-devel >= 0.9.16 +%endif %if %{with winexe} BuildRequires: mingw32-gcc BuildRequires: mingw64-gcc @@ -389,17 +401,6 @@ BuildRequires: python3-tevent >= %{tevent_version} BuildRequires: libtdb-devel >= %{tdb_version} BuildRequires: python3-tdb >= %{tdb_version} - -BuildRequires: libldb-devel >= %{ldb_version} -BuildRequires: python3-ldb >= %{ldb_version} -BuildRequires: python3-ldb-devel >= %{ldb_version} -%endif - -%if %{with includelibs} || %{with testsuite} -# lmdb-devel is required for the mdb ldb module, if samba is configured -# to build includelibs we need lmdb-devel for building that module on our own -BuildRequires: lmdb-devel -#endif without includelibs %endif %if %{with dc} || %{with testsuite} @@ -417,7 +418,6 @@ BuildRequires: python3-setproctitle %if %{without includelibs} BuildRequires: tdb-tools -BuildRequires: ldb-tools #endif without includelibs %endif @@ -559,7 +559,9 @@ Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} %if %{with dc} # samba-tool needs mdb_copy and tdbackup for domain backup or upgrade provision +%if %{with lmdb} Requires: lmdb +%endif Requires: tdb-tools Requires: python3-gpg %endif @@ -603,11 +605,7 @@ Requires: libwbclient = %{samba_depver} Requires: ldb-tools Requires: python3-setproctitle -# Force using libldb version to be the same as build version -# Otherwise LDB modules will not be loaded and samba-tool will fail -# See bug 1507420 -%samba_requires_eq libldb - +Requires: libldb = %{samba_depver} Requires: python3-%{name} = %{samba_depver} Requires: python3-%{name}-dc = %{samba_depver} Requires: krb5-server >= %{required_mit_krb5} @@ -896,13 +894,6 @@ Provides: bundled(libreplace) The python3-%{name} package contains the Python 3 libraries needed by programs that use SMB, RPC and other Samba provided protocols in Python 3 programs. -%package -n python3-%{name}-devel -Summary: Samba python devel files -Requires: python3-%{name} = %{samba_depver} - -%description -n python3-%{name}-devel -The python3-%{name}-devel package contains the Python 3 devel files. - %package -n python3-samba-test Summary: Samba Python libraries Requires: python3-%{name} = %{samba_depver} @@ -1221,7 +1212,79 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB #endif with clustering %endif +### LIBLDB +%package -n libldb +Summary: A schema-less, ldap like, API and database +License: LGPL-3.0-or-later +Requires: libtalloc%{?_isa} >= %{talloc_version} +Requires: libtdb%{?_isa} >= %{tdb_version} +Requires: libtevent%{?_isa} >= %{tevent_version} +Provides: bundled(libreplace) +Obsoletes: libldb < 2.10 +Provides: libldb = %{samba_depver} + +%description -n libldb +An extensible library that implements an LDAP like API to access remote LDAP +servers, or use local tdb databases. + +### LIBLDB-DEVEL +%package -n libldb-devel +Summary: Developer tools for the LDB library +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libtdb-devel%{?_isa} >= %{tdb_version} +Requires: libtalloc-devel%{?_isa} >= %{talloc_version} +Requires: libtevent-devel%{?_isa} >= %{tevent_version} + +Obsoletes: libldb-devel < 2.10 +Provides: libldb-devel = %{samba_depver} + +%description -n libldb-devel +Header files needed to develop programs that link against the LDB library. + +### LDB-TOOLS +%package -n ldb-tools +Summary: Tools to manage LDB files +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{samba_release} +Obsoletes: ldb-tools < 2.10 +Provides: ldb-tools = %{samba_depver} + +%description -n ldb-tools +Tools to manage LDB files + +### PYTHON3-LDB-DEVEL-COMMON +%package -n python-ldb-devel-common +Summary: Common development files for the Python bindings for the LDB library +License: LGPL-3.0-or-later + +Provides: pyldb-devel%{?_isa} = %{version}-%{release} +%{?python_provide:%python_provide python2-ldb-devel} + +Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = %{samba_depver} + +%description -n python-ldb-devel-common +Development files for the Python bindings for the LDB library. +This package includes files that aren't specific to a Python version. + +### PYTHON3-LDB +%package -n python3-ldb +Summary: Python bindings for the LDB library +License: LGPL-3.0-or-later +Requires: libldb%{?_isa} = %{version}-%{release} +Requires: python3-tdb%{?_isa} >= %{tdb_version} +%{?python_provide:%python_provide python3-ldb} + +Obsoletes: python3-ldb < 2.10 +Provides: python3-ldb = %{samba_depver} +# These were the C bindings, only used by Samba +Obsoletes: python3-ldb-devel < 2.10 +Provides: python3-ldb-devel = %{samba_depver} + +%description -n python3-ldb +Python bindings for the LDB library %prep %if 0%{?fedora} || 0%{?rhel} >= 9 @@ -1239,16 +1302,14 @@ rm -rfv third_party/heimdal %global _talloc_lib ,talloc,pytalloc,pytalloc-util %global _tevent_lib ,tevent,pytevent %global _tdb_lib ,tdb,pytdb -%global _ldb_lib ,ldb,pyldb,pyldb-util %else %global _talloc_lib ,!talloc,!pytalloc,!pytalloc-util %global _tevent_lib ,!tevent,!pytevent %global _tdb_lib ,!tdb,!pytdb -%global _ldb_lib ,!ldb,!pyldb,!pyldb-util #endif with includelibs %endif -%global _samba_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib}%{_ldb_lib} +%global _samba_bundled_libraries !popt%{_talloc_lib}%{_tevent_lib}%{_tdb_lib} %global _samba_idmap_modules idmap_ad,idmap_rid,idmap_ldap,idmap_hash,idmap_tdb2 %global _samba_pdb_modules pdb_tdbsam,pdb_ldap,pdb_smbpasswd,pdb_wbc_sam,pdb_samba4 @@ -1274,7 +1335,8 @@ rm -rfv third_party/heimdal %global _libwbclient wbclient, %endif -%global _samba_private_libraries %{_libsmbclient}%{_libwbclient} +%global _default_private_libraries !ldb,!dcerpc-samr,!samba-policy,!tevent-util,!dcerpc,!samba-hostconfig,!samba-credentials,!dcerpc_server,!samdb, +%global _samba_private_libraries %{_default_private_libraries}%{_libsmbclient}%{_libwbclient} # TODO: resolve underlinked python modules export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" @@ -1311,14 +1373,12 @@ fi --with-cachedir=/var/lib/samba \ --disable-rpath-install \ --with-shared-modules=%{_samba_modules} \ - --bundled-libraries=%{_samba_libraries} \ + --bundled-libraries=%{_samba_bundled_libraries} \ + --private-libraries=%{_samba_private_libraries} \ --with-pam \ --with-pie \ --with-relro \ --without-fam \ -%if (%{without libsmbclient}) || (%{without libwbclient}) - --private-libraries=%{_samba_private_libraries} \ -%endif --with-system-mitkrb5 \ --with-experimental-mit-ad-dc \ %if %{without dc} && %{without testsuite} @@ -1364,6 +1424,10 @@ pushd pidl %make_build popd +pushd lib/ldb +doxygen Doxyfile +popd + %install # Do not use %%make_install, make is just a wrapper around waf in Samba! %{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot} @@ -1472,8 +1536,8 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* /sbin/ldconfig -N -n %{buildroot}%{_libdir} %if %{without dc} && %{without testsuite} -for f in samba/libsamba-net-samba4.so \ - samba/libsamba-python-samba4.so \ +for f in samba/libsamba-net-private-samba.so \ + samba/libsamba-python-private-samba.so \ libsamba-policy.so* \ pkgconfig/samba-policy.pc ; do rm -f %{buildroot}%{_libdir}/$f @@ -1496,6 +1560,10 @@ rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist rm -rf %{buildroot}%{perl_vendorlib}/Parse/Yapp popd +# libldb manpages +cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} +rm -f %{buildroot}%{_mandir}/man3/_* + %if %{with testsuite} %check # @@ -1654,6 +1722,8 @@ fi %systemd_postun_with_restart ctdb.service %endif +%ldconfig_scriptlets -n libldb +%ldconfig_scriptlets -n python3-ldb ### SAMBA %files @@ -1954,7 +2024,6 @@ fi %{_libdir}/samba/libtdb-wrap-private-samba.so %{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so -%{_libdir}/samba/libtrusts-util-private-samba.so %{_libdir}/samba/libutil-reg-private-samba.so %{_libdir}/samba/libutil-setid-private-samba.so %{_libdir}/samba/libutil-tdb-private-samba.so @@ -1976,16 +2045,6 @@ fi %{_libdir}/samba/libtdb-private-samba.so %{_libdir}/samba/libtevent-private-samba.so -%{_libdir}/samba/ldb/asq.so -%{_libdir}/samba/ldb/ldb.so -%{_libdir}/samba/ldb/mdb.so -%{_libdir}/samba/ldb/paged_searches.so -%{_libdir}/samba/ldb/rdn_name.so -%{_libdir}/samba/ldb/sample.so -%{_libdir}/samba/ldb/server_sort.so -%{_libdir}/samba/ldb/skel.so -%{_libdir}/samba/ldb/tdb.so - %{_mandir}/man3/ldb.3.gz %{_mandir}/man3/talloc.3.gz #endif with includelibs @@ -2150,6 +2209,8 @@ fi %endif ### DC-LIBS %files dc-libs +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* +%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libauth4-private-samba.so %if %{with dc} || %{with testsuite} @@ -2299,6 +2360,7 @@ fi %{_libdir}/libsamba-credentials.so %{_libdir}/libsamba-errors.so %{_libdir}/libsamba-hostconfig.so +%{_libdir}/libsamba-policy.so %{_libdir}/libsamba-util.so %{_libdir}/libsamdb.so %{_libdir}/libsmbconf.so @@ -2311,6 +2373,7 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc +%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so @@ -2336,8 +2399,10 @@ fi %if %{with vfs_cephfs} %files vfs-cephfs %{_libdir}/samba/vfs/ceph.so +%{_libdir}/samba/vfs/ceph_new.so %{_libdir}/samba/vfs/ceph_snapshots.so %{_mandir}/man8/vfs_ceph.8* +%{_mandir}/man8/vfs_ceph_new.8* %{_mandir}/man8/vfs_ceph_snapshots.8* %endif @@ -2372,6 +2437,7 @@ fi %files ldb-ldap-modules %{_libdir}/samba/ldb/ldbsamba_extensions.so %{_libdir}/samba/ldb/ildap.so +%{_libdir}/samba/ldb/ldap.so ### LIBS %files libs @@ -2491,6 +2557,7 @@ fi %{python3_sitearch}/samba/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/__pycache__/idmap.*.pyc %{python3_sitearch}/samba/__pycache__/join.*.pyc +%{python3_sitearch}/samba/__pycache__/lsa_utils.*.pyc %{python3_sitearch}/samba/__pycache__/logger.*.pyc %{python3_sitearch}/samba/__pycache__/mdb_util.*.pyc %{python3_sitearch}/samba/__pycache__/ms_display_specifiers.*.pyc @@ -2504,7 +2571,6 @@ fi %{python3_sitearch}/samba/__pycache__/sites.*.pyc %{python3_sitearch}/samba/__pycache__/subnets.*.pyc %{python3_sitearch}/samba/__pycache__/tdb_util.*.pyc -%{python3_sitearch}/samba/__pycache__/trust_utils.*.pyc %{python3_sitearch}/samba/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/__pycache__/upgradehelpers.*.pyc %{python3_sitearch}/samba/__pycache__/xattr.*.pyc @@ -2570,6 +2636,53 @@ fi %{python3_sitearch}/samba/dcerpc/xattr.*.so %{python3_sitearch}/samba/descriptor.py %{python3_sitearch}/samba/dnsresolver.py +%dir %{python3_sitearch}/samba/domain +%{python3_sitearch}/samba/domain/__init__.py +%{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/domain/models/__init__.py +%{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/claim_type.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/computer.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/constants.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/container.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/exceptions.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/fields.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/group.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/model.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/org.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/person.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/query.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/registry.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/site.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/subnet.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/types.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/user.*.pyc +%{python3_sitearch}/samba/domain/models/__pycache__/value_type.*.pyc +%{python3_sitearch}/samba/domain/models/auth_policy.py +%{python3_sitearch}/samba/domain/models/auth_silo.py +%{python3_sitearch}/samba/domain/models/claim_type.py +%{python3_sitearch}/samba/domain/models/computer.py +%{python3_sitearch}/samba/domain/models/constants.py +%{python3_sitearch}/samba/domain/models/container.py +%{python3_sitearch}/samba/domain/models/exceptions.py +%{python3_sitearch}/samba/domain/models/fields.py +%{python3_sitearch}/samba/domain/models/gmsa.py +%{python3_sitearch}/samba/domain/models/group.py +%{python3_sitearch}/samba/domain/models/model.py +%{python3_sitearch}/samba/domain/models/org.py +%{python3_sitearch}/samba/domain/models/person.py +%{python3_sitearch}/samba/domain/models/query.py +%{python3_sitearch}/samba/domain/models/registry.py +%{python3_sitearch}/samba/domain/models/schema.py +%{python3_sitearch}/samba/domain/models/site.py +%{python3_sitearch}/samba/domain/models/subnet.py +%{python3_sitearch}/samba/domain/models/types.py +%{python3_sitearch}/samba/domain/models/user.py +%{python3_sitearch}/samba/domain/models/value_type.py %{python3_sitearch}/samba/drs_utils.py %{python3_sitearch}/samba/dsdb.*.so %{python3_sitearch}/samba/dsdb_dns.*.so @@ -2581,6 +2694,7 @@ fi %{python3_sitearch}/samba/hostconfig.py %{python3_sitearch}/samba/idmap.py %{python3_sitearch}/samba/join.py +%{python3_sitearch}/samba/lsa_utils.py %{python3_sitearch}/samba/messaging.*.so %{python3_sitearch}/samba/ndr.py %{python3_sitearch}/samba/net.*.so @@ -2733,12 +2847,30 @@ fi %{python3_sitearch}/samba/netcmd/domain/auth/__init__.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/policy.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/silo_member.*.pyc -%{python3_sitearch}/samba/netcmd/domain/auth/policy.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo_member.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/policy +%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/silo +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py +%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py +%dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py %{python3_sitearch}/samba/netcmd/domain/backup.py %dir %{python3_sitearch}/samba/netcmd/domain/claim %{python3_sitearch}/samba/netcmd/domain/claim/__init__.py @@ -2755,39 +2887,15 @@ fi %{python3_sitearch}/samba/netcmd/domain/functional_prep.py %{python3_sitearch}/samba/netcmd/domain/info.py %{python3_sitearch}/samba/netcmd/domain/join.py +%dir %{python3_sitearch}/samba/netcmd/domain/kds +%{python3_sitearch}/samba/netcmd/domain/kds/__init__.py +%dir %{python3_sitearch}/samba/netcmd/domain/kds/__pycache__ +%{python3_sitearch}/samba/netcmd/domain/kds/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/kds/__pycache__/root_key.*.pyc +%{python3_sitearch}/samba/netcmd/domain/kds/root_key.py %{python3_sitearch}/samba/netcmd/domain/keytab.py %{python3_sitearch}/samba/netcmd/domain/leave.py %{python3_sitearch}/samba/netcmd/domain/level.py -%dir %{python3_sitearch}/samba/netcmd/domain/models -%{python3_sitearch}/samba/netcmd/domain/models/__init__.py -%dir %{python3_sitearch}/samba/netcmd/domain/models/__pycache__ -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/__init__.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_policy.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/auth_silo.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/claim_type.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/exceptions.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/fields.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/group.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/model.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/query.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/schema.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/site.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/subnet.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/user.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/__pycache__/value_type.*.pyc -%{python3_sitearch}/samba/netcmd/domain/models/auth_policy.py -%{python3_sitearch}/samba/netcmd/domain/models/auth_silo.py -%{python3_sitearch}/samba/netcmd/domain/models/claim_type.py -%{python3_sitearch}/samba/netcmd/domain/models/exceptions.py -%{python3_sitearch}/samba/netcmd/domain/models/fields.py -%{python3_sitearch}/samba/netcmd/domain/models/group.py -%{python3_sitearch}/samba/netcmd/domain/models/model.py -%{python3_sitearch}/samba/netcmd/domain/models/query.py -%{python3_sitearch}/samba/netcmd/domain/models/schema.py -%{python3_sitearch}/samba/netcmd/domain/models/site.py -%{python3_sitearch}/samba/netcmd/domain/models/subnet.py -%{python3_sitearch}/samba/netcmd/domain/models/user.py -%{python3_sitearch}/samba/netcmd/domain/models/value_type.py %{python3_sitearch}/samba/netcmd/domain/passwordsettings.py %{python3_sitearch}/samba/netcmd/domain/provision.py %{python3_sitearch}/samba/netcmd/domain/samba3upgrade.py @@ -2812,6 +2920,13 @@ fi %{python3_sitearch}/samba/netcmd/pso.py %{python3_sitearch}/samba/netcmd/rodc.py %{python3_sitearch}/samba/netcmd/schema.py +%dir %{python3_sitearch}/samba/netcmd/service_account +%{python3_sitearch}/samba/netcmd/service_account/__init__.py +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc +%{python3_sitearch}/samba/netcmd/service_account/group_msa_membership.py +%{python3_sitearch}/samba/netcmd/service_account/service_account.py %{python3_sitearch}/samba/netcmd/shell.py %{python3_sitearch}/samba/netcmd/sites.py %{python3_sitearch}/samba/netcmd/spn.py @@ -2908,20 +3023,17 @@ fi %{python3_sitearch}/samba/subunit/__pycache__/run.*.pyc %{python3_sitearch}/samba/subunit/run.py %{python3_sitearch}/samba/tdb_util.py -%{python3_sitearch}/samba/trust_utils.py %{python3_sitearch}/samba/upgrade.py %{python3_sitearch}/samba/upgradehelpers.py %{python3_sitearch}/samba/werror.*.so %{python3_sitearch}/samba/xattr.py %{python3_sitearch}/samba/xattr_native.*.so %{python3_sitearch}/samba/xattr_tdb.*.so -%{_libdir}/libsamba-policy.cpython*.so.* -%{_libdir}/samba/libsamba-net.cpython*.so +%{_libdir}/samba/libsamba-net-join.cpython*.so %{_libdir}/samba/libsamba-python.cpython*.so %if %{with includelibs} %{_libdir}/samba/libpyldb-util.cpython*.so -%{_libdir}/samba/libpytalloc-util.cpython*.so %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -2930,16 +3042,13 @@ fi %{python3_sitearch}/_tdb_text.py %{python3_sitearch}/_tevent.cpython*.so %{python3_sitearch}/ldb.cpython*.so -%{python3_sitearch}/talloc.cpython*.so +#FIXME why is it missing? +#%{python3_sitearch}/talloc.cpython*.so %{python3_sitearch}/tdb.cpython*.so %{python3_sitearch}/tevent.py #endif with includelibs %endif -%files -n python3-%{name}-devel -%{_libdir}/libsamba-policy.*.so -%{_libdir}/pkgconfig/samba-policy.*.pc - %files -n python3-%{name}-dc %{python3_sitearch}/samba/samdb.py %{python3_sitearch}/samba/schema.py @@ -3038,6 +3147,8 @@ fi %{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_dns.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_env_tests.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/dsdb_quiet_provision_tests.*.pyc %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc %{python3_sitearch}/samba/tests/__pycache__/docs.*.pyc %{python3_sitearch}/samba/tests/__pycache__/domain_backup.*.pyc @@ -3156,6 +3267,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/__pycache__/check_output.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/claims.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/downgradedatabase.*.pyc +%{python3_sitearch}/samba/tests/blackbox/__pycache__/gmsa.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_chunk.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/http_content.*.pyc %{python3_sitearch}/samba/tests/blackbox/__pycache__/mdsearch.*.pyc @@ -3179,6 +3291,7 @@ fi %{python3_sitearch}/samba/tests/blackbox/check_output.py %{python3_sitearch}/samba/tests/blackbox/claims.py %{python3_sitearch}/samba/tests/blackbox/downgradedatabase.py +%{python3_sitearch}/samba/tests/blackbox/gmsa.py %{python3_sitearch}/samba/tests/blackbox/http_chunk.py %{python3_sitearch}/samba/tests/blackbox/http_content.py %{python3_sitearch}/samba/tests/blackbox/mdsearch.py @@ -3213,11 +3326,11 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc -%{python3_sitearch}/samba/tests/dcerpc/__pycache__/createtrustrelax.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa_utils.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc @@ -3234,10 +3347,10 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py -%{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/lsa.py +%{python3_sitearch}/samba/tests/dcerpc/lsa_utils.py %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py %{python3_sitearch}/samba/tests/dcerpc/misc.py %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py @@ -3268,6 +3381,8 @@ fi %{python3_sitearch}/samba/tests/dsdb_dns.py %{python3_sitearch}/samba/tests/dsdb_lock.py %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py +%{python3_sitearch}/samba/tests/dsdb_quiet_env_tests.py +%{python3_sitearch}/samba/tests/dsdb_quiet_provision_tests.py %{python3_sitearch}/samba/tests/docs.py %{python3_sitearch}/samba/tests/domain_backup.py %{python3_sitearch}/samba/tests/domain_backup_offline.py @@ -3318,6 +3433,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/etype_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/gkdi_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/gmsa_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/group_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc @@ -3359,6 +3475,7 @@ fi %{python3_sitearch}/samba/tests/krb5/etype_tests.py %{python3_sitearch}/samba/tests/krb5/fast_tests.py %{python3_sitearch}/samba/tests/krb5/gkdi_tests.py +%{python3_sitearch}/samba/tests/krb5/gmsa_tests.py %{python3_sitearch}/samba/tests/krb5/group_tests.py %{python3_sitearch}/samba/tests/krb5/kcrypto.py %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py @@ -3462,6 +3579,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_policy.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_auth_silo.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_claim.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_kds_root_key.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/domain_models.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/drs_clone_dc_data_lmdb_size.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/dsacl.*.pyc @@ -3484,6 +3602,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/__pycache__/provision_userPassword_crypt.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/rodc.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/schema.*.pyc +%{python3_sitearch}/samba/tests/samba_tool/__pycache__/service_account.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/silo_base.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/sites.*.pyc %{python3_sitearch}/samba/tests/samba_tool/__pycache__/timecmd.*.pyc @@ -3508,6 +3627,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/domain_auth_policy.py %{python3_sitearch}/samba/tests/samba_tool/domain_auth_silo.py %{python3_sitearch}/samba/tests/samba_tool/domain_claim.py +%{python3_sitearch}/samba/tests/samba_tool/domain_kds_root_key.py %{python3_sitearch}/samba/tests/samba_tool/domain_models.py %{python3_sitearch}/samba/tests/samba_tool/drs_clone_dc_data_lmdb_size.py %{python3_sitearch}/samba/tests/samba_tool/dsacl.py @@ -3530,6 +3650,7 @@ fi %{python3_sitearch}/samba/tests/samba_tool/provision_userPassword_crypt.py %{python3_sitearch}/samba/tests/samba_tool/rodc.py %{python3_sitearch}/samba/tests/samba_tool/schema.py +%{python3_sitearch}/samba/tests/samba_tool/service_account.py %{python3_sitearch}/samba/tests/samba_tool/silo_base.py %{python3_sitearch}/samba/tests/samba_tool/sites.py %{python3_sitearch}/samba/tests/samba_tool/timecmd.py @@ -3667,7 +3788,6 @@ fi %{_sysconfdir}/ctdb/functions %{_sysconfdir}/ctdb/nfs-linux-kernel-callout %{_sysconfdir}/ctdb/statd-callout -%config %{_sysconfdir}/sudoers.d/ctdb # CTDB scripts, no config files # script with executable bit means activated @@ -3707,6 +3827,8 @@ fi %{_libexecdir}/ctdb/ctdb_recovery_helper %{_libexecdir}/ctdb/ctdb_takeover_helper %{_libexecdir}/ctdb/smnotify +%{_libexecdir}/ctdb/statd_callout +%{_libexecdir}/ctdb/statd_callout_helper %{_libexecdir}/ctdb/tdb_mutex_check %dir %{_localstatedir}/lib/ctdb/ @@ -3737,7 +3859,6 @@ fi %{_datadir}/ctdb/events/legacy/00.ctdb.script %{_datadir}/ctdb/events/legacy/01.reclock.script %{_datadir}/ctdb/events/legacy/05.system.script -%{_datadir}/ctdb/events/legacy/06.nfs.script %{_datadir}/ctdb/events/legacy/10.interface.script %{_datadir}/ctdb/events/legacy/11.natgw.script %{_datadir}/ctdb/events/legacy/11.routing.script @@ -3746,6 +3867,7 @@ fi %{_datadir}/ctdb/events/legacy/31.clamd.script %{_datadir}/ctdb/events/legacy/40.vsftpd.script %{_datadir}/ctdb/events/legacy/41.httpd.script +%{_datadir}/ctdb/events/legacy/46.update-keytabs.script %{_datadir}/ctdb/events/legacy/47.samba-dcerpcd.script %{_datadir}/ctdb/events/legacy/48.netbios.script %{_datadir}/ctdb/events/legacy/49.winbind.script @@ -3753,6 +3875,8 @@ fi %{_datadir}/ctdb/events/legacy/60.nfs.script %{_datadir}/ctdb/events/legacy/70.iscsi.script %{_datadir}/ctdb/events/legacy/91.lvs.script +%dir %{_datadir}/ctdb/scripts +%{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh %if %{with testsuite} %files -n ctdb-tests @@ -4605,5 +4729,63 @@ fi %{_mandir}/man1/winexe.1.gz %endif +%files -n libldb +%{_libdir}/libldb.so.* +%dir %{_libdir}/samba +%{_libdir}/samba/libldb-key-value-private-samba.so +%{_libdir}/samba/libldb-tdb-err-map-private-samba.so +%{_libdir}/samba/libldb-tdb-int-private-samba.so +%if %{with lmdb} +%{_libdir}/samba/libldb-mdb-int-private-samba.so +%endif + +%dir %{_libdir}/samba/ldb +%{_libdir}/samba/ldb/asq.so +%{_libdir}/samba/ldb/ldb.so +%{_libdir}/samba/ldb/mdb.so +%{_libdir}/samba/ldb/paged_searches.so +%{_libdir}/samba/ldb/rdn_name.so +%{_libdir}/samba/ldb/sample.so +%{_libdir}/samba/ldb/server_sort.so +%{_libdir}/samba/ldb/skel.so +%{_libdir}/samba/ldb/tdb.so + +%files -n libldb-devel +%{_includedir}/samba-4.0/ldb_module.h +%{_includedir}/samba-4.0/ldb_handlers.h +%{_includedir}/samba-4.0/ldb_errors.h +%{_includedir}/samba-4.0/ldb_version.h +%{_includedir}/samba-4.0/ldb.h +%{_libdir}/libldb.so + +%{_libdir}/pkgconfig/ldb.pc +%{_mandir}/man3/ldb*.gz +%{_mandir}/man3/ldif*.gz + +%files -n ldb-tools +%{_bindir}/ldbadd +%{_bindir}/ldbdel +%{_bindir}/ldbedit +%{_bindir}/ldbmodify +%{_bindir}/ldbrename +%{_bindir}/ldbsearch +%{_libdir}/samba/libldb-cmdline-private-samba.so +%{_mandir}/man1/ldbadd.1.* +%{_mandir}/man1/ldbdel.1.* +%{_mandir}/man1/ldbedit.1.* +%{_mandir}/man1/ldbmodify.1.* +%{_mandir}/man1/ldbrename.1.* +%{_mandir}/man1/ldbsearch.1.* + +%files -n python-ldb-devel-common +#{_includedir}/pyldb.h +%{_mandir}/man*/Py*.gz + +%files -n python3-ldb +%{python3_sitearch}/ldb.cpython-*.so +%{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so +%{python3_sitearch}/_ldb_text.py +%{python3_sitearch}/__pycache__/_ldb_text.cpython-*.py* + %changelog %autochangelog diff --git a/sources b/sources index fa51daa..153969e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.20.4.tar.xz) = 390805d006c380e83f0a0f6f0c00cd6605c32c937f4cf11e7ac5b177abd4538b0be40c505d72c500855f28a625f60aaa007c4466c316c3f93bfb5baa583f384f -SHA512 (samba-4.20.4.tar.asc) = ff8369bf307e56fe842a101b05dcbf382779a3812763e67b573449412195777fce25864ca4e0d89c126bc46cf3a2d359c5d5bda68b60af8849cd91f9d418ee98 +SHA512 (samba-4.21.0rc2.tar.xz) = c561a1cff99fd23baa738ce304efacfab1f7033880c6b5da6c6d2fc821a751be4f3a11b6e98700192490df17a87b9d9ba24e1ce7ed17bf6710a80d3a24ee3639 +SHA512 (samba-4.21.0rc2.tar.asc) = 415abad180a9771765a3f17978b9aa8008088ef60aee4fa98a278a8d21fa8fc2cdde4d8b8b6b23ff7476d63f642ba2a0d028e63d12f8d27eddd66030dc1068b2 diff --git a/sync_machine_password_script_install.patch b/sync_machine_password_script_install.patch new file mode 100644 index 0000000..ea70c82 --- /dev/null +++ b/sync_machine_password_script_install.patch @@ -0,0 +1,91 @@ +From 7fedd0925965705e435a4bd411fdbd0e73d8b6a6 Mon Sep 17 00:00:00 2001 +From: Anoop C S +Date: Wed, 14 Aug 2024 19:47:35 +0530 +Subject: [PATCH 1/2] source3/script: Fix installation of + winbind_ctdb_updatekeytab.sh + +winbind_ctdb_updatekeytab.sh assumes the presence `onnode` utility to +execute `net ads` command on all nodes in the cluster. But `onnode` +is only built when configured with clustering support. Therefore perform +the script installation only with ctdb configuration. Also fix the +installation path to /usr/share/ctdb/scripts. + +Signed-off-by: Anoop C S +Reviewed-by: Guenther Deschner +--- + source3/script/wscript_build | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/source3/script/wscript_build b/source3/script/wscript_build +index 2b0643b0876..a634ece7ec1 100644 +--- a/source3/script/wscript_build ++++ b/source3/script/wscript_build +@@ -6,7 +6,8 @@ bld.INSTALL_FILES('${BINDIR}', + 'smbtar', + chmod=MODE_755, flat=True) + bld.INSTALL_FILES('${BINDIR}', 'samba-log-parser', chmod=MODE_755, flat=True) +-bld.INSTALL_FILES('${DATADIR}', 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) ++if conf.env.with_ctdb: ++ bld.INSTALL_FILES(bld.env.CTDB_DATADIR+"/scripts", 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) + + # Callout scripts for use in selftest environment + bld.SAMBA_SCRIPT('smbaddshare', pattern='smbaddshare', installdir='.') +-- +2.46.0 + + +From 24d5b7d711566297ce5db92ebc2f56ec100b1dca Mon Sep 17 00:00:00 2001 +From: Anoop C S +Date: Wed, 14 Aug 2024 19:49:04 +0530 +Subject: [PATCH 2/2] docs-xml: Fix script location in + syncmachinepasswordscript.xml + +Update the change in installation path for winbind_ctdb_updatekeytab.sh +from SAMBA_DATADIR to newly defined CTDB_DATADIR. + +Signed-off-by: Anoop C S +Reviewed-by: Guenther Deschner +--- + docs-xml/smbdotconf/security/syncmachinepasswordscript.xml | 4 ++-- + dynconfig/wscript | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml +index 9a7731930d5..df98610cf36 100644 +--- a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml ++++ b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml +@@ -11,7 +11,7 @@ + + + If keytabs should be generated in clustered environments it is recommended to update them on all nodes. +- You can set the config option to &pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. ++ You can set the config option to &pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. + It is also needed to activate the 46.update-keytabs.script in ctdb, + it re-creates the keytab during the ctdb recovered event: + +@@ -22,5 +22,5 @@ + + + +-&pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh ++&pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh + +diff --git a/dynconfig/wscript b/dynconfig/wscript +index 2041d881546..a784dac4e6c 100644 +--- a/dynconfig/wscript ++++ b/dynconfig/wscript +@@ -105,6 +105,11 @@ dynconfig = { + 'FHS-PATH': '${DATADIR}', + 'OVERWRITE': True, + }, ++ 'CTDB_DATADIR' : { ++ 'STD-PATH': '${DATADIR}/ctdb', ++ 'FHS-PATH': '${DATADIR}/ctdb', ++ 'OVERWRITE': True, ++ }, + 'SAMBA_DATADIR' : { + 'STD-PATH': '${DATADIR}/samba', + 'FHS-PATH': '${DATADIR}/samba', +-- +2.46.0 + From 22760e8157b79d2bb5dd4e150d49be93050da5e0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 07:49:11 +0200 Subject: [PATCH 002/101] Remove also python-ldb-devel-common - related: rhbz#230046 This was only used internally. --- samba.spec | 25 +++++-------------------- 1 file changed, 5 insertions(+), 20 deletions(-) diff --git a/samba.spec b/samba.spec index 22d0376..79d5769 100644 --- a/samba.spec +++ b/samba.spec @@ -1254,21 +1254,6 @@ Provides: ldb-tools = %{samba_depver} %description -n ldb-tools Tools to manage LDB files -### PYTHON3-LDB-DEVEL-COMMON -%package -n python-ldb-devel-common -Summary: Common development files for the Python bindings for the LDB library -License: LGPL-3.0-or-later - -Provides: pyldb-devel%{?_isa} = %{version}-%{release} -%{?python_provide:%python_provide python2-ldb-devel} - -Obsoletes: python-ldb-devel-common < 2.10 -Provides: python-ldb-devel-common = %{samba_depver} - -%description -n python-ldb-devel-common -Development files for the Python bindings for the LDB library. -This package includes files that aren't specific to a Python version. - ### PYTHON3-LDB %package -n python3-ldb Summary: Python bindings for the LDB library @@ -1280,6 +1265,8 @@ Requires: python3-tdb%{?_isa} >= %{tdb_version} Obsoletes: python3-ldb < 2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba +Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = %{samba_depver} Obsoletes: python3-ldb-devel < 2.10 Provides: python3-ldb-devel = %{samba_depver} @@ -1560,9 +1547,11 @@ rm -f %{buildroot}%{perl_archlib}/vendor_perl/auto/Parse/Pidl/.packlist rm -rf %{buildroot}%{perl_vendorlib}/Parse/Yapp popd -# libldb manpages +# Install libldb manpages cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} +# Remove manpages we don't want rm -f %{buildroot}%{_mandir}/man3/_* +rm -f %{buildroot}%{_mandir}/man*/Py*.gz %if %{with testsuite} %check @@ -4777,10 +4766,6 @@ fi %{_mandir}/man1/ldbrename.1.* %{_mandir}/man1/ldbsearch.1.* -%files -n python-ldb-devel-common -#{_includedir}/pyldb.h -%{_mandir}/man*/Py*.gz - %files -n python3-ldb %{python3_sitearch}/ldb.cpython-*.so %{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so From 49d714c02974d2989ea1ff9129ffd90bfaa98ea2 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 08:02:37 +0200 Subject: [PATCH 003/101] Update to version 4.21.0rc3 - related: rhbz#230046 --- samba.spec | 6 +- sources | 4 +- sync_machine_password_script_install.patch | 91 ---------------------- 3 files changed, 5 insertions(+), 96 deletions(-) delete mode 100644 sync_machine_password_script_install.patch diff --git a/samba.spec b/samba.spec index 79d5769..3465b9e 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -254,8 +254,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: sync_machine_password_script_install.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -4731,7 +4729,9 @@ fi %dir %{_libdir}/samba/ldb %{_libdir}/samba/ldb/asq.so %{_libdir}/samba/ldb/ldb.so +%if %{with lmdb} %{_libdir}/samba/ldb/mdb.so +%endif %{_libdir}/samba/ldb/paged_searches.so %{_libdir}/samba/ldb/rdn_name.so %{_libdir}/samba/ldb/sample.so diff --git a/sources b/sources index 153969e..f42760a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc2.tar.xz) = c561a1cff99fd23baa738ce304efacfab1f7033880c6b5da6c6d2fc821a751be4f3a11b6e98700192490df17a87b9d9ba24e1ce7ed17bf6710a80d3a24ee3639 -SHA512 (samba-4.21.0rc2.tar.asc) = 415abad180a9771765a3f17978b9aa8008088ef60aee4fa98a278a8d21fa8fc2cdde4d8b8b6b23ff7476d63f642ba2a0d028e63d12f8d27eddd66030dc1068b2 +SHA512 (samba-4.21.0rc3.tar.xz) = 8f4bd550e922beb4af4ddbc1a3e96169c35a348ccaa6bd5de51cc0ce9545952c5262ecbd0e3e9e37576a8346b1e0c5ab27baccf6d015208a8ed2629df64e553b +SHA512 (samba-4.21.0rc3.tar.asc) = a2cdd7d9e53f58ecd32df0d41a928a103fdf78a3885a5d74cf48b7a6e40eed263853f0fa8161f4524844391ef443736659a6c6419aad41345cdc59192db704d3 diff --git a/sync_machine_password_script_install.patch b/sync_machine_password_script_install.patch deleted file mode 100644 index ea70c82..0000000 --- a/sync_machine_password_script_install.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 7fedd0925965705e435a4bd411fdbd0e73d8b6a6 Mon Sep 17 00:00:00 2001 -From: Anoop C S -Date: Wed, 14 Aug 2024 19:47:35 +0530 -Subject: [PATCH 1/2] source3/script: Fix installation of - winbind_ctdb_updatekeytab.sh - -winbind_ctdb_updatekeytab.sh assumes the presence `onnode` utility to -execute `net ads` command on all nodes in the cluster. But `onnode` -is only built when configured with clustering support. Therefore perform -the script installation only with ctdb configuration. Also fix the -installation path to /usr/share/ctdb/scripts. - -Signed-off-by: Anoop C S -Reviewed-by: Guenther Deschner ---- - source3/script/wscript_build | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/source3/script/wscript_build b/source3/script/wscript_build -index 2b0643b0876..a634ece7ec1 100644 ---- a/source3/script/wscript_build -+++ b/source3/script/wscript_build -@@ -6,7 +6,8 @@ bld.INSTALL_FILES('${BINDIR}', - 'smbtar', - chmod=MODE_755, flat=True) - bld.INSTALL_FILES('${BINDIR}', 'samba-log-parser', chmod=MODE_755, flat=True) --bld.INSTALL_FILES('${DATADIR}', 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) -+if conf.env.with_ctdb: -+ bld.INSTALL_FILES(bld.env.CTDB_DATADIR+"/scripts", 'winbind_ctdb_updatekeytab.sh', chmod=MODE_755, flat=True) - - # Callout scripts for use in selftest environment - bld.SAMBA_SCRIPT('smbaddshare', pattern='smbaddshare', installdir='.') --- -2.46.0 - - -From 24d5b7d711566297ce5db92ebc2f56ec100b1dca Mon Sep 17 00:00:00 2001 -From: Anoop C S -Date: Wed, 14 Aug 2024 19:49:04 +0530 -Subject: [PATCH 2/2] docs-xml: Fix script location in - syncmachinepasswordscript.xml - -Update the change in installation path for winbind_ctdb_updatekeytab.sh -from SAMBA_DATADIR to newly defined CTDB_DATADIR. - -Signed-off-by: Anoop C S -Reviewed-by: Guenther Deschner ---- - docs-xml/smbdotconf/security/syncmachinepasswordscript.xml | 4 ++-- - dynconfig/wscript | 5 +++++ - 2 files changed, 7 insertions(+), 2 deletions(-) - -diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -index 9a7731930d5..df98610cf36 100644 ---- a/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -+++ b/docs-xml/smbdotconf/security/syncmachinepasswordscript.xml -@@ -11,7 +11,7 @@ - - - If keytabs should be generated in clustered environments it is recommended to update them on all nodes. -- You can set the config option to &pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. -+ You can set the config option to &pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh in clustering case. - It is also needed to activate the 46.update-keytabs.script in ctdb, - it re-creates the keytab during the ctdb recovered event: - -@@ -22,5 +22,5 @@ - - - --&pathconfig.SAMBA_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh -+&pathconfig.CTDB_DATADIR;/scripts/winbind_ctdb_updatekeytab.sh - -diff --git a/dynconfig/wscript b/dynconfig/wscript -index 2041d881546..a784dac4e6c 100644 ---- a/dynconfig/wscript -+++ b/dynconfig/wscript -@@ -105,6 +105,11 @@ dynconfig = { - 'FHS-PATH': '${DATADIR}', - 'OVERWRITE': True, - }, -+ 'CTDB_DATADIR' : { -+ 'STD-PATH': '${DATADIR}/ctdb', -+ 'FHS-PATH': '${DATADIR}/ctdb', -+ 'OVERWRITE': True, -+ }, - 'SAMBA_DATADIR' : { - 'STD-PATH': '${DATADIR}/samba', - 'FHS-PATH': '${DATADIR}/samba', --- -2.46.0 - From bcb3974e312f6d84a8f23246dc0c65121a2199b5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 09:29:46 +0200 Subject: [PATCH 004/101] Fix manpages for libldb related: rhbz#230046 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 3465b9e..792808a 100644 --- a/samba.spec +++ b/samba.spec @@ -1549,7 +1549,7 @@ popd cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} # Remove manpages we don't want rm -f %{buildroot}%{_mandir}/man3/_* -rm -f %{buildroot}%{_mandir}/man*/Py*.gz +rm -f %{buildroot}%{_mandir}/man3/PyLdb* %if %{with testsuite} %check From 4c2a193110ff7a9048ce27321cfdaed9dad37bf4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 21 Aug 2024 14:55:13 +0200 Subject: [PATCH 005/101] Fix ldb requires and provides - related: rhbz#230046 --- samba.spec | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 792808a..2c36f16 100644 --- a/samba.spec +++ b/samba.spec @@ -1220,6 +1220,7 @@ Requires: libtevent%{?_isa} >= %{tevent_version} Provides: bundled(libreplace) Obsoletes: libldb < 2.10 +Provides: libldb = 2.10 Provides: libldb = %{samba_depver} %description -n libldb @@ -1230,12 +1231,13 @@ servers, or use local tdb databases. %package -n libldb-devel Summary: Developer tools for the LDB library License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libldb%{?_isa} = %{samba_depver} Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} Obsoletes: libldb-devel < 2.10 +Provides: libldb-devel = 2.10 Provides: libldb-devel = %{samba_depver} %description -n libldb-devel @@ -1245,7 +1247,7 @@ Header files needed to develop programs that link against the LDB library. %package -n ldb-tools Summary: Tools to manage LDB files License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{samba_release} +Requires: libldb%{?_isa} = %{samba_depver} Obsoletes: ldb-tools < 2.10 Provides: ldb-tools = %{samba_depver} @@ -1256,7 +1258,7 @@ Tools to manage LDB files %package -n python3-ldb Summary: Python bindings for the LDB library License: LGPL-3.0-or-later -Requires: libldb%{?_isa} = %{version}-%{release} +Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} %{?python_provide:%python_provide python3-ldb} @@ -1264,8 +1266,10 @@ Obsoletes: python3-ldb < 2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba Obsoletes: python-ldb-devel-common < 2.10 +Provides: python-ldb-devel-common = 2.10 Provides: python-ldb-devel-common = %{samba_depver} Obsoletes: python3-ldb-devel < 2.10 +Provides: python3-ldb-devel = 2.10 Provides: python3-ldb-devel = %{samba_depver} %description -n python3-ldb From 11eed52070ab5a7afa578bdc5adf776ab691f09b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 28 Aug 2024 13:54:34 +0200 Subject: [PATCH 006/101] Update to version 4.21.0rc4 - resolves: rhbz#2300469 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 2c36f16..9c94887 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index f42760a..f6fbb9e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc3.tar.xz) = 8f4bd550e922beb4af4ddbc1a3e96169c35a348ccaa6bd5de51cc0ce9545952c5262ecbd0e3e9e37576a8346b1e0c5ab27baccf6d015208a8ed2629df64e553b -SHA512 (samba-4.21.0rc3.tar.asc) = a2cdd7d9e53f58ecd32df0d41a928a103fdf78a3885a5d74cf48b7a6e40eed263853f0fa8161f4524844391ef443736659a6c6419aad41345cdc59192db704d3 +SHA512 (samba-4.21.0rc4.tar.xz) = bbf3e6506b15d7a386292e84c189a8dd2136cb016df9bdb07066359b4bbce5da7e1c7f889a2de223ed83bbd8760a0e5232f5986bfd1c368b1beead4ed25c1076 +SHA512 (samba-4.21.0rc4.tar.asc) = 8a646d3e4b79886e723ad0558f0412e5033d8481ae0d9e04606204ce6af47e2eee2028a32ecd342572ee882aae798a702675d7e4e0593c83dda69edd23b30850 From b363a4cfec680b18ab6f2b0659899d8485e3d993 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 2 Sep 2024 15:25:28 +0200 Subject: [PATCH 007/101] Update to version 4.21.0 - resolves: rhbz#2309153 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 9c94887..554fa54 100644 --- a/samba.spec +++ b/samba.spec @@ -167,7 +167,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index f6fbb9e..3e8e284 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0rc4.tar.xz) = bbf3e6506b15d7a386292e84c189a8dd2136cb016df9bdb07066359b4bbce5da7e1c7f889a2de223ed83bbd8760a0e5232f5986bfd1c368b1beead4ed25c1076 -SHA512 (samba-4.21.0rc4.tar.asc) = 8a646d3e4b79886e723ad0558f0412e5033d8481ae0d9e04606204ce6af47e2eee2028a32ecd342572ee882aae798a702675d7e4e0593c83dda69edd23b30850 +SHA512 (samba-4.21.0.tar.xz) = d05c823afc04669766130745c139e7d129eb9961525453d6da8b5ee6693d4c08192496d07e5c211e86d553956504fb9df16611cc9268111b71b95c7f2fa868a0 +SHA512 (samba-4.21.0.tar.asc) = 7fffbd0b88b42dd7f340e4bcae17da4a68a0f8de86a1e71534a4a02a477a746e4cdb16df7c0da33aaf13278cefb452bd9b7c61ed029e248576f7158e8bec339e From 63dc1a2f19c43bd88f085b39457d3c9f2609e101 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 3 Sep 2024 00:19:59 +0200 Subject: [PATCH 008/101] Update required tdb version - related: rhbz#2309153 --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 554fa54..2a18182 100644 --- a/samba.spec +++ b/samba.spec @@ -198,7 +198,7 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.2 -%global tdb_version 1.4.11 +%global tdb_version 1.4.12 %global tevent_version 0.16.1 %global required_mit_krb5 1.20.1 From 19fdf21ce657e81bc5a06bca1fbaeeacbcd1eb48 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Fri, 13 Sep 2024 16:28:34 +0300 Subject: [PATCH 009/101] Fix Samba integration with FreeIPA - resolves: rhbz#2309199 Signed-off-by: Alexander Bokovoy --- samba-4.21.0-backport-freeipa-support.patch | 132 ++++++++++++++++++++ samba.spec | 2 + 2 files changed, 134 insertions(+) create mode 100644 samba-4.21.0-backport-freeipa-support.patch diff --git a/samba-4.21.0-backport-freeipa-support.patch b/samba-4.21.0-backport-freeipa-support.patch new file mode 100644 index 0000000..d1c5776 --- /dev/null +++ b/samba-4.21.0-backport-freeipa-support.patch @@ -0,0 +1,132 @@ +From 26797d7bd2662718b3eb795f1b8e6100d51e3ab7 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 3 Sep 2024 08:48:24 +0300 +Subject: [PATCH] sync machine password to keytab: handle FreeIPA use case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +FreeIPA uses own procedure to retrieve keytabs and during the setup of +Samba on FreeIPA client the keytab is already present, only machine +account needs to be set in the secrets database. + +'sync machine password to keytab' option handling broke this use case by +always attempting to contact a domain controller and failing to do so +(Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199). + +The original synchronizing machine account password to keytab feature +did not have a mechanism to disable its logic at all. + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Alexander Bokovoy +Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224 + +(cherry picked from commit 4f577c7b6894132be4842944f2f950b087312b16) +--- + .../security/syncmachinepasswordtokeytab.xml | 29 +++++++++++++++++-- + source3/libads/kerberos_keytab.c | 5 ++++ + source3/utils/net.c | 8 +++++ + source3/utils/testparm.c | 3 +- + 4 files changed, 41 insertions(+), 4 deletions(-) + +diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml +index 4cad9da73f2..f7dc30023d4 100644 +--- a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml ++++ b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml +@@ -18,7 +18,11 @@ or by winbindd doing regular updates (see ++If no value is present and is different from ++'secrets only', the behavior differs between winbind and net utility: ++ ++ ++ ++ winbind uses value ++ /path/to/keytab:sync_spns:sync_kvno:machine_password ++ where the path to the keytab is obtained either from the krb5 library or from ++ . ++ ++ ++ ++ net changesecretpw -f command uses the default 'disabled' value. ++ ++ No other net subcommands use the 'disabled' value. ++ ++ ++ ++If a single value 'disabled' is present, the synchronization process is ++disabled. This is required for FreeIPA domain member setup where keytab ++synchronization uses a protocol not implemented by Samba. + + + +diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c +index 6ede567b75f..dbf8af44c1f 100644 +--- a/source3/libads/kerberos_keytab.c ++++ b/source3/libads/kerberos_keytab.c +@@ -904,6 +904,11 @@ NTSTATUS sync_pw2keytabs(void) + goto params_ready; + } + ++ if ((*lp_ptr != NULL) && strequal_m(*lp_ptr, "disabled")) { ++ DBG_DEBUG("'sync machine password to keytab' is explicitly disabled.\n"); ++ return NT_STATUS_OK; ++ } ++ + line = lp_ptr; + while (*line) { + DBG_DEBUG("Scanning line: %s\n", *line); +diff --git a/source3/utils/net.c b/source3/utils/net.c +index 7b40d2bee95..c432ebe991f 100644 +--- a/source3/utils/net.c ++++ b/source3/utils/net.c +@@ -207,6 +207,14 @@ static int net_changesecretpw(struct net_context *c, int argc, + struct timeval tv = timeval_current(); + NTTIME now = timeval_to_nttime(&tv); + ++#ifdef HAVE_ADS ++ if (USE_KERBEROS_KEYTAB) { ++ if (lp_sync_machine_password_to_keytab() == NULL) { ++ lp_do_parameter(-1, "sync machine password to keytab", "disabled"); ++ } ++ } ++#endif ++ + if (c->opt_stdin) { + set_line_buffering(stdin); + set_line_buffering(stdout); +diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c +index e3ed336a79a..a31a7a8a30a 100644 +--- a/source3/utils/testparm.c ++++ b/source3/utils/testparm.c +@@ -803,7 +803,8 @@ static int do_global_checks(void) + "instead of 'kerberos method'.\n\n"); + } + +- if (lp_ptr != NULL) { ++ if (lp_ptr != NULL && ++ ((*lp_ptr != NULL) && !strequal_m(*lp_ptr, "disabled"))) { + while (*lp_ptr) { + ret |= pw2kt_check_line(*lp_ptr++); + } +-- +2.46.0 + diff --git a/samba.spec b/samba.spec index 2a18182..6c5f6b3 100644 --- a/samba.spec +++ b/samba.spec @@ -254,6 +254,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.21.0-backport-freeipa-support.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From b16ff1f961129810587ac3074f8f6ffaa83ee934 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Sep 2024 12:58:24 +0200 Subject: [PATCH 010/101] Add cert directories to samba-common Those are created by gpupdate and we need to have them packaged that selinux can label them correctly. --- samba.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/samba.spec b/samba.spec index 6c5f6b3..a5bcf9e 100644 --- a/samba.spec +++ b/samba.spec @@ -1426,9 +1426,11 @@ popd install -d -m 0755 %{buildroot}/usr/{sbin,bin} install -d -m 0755 %{buildroot}%{_libdir}/security install -d -m 0755 %{buildroot}/var/lib/samba +install -d -m 0755 %{buildroot}/var/lib/samba/certs install -d -m 0755 %{buildroot}/var/lib/samba/drivers install -d -m 0755 %{buildroot}/var/lib/samba/lock install -d -m 0755 %{buildroot}/var/lib/samba/private +install -d -m 0755 %{buildroot}/var/lib/samba/private/certs install -d -m 0755 %{buildroot}/var/lib/samba/scripts install -d -m 0755 %{buildroot}/var/lib/samba/sysvol install -d -m 0755 %{buildroot}/var/lib/samba/usershares @@ -2056,7 +2058,9 @@ fi %ghost %dir /run/samba %ghost %dir /run/winbindd %dir /var/lib/samba +%dir /var/lib/samba/certs %attr(700,root,root) %dir /var/lib/samba/private +%attr(700,root,root) %dir /var/lib/samba/private/certs %dir /var/lib/samba/lock %attr(755,root,root) %dir %{_sysconfdir}/samba %config(noreplace) %{_sysconfdir}/samba/smb.conf From 6ad66947912c84943cf8533cdd0f82583ca21446 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 23 Sep 2024 19:35:26 -0400 Subject: [PATCH 011/101] Fix ELN build libsamba-policy is only built with the AD DC, but the LDB LMDB components should be built regardless: https://gitlab.com/samba-team/samba/-/merge_requests/3807 --- samba-4.21.0-ldb-lmdb.patch | 55 +++++++++++++++++++++++++++++++++++++ samba.spec | 10 ++++--- 2 files changed, 61 insertions(+), 4 deletions(-) create mode 100644 samba-4.21.0-ldb-lmdb.patch diff --git a/samba-4.21.0-ldb-lmdb.patch b/samba-4.21.0-ldb-lmdb.patch new file mode 100644 index 0000000..894014a --- /dev/null +++ b/samba-4.21.0-ldb-lmdb.patch @@ -0,0 +1,55 @@ +From 9f265d6f3b852a9eed9f19147585fe2801507f63 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 24 Sep 2024 15:48:23 +0200 +Subject: [PATCH] ldb: Build lmdb backend also in non-AD case + +We should build with lmdb support also if it is not in AD case. The lmdb +backend is also used e.g. by sssd. + +If you don't want to build it, you can always specify --without-ldb-lmdb + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15721 + +Signed-off-by: Andreas Schneider +--- + lib/ldb/wscript | 22 +++++++++------------- + 1 file changed, 9 insertions(+), 13 deletions(-) + +diff --git a/lib/ldb/wscript b/lib/ldb/wscript +index 87aa3bb6d77..f234fa79c10 100644 +--- a/lib/ldb/wscript ++++ b/lib/ldb/wscript +@@ -33,21 +33,17 @@ def configure(conf): + conf.CONFIG_GET('ENABLE_SELFTEST'): + Logs.warn("NOTE: Some AD DC parts of selftest will fail") + ++ conf.env.REQUIRE_LMDB = False ++ elif Options.options.without_ldb_lmdb: ++ if not Options.options.without_ad_dc and \ ++ conf.CONFIG_GET('ENABLE_SELFTEST'): ++ raise Errors.WafError('--without-ldb-lmdb conflicts ' ++ 'with --enable-selftest while ' ++ 'building the AD DC') ++ + conf.env.REQUIRE_LMDB = False + else: +- if Options.options.without_ad_dc: +- conf.env.REQUIRE_LMDB = False +- else: +- if Options.options.without_ldb_lmdb: +- if not Options.options.without_ad_dc and \ +- conf.CONFIG_GET('ENABLE_SELFTEST'): +- raise Errors.WafError('--without-ldb-lmdb conflicts ' +- 'with --enable-selftest while ' +- 'building the AD DC') +- +- conf.env.REQUIRE_LMDB = False +- else: +- conf.env.REQUIRE_LMDB = True ++ conf.env.REQUIRE_LMDB = True + + # if lmdb support is enabled then we require lmdb + # is present, build the mdb back end and enable lmdb support in +-- +GitLab + diff --git a/samba.spec b/samba.spec index a5bcf9e..4465c44 100644 --- a/samba.spec +++ b/samba.spec @@ -255,6 +255,8 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-4.21.0-backport-freeipa-support.patch +# https://gitlab.com/samba-team/samba/-/merge_requests/3807 +Patch1: samba-4.21.0-ldb-lmdb.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -2206,14 +2208,14 @@ fi %endif ### DC-LIBS %files dc-libs -%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* -%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libauth4-private-samba.so %if %{with dc} || %{with testsuite} +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so +%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libservice-private-samba.so %if %{with testsuite} @@ -2357,7 +2359,6 @@ fi %{_libdir}/libsamba-credentials.so %{_libdir}/libsamba-errors.so %{_libdir}/libsamba-hostconfig.so -%{_libdir}/libsamba-policy.so %{_libdir}/libsamba-util.so %{_libdir}/libsamdb.so %{_libdir}/libsmbconf.so @@ -2370,7 +2371,6 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc -%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so @@ -2379,7 +2379,9 @@ fi %if %{with dc} || %{with testsuite} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so +%{_libdir}/libsamba-policy.so %{_libdir}/pkgconfig/dcerpc_server.pc +%{_libdir}/pkgconfig/samba-policy.pc %endif %if %{without libsmbclient} From a4001d23ea32acfe66586fa9a612e60c6615f60a Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 25 Sep 2024 18:06:49 -0400 Subject: [PATCH 012/101] Always include libsamba-policy and libsamba-net-private-samba As of 4.21, these were converted to regular C libraries to which their respective Python modules depend: https://gitlab.com/samba-team/samba/-/commit/d11b281aefa98e6850053ccd6142253c6cf0d04f https://gitlab.com/samba-team/samba/-/commit/829b52f99d5a9c9df19c9eb67611618095967edd --- samba.spec | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/samba.spec b/samba.spec index 4465c44..8ee8df5 100644 --- a/samba.spec +++ b/samba.spec @@ -1531,10 +1531,7 @@ rm -f %{buildroot}%{_mandir}/man8/vfs_ceph_snapshots.8* /sbin/ldconfig -N -n %{buildroot}%{_libdir} %if %{without dc} && %{without testsuite} -for f in samba/libsamba-net-private-samba.so \ - samba/libsamba-python-private-samba.so \ - libsamba-policy.so* \ - pkgconfig/samba-policy.pc ; do +for f in samba/libsamba-python-private-samba.so; do rm -f %{buildroot}%{_libdir}/$f done #endif without dc @@ -2208,14 +2205,14 @@ fi %endif ### DC-LIBS %files dc-libs +%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libauth4-private-samba.so +%{_libdir}/samba/libsamba-net-private-samba.so %if %{with dc} || %{with testsuite} -%{_libdir}/libsamba-policy.so.%{libsamba_policy_so_version}* %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so -%{_libdir}/samba/libsamba-net-private-samba.so %{_libdir}/samba/libservice-private-samba.so %if %{with testsuite} @@ -2371,17 +2368,17 @@ fi %{_libdir}/pkgconfig/ndr_standard.pc %{_libdir}/pkgconfig/samba-credentials.pc %{_libdir}/pkgconfig/samba-hostconfig.pc +%{_libdir}/pkgconfig/samba-policy.pc %{_libdir}/pkgconfig/samba-util.pc %{_libdir}/pkgconfig/samdb.pc %{_libdir}/libsamba-passdb.so +%{_libdir}/libsamba-policy.so %{_libdir}/libsmbldap.so %if %{with dc} || %{with testsuite} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so -%{_libdir}/libsamba-policy.so %{_libdir}/pkgconfig/dcerpc_server.pc -%{_libdir}/pkgconfig/samba-policy.pc %endif %if %{without libsmbclient} From 8f40e555ff762fd56d2d2ec0dc0e0c30f0f558e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 27 Sep 2024 13:59:42 +0200 Subject: [PATCH 013/101] Build with ceph again for ppc64le This is fixed https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 in gcc >= 11.3. It is ok to enable for rhel-9, rhel-10 and f41: gcc-11.5.0-2.el9 gcc-14.2.1-2.el10 gcc-14.2.1-3.fc41 --- samba.spec | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 8ee8df5..06a1376 100644 --- a/samba.spec +++ b/samba.spec @@ -55,9 +55,7 @@ # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} -# ppc64le excluded pending resolution of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104172 -#%%ifarch aarch64 ppc64le s390x x86_64 -%ifarch aarch64 s390x x86_64 riscv64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond_without vfs_cephfs %bcond_without ceph_mutex %else From 92d190c9b671b656cdccf53479443211be887f77 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 1 Oct 2024 14:11:48 +0200 Subject: [PATCH 014/101] Don't use RTLD_DEEPBIND by default in libldb - resolves: rhbz#2278016 --- samba-4-21-fix-libldb-deepbind.patch | 286 +++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 287 insertions(+) create mode 100644 samba-4-21-fix-libldb-deepbind.patch diff --git a/samba-4-21-fix-libldb-deepbind.patch b/samba-4-21-fix-libldb-deepbind.patch new file mode 100644 index 0000000..9593482 --- /dev/null +++ b/samba-4-21-fix-libldb-deepbind.patch @@ -0,0 +1,286 @@ +From e2d3bf09d6d75c7dc009aff36119e51ea59371fc Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:19:17 +0200 +Subject: [PATCH 1/4] lib:ldb: Remove trailing spaces from ldb_modules.c + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit 8d6b5183770895fef002b6cce84902d1874fa502) +--- + lib/ldb/common/ldb_modules.c | 34 +++++++++++++++++----------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c +index b5627b0d04f..5c970626206 100644 +--- a/lib/ldb/common/ldb_modules.c ++++ b/lib/ldb/common/ldb_modules.c +@@ -631,9 +631,9 @@ int ldb_next_start_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "start_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -650,9 +650,9 @@ int ldb_next_end_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "end_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -720,9 +720,9 @@ int ldb_next_prepare_commit(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "prepare_commit error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -739,9 +739,9 @@ int ldb_next_del_trans(struct ldb_module *module) + /* Set a default error string, to place the blame somewhere */ + ldb_asprintf_errstring(module->ldb, "del_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); + } +- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { +- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", +- ldb_errstring(module->ldb)); ++ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { ++ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", ++ ldb_errstring(module->ldb)); + } + return ret; + } +@@ -777,17 +777,17 @@ int ldb_module_send_entry(struct ldb_request *req, + req->handle->nesting == 0) { + char *s; + struct ldb_ldif ldif; +- ++ + ldif.changetype = LDB_CHANGETYPE_NONE; + ldif.msg = discard_const_p(struct ldb_message, msg); + + ldb_debug_add(req->handle->ldb, "ldb_trace_response: ENTRY\n"); + +- /* ++ /* + * The choice to call + * ldb_ldif_write_redacted_trace_string() is CRITICAL + * for security. It ensures that we do not output +- * passwords into debug logs ++ * passwords into debug logs + */ + + s = ldb_ldif_write_redacted_trace_string(req->handle->ldb, msg, &ldif); +@@ -1104,8 +1104,8 @@ static int ldb_modules_load_dir(const char *modules_dir, const char *version) + return LDB_SUCCESS; + } + +-/* +- load any additional modules from the given directory ++/* ++ load any additional modules from the given directory + */ + void ldb_set_modules_dir(struct ldb_context *ldb, const char *path) + { +-- +2.46.1 + + +From d0ec464cfced2654d74672846d83c19f69af622b Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:19:44 +0200 +Subject: [PATCH 2/4] lib:ldb: Don't use RTLD_DEEPBIND by default + +It should be off by default, as this is not needed by default. It +crashes named on startup, if bind is built with jemalloc support. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit dc6927fdca2ad77dbcf212ef4d3ba0d118ec7bdf) +--- + lib/ldb/common/ldb_modules.c | 21 ++++++--------------- + selftest/selftest.pl | 6 ------ + selftest/wscript | 5 ++--- + 3 files changed, 8 insertions(+), 24 deletions(-) + +diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c +index 5c970626206..08d251f9bdd 100644 +--- a/lib/ldb/common/ldb_modules.c ++++ b/lib/ldb/common/ldb_modules.c +@@ -945,7 +945,7 @@ static int ldb_modules_load_path(const char *path, const char *version) + int dlopen_flags; + + #ifdef RTLD_DEEPBIND +- bool deepbind_enabled = (getenv("LDB_MODULES_DISABLE_DEEPBIND") == NULL); ++ bool deepbind_enabled = (getenv("LDB_MODULES_ENABLE_DEEPBIND") != NULL); + #endif + + ret = stat(path, &st); +@@ -981,21 +981,12 @@ static int ldb_modules_load_path(const char *path, const char *version) + dlopen_flags = RTLD_NOW; + #ifdef RTLD_DEEPBIND + /* +- * use deepbind if possible, to avoid issues with different +- * system library variants, for example ldb modules may be linked +- * against Heimdal while the application may use MIT kerberos. ++ * On systems where e.g. different kerberos libraries are used, like a ++ * mix of Heimdal and MIT Kerberos, LDB_MODULES_ENABLE_DEEPBIND should ++ * be set to avoid issues. + * +- * See the dlopen manpage for details. +- * +- * One typical user is the bind_dlz module of Samba, +- * but symbol versioning might be enough... +- * +- * We need a way to disable this in order to allow the +- * ldb_*ldap modules to work with a preloaded socket wrapper. +- * +- * So in future we may remove this completely +- * or at least invert the default behavior. +- */ ++ * By default Linux distributions only have one Kerberos library. ++ */ + if (deepbind_enabled) { + dlopen_flags |= RTLD_DEEPBIND; + } +diff --git a/selftest/selftest.pl b/selftest/selftest.pl +index 26b1663b5b6..a0c4ec80f59 100755 +--- a/selftest/selftest.pl ++++ b/selftest/selftest.pl +@@ -433,12 +433,6 @@ $ENV{UID_WRAPPER} = 1; + # We are already hitting the limit, so double it. + $ENV{NSS_WRAPPER_MAX_HOSTENTS} = 200; + +-# Disable RTLD_DEEPBIND hack for Samba bind dlz module +-# +-# This is needed in order to allow the ldb_*ldap module +-# to work with a preloaded socket wrapper. +-$ENV{LDB_MODULES_DISABLE_DEEPBIND} = 1; +- + my $socket_wrapper_dir; + if ($opt_socket_wrapper) { + $socket_wrapper_dir = SocketWrapper::setup_dir("$prefix_abs/w", $opt_socket_wrapper_pcap); +diff --git a/selftest/wscript b/selftest/wscript +index 52c34dcb88d..95e70706e63 100644 +--- a/selftest/wscript ++++ b/selftest/wscript +@@ -333,9 +333,8 @@ def cmd_testonly(opt): + asan_options += ":suppressions=${srcdir}/selftest/sanitizer/asan.supp" + asan_options += " " + +- # And we need to disable RTLD_DEEPBIND in ldb and socket wrapper +- no_leak_check = "LDB_MODULES_DISABLE_DEEPBIND=1 " +- no_leak_check += "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" ++ # We need to disable RTLD_DEEPBIND in socket wrapper ++ no_leak_check = "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" + no_leak_check += " " + env.CORE_COMMAND = asan_options + no_leak_check + env.CORE_COMMAND + +-- +2.46.1 + + +From e6745b1444b28904258710dff1dddd18a8b9f662 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:40:23 +0200 +Subject: [PATCH 3/4] lib:ldb: Remove trailing spaces from ldb.3.xml + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit d6ff05cb5708fb6746176821bee5f713195efa54) +--- + lib/ldb/man/ldb.3.xml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml +index 1c0a2ece552..1dd8b2462d4 100644 +--- a/lib/ldb/man/ldb.3.xml ++++ b/lib/ldb/man/ldb.3.xml +@@ -247,7 +247,7 @@ ldb_search(3) manual pages. + Author + + +- ldb was written by ++ ldb was written by + Andrew Tridgell. + + +-- +2.46.1 + + +From ba9918d45820fbdb864b5a1e058136eeb0cf1ce7 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Wed, 25 Sep 2024 09:22:08 +0200 +Subject: [PATCH 4/4] lib:ldb: Document environment variables in ldb manpage + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Fri Sep 27 09:06:43 UTC 2024 on atb-devel-224 + +(cherry picked from commit 20a3a94e06a2294206ec233ccc7f873d6ef2aca0) +--- + lib/ldb/man/ldb.3.xml | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml +index 1dd8b2462d4..f8d3cb50446 100644 +--- a/lib/ldb/man/ldb.3.xml ++++ b/lib/ldb/man/ldb.3.xml +@@ -243,6 +243,27 @@ ldb_search(3) manual pages. + + + ++ ++ ENVIRONMENT VARIABLES ++ ++ ++ ++ LDB_URL ++ - connect to the provided URL (cmdline tools only) ++ ++ ++ ++ LDB_MODULES_PATH ++ - path where to load ldb modules from ++ ++ ++ ++ LDB_MODULES_ENABLE_DEEPBIND ++ - enable RTLD_DEEPBIND when loading ldb modules ++ ++ ++ ++ + + Author + +-- +2.46.1 + diff --git a/samba.spec b/samba.spec index 06a1376..67e3895 100644 --- a/samba.spec +++ b/samba.spec @@ -255,6 +255,7 @@ Source202: samba.abignore Patch0: samba-4.21.0-backport-freeipa-support.patch # https://gitlab.com/samba-team/samba/-/merge_requests/3807 Patch1: samba-4.21.0-ldb-lmdb.patch +Patch2: samba-4-21-fix-libldb-deepbind.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 2535a64d3408af19f390482a87aabf0f148c6683 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 14 Oct 2024 14:29:04 +0200 Subject: [PATCH 015/101] Update to version 4.21.1 - resolves: rhbz#2318518 --- samba-4-21-fix-libldb-deepbind.patch | 286 ----------- samba-4.21.0-backport-freeipa-support.patch | 132 ----- samba-4.21.0-ldb-lmdb.patch | 55 --- samba-4.21.0-s3-notifyd.patch | 513 ++++++++++++++++++++ samba.spec | 7 +- sources | 4 +- 6 files changed, 517 insertions(+), 480 deletions(-) delete mode 100644 samba-4-21-fix-libldb-deepbind.patch delete mode 100644 samba-4.21.0-backport-freeipa-support.patch delete mode 100644 samba-4.21.0-ldb-lmdb.patch create mode 100644 samba-4.21.0-s3-notifyd.patch diff --git a/samba-4-21-fix-libldb-deepbind.patch b/samba-4-21-fix-libldb-deepbind.patch deleted file mode 100644 index 9593482..0000000 --- a/samba-4-21-fix-libldb-deepbind.patch +++ /dev/null @@ -1,286 +0,0 @@ -From e2d3bf09d6d75c7dc009aff36119e51ea59371fc Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:19:17 +0200 -Subject: [PATCH 1/4] lib:ldb: Remove trailing spaces from ldb_modules.c - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit 8d6b5183770895fef002b6cce84902d1874fa502) ---- - lib/ldb/common/ldb_modules.c | 34 +++++++++++++++++----------------- - 1 file changed, 17 insertions(+), 17 deletions(-) - -diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c -index b5627b0d04f..5c970626206 100644 ---- a/lib/ldb/common/ldb_modules.c -+++ b/lib/ldb/common/ldb_modules.c -@@ -631,9 +631,9 @@ int ldb_next_start_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "start_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -650,9 +650,9 @@ int ldb_next_end_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "end_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -720,9 +720,9 @@ int ldb_next_prepare_commit(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "prepare_commit error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -739,9 +739,9 @@ int ldb_next_del_trans(struct ldb_module *module) - /* Set a default error string, to place the blame somewhere */ - ldb_asprintf_errstring(module->ldb, "del_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret); - } -- if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", -- ldb_errstring(module->ldb)); -+ if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { -+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", -+ ldb_errstring(module->ldb)); - } - return ret; - } -@@ -777,17 +777,17 @@ int ldb_module_send_entry(struct ldb_request *req, - req->handle->nesting == 0) { - char *s; - struct ldb_ldif ldif; -- -+ - ldif.changetype = LDB_CHANGETYPE_NONE; - ldif.msg = discard_const_p(struct ldb_message, msg); - - ldb_debug_add(req->handle->ldb, "ldb_trace_response: ENTRY\n"); - -- /* -+ /* - * The choice to call - * ldb_ldif_write_redacted_trace_string() is CRITICAL - * for security. It ensures that we do not output -- * passwords into debug logs -+ * passwords into debug logs - */ - - s = ldb_ldif_write_redacted_trace_string(req->handle->ldb, msg, &ldif); -@@ -1104,8 +1104,8 @@ static int ldb_modules_load_dir(const char *modules_dir, const char *version) - return LDB_SUCCESS; - } - --/* -- load any additional modules from the given directory -+/* -+ load any additional modules from the given directory - */ - void ldb_set_modules_dir(struct ldb_context *ldb, const char *path) - { --- -2.46.1 - - -From d0ec464cfced2654d74672846d83c19f69af622b Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:19:44 +0200 -Subject: [PATCH 2/4] lib:ldb: Don't use RTLD_DEEPBIND by default - -It should be off by default, as this is not needed by default. It -crashes named on startup, if bind is built with jemalloc support. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit dc6927fdca2ad77dbcf212ef4d3ba0d118ec7bdf) ---- - lib/ldb/common/ldb_modules.c | 21 ++++++--------------- - selftest/selftest.pl | 6 ------ - selftest/wscript | 5 ++--- - 3 files changed, 8 insertions(+), 24 deletions(-) - -diff --git a/lib/ldb/common/ldb_modules.c b/lib/ldb/common/ldb_modules.c -index 5c970626206..08d251f9bdd 100644 ---- a/lib/ldb/common/ldb_modules.c -+++ b/lib/ldb/common/ldb_modules.c -@@ -945,7 +945,7 @@ static int ldb_modules_load_path(const char *path, const char *version) - int dlopen_flags; - - #ifdef RTLD_DEEPBIND -- bool deepbind_enabled = (getenv("LDB_MODULES_DISABLE_DEEPBIND") == NULL); -+ bool deepbind_enabled = (getenv("LDB_MODULES_ENABLE_DEEPBIND") != NULL); - #endif - - ret = stat(path, &st); -@@ -981,21 +981,12 @@ static int ldb_modules_load_path(const char *path, const char *version) - dlopen_flags = RTLD_NOW; - #ifdef RTLD_DEEPBIND - /* -- * use deepbind if possible, to avoid issues with different -- * system library variants, for example ldb modules may be linked -- * against Heimdal while the application may use MIT kerberos. -+ * On systems where e.g. different kerberos libraries are used, like a -+ * mix of Heimdal and MIT Kerberos, LDB_MODULES_ENABLE_DEEPBIND should -+ * be set to avoid issues. - * -- * See the dlopen manpage for details. -- * -- * One typical user is the bind_dlz module of Samba, -- * but symbol versioning might be enough... -- * -- * We need a way to disable this in order to allow the -- * ldb_*ldap modules to work with a preloaded socket wrapper. -- * -- * So in future we may remove this completely -- * or at least invert the default behavior. -- */ -+ * By default Linux distributions only have one Kerberos library. -+ */ - if (deepbind_enabled) { - dlopen_flags |= RTLD_DEEPBIND; - } -diff --git a/selftest/selftest.pl b/selftest/selftest.pl -index 26b1663b5b6..a0c4ec80f59 100755 ---- a/selftest/selftest.pl -+++ b/selftest/selftest.pl -@@ -433,12 +433,6 @@ $ENV{UID_WRAPPER} = 1; - # We are already hitting the limit, so double it. - $ENV{NSS_WRAPPER_MAX_HOSTENTS} = 200; - --# Disable RTLD_DEEPBIND hack for Samba bind dlz module --# --# This is needed in order to allow the ldb_*ldap module --# to work with a preloaded socket wrapper. --$ENV{LDB_MODULES_DISABLE_DEEPBIND} = 1; -- - my $socket_wrapper_dir; - if ($opt_socket_wrapper) { - $socket_wrapper_dir = SocketWrapper::setup_dir("$prefix_abs/w", $opt_socket_wrapper_pcap); -diff --git a/selftest/wscript b/selftest/wscript -index 52c34dcb88d..95e70706e63 100644 ---- a/selftest/wscript -+++ b/selftest/wscript -@@ -333,9 +333,8 @@ def cmd_testonly(opt): - asan_options += ":suppressions=${srcdir}/selftest/sanitizer/asan.supp" - asan_options += " " - -- # And we need to disable RTLD_DEEPBIND in ldb and socket wrapper -- no_leak_check = "LDB_MODULES_DISABLE_DEEPBIND=1 " -- no_leak_check += "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" -+ # We need to disable RTLD_DEEPBIND in socket wrapper -+ no_leak_check = "SOCKET_WRAPPER_DISABLE_DEEP_BIND=1" - no_leak_check += " " - env.CORE_COMMAND = asan_options + no_leak_check + env.CORE_COMMAND - --- -2.46.1 - - -From e6745b1444b28904258710dff1dddd18a8b9f662 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:40:23 +0200 -Subject: [PATCH 3/4] lib:ldb: Remove trailing spaces from ldb.3.xml - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit d6ff05cb5708fb6746176821bee5f713195efa54) ---- - lib/ldb/man/ldb.3.xml | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml -index 1c0a2ece552..1dd8b2462d4 100644 ---- a/lib/ldb/man/ldb.3.xml -+++ b/lib/ldb/man/ldb.3.xml -@@ -247,7 +247,7 @@ ldb_search(3) manual pages. - Author - - -- ldb was written by -+ ldb was written by - Andrew Tridgell. - - --- -2.46.1 - - -From ba9918d45820fbdb864b5a1e058136eeb0cf1ce7 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Wed, 25 Sep 2024 09:22:08 +0200 -Subject: [PATCH 4/4] lib:ldb: Document environment variables in ldb manpage - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15643 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Fri Sep 27 09:06:43 UTC 2024 on atb-devel-224 - -(cherry picked from commit 20a3a94e06a2294206ec233ccc7f873d6ef2aca0) ---- - lib/ldb/man/ldb.3.xml | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -diff --git a/lib/ldb/man/ldb.3.xml b/lib/ldb/man/ldb.3.xml -index 1dd8b2462d4..f8d3cb50446 100644 ---- a/lib/ldb/man/ldb.3.xml -+++ b/lib/ldb/man/ldb.3.xml -@@ -243,6 +243,27 @@ ldb_search(3) manual pages. - - - -+ -+ ENVIRONMENT VARIABLES -+ -+ -+ -+ LDB_URL -+ - connect to the provided URL (cmdline tools only) -+ -+ -+ -+ LDB_MODULES_PATH -+ - path where to load ldb modules from -+ -+ -+ -+ LDB_MODULES_ENABLE_DEEPBIND -+ - enable RTLD_DEEPBIND when loading ldb modules -+ -+ -+ -+ - - Author - --- -2.46.1 - diff --git a/samba-4.21.0-backport-freeipa-support.patch b/samba-4.21.0-backport-freeipa-support.patch deleted file mode 100644 index d1c5776..0000000 --- a/samba-4.21.0-backport-freeipa-support.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 26797d7bd2662718b3eb795f1b8e6100d51e3ab7 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Tue, 3 Sep 2024 08:48:24 +0300 -Subject: [PATCH] sync machine password to keytab: handle FreeIPA use case -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -FreeIPA uses own procedure to retrieve keytabs and during the setup of -Samba on FreeIPA client the keytab is already present, only machine -account needs to be set in the secrets database. - -'sync machine password to keytab' option handling broke this use case by -always attempting to contact a domain controller and failing to do so -(Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199). - -The original synchronizing machine account password to keytab feature -did not have a mechanism to disable its logic at all. - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Alexander Bokovoy -Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224 - -(cherry picked from commit 4f577c7b6894132be4842944f2f950b087312b16) ---- - .../security/syncmachinepasswordtokeytab.xml | 29 +++++++++++++++++-- - source3/libads/kerberos_keytab.c | 5 ++++ - source3/utils/net.c | 8 +++++ - source3/utils/testparm.c | 3 +- - 4 files changed, 41 insertions(+), 4 deletions(-) - -diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -index 4cad9da73f2..f7dc30023d4 100644 ---- a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -+++ b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml -@@ -18,7 +18,11 @@ or by winbindd doing regular updates (see -+If no value is present and is different from -+'secrets only', the behavior differs between winbind and net utility: -+ -+ -+ -+ winbind uses value -+ /path/to/keytab:sync_spns:sync_kvno:machine_password -+ where the path to the keytab is obtained either from the krb5 library or from -+ . -+ -+ -+ -+ net changesecretpw -f command uses the default 'disabled' value. -+ -+ No other net subcommands use the 'disabled' value. -+ -+ -+ -+If a single value 'disabled' is present, the synchronization process is -+disabled. This is required for FreeIPA domain member setup where keytab -+synchronization uses a protocol not implemented by Samba. - - - -diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c -index 6ede567b75f..dbf8af44c1f 100644 ---- a/source3/libads/kerberos_keytab.c -+++ b/source3/libads/kerberos_keytab.c -@@ -904,6 +904,11 @@ NTSTATUS sync_pw2keytabs(void) - goto params_ready; - } - -+ if ((*lp_ptr != NULL) && strequal_m(*lp_ptr, "disabled")) { -+ DBG_DEBUG("'sync machine password to keytab' is explicitly disabled.\n"); -+ return NT_STATUS_OK; -+ } -+ - line = lp_ptr; - while (*line) { - DBG_DEBUG("Scanning line: %s\n", *line); -diff --git a/source3/utils/net.c b/source3/utils/net.c -index 7b40d2bee95..c432ebe991f 100644 ---- a/source3/utils/net.c -+++ b/source3/utils/net.c -@@ -207,6 +207,14 @@ static int net_changesecretpw(struct net_context *c, int argc, - struct timeval tv = timeval_current(); - NTTIME now = timeval_to_nttime(&tv); - -+#ifdef HAVE_ADS -+ if (USE_KERBEROS_KEYTAB) { -+ if (lp_sync_machine_password_to_keytab() == NULL) { -+ lp_do_parameter(-1, "sync machine password to keytab", "disabled"); -+ } -+ } -+#endif -+ - if (c->opt_stdin) { - set_line_buffering(stdin); - set_line_buffering(stdout); -diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c -index e3ed336a79a..a31a7a8a30a 100644 ---- a/source3/utils/testparm.c -+++ b/source3/utils/testparm.c -@@ -803,7 +803,8 @@ static int do_global_checks(void) - "instead of 'kerberos method'.\n\n"); - } - -- if (lp_ptr != NULL) { -+ if (lp_ptr != NULL && -+ ((*lp_ptr != NULL) && !strequal_m(*lp_ptr, "disabled"))) { - while (*lp_ptr) { - ret |= pw2kt_check_line(*lp_ptr++); - } --- -2.46.0 - diff --git a/samba-4.21.0-ldb-lmdb.patch b/samba-4.21.0-ldb-lmdb.patch deleted file mode 100644 index 894014a..0000000 --- a/samba-4.21.0-ldb-lmdb.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 9f265d6f3b852a9eed9f19147585fe2801507f63 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 24 Sep 2024 15:48:23 +0200 -Subject: [PATCH] ldb: Build lmdb backend also in non-AD case - -We should build with lmdb support also if it is not in AD case. The lmdb -backend is also used e.g. by sssd. - -If you don't want to build it, you can always specify --without-ldb-lmdb - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15721 - -Signed-off-by: Andreas Schneider ---- - lib/ldb/wscript | 22 +++++++++------------- - 1 file changed, 9 insertions(+), 13 deletions(-) - -diff --git a/lib/ldb/wscript b/lib/ldb/wscript -index 87aa3bb6d77..f234fa79c10 100644 ---- a/lib/ldb/wscript -+++ b/lib/ldb/wscript -@@ -33,21 +33,17 @@ def configure(conf): - conf.CONFIG_GET('ENABLE_SELFTEST'): - Logs.warn("NOTE: Some AD DC parts of selftest will fail") - -+ conf.env.REQUIRE_LMDB = False -+ elif Options.options.without_ldb_lmdb: -+ if not Options.options.without_ad_dc and \ -+ conf.CONFIG_GET('ENABLE_SELFTEST'): -+ raise Errors.WafError('--without-ldb-lmdb conflicts ' -+ 'with --enable-selftest while ' -+ 'building the AD DC') -+ - conf.env.REQUIRE_LMDB = False - else: -- if Options.options.without_ad_dc: -- conf.env.REQUIRE_LMDB = False -- else: -- if Options.options.without_ldb_lmdb: -- if not Options.options.without_ad_dc and \ -- conf.CONFIG_GET('ENABLE_SELFTEST'): -- raise Errors.WafError('--without-ldb-lmdb conflicts ' -- 'with --enable-selftest while ' -- 'building the AD DC') -- -- conf.env.REQUIRE_LMDB = False -- else: -- conf.env.REQUIRE_LMDB = True -+ conf.env.REQUIRE_LMDB = True - - # if lmdb support is enabled then we require lmdb - # is present, build the mdb back end and enable lmdb support in --- -GitLab - diff --git a/samba-4.21.0-s3-notifyd.patch b/samba-4.21.0-s3-notifyd.patch new file mode 100644 index 0000000..31463fd --- /dev/null +++ b/samba-4.21.0-s3-notifyd.patch @@ -0,0 +1,513 @@ +From c9a7bc3e8f36cb9d6746e23ea56f9c27b82dcf49 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Mon, 22 Jul 2024 12:26:55 +0200 +Subject: [PATCH] s3:notifyd: Use a watcher per db record +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This fixes a O(n²) performance regression in notifyd. The problem was +that we had a watcher per notify instance. This changes the code to have +a watcher per notify db entry. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=14430 + +Signed-off-by: Andreas Schneider +Reviewed-by: Stefan Metzmacher +(cherry picked from commit af011b987a4ad0d3753d83cc0b8d97ad64ba874a) +--- + source3/smbd/notifyd/notifyd.c | 214 ++++++++++++++++++------- + source3/smbd/notifyd/notifyd_db.c | 5 +- + source3/smbd/notifyd/notifyd_entry.c | 51 ++++-- + source3/smbd/notifyd/notifyd_private.h | 46 ++++-- + 4 files changed, 228 insertions(+), 88 deletions(-) + +diff --git a/source3/smbd/notifyd/notifyd.c b/source3/smbd/notifyd/notifyd.c +index 64dd26a7e11..0b07ab3e435 100644 +--- a/source3/smbd/notifyd/notifyd.c ++++ b/source3/smbd/notifyd/notifyd.c +@@ -337,6 +337,7 @@ static bool notifyd_apply_rec_change( + struct messaging_context *msg_ctx) + { + struct db_record *rec = NULL; ++ struct notifyd_watcher watcher = {}; + struct notifyd_instance *instances = NULL; + size_t num_instances; + size_t i; +@@ -344,6 +345,7 @@ static bool notifyd_apply_rec_change( + TDB_DATA value; + NTSTATUS status; + bool ok = false; ++ bool new_watcher = false; + + if (pathlen == 0) { + DBG_WARNING("pathlen==0\n"); +@@ -374,8 +376,12 @@ static bool notifyd_apply_rec_change( + value = dbwrap_record_get_value(rec); + + if (value.dsize != 0) { +- if (!notifyd_parse_entry(value.dptr, value.dsize, NULL, +- &num_instances)) { ++ ok = notifyd_parse_entry(value.dptr, ++ value.dsize, ++ &watcher, ++ NULL, ++ &num_instances); ++ if (!ok) { + goto fail; + } + } +@@ -390,8 +396,22 @@ static bool notifyd_apply_rec_change( + goto fail; + } + +- if (value.dsize != 0) { +- memcpy(instances, value.dptr, value.dsize); ++ if (num_instances > 0) { ++ struct notifyd_instance *tmp = NULL; ++ size_t num_tmp = 0; ++ ++ ok = notifyd_parse_entry(value.dptr, ++ value.dsize, ++ NULL, ++ &tmp, ++ &num_tmp); ++ if (!ok) { ++ goto fail; ++ } ++ ++ memcpy(instances, ++ tmp, ++ sizeof(struct notifyd_instance) * num_tmp); + } + + for (i=0; ifilter, +- .internal_subdir_filter = chg->subdir_filter + }; + + num_instances += 1; + } + +- if ((instance->instance.filter != 0) || +- (instance->instance.subdir_filter != 0)) { +- int ret; ++ /* ++ * Calculate an intersection of the instances filters for the watcher. ++ */ ++ if (instance->instance.filter > 0) { ++ uint32_t filter = instance->instance.filter; ++ ++ if ((watcher.filter & filter) != filter) { ++ watcher.filter |= filter; ++ ++ new_watcher = true; ++ } ++ } ++ ++ /* ++ * Calculate an intersection of the instances subdir_filters for the ++ * watcher. ++ */ ++ if (instance->instance.subdir_filter > 0) { ++ uint32_t subdir_filter = instance->instance.subdir_filter; + +- TALLOC_FREE(instance->sys_watch); ++ if ((watcher.subdir_filter & subdir_filter) != subdir_filter) { ++ watcher.subdir_filter |= subdir_filter; + +- ret = sys_notify_watch(entries, sys_notify_ctx, path, +- &instance->internal_filter, +- &instance->internal_subdir_filter, +- notifyd_sys_callback, msg_ctx, +- &instance->sys_watch); +- if (ret != 0) { +- DBG_WARNING("sys_notify_watch for [%s] returned %s\n", +- path, strerror(errno)); ++ new_watcher = true; + } + } + + if ((instance->instance.filter == 0) && + (instance->instance.subdir_filter == 0)) { ++ uint32_t tmp_filter = 0; ++ uint32_t tmp_subdir_filter = 0; ++ + /* This is a delete request */ +- TALLOC_FREE(instance->sys_watch); + *instance = instances[num_instances-1]; + num_instances -= 1; ++ ++ for (i = 0; i < num_instances; i++) { ++ struct notifyd_instance *tmp = &instances[i]; ++ ++ tmp_filter |= tmp->instance.filter; ++ tmp_subdir_filter |= tmp->instance.subdir_filter; ++ } ++ ++ /* ++ * If the filter has changed, register a new watcher with the ++ * changed filter. ++ */ ++ if (watcher.filter != tmp_filter || ++ watcher.subdir_filter != tmp_subdir_filter) ++ { ++ watcher.filter = tmp_filter; ++ watcher.subdir_filter = tmp_subdir_filter; ++ ++ new_watcher = true; ++ } ++ } ++ ++ if (new_watcher) { ++ /* ++ * In case we removed all notify instances, we want to remove ++ * the watcher. We won't register a new one, if no filters are ++ * set anymore. ++ */ ++ ++ TALLOC_FREE(watcher.sys_watch); ++ ++ watcher.sys_filter = watcher.filter; ++ watcher.sys_subdir_filter = watcher.subdir_filter; ++ ++ /* ++ * Only register a watcher if we have filter. ++ */ ++ if (watcher.filter != 0 || watcher.subdir_filter != 0) { ++ int ret = sys_notify_watch(entries, ++ sys_notify_ctx, ++ path, ++ &watcher.sys_filter, ++ &watcher.sys_subdir_filter, ++ notifyd_sys_callback, ++ msg_ctx, ++ &watcher.sys_watch); ++ if (ret != 0) { ++ DBG_WARNING("sys_notify_watch for [%s] " ++ "returned %s\n", ++ path, ++ strerror(errno)); ++ } ++ } + } + + DBG_DEBUG("%s has %zu instances\n", path, num_instances); + + if (num_instances == 0) { ++ TALLOC_FREE(watcher.sys_watch); ++ + status = dbwrap_record_delete(rec); + if (!NT_STATUS_IS_OK(status)) { + DBG_WARNING("dbwrap_record_delete returned %s\n", +@@ -456,13 +541,21 @@ static bool notifyd_apply_rec_change( + goto fail; + } + } else { +- value = make_tdb_data( +- (uint8_t *)instances, +- sizeof(struct notifyd_instance) * num_instances); ++ struct TDB_DATA iov[2] = { ++ { ++ .dptr = (uint8_t *)&watcher, ++ .dsize = sizeof(struct notifyd_watcher), ++ }, ++ { ++ .dptr = (uint8_t *)instances, ++ .dsize = sizeof(struct notifyd_instance) * ++ num_instances, ++ }, ++ }; + +- status = dbwrap_record_store(rec, value, 0); ++ status = dbwrap_record_storev(rec, iov, ARRAY_SIZE(iov), 0); + if (!NT_STATUS_IS_OK(status)) { +- DBG_WARNING("dbwrap_record_store returned %s\n", ++ DBG_WARNING("dbwrap_record_storev returned %s\n", + nt_errstr(status)); + goto fail; + } +@@ -706,12 +799,18 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, + .when = tstate->msg->when }; + struct iovec iov[2]; + size_t path_len = key.dsize; ++ struct notifyd_watcher watcher = {}; + struct notifyd_instance *instances = NULL; + size_t num_instances = 0; + size_t i; ++ bool ok; + +- if (!notifyd_parse_entry(data.dptr, data.dsize, &instances, +- &num_instances)) { ++ ok = notifyd_parse_entry(data.dptr, ++ data.dsize, ++ &watcher, ++ &instances, ++ &num_instances); ++ if (!ok) { + DBG_DEBUG("Could not parse notifyd_entry\n"); + return; + } +@@ -734,9 +833,11 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, + + if (tstate->covered_by_sys_notify) { + if (tstate->recursive) { +- i_filter = instance->internal_subdir_filter; ++ i_filter = watcher.sys_subdir_filter & ++ instance->instance.subdir_filter; + } else { +- i_filter = instance->internal_filter; ++ i_filter = watcher.sys_filter & ++ instance->instance.filter; + } + } else { + if (tstate->recursive) { +@@ -1146,46 +1247,39 @@ static int notifyd_add_proxy_syswatches(struct db_record *rec, + struct db_context *db = dbwrap_record_get_db(rec); + TDB_DATA key = dbwrap_record_get_key(rec); + TDB_DATA value = dbwrap_record_get_value(rec); +- struct notifyd_instance *instances = NULL; +- size_t num_instances = 0; +- size_t i; ++ struct notifyd_watcher watcher = {}; + char path[key.dsize+1]; + bool ok; ++ int ret; + + memcpy(path, key.dptr, key.dsize); + path[key.dsize] = '\0'; + +- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, +- &num_instances); ++ /* This is a remote database, we just need the watcher. */ ++ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); + if (!ok) { + DBG_WARNING("Could not parse notifyd entry for %s\n", path); + return 0; + } + +- for (i=0; iinstance.filter; +- uint32_t subdir_filter = instance->instance.subdir_filter; +- int ret; ++ watcher.sys_watch = NULL; ++ watcher.sys_filter = watcher.filter; ++ watcher.sys_subdir_filter = watcher.subdir_filter; + +- /* +- * This is a remote database. Pointers that we were +- * given don't make sense locally. Initialize to NULL +- * in case sys_notify_watch fails. +- */ +- instances[i].sys_watch = NULL; +- +- ret = state->sys_notify_watch( +- db, state->sys_notify_ctx, path, +- &filter, &subdir_filter, +- notifyd_sys_callback, state->msg_ctx, +- &instance->sys_watch); +- if (ret != 0) { +- DBG_WARNING("inotify_watch returned %s\n", +- strerror(errno)); +- } ++ ret = state->sys_notify_watch(db, ++ state->sys_notify_ctx, ++ path, ++ &watcher.filter, ++ &watcher.subdir_filter, ++ notifyd_sys_callback, ++ state->msg_ctx, ++ &watcher.sys_watch); ++ if (ret != 0) { ++ DBG_WARNING("inotify_watch returned %s\n", strerror(errno)); + } + ++ memcpy(value.dptr, &watcher, sizeof(struct notifyd_watcher)); ++ + return 0; + } + +@@ -1193,21 +1287,17 @@ static int notifyd_db_del_syswatches(struct db_record *rec, void *private_data) + { + TDB_DATA key = dbwrap_record_get_key(rec); + TDB_DATA value = dbwrap_record_get_value(rec); +- struct notifyd_instance *instances = NULL; +- size_t num_instances = 0; +- size_t i; ++ struct notifyd_watcher watcher = {}; + bool ok; + +- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, +- &num_instances); ++ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); + if (!ok) { + DBG_WARNING("Could not parse notifyd entry for %.*s\n", + (int)key.dsize, (char *)key.dptr); + return 0; + } +- for (i=0; ientries database + */ + +-bool notifyd_parse_entry( +- uint8_t *buf, +- size_t buflen, +- struct notifyd_instance **instances, +- size_t *num_instances) ++/** ++ * @brief Parse a notifyd database entry. ++ * ++ * The memory we pass down needs to be aligned. If it isn't aligned we can run ++ * into obscure errors as we just point into the data buffer. ++ * ++ * @param data The data to parse ++ * @param data_len The length of the data to parse ++ * @param watcher A pointer to store the watcher data or NULL. ++ * @param instances A pointer to store the array of notify instances or NULL. ++ * @param pnum_instances The number of elements in the array. If you just want ++ * the number of elements pass NULL for the watcher and instances pointers. ++ * ++ * @return true on success, false if an error occurred. ++ */ ++bool notifyd_parse_entry(uint8_t *data, ++ size_t data_len, ++ struct notifyd_watcher *watcher, ++ struct notifyd_instance **instances, ++ size_t *pnum_instances) + { +- if ((buflen % sizeof(struct notifyd_instance)) != 0) { +- DBG_WARNING("invalid buffer size: %zu\n", buflen); ++ size_t ilen; ++ ++ if (data_len < sizeof(struct notifyd_watcher)) { + return false; + } + +- if (instances != NULL) { +- *instances = (struct notifyd_instance *)buf; ++ if (watcher != NULL) { ++ *watcher = *((struct notifyd_watcher *)(uintptr_t)data); + } +- if (num_instances != NULL) { +- *num_instances = buflen / sizeof(struct notifyd_instance); ++ ++ ilen = data_len - sizeof(struct notifyd_watcher); ++ if ((ilen % sizeof(struct notifyd_instance)) != 0) { ++ return false; ++ } ++ ++ if (pnum_instances != NULL) { ++ *pnum_instances = ilen / sizeof(struct notifyd_instance); + } ++ if (instances != NULL) { ++ /* The (uintptr_t) cast removes a warning from -Wcast-align. */ ++ *instances = ++ (struct notifyd_instance *)(uintptr_t) ++ (data + sizeof(struct notifyd_watcher)); ++ } ++ + return true; + } +diff --git a/source3/smbd/notifyd/notifyd_private.h b/source3/smbd/notifyd/notifyd_private.h +index 36c08f47c54..db8e6e1c005 100644 +--- a/source3/smbd/notifyd/notifyd_private.h ++++ b/source3/smbd/notifyd/notifyd_private.h +@@ -20,30 +20,48 @@ + #include "lib/util/server_id.h" + #include "notifyd.h" + ++ + /* +- * notifyd's representation of a notify instance ++ * Representation of a watcher for a path ++ * ++ * This will be stored in the db. + */ +-struct notifyd_instance { +- struct server_id client; +- struct notify_instance instance; +- +- void *sys_watch; /* inotify/fam/etc handle */ ++struct notifyd_watcher { ++ /* ++ * This is an intersections of the filter the watcher is listening for. ++ */ ++ uint32_t filter; ++ uint32_t subdir_filter; + + /* +- * Filters after sys_watch took responsibility of some bits ++ * Those are inout variables passed to the sys_watcher. The sys_watcher ++ * will remove the bits it can't handle. + */ +- uint32_t internal_filter; +- uint32_t internal_subdir_filter; ++ uint32_t sys_filter; ++ uint32_t sys_subdir_filter; ++ ++ /* The handle for inotify/fam etc. */ ++ void *sys_watch; ++}; ++ ++/* ++ * Representation of a notifyd instance ++ * ++ * This will be stored in the db. ++ */ ++struct notifyd_instance { ++ struct server_id client; ++ struct notify_instance instance; + }; + + /* + * Parse an entry in the notifyd_context->entries database + */ + +-bool notifyd_parse_entry( +- uint8_t *buf, +- size_t buflen, +- struct notifyd_instance **instances, +- size_t *num_instances); ++bool notifyd_parse_entry(uint8_t *data, ++ size_t data_len, ++ struct notifyd_watcher *watcher, ++ struct notifyd_instance **instances, ++ size_t *num_instances); + + #endif +-- +2.46.1 + diff --git a/samba.spec b/samba.spec index 67e3895..0de5d76 100644 --- a/samba.spec +++ b/samba.spec @@ -150,7 +150,7 @@ %define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") -%global samba_version 4.21.0 +%global samba_version 4.21.1 # The release field is extended: # [.][.]%%{?dist}[.] @@ -252,10 +252,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.21.0-backport-freeipa-support.patch -# https://gitlab.com/samba-team/samba/-/merge_requests/3807 -Patch1: samba-4.21.0-ldb-lmdb.patch -Patch2: samba-4-21-fix-libldb-deepbind.patch +Patch0: samba-4.21.0-s3-notifyd.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} diff --git a/sources b/sources index 3e8e284..a1c1a28 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.0.tar.xz) = d05c823afc04669766130745c139e7d129eb9961525453d6da8b5ee6693d4c08192496d07e5c211e86d553956504fb9df16611cc9268111b71b95c7f2fa868a0 -SHA512 (samba-4.21.0.tar.asc) = 7fffbd0b88b42dd7f340e4bcae17da4a68a0f8de86a1e71534a4a02a477a746e4cdb16df7c0da33aaf13278cefb452bd9b7c61ed029e248576f7158e8bec339e +SHA512 (samba-4.21.1.tar.xz) = 182759820708c9df26fbcb09e755e81236ecacf543f3e18a05dbd0ea551ab072d338fe239eb99ff506f158ec45e981a893ce46eacdde6e073ee85ceb43e2669a +SHA512 (samba-4.21.1.tar.asc) = 2c1e4b347044e15a852ced8bb412a3f372fd2c2b5e0001b1a773f7283f2d8fa62942143b46cbc3f16b18882255cf0aac4426002453971361b0002357657484f1 From 16e2ea30c449f8a043680b12aaac21abe6af286a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 15 Oct 2024 11:33:45 +0200 Subject: [PATCH 016/101] rpminspect: Disable inspection of disttag rpminspect just reads the file an doesn't expand it so it doesn't understand: Release: %{samba_release} [skip changelog] --- rpminspect.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index 75d7856..c1455e2 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,4 +1,7 @@ --- +inspections: + disttag: off + badfuncs: ignore: - /usr/bin/nmblookup From a55c2e04452fd163be78a5079c6dc77218e916fc Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 15 Oct 2024 11:57:41 +0200 Subject: [PATCH 017/101] Fix several rpminspect warnings --- samba.spec | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 0de5d76..e44cdd5 100644 --- a/samba.spec +++ b/samba.spec @@ -261,6 +261,7 @@ Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dcerpc = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -438,6 +439,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif @@ -464,6 +466,7 @@ Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -498,6 +501,7 @@ Summary: Libraries used by both Samba servers and clients Requires(pre): samba-common = %{samba_depver} Requires: samba-common = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -538,6 +542,7 @@ Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -574,6 +579,7 @@ Summary: DCE RPC binaries Requires: samba-common-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -634,6 +640,7 @@ Summary: Samba AD Domain Controller Libraries Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} @@ -654,6 +661,7 @@ Requires: %{name}-dc-libs = %{samba_depver} Requires: %{name}-dc = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: bind +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -688,6 +696,7 @@ Summary: Samba VFS module for Ceph distributed storage system Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -703,6 +712,7 @@ Summary: Samba VFS module for io_uring Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -721,6 +731,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -772,6 +783,7 @@ the Kerberos credentials cache of the user issuing the print job. Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %description ldb-ldap-modules This package contains the ldb ldap modules required by samba-tool and @@ -782,6 +794,7 @@ samba-gpupdate. Summary: Samba libraries Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -802,6 +815,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %description -n libnetapi This contains the NETAPI library from the Samba suite. @@ -822,6 +836,7 @@ Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -879,6 +894,7 @@ Requires: python3-requests Requires: python3-talloc Requires: python3-tdb Requires: python3-tevent +Requires: libldb = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} %endif @@ -909,6 +925,7 @@ Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # for ms_forest_updates_markdown.py and ms_schema_markdown.py Requires: python3-markdown +Requires: libldb = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs @@ -944,6 +961,7 @@ Requires: %{name}-test-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} %endif Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Requires: libnetapi = %{samba_depver} %if %{with libsmbclient} Requires: libsmbclient = %{samba_depver} @@ -969,6 +987,7 @@ Summary: Libraries need by the testing tools for Samba servers and clients Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -1006,6 +1025,7 @@ Requires: %{name}-libs = %{samba_depver} Requires(post): %{name}-libs = %{samba_depver} Requires: %{name}-winbind-modules = %{samba_depver} Suggests: %{name}-tools = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires(post): libwbclient = %{samba_depver} @@ -1034,6 +1054,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} +Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} %endif @@ -1057,6 +1078,7 @@ Requires: %{name}-winbind = %{samba_depver} Requires: %{name}-libs = %{samba_depver} %endif Requires: samba-client-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: samba4-winbind-krb5-locator = %{samba_depver} Obsoletes: samba4-winbind-krb5-locator < %{samba_depver} @@ -1099,6 +1121,7 @@ Summary: Samba Winexe Windows Binary License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: libldb = %{samba_depver} Provides: bundled(libreplace) @@ -1219,8 +1242,8 @@ Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} Provides: bundled(libreplace) -Obsoletes: libldb < 2.10 -Provides: libldb = 2.10 +Obsoletes: libldb < 0:2.10 +Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} %description -n libldb @@ -1236,8 +1259,8 @@ Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} -Obsoletes: libldb-devel < 2.10 -Provides: libldb-devel = 2.10 +Obsoletes: libldb-devel < 0:2.10 +Provides: libldb-devel = 0:2.10 Provides: libldb-devel = %{samba_depver} %description -n libldb-devel From 682be9e3984abd64b6bd10423d79e26f99bcf196 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 15 Oct 2024 13:19:08 +0200 Subject: [PATCH 018/101] Fix some more rpminspect warnings --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index e44cdd5..5258f94 100644 --- a/samba.spec +++ b/samba.spec @@ -1271,7 +1271,7 @@ Header files needed to develop programs that link against the LDB library. Summary: Tools to manage LDB files License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} -Obsoletes: ldb-tools < 2.10 +Obsoletes: ldb-tools < 0:2.10 Provides: ldb-tools = %{samba_depver} %description -n ldb-tools @@ -1285,7 +1285,7 @@ Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} %{?python_provide:%python_provide python3-ldb} -Obsoletes: python3-ldb < 2.10 +Obsoletes: python3-ldb < 0:2.10 Provides: python3-ldb = %{samba_depver} # These were the C bindings, only used by Samba Obsoletes: python-ldb-devel-common < 2.10 From 6d5708b5e4b8e9be2742e147c52b1961198d0ef5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Wed, 16 Oct 2024 10:17:10 +0200 Subject: [PATCH 019/101] Fix even more rpminspect warnings --- samba.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/samba.spec b/samba.spec index 5258f94..acaed49 100644 --- a/samba.spec +++ b/samba.spec @@ -641,6 +641,7 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} @@ -662,6 +663,7 @@ Requires: %{name}-dc = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: bind Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -697,6 +699,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -713,6 +716,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -784,6 +788,7 @@ Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description ldb-ldap-modules This package contains the ldb ldap modules required by samba-tool and @@ -816,6 +821,7 @@ Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description -n libnetapi This contains the NETAPI library from the Samba suite. @@ -926,6 +932,7 @@ Requires: python3-%{name} = %{samba_depver} # for ms_forest_updates_markdown.py and ms_schema_markdown.py Requires: python3-markdown Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} %description -n python3-samba-dc The python3-%{name}-dc package contains the Python libraries needed by programs @@ -1122,6 +1129,7 @@ License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} +Requires: libwbclient = %{samba_depver} Provides: bundled(libreplace) @@ -1283,6 +1291,7 @@ Summary: Python bindings for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} Requires: python3-tdb%{?_isa} >= %{tdb_version} +Requires: samba-client-libs = %{samba_depver} %{?python_provide:%python_provide python3-ldb} Obsoletes: python3-ldb < 0:2.10 From 1caea566a46616d21248b4a2ce7c87b7abf3b131 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 17 Oct 2024 11:39:31 +0200 Subject: [PATCH 020/101] Revert "Re-enable linking with mold on i686" This reverts commit ac58d580e8ff60046b6600a1f6c843391ae1ffdd. This is to address debuginfo issue reported by rpminspect for i686: https://bugzilla.redhat.com/show_bug.cgi?id=2318727 --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index acaed49..4001c34 100644 --- a/samba.spec +++ b/samba.spec @@ -353,7 +353,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch riscv64 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 BuildRequires: mold %endif @@ -1365,13 +1365,13 @@ export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" # Use the mold linker if possible export python_LDFLAGS="$(echo %{__global_ldflags} | sed -e 's/-Wl,-z,defs//g')" -%ifnarch riscv64 +%ifnarch i686 riscv64 %if 0%{?fedora} >= 37 export LDFLAGS="%{__global_ldflags} -fuse-ld=mold" export python_LDFLAGS="$(echo ${LDFLAGS} | sed -e 's/-Wl,-z,defs//g')" #endif fedora >= 37 %endif -#endif narch riscv64 +#endif narch i686 %endif # Add support for mock ccache plugin From a98899c6d21a92fdb6b5ab406297406e8c7af2d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 22 Oct 2024 11:02:58 +0200 Subject: [PATCH 021/101] Fix samba 4.20 -> 4.21 upgrade for the removed python3-samba-devel --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 4001c34..cee1bec 100644 --- a/samba.spec +++ b/samba.spec @@ -685,6 +685,8 @@ Requires: libnetapi = %{samba_depver} Provides: samba4-devel = %{samba_depver} Obsoletes: samba4-devel < %{samba_depver} +Provides: python3-samba-devel = %{samba_depver} +Obsoletes: python3-samba-devel < %{samba_depver} %description devel The %{name}-devel package contains the header files for the libraries From 4ae2996e49becec13fe8a30bed92b3a9a9330170 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 22 Oct 2024 13:42:50 +0100 Subject: [PATCH 022/101] Rebuild for Jansson 2.14 (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/3PYINSQGKQ4BB25NQUI2A2UCGGLAG5ND/) From 667e752f95dad7cfb1526eb3d0f54a65e0e38386 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Fri, 25 Oct 2024 19:42:31 +0200 Subject: [PATCH 023/101] Add always to samba-devel: Requires: samba-dc-libs --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index cee1bec..8867bf8 100644 --- a/samba.spec +++ b/samba.spec @@ -678,9 +678,7 @@ name server related details of Samba AD. Summary: Developer tools for Samba libraries Requires: %{name}-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -%if %{with dc} Requires: %{name}-dc-libs = %{samba_depver} -%endif Requires: libnetapi = %{samba_depver} Provides: samba4-devel = %{samba_depver} From f654bad3bbb3968dd029d795205d4879bda2e864 Mon Sep 17 00:00:00 2001 From: Anoop C S Date: Wed, 13 Nov 2024 11:29:47 +0530 Subject: [PATCH 024/101] Remove unused macro samba_requires_eq This was previously used to force the installation of a matching libldb version from build time. With libldb now versioned along with Samba as a public library its usage got removed in d0472882 but the definition remained as a left over. Signed-off-by: Anoop C S --- samba.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/samba.spec b/samba.spec index 8867bf8..57b412a 100644 --- a/samba.spec +++ b/samba.spec @@ -148,8 +148,6 @@ %bcond lmdb 0 %endif -%define samba_requires_eq() %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not") - %global samba_version 4.21.1 # The release field is extended: From 438b8a6e95335df41efa69442b7aef2bc246f51c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 25 Nov 2024 18:55:39 +0100 Subject: [PATCH 025/101] Update to version 4.21.2 - resolves: rhbz#2328717 --- samba.spec | 11 +++++++++-- sources | 4 ++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 57b412a..c3a8da1 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.1 +%global samba_version 4.21.2 # The release field is extended: # [.][.]%%{?dist}[.] @@ -1584,6 +1584,12 @@ cp -a lib/ldb/apidocs/man/* %{buildroot}%{_mandir} rm -f %{buildroot}%{_mandir}/man3/_* rm -f %{buildroot}%{_mandir}/man3/PyLdb* +# CTDB +%if %{with clustering} +touch %{buildroot}%{_libexecdir}/ctdb/statd_callout +#endif with clustering +%endif + %if %{with testsuite} %check # @@ -2640,6 +2646,7 @@ fi %{python3_sitearch}/samba/dcerpc/ntlmssp.*.so %{python3_sitearch}/samba/dcerpc/preg.*.so %{python3_sitearch}/samba/dcerpc/samr.*.so +%{python3_sitearch}/samba/dcerpc/schannel.*.so %{python3_sitearch}/samba/dcerpc/security.*.so %{python3_sitearch}/samba/dcerpc/server_id.*.so %{python3_sitearch}/samba/dcerpc/smb_acl.*.so @@ -3809,7 +3816,7 @@ fi %{_sysconfdir}/ctdb/functions %{_sysconfdir}/ctdb/nfs-linux-kernel-callout -%{_sysconfdir}/ctdb/statd-callout +%ghost %{_sysconfdir}/ctdb/statd-callout # CTDB scripts, no config files # script with executable bit means activated diff --git a/sources b/sources index a1c1a28..285808c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.1.tar.xz) = 182759820708c9df26fbcb09e755e81236ecacf543f3e18a05dbd0ea551ab072d338fe239eb99ff506f158ec45e981a893ce46eacdde6e073ee85ceb43e2669a -SHA512 (samba-4.21.1.tar.asc) = 2c1e4b347044e15a852ced8bb412a3f372fd2c2b5e0001b1a773f7283f2d8fa62942143b46cbc3f16b18882255cf0aac4426002453971361b0002357657484f1 +SHA512 (samba-4.21.2.tar.xz) = c26311a60d3994561aa12c36e54bc37d1161ec1063aa9876ea03dee24984e9c827e5836dc86bc392e37193010275a642b960e775b5a9e029246ba56ae1697682 +SHA512 (samba-4.21.2.tar.asc) = f3da123d2e86a7e07c4fcb83924edd29195d865091d80125f3531c463662a8a38ba6d8c467932af8cd065d0cc4467131c83a4e3783573b757f6ed9c2bde0befc From e2b080c313ae5af530b0b830bd5bf9f6af216cad Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 26 Nov 2024 14:52:12 +0100 Subject: [PATCH 026/101] Add python3-crypt-r as requirement for samba-tool --- samba.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/samba.spec b/samba.spec index c3a8da1..9fd763b 100644 --- a/samba.spec +++ b/samba.spec @@ -565,6 +565,9 @@ Requires: lmdb %endif Requires: tdb-tools Requires: python3-gpg +# The `crypt` module has been removed in Python 3.13, this is a copy +# See also python3-crypt-r.x86_64 +Requires: python3-crypt-r %endif %description tools From 1af6d0aa01aa45a9bca5051d056cb3cd5660777e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:45:39 +0100 Subject: [PATCH 027/101] Add missing BuildRequires for running the testsuite [skip changelog] --- samba.spec | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 9fd763b..771e79f 100644 --- a/samba.spec +++ b/samba.spec @@ -419,6 +419,36 @@ BuildRequires: tdb-tools %endif #endif with dc || with testsuite + +%if %{with testsuite} +BuildRequires: bind-utils +BuildRequires: glibc-langpack-en +BuildRequires: git +BuildRequires: gnutls-utils +BuildRequires: jq +BuildRequires: krb5-pkinit +BuildRequires: krb5-workstation +BuildRequires: lmdb +BuildRequires: nss_wrapper +BuildRequires: pam_wrapper +BuildRequires: perl-Archive-Tar +BuildRequires: perl-Digest-MD5 +BuildRequires: perl-ExtUtils-MakeMaker +BuildRequires: perl-JSON +BuildRequires: perl-JSON-Parse +BuildRequires: perl-Parse-Yapp +BuildRequires: perl-Test-Base +BuildRequires: psmisc +BuildRequires: python3-libpamtest +# The `crypt` module has been removed in Python 3.13, this is a copy +# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 +BuildRequires: python3-crypt-r +BuildRequires: resolv_wrapper +BuildRequires: rsync +BuildRequires: socket_wrapper +BuildRequires: sudo +BuildRequires: uid_wrapper +#endif with testsuite %endif # filter out perl requirements pulled in from examples in the docdir. @@ -566,7 +596,7 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg # The `crypt` module has been removed in Python 3.13, this is a copy -# See also python3-crypt-r.x86_64 +# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 Requires: python3-crypt-r %endif From a5688d299c0d43fe960e3e57535c3e1fdcb392bf Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:48:35 +0100 Subject: [PATCH 028/101] Rework 'with testsuite' In case we run the testsuite, the %install part will be skipped. Without the testsuite, the %check section will be skipped. [skip changelog] --- samba.spec | 896 ++--------------------------------------------------- 1 file changed, 21 insertions(+), 875 deletions(-) diff --git a/samba.spec b/samba.spec index 771e79f..039caad 100644 --- a/samba.spec +++ b/samba.spec @@ -400,7 +400,7 @@ BuildRequires: libtdb-devel >= %{tdb_version} BuildRequires: python3-tdb >= %{tdb_version} %endif -%if %{with dc} || %{with testsuite} +%if %{with dc} BuildRequires: bind BuildRequires: krb5-server >= %{required_mit_krb5} %if 0%{?fedora} || 0%{?rhel} >= 9 @@ -418,7 +418,8 @@ BuildRequires: tdb-tools #endif without includelibs %endif -#endif with dc || with testsuite +#endif with dc +%endif %if %{with testsuite} BuildRequires: bind-utils @@ -1206,30 +1207,6 @@ projects to store temporary data. If an application is already using TDB for temporary data it is very easy to convert that application to be cluster aware and use CTDB instead. -%if %{with testsuite} -### CTDB-TEST -%package -n ctdb-tests -Summary: CTDB clustered database test suite - -Requires: %{name}-common-libs = %{samba_depver} -Requires: %{name}-client-libs = %{samba_depver} - -Requires: ctdb = %{samba_depver} -Recommends: nc - -Provides: ctdb-devel = %{samba_depver} -Obsoletes: ctdb-devel < %{samba_depver} - -%description -n ctdb-tests -Test suite for CTDB. -CTDB is a cluster implementation of the TDB database used by Samba and other -projects to store temporary data. If an application is already using TDB for -temporary data it is very easy to convert that application to be cluster aware -and use CTDB instead. - -#endif with testsuite -%endif - %if %{with pcp_pmda} %package -n ctdb-pcp-pmda @@ -1481,6 +1458,7 @@ doxygen Doxyfile popd %install +%if !%{with testsuite} # Do not use %%make_install, make is just a wrapper around waf in Samba! %{__make} %{?_smp_mflags} %{_make_verbose} install DESTDIR=%{buildroot} @@ -1623,8 +1601,11 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout #endif with clustering %endif -%if %{with testsuite} +#endif !with testsuite +%endif + %check +%if %{with testsuite} # # samba3.smb2.timestamps.*: # @@ -1648,6 +1629,7 @@ export WINBINDD_DONT_LOG_STDOUT=1 #endif with testsuite %endif +%if !%{with testsuite} %post %systemd_post samba-bgqd.service %systemd_post smb.service @@ -1691,7 +1673,7 @@ fi %ldconfig_scriptlets common-libs -%if %{with dc} || %{with testsuite} +%if %{with dc} %ldconfig_scriptlets dc-libs %post dc @@ -1793,7 +1775,7 @@ fi %{_sbindir}/eventlogadm %{_sbindir}/nmbd %{_sbindir}/smbd -%if %{with dc} || %{with testsuite} +%if %{with dc} # This is only used by vfs_dfs_samba4 %{_libdir}/samba/libdfs-server-ad-private-samba.so %endif @@ -1811,7 +1793,7 @@ fi %{_libdir}/samba/vfs/commit.so %{_libdir}/samba/vfs/crossrename.so %{_libdir}/samba/vfs/default_quota.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/vfs/dfs_samba4.so %endif %{_libdir}/samba/vfs/dirsort.so @@ -1844,10 +1826,6 @@ fi %{_libdir}/samba/vfs/worm.so %{_libdir}/samba/vfs/xattr_tdb.so -%if %{with testsuite} -%{_libdir}/samba/vfs/nfs4acl_xattr.so -%endif - %dir %{_libexecdir}/samba %{_libexecdir}/samba/samba-bgqd @@ -2179,16 +2157,13 @@ fi %{_libexecdir}/samba/rpcd_fsrvp %{_libexecdir}/samba/rpcd_lsad %{_libexecdir}/samba/rpcd_mdssvc -%if %{with testsuite} -%{_libexecdir}/samba/rpcd_rpcecho -%endif %{_libexecdir}/samba/rpcd_spoolss %{_libexecdir}/samba/rpcd_winreg %{_libexecdir}/samba/rpcd_witness %{_mandir}/man8/samba-dcerpcd.8* ### DC -%if %{with dc} || %{with testsuite} +%if %{with dc} %files dc %{_unitdir}/samba.service %{_sbindir}/samba @@ -2266,7 +2241,7 @@ fi %license source4/setup/ad-schema/licence.txt %{_datadir}/samba/setup -#endif with dc || with testsuite +#endif with dc %endif ### DC-LIBS %files dc-libs @@ -2274,16 +2249,12 @@ fi %{_libdir}/samba/libauth4-private-samba.so %{_libdir}/samba/libsamba-net-private-samba.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/libdb-glue-private-samba.so %{_libdir}/samba/libpac-private-samba.so %{_libdir}/samba/libprocess-model-private-samba.so %{_libdir}/samba/libservice-private-samba.so -%if %{with testsuite} -%{_libdir}/samba/libntvfs-private-samba.so -%endif - %dir %{_libdir}/samba/process_model %{_libdir}/samba/process_model/prefork.so %{_libdir}/samba/process_model/standard.so @@ -2302,10 +2273,6 @@ fi %{_libdir}/samba/service/winbindd.so %{_libdir}/samba/service/wrepl.so -%if %{with testsuite} -%{_libdir}/samba/service/smb.so -%endif - %{_libdir}/libdcerpc-server.so.* %{_libdir}/samba/libad-claims-private-samba.so %{_libdir}/samba/libauthn-policy-util-private-samba.so @@ -2440,7 +2407,7 @@ fi %{_libdir}/libsamba-policy.so %{_libdir}/libsmbldap.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_includedir}/samba-4.0/dcerpc_server.h %{_libdir}/libdcerpc-server.so %{_libdir}/pkgconfig/dcerpc_server.pc @@ -3126,7 +3093,7 @@ fi %{python3_sitearch}/samba/__pycache__/uptodateness.*.pyc %{python3_sitearch}/samba/dcerpc/dnsserver.*.so -%if %{with dc} || %{with testsuite} +%if %{with dc} %{python3_sitearch}/samba/dckeytab.*.so %endif %{python3_sitearch}/samba/domain_update.py @@ -3770,21 +3737,12 @@ fi %{_mandir}/man1/ndrdump.1* %{_mandir}/man1/smbtorture.1* -%if %{with testsuite} -%{_mandir}/man1/vfstest.1* -# files to ignore in testsuite mode -%{_libdir}/samba/libnss-wrapper.so -%{_libdir}/samba/libsocket-wrapper.so -%{_libdir}/samba/libuid-wrapper.so -%endif - ### TEST-LIBS %files test-libs -%if %{with dc} || %{with testsuite} +%if %{with dc} %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so -%else -%{_libdir}/samba/libdsdb-module-private-samba.so %endif +%{_libdir}/samba/libdsdb-module-private-samba.so ### USERSHARES %files usershares @@ -3940,820 +3898,6 @@ fi %dir %{_datadir}/ctdb/scripts %{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh -%if %{with testsuite} -%files -n ctdb-tests -%doc ctdb/tests/README -%{_bindir}/ctdb_local_daemons -%{_bindir}/ctdb_run_tests -%{_bindir}/ctdb_run_cluster_tests - -%dir %{_libexecdir}/ctdb -%dir %{_libexecdir}/ctdb/tests -%{_libexecdir}/ctdb/tests/cluster_mutex_test -%{_libexecdir}/ctdb/tests/cmdline_test -%{_libexecdir}/ctdb/tests/comm_client_test -%{_libexecdir}/ctdb/tests/comm_server_test -%{_libexecdir}/ctdb/tests/comm_test -%{_libexecdir}/ctdb/tests/conf_test -%{_libexecdir}/ctdb/tests/ctdb-db-test -%{_libexecdir}/ctdb/tests/ctdb_io_test -%{_libexecdir}/ctdb/tests/ctdb_packet_parse -%{_libexecdir}/ctdb/tests/ctdb_takeover_tests -%{_libexecdir}/ctdb/tests/db_hash_test -%{_libexecdir}/ctdb/tests/dummy_client -%{_libexecdir}/ctdb/tests/errcode -%{_libexecdir}/ctdb/tests/event_protocol_test -%{_libexecdir}/ctdb/tests/event_script_test -%{_libexecdir}/ctdb/tests/fake_ctdbd -%{_libexecdir}/ctdb/tests/fetch_loop -%{_libexecdir}/ctdb/tests/fetch_loop_key -%{_libexecdir}/ctdb/tests/fetch_readonly -%{_libexecdir}/ctdb/tests/fetch_readonly_loop -%{_libexecdir}/ctdb/tests/fetch_ring -%{_libexecdir}/ctdb/tests/g_lock_loop -%{_libexecdir}/ctdb/tests/hash_count_test -%{_libexecdir}/ctdb/tests/line_test -%{_libexecdir}/ctdb/tests/lock_tdb -%{_libexecdir}/ctdb/tests/message_ring -%{_libexecdir}/ctdb/tests/pidfile_test -%{_libexecdir}/ctdb/tests/pkt_read_test -%{_libexecdir}/ctdb/tests/pkt_write_test -%{_libexecdir}/ctdb/tests/porting_tests -%{_libexecdir}/ctdb/tests/protocol_basic_test -%{_libexecdir}/ctdb/tests/protocol_ctdb_compat_test -%{_libexecdir}/ctdb/tests/protocol_ctdb_test -%{_libexecdir}/ctdb/tests/protocol_types_compat_test -%{_libexecdir}/ctdb/tests/protocol_types_test -%{_libexecdir}/ctdb/tests/protocol_util_test -%{_libexecdir}/ctdb/tests/rb_test -%{_libexecdir}/ctdb/tests/reqid_test -%{_libexecdir}/ctdb/tests/run_event_test -%{_libexecdir}/ctdb/tests/run_proc_test -%{_libexecdir}/ctdb/tests/sigcode -%{_libexecdir}/ctdb/tests/sock_daemon_test -%{_libexecdir}/ctdb/tests/sock_io_test -%{_libexecdir}/ctdb/tests/srvid_test -%{_libexecdir}/ctdb/tests/system_socket_test -%{_libexecdir}/ctdb/tests/tmon_ping_test -%{_libexecdir}/ctdb/tests/tmon_test -%{_libexecdir}/ctdb/tests/transaction_loop -%{_libexecdir}/ctdb/tests/tunable_test -%{_libexecdir}/ctdb/tests/tunnel_cmd -%{_libexecdir}/ctdb/tests/tunnel_test -%{_libexecdir}/ctdb/tests/update_record -%{_libexecdir}/ctdb/tests/update_record_persistent - -%dir %{_datadir}/ctdb/tests -%dir %{_datadir}/ctdb/tests/CLUSTER -%dir %{_datadir}/ctdb/tests/CLUSTER/complex -%{_datadir}/ctdb/tests/CLUSTER/complex/11_ctdb_delip_removes_ip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/18_ctdb_reloadips.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/30_nfs_tickle_killtcp.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/31_nfs_tickle.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/32_cifs_tickle.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/33_gratuitous_arp.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/34_nfs_tickle_restart.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/36_smb_reset_server.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/37_nfs_reset_server.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/41_failover_ping_discrete.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/42_failover_ssh_hostname.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/43_failover_nfs_basic.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/44_failover_nfs_oneway.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/45_failover_nfs_kill.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/60_rogueip_releaseip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/61_rogueip_takeip.sh -%{_datadir}/ctdb/tests/CLUSTER/complex/README - -%dir %{_datadir}/ctdb/tests/CLUSTER/complex/scripts -%{_datadir}/ctdb/tests/CLUSTER/complex/scripts/local.bash - -%dir %{_datadir}/ctdb/tests/etc-ctdb -%dir %{_datadir}/ctdb/tests/etc-ctdb/events -%dir %{_datadir}/ctdb/tests/etc-ctdb/events/legacy -%{_datadir}/ctdb/tests/etc-ctdb/events/legacy/00.test.script -%dir %{_datadir}/ctdb/tests/INTEGRATION -%dir %{_datadir}/ctdb/tests/INTEGRATION/database -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.001.attach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.002.attach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.003.detach.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.004.wipe.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/basics.010.backup_restore.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/fetch.001.ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/fetch.002.ring-hotkeys.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/readonly.001.basic.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.001.volatile.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.002.large.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.003.no_resurrect.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.010.persistent.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/recovery.011.continue.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/database/scripts -%{_datadir}/ctdb/tests/INTEGRATION/database/scripts/local.bash -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.001.ptrans.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.002.loop.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.003.loop_recovery.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.004.update_record.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/transaction.010.loop_recovery.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/traverse.001.one.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/traverse.002.many.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.001.fast.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.002.full.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.003.recreate.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.030.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.031.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.032.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.033.locked.sh -%{_datadir}/ctdb/tests/INTEGRATION/database/vacuum.034.locked.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/failover -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.001.list.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.010.addip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.011.delip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.012.reloadips.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.013.failover_noop.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.014.iface_gc.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.020.moveip.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.030.disable_enable.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.032.stop_continue.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.040.NoIPTakeover.sh -%{_datadir}/ctdb/tests/INTEGRATION/failover/pubips.050.missing_ip.sh -%dir %{_datadir}/ctdb/tests/INTEGRATION/simple -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.000.onnode.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.001.listnodes.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.002.tunables.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.003.ping.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.004.getpid.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.005.process_exists.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.010.statistics.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/basics.011.statistics_reset.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.001.stop_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.002.ban_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.003.capability_leader_yield.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.006.stop_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.007.ban_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.008.capability_leader_yield_no_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.010.getrelock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.012.reclock_command.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.015.reclock_remove_lock.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.016.reclock_move_lock_dir.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.020.message_ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.021.tunnel_ring.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.030.node_stall_leader_timeout.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.090.unreachable.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/cluster.091.version_check.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.001.getdebug.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.002.setdebug.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/debug.003.dumpmemory.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/eventscripts.001.zero_scripts.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/eventscripts.090.debug_hung.sh -%{_datadir}/ctdb/tests/INTEGRATION/simple/README -%dir %{_datadir}/ctdb/tests/scripts -%{_datadir}/ctdb/tests/scripts/cluster.bash -%{_datadir}/ctdb/tests/scripts/common.sh -%{_datadir}/ctdb/tests/scripts/integration.bash -%{_datadir}/ctdb/tests/scripts/integration_local_daemons.bash -%{_datadir}/ctdb/tests/scripts/integration_real_cluster.bash -%{_datadir}/ctdb/tests/scripts/script_install_paths.sh -%{_datadir}/ctdb/tests/scripts/test_wrap -%{_datadir}/ctdb/tests/scripts/unit.sh -%dir %{_datadir}/ctdb/tests/UNIT -%dir %{_datadir}/ctdb/tests/UNIT/cunit -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cluster_mutex_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/cmdline_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/comm_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/comm_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/conf_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_004.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_005.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_006.sh -%{_datadir}/ctdb/tests/UNIT/cunit/config_test_007.sh -%{_datadir}/ctdb/tests/UNIT/cunit/ctdb_io_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/db_hash_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/event_protocol_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/event_script_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/hash_count_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/line_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/path_tests_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pidfile_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pkt_read_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/pkt_write_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/porting_tests_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_012.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_101.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_111.sh -%{_datadir}/ctdb/tests/UNIT/cunit/protocol_test_201.sh -%{_datadir}/ctdb/tests/UNIT/cunit/rb_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/reqid_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/run_event_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/run_proc_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/sock_daemon_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/sock_io_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/srvid_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/system_socket_test_003.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_001.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tmon_test_002.sh -%{_datadir}/ctdb/tests/UNIT/cunit/tunable_test_001.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventd -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/ctdb.conf -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/debug-script.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data/03.notalink.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/data/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/empty -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/empty/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/01.test.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/02.test.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/multi/03.test.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/01.disabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/02.enabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/a.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/events/random/README.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data/01.dummy.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/data/02.disabled.script -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/empty -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/empty/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/01.disabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/02.enabled.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/a.script -%{_datadir}/ctdb/tests/UNIT/eventd/etc-ctdb/share/events/random/README.script -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_001.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_002.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_003.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_004.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_005.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_006.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_007.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_008.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_009.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_011.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_012.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_013.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_014.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_021.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_022.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_023.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_024.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_031.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_032.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_033.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_041.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_042.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_043.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_044.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_051.sh -%{_datadir}/ctdb/tests/UNIT/eventd/eventd_052.sh -%{_datadir}/ctdb/tests/UNIT/eventd/README -%dir %{_datadir}/ctdb/tests/UNIT/eventd/scripts -%{_datadir}/ctdb/tests/UNIT/eventd/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/00.ctdb.init.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/01.reclock.init.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/05.system.monitor.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/06.nfs.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.init.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.016.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.monitor.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.multi.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/10.interface.takeip.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.025.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.031.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.041.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.042.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.051.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.052.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.053.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/11.natgw.054.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.009.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.010.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.015.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.016.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.017.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.018.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.019.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/13.per_ip_routing.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/20.multipathd.monitor.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/31.clamd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/31.clamd.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/40.vsftpd.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/41.httpd.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/48.netbios.shutdown.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/48.netbios.startup.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.monitor.102.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/49.winbind.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.103.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.104.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.105.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.106.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.110.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.111.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.112.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.monitor.113.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.shutdown.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/50.samba.startup.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.101.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.102.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.103.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.104.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.105.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.106.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.107.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.108.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.109.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.111.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.112.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.113.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.114.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.121.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.122.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.131.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.132.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.141.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.142.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.143.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.144.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.151.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.152.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.153.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.161.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.monitor.162.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.multi.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.multi.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.releaseip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.releaseip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.takeip.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/60.nfs.takeip.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.011.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.012.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.013.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.ipreallocated.014.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.monitor.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.shutdown.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.shutdown.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/91.lvs.startup.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.007.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.008.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.021.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.022.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.023.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.024.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.025.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.026.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.027.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/debug_locks.sh.028.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb/public_addresses -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc-ctdb/rc.local -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d/nfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/init.d/nfslock -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/samba -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/samba/smb.conf -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/etc/sysconfig -%{_datadir}/ctdb/tests/UNIT/eventscripts/etc/sysconfig/nfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/README -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/scripts -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/00.ctdb.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/01.reclock.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/05.system.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/06.nfs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/10.interface.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/11.natgw.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/13.per_ip_routing.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/20.multipathd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/31.clamd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/40.vsftpd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/41.httpd.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/48.netbios.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/49.winbind.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/50.samba.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/60.nfs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/91.lvs.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/debug_locks.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/scripts/statd-callout.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.001.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.002.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.003.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.004.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.005.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.006.sh -%{_datadir}/ctdb/tests/UNIT/eventscripts/statd-callout.007.sh -%dir %{_datadir}/ctdb/tests/UNIT/eventscripts/stubs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb-config -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_killtcp -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_lvs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ctdb_natgw -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/date -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/df -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ethtool -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/exportfs -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/gstack -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/id -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ip6tables -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/iptables -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ipvsadm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/kill -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/killall -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/multipath -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/net -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfs-fake-callout -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/nfsconf -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pidof -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/pkill -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ps -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.lockd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.mountd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.rquotad -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpc.statd -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/rpcinfo -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/service -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/sleep -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/smnotify -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/ss -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/stat -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdb_mutex_check -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbdump -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/tdbtool -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/testparm -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/timeout -%{_datadir}/ctdb/tests/UNIT/eventscripts/stubs/wbinfo -%dir %{_datadir}/ctdb/tests/UNIT/onnode -%{_datadir}/ctdb/tests/UNIT/onnode/0001.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0002.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0003.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0004.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0005.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0006.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0010.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0011.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0070.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0071.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0072.sh -%{_datadir}/ctdb/tests/UNIT/onnode/0075.sh -%dir %{_datadir}/ctdb/tests/UNIT/onnode/etc-ctdb -%{_datadir}/ctdb/tests/UNIT/onnode/etc-ctdb/nodes -%dir %{_datadir}/ctdb/tests/UNIT/onnode/scripts -%{_datadir}/ctdb/tests/UNIT/onnode/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/onnode/stubs -%{_datadir}/ctdb/tests/UNIT/onnode/stubs/ctdb -%{_datadir}/ctdb/tests/UNIT/onnode/stubs/ssh -%dir %{_datadir}/ctdb/tests/UNIT/shellcheck -%{_datadir}/ctdb/tests/UNIT/shellcheck/base_scripts.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/ctdb_helpers.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/event_scripts.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/functions.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/init_script.sh -%dir %{_datadir}/ctdb/tests/UNIT/shellcheck/scripts -%{_datadir}/ctdb/tests/UNIT/shellcheck/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/tests.sh -%{_datadir}/ctdb/tests/UNIT/shellcheck/tools.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover -%{_datadir}/ctdb/tests/UNIT/takeover/det.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/det.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/det.003.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover_helper -%{_datadir}/ctdb/tests/UNIT/takeover_helper/000.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/010.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/011.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/012.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/013.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/014.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/016.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/017.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/018.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/019.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/021.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/022.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/023.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/024.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/025.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/026.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/027.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/028.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/030.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/031.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/110.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/111.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/120.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/121.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/122.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/130.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/131.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/132.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/140.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/150.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/160.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/210.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/211.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/220.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/230.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/240.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/250.sh -%{_datadir}/ctdb/tests/UNIT/takeover_helper/260.sh -%dir %{_datadir}/ctdb/tests/UNIT/takeover_helper/scripts -%{_datadir}/ctdb/tests/UNIT/takeover_helper/scripts/local.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.003.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.004.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.005.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.006.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.007.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.008.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.009.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.010.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.011.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.012.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.013.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.014.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.015.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.016.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.024.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.025.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.027.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.028.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.029.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.030.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.031.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.032.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.033.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.034.sh -%{_datadir}/ctdb/tests/UNIT/takeover/lcp2.035.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.001.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.002.sh -%{_datadir}/ctdb/tests/UNIT/takeover/nondet.003.sh -%{_datadir}/ctdb/tests/UNIT/takeover/README -%dir %{_datadir}/ctdb/tests/UNIT/takeover/scripts -%{_datadir}/ctdb/tests/UNIT/takeover/scripts/local.sh -%dir %{_datadir}/ctdb/tests/UNIT/tool -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.attach.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ban.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.catdb.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.catdb.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.cattdb.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.cattdb.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.continue.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.deletekey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.disable.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.enable.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getcapabilities.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbmap.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbseqnum.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbseqnum.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbstatus.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getdbstatus.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getpid.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getpid.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getreclock.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getreclock.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getvar.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.getvar.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ifaces.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ip.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ipinfo.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.leader.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listnodes.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.listvars.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.008.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.lvs.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.008.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.natgw.010.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.006.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.nodestatus.007.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pdelete.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ping.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pnn.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.process-exists.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.pstore.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.ptrans.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.readkey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.recover.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.011.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.012.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.013.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.014.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.015.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.016.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.017.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.018.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.019.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.020.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.021.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.023.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.reloadnodes.024.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.runstate.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbreadonly.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.004.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdbsticky.005.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setdebug.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setifacelink.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setifacelink.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setvar.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.setvar.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.status.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.stop.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.002.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.unban.003.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.uptime.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/ctdb.writekey.001.sh -%{_datadir}/ctdb/tests/UNIT/tool/README -%dir %{_datadir}/ctdb/tests/UNIT/tool/scripts -%{_datadir}/ctdb/tests/UNIT/tool/scripts/local.sh -#endif with selftest -%endif - %if %{with pcp_pmda} %files -n ctdb-pcp-pmda %dir %{_localstatedir}/lib/pcp/pmdas/ctdb @@ -4846,6 +3990,8 @@ fi %{_libdir}/samba/libpyldb-util.cpython-*-private-samba.so %{python3_sitearch}/_ldb_text.py %{python3_sitearch}/__pycache__/_ldb_text.cpython-*.py* +#endif !with testsuite +%endif %changelog %autochangelog From b0f6e67bbc2238f365056aa0f264c437c4e07159 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 27 Nov 2024 17:50:17 +0100 Subject: [PATCH 029/101] Add missing SAMBA_DCERPCD_DONT_LOG_STDOUT=1 for the testsuite [skip changelog] --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 039caad..c45bb11 100644 --- a/samba.spec +++ b/samba.spec @@ -1625,6 +1625,7 @@ export TDB_NO_FSYNC=1 export NMBD_DONT_LOG_STDOUT=1 export SMBD_DONT_LOG_STDOUT=1 export WINBINDD_DONT_LOG_STDOUT=1 +export SAMBA_DCERPCD_DONT_LOG_STDOUT=1 %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 #endif with testsuite %endif From 6b05011701d1266df1099baf1daa6dd2c0d44f45 Mon Sep 17 00:00:00 2001 From: Pete Walter Date: Sun, 8 Dec 2024 22:44:21 +0000 Subject: [PATCH 030/101] Rebuild for ICU 76 From d70953a5edf7f4ccc6b9be7958d739e30f8f861c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 10:42:42 +0100 Subject: [PATCH 031/101] Update to version 4.21.3 - resolves: rhbz#2335911 --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index c45bb11..b956d6d 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.2 +%global samba_version 4.21.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 285808c..1055c45 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.2.tar.xz) = c26311a60d3994561aa12c36e54bc37d1161ec1063aa9876ea03dee24984e9c827e5836dc86bc392e37193010275a642b960e775b5a9e029246ba56ae1697682 -SHA512 (samba-4.21.2.tar.asc) = f3da123d2e86a7e07c4fcb83924edd29195d865091d80125f3531c463662a8a38ba6d8c467932af8cd065d0cc4467131c83a4e3783573b757f6ed9c2bde0befc +SHA512 (samba-4.21.3.tar.xz) = 62eb3bfe1aa1cc8aa68055d4caf21bdea6d6f5b0f767566bef1da210100b5dd17b7d60f5c47da01b0123d3a2c1c3689b1960ef2c2cbd4f804ff998ead994fc3f +SHA512 (samba-4.21.3.tar.asc) = 11e40d32b783b7d57d3f35fe96a17e897719f65d796d965b371dfb58b8cf1f8ffe60c3047bea8c2b2b0d475fa55cd25237b9ba84d44b3d65a8cd53c6af760957 From a7c8b51b0f13bd381d5cab73a48f9583d6b5ae56 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 13:27:35 +0100 Subject: [PATCH 032/101] Use upstream Patch instead of python3-crypt-r --- samba-4-21-pycrypt.patch | 853 +++++++++++++++++++++++++++++++++++++++ samba.spec | 5 +- 2 files changed, 855 insertions(+), 3 deletions(-) create mode 100644 samba-4-21-pycrypt.patch diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch new file mode 100644 index 0000000..8c197fc --- /dev/null +++ b/samba-4-21-pycrypt.patch @@ -0,0 +1,853 @@ +From 93bc860e8f344a96d0496edbc5d463f2c5411fcd Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 5 Dec 2024 16:35:51 +1300 +Subject: [PATCH 01/10] util: add a crypt wrapper, derived from + dsdb:password_hash + +This is going to be used by the dsdb password_hash module, and exposed +to Python via pyglue. + +We're doing this because Python 3.13 has dropped crypt from the Python +standard library. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Reviewed-by: Andreas Schneider +--- + lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ + lib/util/util_crypt.h | 5 +++ + lib/util/wscript_build | 6 +++ + 3 files changed, 101 insertions(+) + create mode 100644 lib/util/util_crypt.c + create mode 100644 lib/util/util_crypt.h + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +new file mode 100644 +index 00000000000..0f7b2d0fd31 +--- /dev/null ++++ b/lib/util/util_crypt.c +@@ -0,0 +1,90 @@ ++#include ++#include "data_blob.h" ++#include ++#include ++#include "util_crypt.h" ++ ++ ++static int crypt_as_best_we_can(const char *phrase, ++ const char *setting, ++ const char **hashp) ++{ ++ int ret = 0; ++ const char *hash = NULL; ++ ++#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) ++ struct crypt_data crypt_data = { ++ .initialized = 0 /* working storage used by crypt */ ++ }; ++#endif ++ ++ /* ++ * crypt_r() and crypt() may return a null pointer upon error ++ * depending on how libcrypt was configured, so we prefer ++ * crypt_rn() from libcrypt / libxcrypt which always returns ++ * NULL on error. ++ * ++ * POSIX specifies returning a null pointer and setting ++ * errno. ++ * ++ * RHEL 7 (which does not use libcrypt / libxcrypt) returns a ++ * non-NULL pointer from crypt_r() on success but (always?) ++ * sets errno during internal processing in the NSS crypto ++ * subsystem. ++ * ++ * By preferring crypt_rn we avoid the 'return non-NULL but ++ * set-errno' that we otherwise cannot tell apart from the ++ * RHEL 7 behaviour. ++ */ ++ errno = 0; ++ ++#ifdef HAVE_CRYPT_RN ++ hash = crypt_rn(phrase, setting, ++ &crypt_data, ++ sizeof(crypt_data)); ++#elif HAVE_CRYPT_R ++ hash = crypt_r(phrase, setting, &crypt_data); ++#else ++ /* ++ * No crypt_r falling back to crypt, which is NOT thread safe ++ * Thread safety MT-Unsafe race:crypt ++ */ ++ hash = crypt(phrase, setting); ++#endif ++ /* ++ * On error, crypt() and crypt_r() may return a null pointer, ++ * or a pointer to an invalid hash beginning with a '*'. ++ */ ++ ret = errno; ++ errno = 0; ++ if (hash == NULL || hash[0] == '*') { ++ if (ret == 0) { ++ /* this is annoying */ ++ ret = ENOTRECOVERABLE; ++ } ++ } ++ ++ *hashp = hash; ++ return ret; ++} ++ ++ ++int talloc_crypt_blob(TALLOC_CTX *mem_ctx, ++ const char *phrase, ++ const char *setting, ++ DATA_BLOB *blob) ++{ ++ const char *hash = NULL; ++ int ret = crypt_as_best_we_can(phrase, setting, &hash); ++ if (ret != 0) { ++ blob->data = NULL; ++ blob->length = 0; ++ return ret; ++ } ++ blob->length = strlen(hash); ++ blob->data = talloc_memdup(mem_ctx, hash, blob->length); ++ if (blob->data == NULL) { ++ return ENOMEM; ++ } ++ return 0; ++} +diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h +new file mode 100644 +index 00000000000..8c289e489e8 +--- /dev/null ++++ b/lib/util/util_crypt.h +@@ -0,0 +1,5 @@ ++ ++int talloc_crypt_blob(TALLOC_CTX *mem_ctx, ++ const char *phrase, ++ const char *cmd, ++ DATA_BLOB *blob); +diff --git a/lib/util/wscript_build b/lib/util/wscript_build +index b4fcfeaba07..7de9c0b7b17 100644 +--- a/lib/util/wscript_build ++++ b/lib/util/wscript_build +@@ -253,6 +253,12 @@ else: + private_library=True, + local_include=False) + ++ bld.SAMBA_LIBRARY('util_crypt', ++ source='util_crypt.c', ++ deps='talloc crypt', ++ private_library=True, ++ local_include=False) ++ + + bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', + source='unix_privs.c', +-- +2.34.1 + + +From c8c1de1ac3b715e76cb987525197209e453cdd50 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:29:21 +1300 +Subject: [PATCH 02/10] dsdb:password_hash: move hash_blob allocation up + +This will make the next patch simpler. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index 1d1267624e2..c1902126a72 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -1649,6 +1649,13 @@ static int setup_primary_userPassword_hash( + } + } + ++ hash_blob = talloc_zero(ctx, DATA_BLOB); ++ ++ if (hash_blob == NULL) { ++ TALLOC_FREE(frame); ++ return ldb_oom(ldb); ++ } ++ + /* + * Relies on the assertion that cleartext_utf8->data is a zero + * terminated UTF-8 string +@@ -1712,15 +1719,10 @@ static int setup_primary_userPassword_hash( + scheme, + reason); + TALLOC_FREE(frame); ++ TALLOC_FREE(hash_blob); + return LDB_ERR_OPERATIONS_ERROR; + } + +- hash_blob = talloc_zero(ctx, DATA_BLOB); +- +- if (hash_blob == NULL) { +- TALLOC_FREE(frame); +- return ldb_oom(ldb); +- } + + *hash_blob = data_blob_talloc(hash_blob, + (const uint8_t *)hash, +-- +2.34.1 + + +From ac5008598e4a4d3dbf5d58f4b4a2c6fc25195775 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 11:16:22 +1300 +Subject: [PATCH 03/10] dsdb:password_hash: use talloc_crypt_blob() + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- + .../samdb/ldb_modules/wscript_build_server | 2 +- + 2 files changed, 13 insertions(+), 57 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index c1902126a72..7a7114c1caa 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -51,6 +51,7 @@ + #include "auth/common_auth.h" + #include "lib/messaging/messaging.h" + #include "lib/param/loadparm.h" ++#include "lib/util/util_crypt.h" + + #include "lib/crypto/gnutls_helpers.h" + #include +@@ -1592,16 +1593,11 @@ static int setup_primary_userPassword_hash( + struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module); + const char *salt = NULL; /* Randomly generated salt */ + const char *cmd = NULL; /* command passed to crypt */ +- const char *hash = NULL; /* password hash generated by crypt */ + int algorithm = 0; /* crypt hash algorithm number */ + int rounds = 0; /* The number of hash rounds */ ++ int ret; + DATA_BLOB *hash_blob = NULL; + TALLOC_CTX *frame = talloc_stackframe(); +-#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) +- struct crypt_data crypt_data = { +- .initialized = 0 /* working storage used by crypt */ +- }; +-#endif + + /* Generate a random password salt */ + salt = generate_random_str_list(frame, +@@ -1660,52 +1656,20 @@ static int setup_primary_userPassword_hash( + * Relies on the assertion that cleartext_utf8->data is a zero + * terminated UTF-8 string + */ +- +- /* +- * crypt_r() and crypt() may return a null pointer upon error +- * depending on how libcrypt was configured, so we prefer +- * crypt_rn() from libcrypt / libxcrypt which always returns +- * NULL on error. +- * +- * POSIX specifies returning a null pointer and setting +- * errno. +- * +- * RHEL 7 (which does not use libcrypt / libxcrypt) returns a +- * non-NULL pointer from crypt_r() on success but (always?) +- * sets errno during internal processing in the NSS crypto +- * subsystem. +- * +- * By preferring crypt_rn we avoid the 'return non-NULL but +- * set-errno' that we otherwise cannot tell apart from the +- * RHEL 7 behaviour. +- */ +- errno = 0; +- +-#ifdef HAVE_CRYPT_RN +- hash = crypt_rn((char *)io->n.cleartext_utf8->data, +- cmd, +- &crypt_data, +- sizeof(crypt_data)); +-#elif HAVE_CRYPT_R +- hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data); +-#else +- /* +- * No crypt_r falling back to crypt, which is NOT thread safe +- * Thread safety MT-Unsafe race:crypt +- */ +- hash = crypt((char *)io->n.cleartext_utf8->data, cmd); +-#endif +- /* +- * On error, crypt() and crypt_r() may return a null pointer, +- * or a pointer to an invalid hash beginning with a '*'. +- */ +- if (hash == NULL || hash[0] == '*') { ++ ret = talloc_crypt_blob(hash_blob, ++ (char *)io->n.cleartext_utf8->data, ++ cmd, ++ hash_blob); ++ if (ret != 0) { + char buf[1024]; + const char *reason = NULL; +- if (errno == ERANGE) { ++ if (ret == ERANGE) { + reason = "Password exceeds maximum length allowed for crypt() hashing"; ++ } else if (ret == ENOTRECOVERABLE) { ++ /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ ++ reason = "Unknown error"; + } else { +- int err = strerror_r(errno, buf, sizeof(buf)); ++ int err = strerror_r(ret, buf, sizeof(buf)); + if (err == 0) { + reason = buf; + } else { +@@ -1723,14 +1687,6 @@ static int setup_primary_userPassword_hash( + return LDB_ERR_OPERATIONS_ERROR; + } + +- +- *hash_blob = data_blob_talloc(hash_blob, +- (const uint8_t *)hash, +- strlen(hash)); +- if (hash_blob->data == NULL) { +- TALLOC_FREE(frame); +- return ldb_oom(ldb); +- } + hash_value->value = hash_blob; + TALLOC_FREE(frame); + return LDB_SUCCESS; +diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server +index 9c1eb12a7c2..16d9b31a982 100644 +--- a/source4/dsdb/samdb/ldb_modules/wscript_build_server ++++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server +@@ -195,7 +195,7 @@ bld.SAMBA_MODULE('ldb_password_hash', + init_function='ldb_password_hash_module_init', + module_init_name='ldb_init_module', + internal_module=False, +- deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS crypt db-glue' ++ deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS util_crypt db-glue' + ) + + +-- +2.34.1 + + +From 0f19a12e9f28dd78e5108eeb22950eff48202d97 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:30:04 +1300 +Subject: [PATCH 04/10] util: add a crypt strerror helper + +This will be used by Python also. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + lib/util/util_crypt.c | 24 +++++++++++++++++++ + lib/util/util_crypt.h | 2 ++ + .../dsdb/samdb/ldb_modules/password_hash.c | 16 +------------ + 3 files changed, 27 insertions(+), 15 deletions(-) + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +index 0f7b2d0fd31..09cd47597d1 100644 +--- a/lib/util/util_crypt.c ++++ b/lib/util/util_crypt.c +@@ -88,3 +88,27 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + } + return 0; + } ++ ++ ++char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error) ++{ ++ char buf[1024]; ++ int err; ++ if (error == ERANGE) { ++ return talloc_strdup( ++ mem_ctx, ++ "Password exceeds maximum length allowed for crypt() hashing"); ++ } ++ if (error == ENOTRECOVERABLE) { ++ /* probably weird RHEL7 crypt, see crypt_as_best_we_can() */ ++ goto unknown; ++ } ++ ++ err = strerror_r(error, buf, sizeof(buf)); ++ if (err != 0) { ++ goto unknown; ++ } ++ return talloc_strndup(mem_ctx, buf, sizeof(buf)); ++unknown: ++ return talloc_strdup(mem_ctx, "Unknown error"); ++} +diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h +index 8c289e489e8..ca1a58e922c 100644 +--- a/lib/util/util_crypt.h ++++ b/lib/util/util_crypt.h +@@ -3,3 +3,5 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + const char *phrase, + const char *cmd, + DATA_BLOB *blob); ++ ++char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error); +diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c +index 7a7114c1caa..6949a92fc3e 100644 +--- a/source4/dsdb/samdb/ldb_modules/password_hash.c ++++ b/source4/dsdb/samdb/ldb_modules/password_hash.c +@@ -1661,21 +1661,7 @@ static int setup_primary_userPassword_hash( + cmd, + hash_blob); + if (ret != 0) { +- char buf[1024]; +- const char *reason = NULL; +- if (ret == ERANGE) { +- reason = "Password exceeds maximum length allowed for crypt() hashing"; +- } else if (ret == ENOTRECOVERABLE) { +- /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ +- reason = "Unknown error"; +- } else { +- int err = strerror_r(ret, buf, sizeof(buf)); +- if (err == 0) { +- reason = buf; +- } else { +- reason = "Unknown error"; +- } +- } ++ const char *reason = talloc_crypt_errstring(frame, ret); + ldb_asprintf_errstring( + ldb, + "setup_primary_userPassword: generation of a %s " +-- +2.34.1 + + +From 354ea5b1e69e27bfdd2d0b5ae8157790ba1bb590 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:30:15 +1300 +Subject: [PATCH 05/10] pyglue: add crypt() function + +This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in +turn wraps the system crypt[_r[n]]. + +We want this because the Python standard library crypt module is going +away. That one also wrapped the system crypt or crypt_r, so there +should be no change. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ + python/wscript | 1 + + 2 files changed, 42 insertions(+) + +diff --git a/python/pyglue.c b/python/pyglue.c +index 042bf9e14f3..fcccb849f5e 100644 +--- a/python/pyglue.c ++++ b/python/pyglue.c +@@ -18,6 +18,7 @@ + */ + + #include "lib/replace/system/python.h" ++#include "pyerrors.h" + #include "python/py3compat.h" + #include "includes.h" + #include "python/modules.h" +@@ -25,6 +26,7 @@ + #include "param/pyparam.h" + #include "lib/socket/netif.h" + #include "lib/util/debug.h" ++#include "lib/util/util_crypt.h" + #include "librpc/ndr/ndr_private.h" + #include "lib/cmdline/cmdline.h" + #include "lib/crypto/gkdi.h" +@@ -519,6 +521,42 @@ static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args) + return ret; + } + ++static PyObject *py_crypt(PyObject *self, PyObject *args) ++{ ++ PyObject *py_hash = NULL; ++ char *phrase = NULL; ++ char *setting = NULL; ++ TALLOC_CTX *frame = NULL; ++ int ret; ++ DATA_BLOB hash = {}; ++ ++ if (!PyArg_ParseTuple(args, "ss", &phrase, &setting)) { ++ TALLOC_FREE(frame); ++ return NULL; ++ } ++ frame = talloc_stackframe(); ++ ret = talloc_crypt_blob(frame, phrase, setting, &hash); ++ if (ret != 0) { ++ const char *errstr = talloc_crypt_errstring(frame, ret); ++ if (ret == EINVAL || ret == ERANGE || ret == ENOTRECOVERABLE) { ++ PyErr_Format(PyExc_ValueError, ++ "could not crypt(): %s", ++ errstr); ++ } else { ++ PyErr_Format(PyExc_OSError, ++ "could not crypt(): %s", ++ errstr); ++ } ++ TALLOC_FREE(frame); ++ return NULL; ++ } ++ ++ py_hash = PyUnicode_FromStringAndSize((char *)hash.data, hash.length); ++ TALLOC_FREE(frame); ++ return py_hash; ++} ++ ++ + static PyMethodDef py_misc_methods[] = { + { "generate_random_str", (PyCFunction)py_generate_random_str, METH_VARARGS, + "generate_random_str(len) -> string\n" +@@ -580,6 +618,9 @@ static PyMethodDef py_misc_methods[] = { + METH_NOARGS, "How many NDR internal tokens is too many for this build?" }, + { "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline, + METH_VARARGS, "Return a redacted commandline to feed to setproctitle (None if no redaction required)" }, ++ { "crypt", (PyCFunction)py_crypt, ++ METH_VARARGS, ++ "encrypt as phrase, per crypt(3), as determined by setting." }, + {0} + }; + +diff --git a/python/wscript b/python/wscript +index 3e6439930e9..7c17e390dc7 100644 +--- a/python/wscript ++++ b/python/wscript +@@ -119,6 +119,7 @@ def build(bld): + ndr + cmdline + gkdi ++ util_crypt + %s + ''' % (pyparam_util, pytalloc_util), + realname='samba/_glue.so') +-- +2.34.1 + + +From fec10dfe574a8acef0646a666fd4ff54ef11adf6 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 10:44:07 +1300 +Subject: [PATCH 06/10] pytest: test that _glue.crypt works + +The test vectors were generated via Python 3.10 crypt module, which +directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. + +We mainly test the sha256 and sha512 vectors, which seems to be all we +use, and which are said to be widely supported. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 65 insertions(+) + +diff --git a/python/samba/tests/glue.py b/python/samba/tests/glue.py +index ac504b3f366..824f5ca0c81 100644 +--- a/python/samba/tests/glue.py ++++ b/python/samba/tests/glue.py +@@ -88,3 +88,68 @@ class GlueTests(samba.tests.TestCase): + self.assertEqual(_glue.strstr_m(string, '_'), '_string_num__one') + self.assertEqual(_glue.strstr_m(string, '__'), '__one') + self.assertEqual(_glue.strstr_m(string, 'ring'), 'ring_num__one') ++ ++ def test_crypt(self): ++ # We hopefully only use schemes 5 and 6 (sha256 and sha512), ++ # which are OK and also quite widely supported according to ++ # https://en.wikipedia.org/wiki/Crypt_(C) ++ for phrase, setting, expected in [ ++ ("a", "$5$aaaaaa", ++ "$5$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6"), ++ # with scheme 5, 5000 rounds is default, so hash is the same as above ++ ('a', '$5$rounds=5000$aaaaaa', ++ '$5$rounds=5000$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6'), ++ ('a', ++ '$5$rounds=4999$aaaaaa', ++ '$5$rounds=4999$aaaaaa$FiP70gtxOJUFLokUJvET06E7jbL6aNmF6Wtv2ddzjY8'), ++ ('a', '$5$aaaaab', ++ '$5$aaaaab$e9qR2F833/JyuMu.nkQc9kn184vBWLo0ODqnCe./mj0'), ++ ++ ('', '$5$aaaaaa', '$5$aaaaaa$5B4WTdWp5n/v/aNUw2N8RsEitqvlZJEaAKhH/pOkGg4'), ++ ++ ("a", "$6$aaaaaa", ++ "$6$aaaaaa$KHs/Ez7X/I5/K.V8FR7kEsx9rOvjXnEDUmGC.dLBWP87XWy.oUEAM7QYcZQRVhiDwGepOF2pKrCVETYLyASh60"), ++ ++ ('', '$5$', '$5$$3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.'), ++ ++ # scheme 1 (md5) should be supported if not used ++ ('a', '$1$aaaaaa', ++ '$1$aaaaaa$MUMWPbGfzrHFCNm7ZHg31.'), ++ ++ ('', '$6$', ++ '$6$$/chiBau24cE26QQVW3IfIe68Xu5.JQ4E8Ie7lcRLwqxO5cxGuBhqF2HmTL.zWJ9zjChg3yJYFXeGBQ2y3Ba1d1'), ++ (' ', ++ '$6$6', ++ '$6$6$asLnbxf0obyuv3ybNvDE9ZcdwGFkDhLe7uW.wzdOdKCm4/M3vGFKq4Ttk1tBQrOn4wALZ3tj1L8IarIu5i8hR/'), ++ ++ # original DES scheme, 12 bits of salt ++ ("a", "lalala", "laKGbFzgh./R2"), ++ ("a", "lalalaLALALAla", "laKGbFzgh./R2"), ++ ("a", "arrgh", "ar7VUiUvDhX2c"), ++ ("a", "arrggghhh", "ar7VUiUvDhX2c"), ++ ]: ++ hash = _glue.crypt(phrase, setting) ++ self.assertEqual(hash, expected) ++ ++ def test_crypt_bad(self): ++ # We can't be too strident in our assertions, because every ++ # system allows a different set of algorithms, and some have ++ # different ideas of how to parse. ++ for phrase, setting, exception in [ ++ ("a", "$5", ValueError), ++ ("a", "$0$", ValueError), ++ ("a", None, TypeError), ++ (None, "", TypeError), ++ ('a', '$66$', ValueError), ++ ('a', '$$', ValueError), ++ ('a', '*0', ValueError), ++ ('a', '*', ValueError), ++ ('a', '++', ValueError), ++ # this next one is too long, except on Rocky Linux 8. ++ #('a' * 10000, '$5$5', ValueError), ++ # this is invalid, except on Debian 11. ++ # (' ', '$6$ ', ValueError), ++ ]: ++ with self.assertRaises(exception, ++ msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): ++ _glue.crypt(phrase, setting) +-- +2.34.1 + + +From 7d1fa8cdc52423bd53de4314a62e2c2b2e0b2aa7 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 15:54:48 +1300 +Subject: [PATCH 07/10] samba-tool user: use _glue.crypt, not crypt.crypt + +Because we know we have _glue.crypt, and we know it raises exceptions +rather than returning None, we can simplify the checks. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py +index 7944d4e1682..68befb3f356 100644 +--- a/python/samba/netcmd/user/readpasswords/common.py ++++ b/python/samba/netcmd/user/readpasswords/common.py +@@ -37,6 +37,7 @@ from samba.netcmd import Command, CommandError + from samba.samdb import SamDB + from samba.nt_time import timedelta_from_nt_time_delta, nt_time_from_datetime + from samba.gkdi import MAX_CLOCK_SKEW ++from samba._glue import crypt + + # python[3]-gpgme is abandoned since ubuntu 1804 and debian 9 + # have to use python[3]-gpg instead +@@ -132,9 +133,7 @@ def get_crypt_value(alg, utf8pw, rounds=0): + else: + crypt_salt = "$%s$%s$" % (alg, b64salt) + +- crypt_value = crypt.crypt(utf8pw, crypt_salt) +- if crypt_value is None: +- raise NotImplementedError("crypt.crypt(%s) returned None" % (crypt_salt)) ++ crypt_value = crypt(utf8pw, crypt_salt) + expected_len = len(crypt_salt) + algs[alg]["length"] + if len(crypt_value) != expected_len: + raise NotImplementedError("crypt.crypt(%s) returned a value with length %d, expected length is %d" % ( +@@ -156,21 +155,13 @@ except ImportError as e: + + for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: + try: +- import crypt + get_crypt_value(alg, "") +- virtual_attributes[attr] = { +- } +- except ImportError as e: +- reason = "crypt" +- reason += " required" +- disabled_virtual_attributes[attr] = { +- "reason": reason, +- } +- except NotImplementedError as e: +- reason = "modern '$%s$' salt in crypt(3) required" % (alg) ++ except (ValueError, OSError): + disabled_virtual_attributes[attr] = { +- "reason": reason, ++ "reason": f"modern '${alg}$' salt in crypt(3) required" + } ++ continue ++ virtual_attributes[attr] = {} + + # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 + for x in range(1, 30): +-- +2.34.1 + + +From dde9d1c473ac2fccfc123cfe2ca224da59042c6d Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 15:56:20 +1300 +Subject: [PATCH 08/10] samba-tool user: hashlib.sha1 is always present + +We maybe thought we were checking that sha1 was in hashlib, but we were +only checking that hashlib is in the Python library (`hashlib.sha1()` +would not raise ImportError). + +The documentation says hashlib always contains sha1 -- if that +changes, it is better we know by failing noisily with the import error +at the top of the file. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py +index 68befb3f356..3043525874e 100644 +--- a/python/samba/netcmd/user/readpasswords/common.py ++++ b/python/samba/netcmd/user/readpasswords/common.py +@@ -26,6 +26,7 @@ import datetime + import errno + import io + import os ++from hashlib import sha1 + + import ldb + from samba import credentials, nttime2float +@@ -141,17 +142,8 @@ def get_crypt_value(alg, utf8pw, rounds=0): + return crypt_value + + +-try: +- import hashlib +- hashlib.sha1() +- virtual_attributes["virtualSSHA"] = { +- } +-except ImportError as e: +- reason = "hashlib.sha1()" +- reason += " required" +- disabled_virtual_attributes["virtualSSHA"] = { +- "reason": reason, +- } ++ ++virtual_attributes["virtualSSHA"] = {} + + for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: + try: +@@ -736,7 +728,7 @@ class GetPasswordCommand(Command): + if u8 is None: + continue + salt = os.urandom(4) +- h = hashlib.sha1() ++ h = sha1() + h.update(u8) + h.update(salt) + bv = h.digest() + salt +-- +2.34.1 + + +From 361a7bcfc203c8cf4884c3f35e7147b59c0e4116 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Thu, 12 Dec 2024 10:46:16 +1300 +Subject: [PATCH 09/10] pytest: password_hash uses internal _glue.crypt + +This will remove an external dependency. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider +--- + python/samba/tests/password_hash.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/python/samba/tests/password_hash.py b/python/samba/tests/password_hash.py +index 1b7af7de7b8..39ef13fd7b2 100644 +--- a/python/samba/tests/password_hash.py ++++ b/python/samba/tests/password_hash.py +@@ -30,11 +30,11 @@ from samba.dcerpc.samr import DOMAIN_PASSWORD_STORE_CLEARTEXT + from samba.dsdb import UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED + from samba.tests import delete_force + from samba.tests.password_test import PasswordCommon ++from samba._glue import crypt + import ldb + import samba + import binascii + from hashlib import md5 +-import crypt + + + USER_NAME = "PasswordHashTestUser" +@@ -321,7 +321,7 @@ class PassWordHashTests(TestCase): + cmd = "$%s$rounds=%d$%s" % (alg, rounds, data[3]) + + # Calculate the expected hash value +- expected = crypt.crypt(USER_PASS, cmd) ++ expected = crypt(USER_PASS, cmd) + self.assertEqual(expected, up.hashes[i].value.decode('utf8')) + i += 1 + +-- +2.34.1 + + +From 11ec542b49c4fe165ce717b0f978439ed717f3e0 Mon Sep 17 00:00:00 2001 +From: Douglas Bagnall +Date: Wed, 11 Dec 2024 14:31:18 +1300 +Subject: [PATCH 10/10] util:datablob: data_blob_pad checks its alignment + assumption + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 + +Signed-off-by: Douglas Bagnall +Reviewed-by: Andreas Schneider + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 +--- + lib/util/data_blob.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/util/data_blob.c b/lib/util/data_blob.c +index b5b78bc7a8a..0522e7755af 100644 +--- a/lib/util/data_blob.c ++++ b/lib/util/data_blob.c +@@ -286,7 +286,7 @@ _PUBLIC_ bool data_blob_pad(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, + size_t old_len = blob->length; + size_t new_len = (old_len + pad - 1) & ~(pad - 1); + +- if (new_len < old_len) { ++ if (new_len < old_len || (pad & (pad - 1)) != 0) { + return false; + } + +-- +2.34.1 + diff --git a/samba.spec b/samba.spec index b956d6d..68977a3 100644 --- a/samba.spec +++ b/samba.spec @@ -251,6 +251,7 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-4.21.0-s3-notifyd.patch +Patch1: samba-4-21-pycrypt.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -441,9 +442,6 @@ BuildRequires: perl-Parse-Yapp BuildRequires: perl-Test-Base BuildRequires: psmisc BuildRequires: python3-libpamtest -# The `crypt` module has been removed in Python 3.13, this is a copy -# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 -BuildRequires: python3-crypt-r BuildRequires: resolv_wrapper BuildRequires: rsync BuildRequires: socket_wrapper @@ -2062,6 +2060,7 @@ fi %{_libdir}/samba/libtdb-wrap-private-samba.so %{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libutil-crypt-private-samba.so %{_libdir}/samba/libutil-reg-private-samba.so %{_libdir}/samba/libutil-setid-private-samba.so %{_libdir}/samba/libutil-tdb-private-samba.so From 99bcb0cab84201e9f7154c4bf58ebe206f30e112 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 7 Jan 2025 14:23:35 +0100 Subject: [PATCH 033/101] Remove 'Requires: python3-crypt-r' also from samba-tools --- samba.spec | 3 --- 1 file changed, 3 deletions(-) diff --git a/samba.spec b/samba.spec index 68977a3..30fdeb5 100644 --- a/samba.spec +++ b/samba.spec @@ -594,9 +594,6 @@ Requires: lmdb %endif Requires: tdb-tools Requires: python3-gpg -# The `crypt` module has been removed in Python 3.13, this is a copy -# See also https://bugzilla.samba.org/show_bug.cgi?id=15756 -Requires: python3-crypt-r %endif %description tools From 09d4509590333c14fe063ef4115f51c81a512f04 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 09:54:56 +0000 Subject: [PATCH 034/101] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From c6899c34b0abb2e408216e19c317e5a5949b37e3 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jan 2025 09:00:27 +0100 Subject: [PATCH 035/101] Fix stack use after return in new crypt module --- samba-4-21-pycrypt.patch | 150 +++++++++++++++++++++++++++++++-------- 1 file changed, 120 insertions(+), 30 deletions(-) diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch index 8c197fc..bf4c1e5 100644 --- a/samba-4-21-pycrypt.patch +++ b/samba-4-21-pycrypt.patch @@ -1,7 +1,7 @@ -From 93bc860e8f344a96d0496edbc5d463f2c5411fcd Mon Sep 17 00:00:00 2001 +From 07fe7b437c695c7a715418d4414c930b72758dab Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 5 Dec 2024 16:35:51 +1300 -Subject: [PATCH 01/10] util: add a crypt wrapper, derived from +Subject: [PATCH 01/11] util: add a crypt wrapper, derived from dsdb:password_hash This is going to be used by the dsdb password_hash module, and exposed @@ -13,6 +13,7 @@ standard library. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Reviewed-by: Andreas Schneider +(cherry picked from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b) --- lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ lib/util/util_crypt.h | 5 +++ @@ -146,13 +147,13 @@ index b4fcfeaba07..7de9c0b7b17 100644 bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', source='unix_privs.c', -- -2.34.1 +2.48.1 -From c8c1de1ac3b715e76cb987525197209e453cdd50 Mon Sep 17 00:00:00 2001 +From adf180613e4172292090d4c3573a439388a09788 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:29:21 +1300 -Subject: [PATCH 02/10] dsdb:password_hash: move hash_blob allocation up +Subject: [PATCH 02/11] dsdb:password_hash: move hash_blob allocation up This will make the next patch simpler. @@ -160,6 +161,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6) --- source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) @@ -200,18 +202,19 @@ index 1d1267624e2..c1902126a72 100644 *hash_blob = data_blob_talloc(hash_blob, (const uint8_t *)hash, -- -2.34.1 +2.48.1 -From ac5008598e4a4d3dbf5d58f4b4a2c6fc25195775 Mon Sep 17 00:00:00 2001 +From 9d43e4d649db23549bbb230ed60426fa286b7ab7 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 11:16:22 +1300 -Subject: [PATCH 03/10] dsdb:password_hash: use talloc_crypt_blob() +Subject: [PATCH 03/11] dsdb:password_hash: use talloc_crypt_blob() BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034) --- .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- .../samdb/ldb_modules/wscript_build_server | 2 +- @@ -339,13 +342,13 @@ index 9c1eb12a7c2..16d9b31a982 100644 -- -2.34.1 +2.48.1 -From 0f19a12e9f28dd78e5108eeb22950eff48202d97 Mon Sep 17 00:00:00 2001 +From 1c94645881bd5130c67bfee96aa463f360df300a Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:30:04 +1300 -Subject: [PATCH 04/10] util: add a crypt strerror helper +Subject: [PATCH 04/11] util: add a crypt strerror helper This will be used by Python also. @@ -353,6 +356,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2) --- lib/util/util_crypt.c | 24 +++++++++++++++++++ lib/util/util_crypt.h | 2 ++ @@ -429,13 +433,13 @@ index 7a7114c1caa..6949a92fc3e 100644 ldb, "setup_primary_userPassword: generation of a %s " -- -2.34.1 +2.48.1 -From 354ea5b1e69e27bfdd2d0b5ae8157790ba1bb590 Mon Sep 17 00:00:00 2001 +From ce70e852783ec69104d274def931e7d39f17576a Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:30:15 +1300 -Subject: [PATCH 05/10] pyglue: add crypt() function +Subject: [PATCH 05/11] pyglue: add crypt() function This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in turn wraps the system crypt[_r[n]]. @@ -448,6 +452,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a) --- python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ python/wscript | 1 + @@ -539,13 +544,13 @@ index 3e6439930e9..7c17e390dc7 100644 ''' % (pyparam_util, pytalloc_util), realname='samba/_glue.so') -- -2.34.1 +2.48.1 -From fec10dfe574a8acef0646a666fd4ff54ef11adf6 Mon Sep 17 00:00:00 2001 +From 9a0dc2db7cde22f36583159c0d697a3de6640990 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 10:44:07 +1300 -Subject: [PATCH 06/10] pytest: test that _glue.crypt works +Subject: [PATCH 06/11] pytest: test that _glue.crypt works The test vectors were generated via Python 3.10 crypt module, which directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. @@ -557,6 +562,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963) --- python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) @@ -635,13 +641,13 @@ index ac504b3f366..824f5ca0c81 100644 + msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): + _glue.crypt(phrase, setting) -- -2.34.1 +2.48.1 -From 7d1fa8cdc52423bd53de4314a62e2c2b2e0b2aa7 Mon Sep 17 00:00:00 2001 +From 6425e2514052027ee2269e15e0e0dff1686fa34e Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 15:54:48 +1300 -Subject: [PATCH 07/10] samba-tool user: use _glue.crypt, not crypt.crypt +Subject: [PATCH 07/11] samba-tool user: use _glue.crypt, not crypt.crypt Because we know we have _glue.crypt, and we know it raises exceptions rather than returning None, we can simplify the checks. @@ -650,6 +656,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180) --- .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- 1 file changed, 6 insertions(+), 15 deletions(-) @@ -704,13 +711,13 @@ index 7944d4e1682..68befb3f356 100644 # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 for x in range(1, 30): -- -2.34.1 +2.48.1 -From dde9d1c473ac2fccfc123cfe2ca224da59042c6d Mon Sep 17 00:00:00 2001 +From a2a04286e13676177c952e67363fc7502f544861 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 15:56:20 +1300 -Subject: [PATCH 08/10] samba-tool user: hashlib.sha1 is always present +Subject: [PATCH 08/11] samba-tool user: hashlib.sha1 is always present We maybe thought we were checking that sha1 was in hashlib, but we were only checking that hashlib is in the Python library (`hashlib.sha1()` @@ -724,6 +731,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98) --- python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) @@ -770,13 +778,13 @@ index 68befb3f356..3043525874e 100644 h.update(salt) bv = h.digest() + salt -- -2.34.1 +2.48.1 -From 361a7bcfc203c8cf4884c3f35e7147b59c0e4116 Mon Sep 17 00:00:00 2001 +From e9a8748f3cc4ba74f8b0d75e7a01866e7c12a0a4 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Thu, 12 Dec 2024 10:46:16 +1300 -Subject: [PATCH 09/10] pytest: password_hash uses internal _glue.crypt +Subject: [PATCH 09/11] pytest: password_hash uses internal _glue.crypt This will remove an external dependency. @@ -784,6 +792,7 @@ BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 Signed-off-by: Douglas Bagnall Reviewed-by: Andreas Schneider +(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d) --- python/samba/tests/password_hash.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) @@ -815,13 +824,13 @@ index 1b7af7de7b8..39ef13fd7b2 100644 i += 1 -- -2.34.1 +2.48.1 -From 11ec542b49c4fe165ce717b0f978439ed717f3e0 Mon Sep 17 00:00:00 2001 +From 0e01dc4f1fabfd2c3f21f724c05d94227a278b20 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 11 Dec 2024 14:31:18 +1300 -Subject: [PATCH 10/10] util:datablob: data_blob_pad checks its alignment +Subject: [PATCH 10/11] util:datablob: data_blob_pad checks its alignment assumption BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 @@ -831,6 +840,8 @@ Reviewed-by: Andreas Schneider Autobuild-User(master): Andreas Schneider Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 + +(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb) --- lib/util/data_blob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) @@ -849,5 +860,84 @@ index b5b78bc7a8a..0522e7755af 100644 } -- -2.34.1 +2.48.1 + + +From 8cfae9f33fb1c170c3fe937be200490597e9e4c2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 17 Jan 2025 13:28:30 +0100 +Subject: [PATCH 11/11] lib:util: Fix stack-use-after-return in + crypt_as_best_we_can() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784 + +Signed-off-by: Andreas Schneider +Reviewed-by: Douglas Bagnall +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Douglas Bagnall +Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224 + +(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53) +--- + lib/util/util_crypt.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c +index 09cd47597d1..9ac6e1cfd0e 100644 +--- a/lib/util/util_crypt.c ++++ b/lib/util/util_crypt.c +@@ -1,11 +1,13 @@ + #include + #include "data_blob.h" ++#include "discard.h" + #include + #include + #include "util_crypt.h" + + +-static int crypt_as_best_we_can(const char *phrase, ++static int crypt_as_best_we_can(TALLOC_CTX *mem_ctx, ++ const char *phrase, + const char *setting, + const char **hashp) + { +@@ -63,8 +65,14 @@ static int crypt_as_best_we_can(const char *phrase, + ret = ENOTRECOVERABLE; + } + } ++ if (ret != 0) { ++ return ret; ++ } + +- *hashp = hash; ++ *hashp = talloc_strdup(mem_ctx, hash); ++ if (*hashp == NULL) { ++ ret = -1; ++ } + return ret; + } + +@@ -75,14 +83,14 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, + DATA_BLOB *blob) + { + const char *hash = NULL; +- int ret = crypt_as_best_we_can(phrase, setting, &hash); ++ int ret = crypt_as_best_we_can(mem_ctx, phrase, setting, &hash); + if (ret != 0) { + blob->data = NULL; + blob->length = 0; + return ret; + } + blob->length = strlen(hash); +- blob->data = talloc_memdup(mem_ctx, hash, blob->length); ++ blob->data = discard_const_p(uint8_t, hash); + if (blob->data == NULL) { + return ENOMEM; + } +-- +2.48.1 From 7bc49d20ad6345bd820bb043262db005c422b535 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 22 Jan 2025 09:03:43 +0100 Subject: [PATCH 036/101] Fix building with gcc 15 --- samba-4-21-fix-smbreadline.patch | 112 +++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 113 insertions(+) create mode 100644 samba-4-21-fix-smbreadline.patch diff --git a/samba-4-21-fix-smbreadline.patch b/samba-4-21-fix-smbreadline.patch new file mode 100644 index 0000000..9fd288d --- /dev/null +++ b/samba-4-21-fix-smbreadline.patch @@ -0,0 +1,112 @@ +From 36e3944418789f5d2018063fa3988c318baa0a35 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 21 Jan 2025 17:59:12 +0100 +Subject: [PATCH 1/2] lib:replace: Remove trailing spaces from readline.h + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy +(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7) +--- + lib/replace/system/readline.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h +index 29379626e0d..9a9af266ca6 100644 +--- a/lib/replace/system/readline.h ++++ b/lib/replace/system/readline.h +@@ -1,14 +1,14 @@ + #ifndef _system_readline_h + #define _system_readline_h +-/* ++/* + Unix SMB/CIFS implementation. + + Readline wrappers +- ++ + ** NOTE! The following LGPL license applies to the replace + ** library. This does NOT imply that all of Samba is released + ** under the LGPL +- ++ + This library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either +-- +2.48.1 + + +From 6944f700dcd4ad795652070dfb04135d602622a2 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Tue, 21 Jan 2025 17:59:27 +0100 +Subject: [PATCH 2/2] lib:replace: Don't use deprecated readline CPPFunction + cast +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right +function. + +libcli/smbreadline/smbreadline.c: In function ‘smb_readline’: +libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations] + 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int, int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types] + 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; + | ^ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 + +Signed-off-by: Andreas Schneider +Reviewed-by: Alexander Bokovoy + +Autobuild-User(master): Andreas Schneider +Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224 + +(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821) +--- + lib/replace/system/readline.h | 4 +++- + libcli/smbreadline/wscript_configure | 8 +++++--- + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h +index 9a9af266ca6..ac3604fc12e 100644 +--- a/lib/replace/system/readline.h ++++ b/lib/replace/system/readline.h +@@ -46,7 +46,9 @@ + #endif + + #ifdef HAVE_NEW_LIBREADLINE +-#ifdef HAVE_CPPFUNCTION ++#if defined(HAVE_RL_COMPLETION_FUNC_T) ++# define RL_COMPLETION_CAST (rl_completion_func_t *) ++#elif defined(HAVE_CPPFUNCTION) + # define RL_COMPLETION_CAST (CPPFunction *) + #elif defined(HAVE_RL_COMPLETION_T) + # define RL_COMPLETION_CAST (rl_completion_t *) +diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure +index 912ff53a150..f5a401ebae0 100644 +--- a/libcli/smbreadline/wscript_configure ++++ b/libcli/smbreadline/wscript_configure +@@ -51,10 +51,12 @@ conf.CHECK_CODE(''' + # endif + # endif + #endif +-int main(void) {rl_completion_t f; return 0;} ++int main(void) {rl_completion_func_t f; return 0;} + ''', +-'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False, +-msg='Checking for rl_completion_t') ++ 'HAVE_RL_COMPLETION_FUNC_T', ++ execute=False, ++ addmain=False, ++ msg='Checking for rl_completion_func_t') + + conf.CHECK_CODE(''' + #ifdef HAVE_READLINE_READLINE_H +-- +2.48.1 + diff --git a/samba.spec b/samba.spec index 30fdeb5..0852641 100644 --- a/samba.spec +++ b/samba.spec @@ -252,6 +252,7 @@ Source202: samba.abignore Patch0: samba-4.21.0-s3-notifyd.patch Patch1: samba-4-21-pycrypt.patch +Patch2: samba-4-21-fix-smbreadline.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From e52328b755e2fe92cf0c6d2455aea7b42b47848e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 1 Feb 2025 19:57:20 +0100 Subject: [PATCH 037/101] Add explicit BR: libxcrypt-devel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 0852641..ba9f3ed 100644 --- a/samba.spec +++ b/samba.spec @@ -316,6 +316,7 @@ BuildRequires: libicu-devel BuildRequires: libcmocka-devel BuildRequires: libtirpc-devel BuildRequires: libuuid-devel +BuildRequires: libxcrypt-devel BuildRequires: libxslt %if %{with lmdb} BuildRequires: lmdb From f24bbdaf786f2f75a82df28ddffb5491d7db6b35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Sat, 8 Feb 2025 23:02:27 +0100 Subject: [PATCH 038/101] Update to version 4.22.0rc1 - resolves: rhbz#2344189 Guenther --- samba-4-21-fix-smbreadline.patch | 112 ---- samba-4-21-pycrypt.patch | 943 ------------------------------- samba-4.21.0-s3-notifyd.patch | 513 ----------------- samba.spec | 36 +- sources | 4 +- 5 files changed, 23 insertions(+), 1585 deletions(-) delete mode 100644 samba-4-21-fix-smbreadline.patch delete mode 100644 samba-4-21-pycrypt.patch delete mode 100644 samba-4.21.0-s3-notifyd.patch diff --git a/samba-4-21-fix-smbreadline.patch b/samba-4-21-fix-smbreadline.patch deleted file mode 100644 index 9fd288d..0000000 --- a/samba-4-21-fix-smbreadline.patch +++ /dev/null @@ -1,112 +0,0 @@ -From 36e3944418789f5d2018063fa3988c318baa0a35 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:12 +0100 -Subject: [PATCH 1/2] lib:replace: Remove trailing spaces from readline.h - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy -(cherry picked from commit dbff53f77680f0ccd022f2d864ba6ae7585a34b7) ---- - lib/replace/system/readline.h | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 29379626e0d..9a9af266ca6 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -1,14 +1,14 @@ - #ifndef _system_readline_h - #define _system_readline_h --/* -+/* - Unix SMB/CIFS implementation. - - Readline wrappers -- -+ - ** NOTE! The following LGPL license applies to the replace - ** library. This does NOT imply that all of Samba is released - ** under the LGPL -- -+ - This library is free software; you can redistribute it and/or - modify it under the terms of the GNU Lesser General Public - License as published by the Free Software Foundation; either --- -2.48.1 - - -From 6944f700dcd4ad795652070dfb04135d602622a2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Tue, 21 Jan 2025 17:59:27 +0100 -Subject: [PATCH 2/2] lib:replace: Don't use deprecated readline CPPFunction - cast -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right -function. - -libcli/smbreadline/smbreadline.c: In function ‘smb_readline’: -libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int, int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types] - 139 | rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn; - | ^ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788 - -Signed-off-by: Andreas Schneider -Reviewed-by: Alexander Bokovoy - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224 - -(cherry picked from commit 9aa5c43315d83c19514251a11c4fba5a137f2821) ---- - lib/replace/system/readline.h | 4 +++- - libcli/smbreadline/wscript_configure | 8 +++++--- - 2 files changed, 8 insertions(+), 4 deletions(-) - -diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h -index 9a9af266ca6..ac3604fc12e 100644 ---- a/lib/replace/system/readline.h -+++ b/lib/replace/system/readline.h -@@ -46,7 +46,9 @@ - #endif - - #ifdef HAVE_NEW_LIBREADLINE --#ifdef HAVE_CPPFUNCTION -+#if defined(HAVE_RL_COMPLETION_FUNC_T) -+# define RL_COMPLETION_CAST (rl_completion_func_t *) -+#elif defined(HAVE_CPPFUNCTION) - # define RL_COMPLETION_CAST (CPPFunction *) - #elif defined(HAVE_RL_COMPLETION_T) - # define RL_COMPLETION_CAST (rl_completion_t *) -diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure -index 912ff53a150..f5a401ebae0 100644 ---- a/libcli/smbreadline/wscript_configure -+++ b/libcli/smbreadline/wscript_configure -@@ -51,10 +51,12 @@ conf.CHECK_CODE(''' - # endif - # endif - #endif --int main(void) {rl_completion_t f; return 0;} -+int main(void) {rl_completion_func_t f; return 0;} - ''', --'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False, --msg='Checking for rl_completion_t') -+ 'HAVE_RL_COMPLETION_FUNC_T', -+ execute=False, -+ addmain=False, -+ msg='Checking for rl_completion_func_t') - - conf.CHECK_CODE(''' - #ifdef HAVE_READLINE_READLINE_H --- -2.48.1 - diff --git a/samba-4-21-pycrypt.patch b/samba-4-21-pycrypt.patch deleted file mode 100644 index bf4c1e5..0000000 --- a/samba-4-21-pycrypt.patch +++ /dev/null @@ -1,943 +0,0 @@ -From 07fe7b437c695c7a715418d4414c930b72758dab Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 5 Dec 2024 16:35:51 +1300 -Subject: [PATCH 01/11] util: add a crypt wrapper, derived from - dsdb:password_hash - -This is going to be used by the dsdb password_hash module, and exposed -to Python via pyglue. - -We're doing this because Python 3.13 has dropped crypt from the Python -standard library. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Reviewed-by: Andreas Schneider -(cherry picked from commit 833455c7f9f71583d567e3a53e854567cd8c3b0b) ---- - lib/util/util_crypt.c | 90 ++++++++++++++++++++++++++++++++++++++++++ - lib/util/util_crypt.h | 5 +++ - lib/util/wscript_build | 6 +++ - 3 files changed, 101 insertions(+) - create mode 100644 lib/util/util_crypt.c - create mode 100644 lib/util/util_crypt.h - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -new file mode 100644 -index 00000000000..0f7b2d0fd31 ---- /dev/null -+++ b/lib/util/util_crypt.c -@@ -0,0 +1,90 @@ -+#include -+#include "data_blob.h" -+#include -+#include -+#include "util_crypt.h" -+ -+ -+static int crypt_as_best_we_can(const char *phrase, -+ const char *setting, -+ const char **hashp) -+{ -+ int ret = 0; -+ const char *hash = NULL; -+ -+#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -+ struct crypt_data crypt_data = { -+ .initialized = 0 /* working storage used by crypt */ -+ }; -+#endif -+ -+ /* -+ * crypt_r() and crypt() may return a null pointer upon error -+ * depending on how libcrypt was configured, so we prefer -+ * crypt_rn() from libcrypt / libxcrypt which always returns -+ * NULL on error. -+ * -+ * POSIX specifies returning a null pointer and setting -+ * errno. -+ * -+ * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -+ * non-NULL pointer from crypt_r() on success but (always?) -+ * sets errno during internal processing in the NSS crypto -+ * subsystem. -+ * -+ * By preferring crypt_rn we avoid the 'return non-NULL but -+ * set-errno' that we otherwise cannot tell apart from the -+ * RHEL 7 behaviour. -+ */ -+ errno = 0; -+ -+#ifdef HAVE_CRYPT_RN -+ hash = crypt_rn(phrase, setting, -+ &crypt_data, -+ sizeof(crypt_data)); -+#elif HAVE_CRYPT_R -+ hash = crypt_r(phrase, setting, &crypt_data); -+#else -+ /* -+ * No crypt_r falling back to crypt, which is NOT thread safe -+ * Thread safety MT-Unsafe race:crypt -+ */ -+ hash = crypt(phrase, setting); -+#endif -+ /* -+ * On error, crypt() and crypt_r() may return a null pointer, -+ * or a pointer to an invalid hash beginning with a '*'. -+ */ -+ ret = errno; -+ errno = 0; -+ if (hash == NULL || hash[0] == '*') { -+ if (ret == 0) { -+ /* this is annoying */ -+ ret = ENOTRECOVERABLE; -+ } -+ } -+ -+ *hashp = hash; -+ return ret; -+} -+ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *setting, -+ DATA_BLOB *blob) -+{ -+ const char *hash = NULL; -+ int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ if (ret != 0) { -+ blob->data = NULL; -+ blob->length = 0; -+ return ret; -+ } -+ blob->length = strlen(hash); -+ blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ if (blob->data == NULL) { -+ return ENOMEM; -+ } -+ return 0; -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -new file mode 100644 -index 00000000000..8c289e489e8 ---- /dev/null -+++ b/lib/util/util_crypt.h -@@ -0,0 +1,5 @@ -+ -+int talloc_crypt_blob(TALLOC_CTX *mem_ctx, -+ const char *phrase, -+ const char *cmd, -+ DATA_BLOB *blob); -diff --git a/lib/util/wscript_build b/lib/util/wscript_build -index b4fcfeaba07..7de9c0b7b17 100644 ---- a/lib/util/wscript_build -+++ b/lib/util/wscript_build -@@ -253,6 +253,12 @@ else: - private_library=True, - local_include=False) - -+ bld.SAMBA_LIBRARY('util_crypt', -+ source='util_crypt.c', -+ deps='talloc crypt', -+ private_library=True, -+ local_include=False) -+ - - bld.SAMBA_SUBSYSTEM('UNIX_PRIVS', - source='unix_privs.c', --- -2.48.1 - - -From adf180613e4172292090d4c3573a439388a09788 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:29:21 +1300 -Subject: [PATCH 02/11] dsdb:password_hash: move hash_blob allocation up - -This will make the next patch simpler. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 1edb12f79593d0b2aac36d5acdaaae6f495772f6) ---- - source4/dsdb/samdb/ldb_modules/password_hash.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 1d1267624e2..c1902126a72 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1649,6 +1649,13 @@ static int setup_primary_userPassword_hash( - } - } - -+ hash_blob = talloc_zero(ctx, DATA_BLOB); -+ -+ if (hash_blob == NULL) { -+ TALLOC_FREE(frame); -+ return ldb_oom(ldb); -+ } -+ - /* - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string -@@ -1712,15 +1719,10 @@ static int setup_primary_userPassword_hash( - scheme, - reason); - TALLOC_FREE(frame); -+ TALLOC_FREE(hash_blob); - return LDB_ERR_OPERATIONS_ERROR; - } - -- hash_blob = talloc_zero(ctx, DATA_BLOB); -- -- if (hash_blob == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - - *hash_blob = data_blob_talloc(hash_blob, - (const uint8_t *)hash, --- -2.48.1 - - -From 9d43e4d649db23549bbb230ed60426fa286b7ab7 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 11:16:22 +1300 -Subject: [PATCH 03/11] dsdb:password_hash: use talloc_crypt_blob() - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit c7597380b479208e33a403211cec9b3c7bd3f034) ---- - .../dsdb/samdb/ldb_modules/password_hash.c | 68 ++++--------------- - .../samdb/ldb_modules/wscript_build_server | 2 +- - 2 files changed, 13 insertions(+), 57 deletions(-) - -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index c1902126a72..7a7114c1caa 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -51,6 +51,7 @@ - #include "auth/common_auth.h" - #include "lib/messaging/messaging.h" - #include "lib/param/loadparm.h" -+#include "lib/util/util_crypt.h" - - #include "lib/crypto/gnutls_helpers.h" - #include -@@ -1592,16 +1593,11 @@ static int setup_primary_userPassword_hash( - struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module); - const char *salt = NULL; /* Randomly generated salt */ - const char *cmd = NULL; /* command passed to crypt */ -- const char *hash = NULL; /* password hash generated by crypt */ - int algorithm = 0; /* crypt hash algorithm number */ - int rounds = 0; /* The number of hash rounds */ -+ int ret; - DATA_BLOB *hash_blob = NULL; - TALLOC_CTX *frame = talloc_stackframe(); --#if defined(HAVE_CRYPT_R) || defined(HAVE_CRYPT_RN) -- struct crypt_data crypt_data = { -- .initialized = 0 /* working storage used by crypt */ -- }; --#endif - - /* Generate a random password salt */ - salt = generate_random_str_list(frame, -@@ -1660,52 +1656,20 @@ static int setup_primary_userPassword_hash( - * Relies on the assertion that cleartext_utf8->data is a zero - * terminated UTF-8 string - */ -- -- /* -- * crypt_r() and crypt() may return a null pointer upon error -- * depending on how libcrypt was configured, so we prefer -- * crypt_rn() from libcrypt / libxcrypt which always returns -- * NULL on error. -- * -- * POSIX specifies returning a null pointer and setting -- * errno. -- * -- * RHEL 7 (which does not use libcrypt / libxcrypt) returns a -- * non-NULL pointer from crypt_r() on success but (always?) -- * sets errno during internal processing in the NSS crypto -- * subsystem. -- * -- * By preferring crypt_rn we avoid the 'return non-NULL but -- * set-errno' that we otherwise cannot tell apart from the -- * RHEL 7 behaviour. -- */ -- errno = 0; -- --#ifdef HAVE_CRYPT_RN -- hash = crypt_rn((char *)io->n.cleartext_utf8->data, -- cmd, -- &crypt_data, -- sizeof(crypt_data)); --#elif HAVE_CRYPT_R -- hash = crypt_r((char *)io->n.cleartext_utf8->data, cmd, &crypt_data); --#else -- /* -- * No crypt_r falling back to crypt, which is NOT thread safe -- * Thread safety MT-Unsafe race:crypt -- */ -- hash = crypt((char *)io->n.cleartext_utf8->data, cmd); --#endif -- /* -- * On error, crypt() and crypt_r() may return a null pointer, -- * or a pointer to an invalid hash beginning with a '*'. -- */ -- if (hash == NULL || hash[0] == '*') { -+ ret = talloc_crypt_blob(hash_blob, -+ (char *)io->n.cleartext_utf8->data, -+ cmd, -+ hash_blob); -+ if (ret != 0) { - char buf[1024]; - const char *reason = NULL; -- if (errno == ERANGE) { -+ if (ret == ERANGE) { - reason = "Password exceeds maximum length allowed for crypt() hashing"; -+ } else if (ret == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -+ reason = "Unknown error"; - } else { -- int err = strerror_r(errno, buf, sizeof(buf)); -+ int err = strerror_r(ret, buf, sizeof(buf)); - if (err == 0) { - reason = buf; - } else { -@@ -1723,14 +1687,6 @@ static int setup_primary_userPassword_hash( - return LDB_ERR_OPERATIONS_ERROR; - } - -- -- *hash_blob = data_blob_talloc(hash_blob, -- (const uint8_t *)hash, -- strlen(hash)); -- if (hash_blob->data == NULL) { -- TALLOC_FREE(frame); -- return ldb_oom(ldb); -- } - hash_value->value = hash_blob; - TALLOC_FREE(frame); - return LDB_SUCCESS; -diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build_server b/source4/dsdb/samdb/ldb_modules/wscript_build_server -index 9c1eb12a7c2..16d9b31a982 100644 ---- a/source4/dsdb/samdb/ldb_modules/wscript_build_server -+++ b/source4/dsdb/samdb/ldb_modules/wscript_build_server -@@ -195,7 +195,7 @@ bld.SAMBA_MODULE('ldb_password_hash', - init_function='ldb_password_hash_module_init', - module_init_name='ldb_init_module', - internal_module=False, -- deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS crypt db-glue' -+ deps='talloc samdb LIBCLI_AUTH NDR_DRSBLOBS authkrb5 krb5 gpgme DSDB_MODULE_HELPERS util_crypt db-glue' - ) - - --- -2.48.1 - - -From 1c94645881bd5130c67bfee96aa463f360df300a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:04 +1300 -Subject: [PATCH 04/11] util: add a crypt strerror helper - -This will be used by Python also. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5f365e71c1fa8cdc533159283a5977164b5d39f2) ---- - lib/util/util_crypt.c | 24 +++++++++++++++++++ - lib/util/util_crypt.h | 2 ++ - .../dsdb/samdb/ldb_modules/password_hash.c | 16 +------------ - 3 files changed, 27 insertions(+), 15 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 0f7b2d0fd31..09cd47597d1 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -88,3 +88,27 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - } - return 0; - } -+ -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error) -+{ -+ char buf[1024]; -+ int err; -+ if (error == ERANGE) { -+ return talloc_strdup( -+ mem_ctx, -+ "Password exceeds maximum length allowed for crypt() hashing"); -+ } -+ if (error == ENOTRECOVERABLE) { -+ /* probably weird RHEL7 crypt, see crypt_as_best_we_can() */ -+ goto unknown; -+ } -+ -+ err = strerror_r(error, buf, sizeof(buf)); -+ if (err != 0) { -+ goto unknown; -+ } -+ return talloc_strndup(mem_ctx, buf, sizeof(buf)); -+unknown: -+ return talloc_strdup(mem_ctx, "Unknown error"); -+} -diff --git a/lib/util/util_crypt.h b/lib/util/util_crypt.h -index 8c289e489e8..ca1a58e922c 100644 ---- a/lib/util/util_crypt.h -+++ b/lib/util/util_crypt.h -@@ -3,3 +3,5 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - const char *phrase, - const char *cmd, - DATA_BLOB *blob); -+ -+char *talloc_crypt_errstring(TALLOC_CTX *mem_ctx, int error); -diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c -index 7a7114c1caa..6949a92fc3e 100644 ---- a/source4/dsdb/samdb/ldb_modules/password_hash.c -+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c -@@ -1661,21 +1661,7 @@ static int setup_primary_userPassword_hash( - cmd, - hash_blob); - if (ret != 0) { -- char buf[1024]; -- const char *reason = NULL; -- if (ret == ERANGE) { -- reason = "Password exceeds maximum length allowed for crypt() hashing"; -- } else if (ret == ENOTRECOVERABLE) { -- /* probably weird RHEL7 crypt, see talloc_crypt_blob() */ -- reason = "Unknown error"; -- } else { -- int err = strerror_r(ret, buf, sizeof(buf)); -- if (err == 0) { -- reason = buf; -- } else { -- reason = "Unknown error"; -- } -- } -+ const char *reason = talloc_crypt_errstring(frame, ret); - ldb_asprintf_errstring( - ldb, - "setup_primary_userPassword: generation of a %s " --- -2.48.1 - - -From ce70e852783ec69104d274def931e7d39f17576a Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:30:15 +1300 -Subject: [PATCH 05/11] pyglue: add crypt() function - -This wraps talloc_crypt_blob() from lib/util/util_crypt.c which in -turn wraps the system crypt[_r[n]]. - -We want this because the Python standard library crypt module is going -away. That one also wrapped the system crypt or crypt_r, so there -should be no change. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(backported from commit 88e3c82d88a68cf972f8189e1c3718698b49974a) ---- - python/pyglue.c | 41 +++++++++++++++++++++++++++++++++++++++++ - python/wscript | 1 + - 2 files changed, 42 insertions(+) - -diff --git a/python/pyglue.c b/python/pyglue.c -index 042bf9e14f3..fcccb849f5e 100644 ---- a/python/pyglue.c -+++ b/python/pyglue.c -@@ -18,6 +18,7 @@ - */ - - #include "lib/replace/system/python.h" -+#include "pyerrors.h" - #include "python/py3compat.h" - #include "includes.h" - #include "python/modules.h" -@@ -25,6 +26,7 @@ - #include "param/pyparam.h" - #include "lib/socket/netif.h" - #include "lib/util/debug.h" -+#include "lib/util/util_crypt.h" - #include "librpc/ndr/ndr_private.h" - #include "lib/cmdline/cmdline.h" - #include "lib/crypto/gkdi.h" -@@ -519,6 +521,42 @@ static PyObject *py_get_burnt_commandline(PyObject *self, PyObject *args) - return ret; - } - -+static PyObject *py_crypt(PyObject *self, PyObject *args) -+{ -+ PyObject *py_hash = NULL; -+ char *phrase = NULL; -+ char *setting = NULL; -+ TALLOC_CTX *frame = NULL; -+ int ret; -+ DATA_BLOB hash = {}; -+ -+ if (!PyArg_ParseTuple(args, "ss", &phrase, &setting)) { -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ frame = talloc_stackframe(); -+ ret = talloc_crypt_blob(frame, phrase, setting, &hash); -+ if (ret != 0) { -+ const char *errstr = talloc_crypt_errstring(frame, ret); -+ if (ret == EINVAL || ret == ERANGE || ret == ENOTRECOVERABLE) { -+ PyErr_Format(PyExc_ValueError, -+ "could not crypt(): %s", -+ errstr); -+ } else { -+ PyErr_Format(PyExc_OSError, -+ "could not crypt(): %s", -+ errstr); -+ } -+ TALLOC_FREE(frame); -+ return NULL; -+ } -+ -+ py_hash = PyUnicode_FromStringAndSize((char *)hash.data, hash.length); -+ TALLOC_FREE(frame); -+ return py_hash; -+} -+ -+ - static PyMethodDef py_misc_methods[] = { - { "generate_random_str", (PyCFunction)py_generate_random_str, METH_VARARGS, - "generate_random_str(len) -> string\n" -@@ -580,6 +618,9 @@ static PyMethodDef py_misc_methods[] = { - METH_NOARGS, "How many NDR internal tokens is too many for this build?" }, - { "get_burnt_commandline", (PyCFunction)py_get_burnt_commandline, - METH_VARARGS, "Return a redacted commandline to feed to setproctitle (None if no redaction required)" }, -+ { "crypt", (PyCFunction)py_crypt, -+ METH_VARARGS, -+ "encrypt as phrase, per crypt(3), as determined by setting." }, - {0} - }; - -diff --git a/python/wscript b/python/wscript -index 3e6439930e9..7c17e390dc7 100644 ---- a/python/wscript -+++ b/python/wscript -@@ -119,6 +119,7 @@ def build(bld): - ndr - cmdline - gkdi -+ util_crypt - %s - ''' % (pyparam_util, pytalloc_util), - realname='samba/_glue.so') --- -2.48.1 - - -From 9a0dc2db7cde22f36583159c0d697a3de6640990 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:44:07 +1300 -Subject: [PATCH 06/11] pytest: test that _glue.crypt works - -The test vectors were generated via Python 3.10 crypt module, which -directly wraps crypt(3), which in this case is from glibc 2.39-0ubuntu8.3. - -We mainly test the sha256 and sha512 vectors, which seems to be all we -use, and which are said to be widely supported. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 5636d30c0959fd4a211ee7b8d1b267dcdbf0b963) ---- - python/samba/tests/glue.py | 65 ++++++++++++++++++++++++++++++++++++++ - 1 file changed, 65 insertions(+) - -diff --git a/python/samba/tests/glue.py b/python/samba/tests/glue.py -index ac504b3f366..824f5ca0c81 100644 ---- a/python/samba/tests/glue.py -+++ b/python/samba/tests/glue.py -@@ -88,3 +88,68 @@ class GlueTests(samba.tests.TestCase): - self.assertEqual(_glue.strstr_m(string, '_'), '_string_num__one') - self.assertEqual(_glue.strstr_m(string, '__'), '__one') - self.assertEqual(_glue.strstr_m(string, 'ring'), 'ring_num__one') -+ -+ def test_crypt(self): -+ # We hopefully only use schemes 5 and 6 (sha256 and sha512), -+ # which are OK and also quite widely supported according to -+ # https://en.wikipedia.org/wiki/Crypt_(C) -+ for phrase, setting, expected in [ -+ ("a", "$5$aaaaaa", -+ "$5$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6"), -+ # with scheme 5, 5000 rounds is default, so hash is the same as above -+ ('a', '$5$rounds=5000$aaaaaa', -+ '$5$rounds=5000$aaaaaa$F4lxguL7mZR7TGlvukPTJIxoRhVmHMZs8ZdH8oDP0.6'), -+ ('a', -+ '$5$rounds=4999$aaaaaa', -+ '$5$rounds=4999$aaaaaa$FiP70gtxOJUFLokUJvET06E7jbL6aNmF6Wtv2ddzjY8'), -+ ('a', '$5$aaaaab', -+ '$5$aaaaab$e9qR2F833/JyuMu.nkQc9kn184vBWLo0ODqnCe./mj0'), -+ -+ ('', '$5$aaaaaa', '$5$aaaaaa$5B4WTdWp5n/v/aNUw2N8RsEitqvlZJEaAKhH/pOkGg4'), -+ -+ ("a", "$6$aaaaaa", -+ "$6$aaaaaa$KHs/Ez7X/I5/K.V8FR7kEsx9rOvjXnEDUmGC.dLBWP87XWy.oUEAM7QYcZQRVhiDwGepOF2pKrCVETYLyASh60"), -+ -+ ('', '$5$', '$5$$3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.'), -+ -+ # scheme 1 (md5) should be supported if not used -+ ('a', '$1$aaaaaa', -+ '$1$aaaaaa$MUMWPbGfzrHFCNm7ZHg31.'), -+ -+ ('', '$6$', -+ '$6$$/chiBau24cE26QQVW3IfIe68Xu5.JQ4E8Ie7lcRLwqxO5cxGuBhqF2HmTL.zWJ9zjChg3yJYFXeGBQ2y3Ba1d1'), -+ (' ', -+ '$6$6', -+ '$6$6$asLnbxf0obyuv3ybNvDE9ZcdwGFkDhLe7uW.wzdOdKCm4/M3vGFKq4Ttk1tBQrOn4wALZ3tj1L8IarIu5i8hR/'), -+ -+ # original DES scheme, 12 bits of salt -+ ("a", "lalala", "laKGbFzgh./R2"), -+ ("a", "lalalaLALALAla", "laKGbFzgh./R2"), -+ ("a", "arrgh", "ar7VUiUvDhX2c"), -+ ("a", "arrggghhh", "ar7VUiUvDhX2c"), -+ ]: -+ hash = _glue.crypt(phrase, setting) -+ self.assertEqual(hash, expected) -+ -+ def test_crypt_bad(self): -+ # We can't be too strident in our assertions, because every -+ # system allows a different set of algorithms, and some have -+ # different ideas of how to parse. -+ for phrase, setting, exception in [ -+ ("a", "$5", ValueError), -+ ("a", "$0$", ValueError), -+ ("a", None, TypeError), -+ (None, "", TypeError), -+ ('a', '$66$', ValueError), -+ ('a', '$$', ValueError), -+ ('a', '*0', ValueError), -+ ('a', '*', ValueError), -+ ('a', '++', ValueError), -+ # this next one is too long, except on Rocky Linux 8. -+ #('a' * 10000, '$5$5', ValueError), -+ # this is invalid, except on Debian 11. -+ # (' ', '$6$ ', ValueError), -+ ]: -+ with self.assertRaises(exception, -+ msg=f"crypt({phrase!r}, {setting!r}) didn't fail"): -+ _glue.crypt(phrase, setting) --- -2.48.1 - - -From 6425e2514052027ee2269e15e0e0dff1686fa34e Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:54:48 +1300 -Subject: [PATCH 07/11] samba-tool user: use _glue.crypt, not crypt.crypt - -Because we know we have _glue.crypt, and we know it raises exceptions -rather than returning None, we can simplify the checks. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 405187d2ef4920a9a284649c9c3287f5844d5180) ---- - .../samba/netcmd/user/readpasswords/common.py | 21 ++++++------------- - 1 file changed, 6 insertions(+), 15 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 7944d4e1682..68befb3f356 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -37,6 +37,7 @@ from samba.netcmd import Command, CommandError - from samba.samdb import SamDB - from samba.nt_time import timedelta_from_nt_time_delta, nt_time_from_datetime - from samba.gkdi import MAX_CLOCK_SKEW -+from samba._glue import crypt - - # python[3]-gpgme is abandoned since ubuntu 1804 and debian 9 - # have to use python[3]-gpg instead -@@ -132,9 +133,7 @@ def get_crypt_value(alg, utf8pw, rounds=0): - else: - crypt_salt = "$%s$%s$" % (alg, b64salt) - -- crypt_value = crypt.crypt(utf8pw, crypt_salt) -- if crypt_value is None: -- raise NotImplementedError("crypt.crypt(%s) returned None" % (crypt_salt)) -+ crypt_value = crypt(utf8pw, crypt_salt) - expected_len = len(crypt_salt) + algs[alg]["length"] - if len(crypt_value) != expected_len: - raise NotImplementedError("crypt.crypt(%s) returned a value with length %d, expected length is %d" % ( -@@ -156,21 +155,13 @@ except ImportError as e: - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -- import crypt - get_crypt_value(alg, "") -- virtual_attributes[attr] = { -- } -- except ImportError as e: -- reason = "crypt" -- reason += " required" -- disabled_virtual_attributes[attr] = { -- "reason": reason, -- } -- except NotImplementedError as e: -- reason = "modern '$%s$' salt in crypt(3) required" % (alg) -+ except (ValueError, OSError): - disabled_virtual_attributes[attr] = { -- "reason": reason, -+ "reason": f"modern '${alg}$' salt in crypt(3) required" - } -+ continue -+ virtual_attributes[attr] = {} - - # Add the wDigest virtual attributes, virtualWDigest01 to virtualWDigest29 - for x in range(1, 30): --- -2.48.1 - - -From a2a04286e13676177c952e67363fc7502f544861 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 15:56:20 +1300 -Subject: [PATCH 08/11] samba-tool user: hashlib.sha1 is always present - -We maybe thought we were checking that sha1 was in hashlib, but we were -only checking that hashlib is in the Python library (`hashlib.sha1()` -would not raise ImportError). - -The documentation says hashlib always contains sha1 -- if that -changes, it is better we know by failing noisily with the import error -at the top of the file. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 4af4dd8135e8edbe2a16cfdfc7ded8c145c82e98) ---- - python/samba/netcmd/user/readpasswords/common.py | 16 ++++------------ - 1 file changed, 4 insertions(+), 12 deletions(-) - -diff --git a/python/samba/netcmd/user/readpasswords/common.py b/python/samba/netcmd/user/readpasswords/common.py -index 68befb3f356..3043525874e 100644 ---- a/python/samba/netcmd/user/readpasswords/common.py -+++ b/python/samba/netcmd/user/readpasswords/common.py -@@ -26,6 +26,7 @@ import datetime - import errno - import io - import os -+from hashlib import sha1 - - import ldb - from samba import credentials, nttime2float -@@ -141,17 +142,8 @@ def get_crypt_value(alg, utf8pw, rounds=0): - return crypt_value - - --try: -- import hashlib -- hashlib.sha1() -- virtual_attributes["virtualSSHA"] = { -- } --except ImportError as e: -- reason = "hashlib.sha1()" -- reason += " required" -- disabled_virtual_attributes["virtualSSHA"] = { -- "reason": reason, -- } -+ -+virtual_attributes["virtualSSHA"] = {} - - for (alg, attr) in [("5", "virtualCryptSHA256"), ("6", "virtualCryptSHA512")]: - try: -@@ -736,7 +728,7 @@ class GetPasswordCommand(Command): - if u8 is None: - continue - salt = os.urandom(4) -- h = hashlib.sha1() -+ h = sha1() - h.update(u8) - h.update(salt) - bv = h.digest() + salt --- -2.48.1 - - -From e9a8748f3cc4ba74f8b0d75e7a01866e7c12a0a4 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Thu, 12 Dec 2024 10:46:16 +1300 -Subject: [PATCH 09/11] pytest: password_hash uses internal _glue.crypt - -This will remove an external dependency. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider -(cherry picked from commit 552053b6445611ecef6ac4c11c55ebf92f03571d) ---- - python/samba/tests/password_hash.py | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/python/samba/tests/password_hash.py b/python/samba/tests/password_hash.py -index 1b7af7de7b8..39ef13fd7b2 100644 ---- a/python/samba/tests/password_hash.py -+++ b/python/samba/tests/password_hash.py -@@ -30,11 +30,11 @@ from samba.dcerpc.samr import DOMAIN_PASSWORD_STORE_CLEARTEXT - from samba.dsdb import UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED - from samba.tests import delete_force - from samba.tests.password_test import PasswordCommon -+from samba._glue import crypt - import ldb - import samba - import binascii - from hashlib import md5 --import crypt - - - USER_NAME = "PasswordHashTestUser" -@@ -321,7 +321,7 @@ class PassWordHashTests(TestCase): - cmd = "$%s$rounds=%d$%s" % (alg, rounds, data[3]) - - # Calculate the expected hash value -- expected = crypt.crypt(USER_PASS, cmd) -+ expected = crypt(USER_PASS, cmd) - self.assertEqual(expected, up.hashes[i].value.decode('utf8')) - i += 1 - --- -2.48.1 - - -From 0e01dc4f1fabfd2c3f21f724c05d94227a278b20 Mon Sep 17 00:00:00 2001 -From: Douglas Bagnall -Date: Wed, 11 Dec 2024 14:31:18 +1300 -Subject: [PATCH 10/11] util:datablob: data_blob_pad checks its alignment - assumption - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15756 - -Signed-off-by: Douglas Bagnall -Reviewed-by: Andreas Schneider - -Autobuild-User(master): Andreas Schneider -Autobuild-Date(master): Fri Dec 20 07:59:51 UTC 2024 on atb-devel-224 - -(cherry picked from commit 8b84282008dc372d67ba01c8fe256ef756c3dcfb) ---- - lib/util/data_blob.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/util/data_blob.c b/lib/util/data_blob.c -index b5b78bc7a8a..0522e7755af 100644 ---- a/lib/util/data_blob.c -+++ b/lib/util/data_blob.c -@@ -286,7 +286,7 @@ _PUBLIC_ bool data_blob_pad(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, - size_t old_len = blob->length; - size_t new_len = (old_len + pad - 1) & ~(pad - 1); - -- if (new_len < old_len) { -+ if (new_len < old_len || (pad & (pad - 1)) != 0) { - return false; - } - --- -2.48.1 - - -From 8cfae9f33fb1c170c3fe937be200490597e9e4c2 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 17 Jan 2025 13:28:30 +0100 -Subject: [PATCH 11/11] lib:util: Fix stack-use-after-return in - crypt_as_best_we_can() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15784 - -Signed-off-by: Andreas Schneider -Reviewed-by: Douglas Bagnall -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Douglas Bagnall -Autobuild-Date(master): Fri Jan 17 23:21:13 UTC 2025 on atb-devel-224 - -(cherry picked from commit 6cd9849b58ec653cbffc602e3c96996a082faf53) ---- - lib/util/util_crypt.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/lib/util/util_crypt.c b/lib/util/util_crypt.c -index 09cd47597d1..9ac6e1cfd0e 100644 ---- a/lib/util/util_crypt.c -+++ b/lib/util/util_crypt.c -@@ -1,11 +1,13 @@ - #include - #include "data_blob.h" -+#include "discard.h" - #include - #include - #include "util_crypt.h" - - --static int crypt_as_best_we_can(const char *phrase, -+static int crypt_as_best_we_can(TALLOC_CTX *mem_ctx, -+ const char *phrase, - const char *setting, - const char **hashp) - { -@@ -63,8 +65,14 @@ static int crypt_as_best_we_can(const char *phrase, - ret = ENOTRECOVERABLE; - } - } -+ if (ret != 0) { -+ return ret; -+ } - -- *hashp = hash; -+ *hashp = talloc_strdup(mem_ctx, hash); -+ if (*hashp == NULL) { -+ ret = -1; -+ } - return ret; - } - -@@ -75,14 +83,14 @@ int talloc_crypt_blob(TALLOC_CTX *mem_ctx, - DATA_BLOB *blob) - { - const char *hash = NULL; -- int ret = crypt_as_best_we_can(phrase, setting, &hash); -+ int ret = crypt_as_best_we_can(mem_ctx, phrase, setting, &hash); - if (ret != 0) { - blob->data = NULL; - blob->length = 0; - return ret; - } - blob->length = strlen(hash); -- blob->data = talloc_memdup(mem_ctx, hash, blob->length); -+ blob->data = discard_const_p(uint8_t, hash); - if (blob->data == NULL) { - return ENOMEM; - } --- -2.48.1 - diff --git a/samba-4.21.0-s3-notifyd.patch b/samba-4.21.0-s3-notifyd.patch deleted file mode 100644 index 31463fd..0000000 --- a/samba-4.21.0-s3-notifyd.patch +++ /dev/null @@ -1,513 +0,0 @@ -From c9a7bc3e8f36cb9d6746e23ea56f9c27b82dcf49 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Mon, 22 Jul 2024 12:26:55 +0200 -Subject: [PATCH] s3:notifyd: Use a watcher per db record -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This fixes a O(n²) performance regression in notifyd. The problem was -that we had a watcher per notify instance. This changes the code to have -a watcher per notify db entry. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=14430 - -Signed-off-by: Andreas Schneider -Reviewed-by: Stefan Metzmacher -(cherry picked from commit af011b987a4ad0d3753d83cc0b8d97ad64ba874a) ---- - source3/smbd/notifyd/notifyd.c | 214 ++++++++++++++++++------- - source3/smbd/notifyd/notifyd_db.c | 5 +- - source3/smbd/notifyd/notifyd_entry.c | 51 ++++-- - source3/smbd/notifyd/notifyd_private.h | 46 ++++-- - 4 files changed, 228 insertions(+), 88 deletions(-) - -diff --git a/source3/smbd/notifyd/notifyd.c b/source3/smbd/notifyd/notifyd.c -index 64dd26a7e11..0b07ab3e435 100644 ---- a/source3/smbd/notifyd/notifyd.c -+++ b/source3/smbd/notifyd/notifyd.c -@@ -337,6 +337,7 @@ static bool notifyd_apply_rec_change( - struct messaging_context *msg_ctx) - { - struct db_record *rec = NULL; -+ struct notifyd_watcher watcher = {}; - struct notifyd_instance *instances = NULL; - size_t num_instances; - size_t i; -@@ -344,6 +345,7 @@ static bool notifyd_apply_rec_change( - TDB_DATA value; - NTSTATUS status; - bool ok = false; -+ bool new_watcher = false; - - if (pathlen == 0) { - DBG_WARNING("pathlen==0\n"); -@@ -374,8 +376,12 @@ static bool notifyd_apply_rec_change( - value = dbwrap_record_get_value(rec); - - if (value.dsize != 0) { -- if (!notifyd_parse_entry(value.dptr, value.dsize, NULL, -- &num_instances)) { -+ ok = notifyd_parse_entry(value.dptr, -+ value.dsize, -+ &watcher, -+ NULL, -+ &num_instances); -+ if (!ok) { - goto fail; - } - } -@@ -390,8 +396,22 @@ static bool notifyd_apply_rec_change( - goto fail; - } - -- if (value.dsize != 0) { -- memcpy(instances, value.dptr, value.dsize); -+ if (num_instances > 0) { -+ struct notifyd_instance *tmp = NULL; -+ size_t num_tmp = 0; -+ -+ ok = notifyd_parse_entry(value.dptr, -+ value.dsize, -+ NULL, -+ &tmp, -+ &num_tmp); -+ if (!ok) { -+ goto fail; -+ } -+ -+ memcpy(instances, -+ tmp, -+ sizeof(struct notifyd_instance) * num_tmp); - } - - for (i=0; ifilter, -- .internal_subdir_filter = chg->subdir_filter - }; - - num_instances += 1; - } - -- if ((instance->instance.filter != 0) || -- (instance->instance.subdir_filter != 0)) { -- int ret; -+ /* -+ * Calculate an intersection of the instances filters for the watcher. -+ */ -+ if (instance->instance.filter > 0) { -+ uint32_t filter = instance->instance.filter; -+ -+ if ((watcher.filter & filter) != filter) { -+ watcher.filter |= filter; -+ -+ new_watcher = true; -+ } -+ } -+ -+ /* -+ * Calculate an intersection of the instances subdir_filters for the -+ * watcher. -+ */ -+ if (instance->instance.subdir_filter > 0) { -+ uint32_t subdir_filter = instance->instance.subdir_filter; - -- TALLOC_FREE(instance->sys_watch); -+ if ((watcher.subdir_filter & subdir_filter) != subdir_filter) { -+ watcher.subdir_filter |= subdir_filter; - -- ret = sys_notify_watch(entries, sys_notify_ctx, path, -- &instance->internal_filter, -- &instance->internal_subdir_filter, -- notifyd_sys_callback, msg_ctx, -- &instance->sys_watch); -- if (ret != 0) { -- DBG_WARNING("sys_notify_watch for [%s] returned %s\n", -- path, strerror(errno)); -+ new_watcher = true; - } - } - - if ((instance->instance.filter == 0) && - (instance->instance.subdir_filter == 0)) { -+ uint32_t tmp_filter = 0; -+ uint32_t tmp_subdir_filter = 0; -+ - /* This is a delete request */ -- TALLOC_FREE(instance->sys_watch); - *instance = instances[num_instances-1]; - num_instances -= 1; -+ -+ for (i = 0; i < num_instances; i++) { -+ struct notifyd_instance *tmp = &instances[i]; -+ -+ tmp_filter |= tmp->instance.filter; -+ tmp_subdir_filter |= tmp->instance.subdir_filter; -+ } -+ -+ /* -+ * If the filter has changed, register a new watcher with the -+ * changed filter. -+ */ -+ if (watcher.filter != tmp_filter || -+ watcher.subdir_filter != tmp_subdir_filter) -+ { -+ watcher.filter = tmp_filter; -+ watcher.subdir_filter = tmp_subdir_filter; -+ -+ new_watcher = true; -+ } -+ } -+ -+ if (new_watcher) { -+ /* -+ * In case we removed all notify instances, we want to remove -+ * the watcher. We won't register a new one, if no filters are -+ * set anymore. -+ */ -+ -+ TALLOC_FREE(watcher.sys_watch); -+ -+ watcher.sys_filter = watcher.filter; -+ watcher.sys_subdir_filter = watcher.subdir_filter; -+ -+ /* -+ * Only register a watcher if we have filter. -+ */ -+ if (watcher.filter != 0 || watcher.subdir_filter != 0) { -+ int ret = sys_notify_watch(entries, -+ sys_notify_ctx, -+ path, -+ &watcher.sys_filter, -+ &watcher.sys_subdir_filter, -+ notifyd_sys_callback, -+ msg_ctx, -+ &watcher.sys_watch); -+ if (ret != 0) { -+ DBG_WARNING("sys_notify_watch for [%s] " -+ "returned %s\n", -+ path, -+ strerror(errno)); -+ } -+ } - } - - DBG_DEBUG("%s has %zu instances\n", path, num_instances); - - if (num_instances == 0) { -+ TALLOC_FREE(watcher.sys_watch); -+ - status = dbwrap_record_delete(rec); - if (!NT_STATUS_IS_OK(status)) { - DBG_WARNING("dbwrap_record_delete returned %s\n", -@@ -456,13 +541,21 @@ static bool notifyd_apply_rec_change( - goto fail; - } - } else { -- value = make_tdb_data( -- (uint8_t *)instances, -- sizeof(struct notifyd_instance) * num_instances); -+ struct TDB_DATA iov[2] = { -+ { -+ .dptr = (uint8_t *)&watcher, -+ .dsize = sizeof(struct notifyd_watcher), -+ }, -+ { -+ .dptr = (uint8_t *)instances, -+ .dsize = sizeof(struct notifyd_instance) * -+ num_instances, -+ }, -+ }; - -- status = dbwrap_record_store(rec, value, 0); -+ status = dbwrap_record_storev(rec, iov, ARRAY_SIZE(iov), 0); - if (!NT_STATUS_IS_OK(status)) { -- DBG_WARNING("dbwrap_record_store returned %s\n", -+ DBG_WARNING("dbwrap_record_storev returned %s\n", - nt_errstr(status)); - goto fail; - } -@@ -706,12 +799,18 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, - .when = tstate->msg->when }; - struct iovec iov[2]; - size_t path_len = key.dsize; -+ struct notifyd_watcher watcher = {}; - struct notifyd_instance *instances = NULL; - size_t num_instances = 0; - size_t i; -+ bool ok; - -- if (!notifyd_parse_entry(data.dptr, data.dsize, &instances, -- &num_instances)) { -+ ok = notifyd_parse_entry(data.dptr, -+ data.dsize, -+ &watcher, -+ &instances, -+ &num_instances); -+ if (!ok) { - DBG_DEBUG("Could not parse notifyd_entry\n"); - return; - } -@@ -734,9 +833,11 @@ static void notifyd_trigger_parser(TDB_DATA key, TDB_DATA data, - - if (tstate->covered_by_sys_notify) { - if (tstate->recursive) { -- i_filter = instance->internal_subdir_filter; -+ i_filter = watcher.sys_subdir_filter & -+ instance->instance.subdir_filter; - } else { -- i_filter = instance->internal_filter; -+ i_filter = watcher.sys_filter & -+ instance->instance.filter; - } - } else { - if (tstate->recursive) { -@@ -1146,46 +1247,39 @@ static int notifyd_add_proxy_syswatches(struct db_record *rec, - struct db_context *db = dbwrap_record_get_db(rec); - TDB_DATA key = dbwrap_record_get_key(rec); - TDB_DATA value = dbwrap_record_get_value(rec); -- struct notifyd_instance *instances = NULL; -- size_t num_instances = 0; -- size_t i; -+ struct notifyd_watcher watcher = {}; - char path[key.dsize+1]; - bool ok; -+ int ret; - - memcpy(path, key.dptr, key.dsize); - path[key.dsize] = '\0'; - -- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, -- &num_instances); -+ /* This is a remote database, we just need the watcher. */ -+ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); - if (!ok) { - DBG_WARNING("Could not parse notifyd entry for %s\n", path); - return 0; - } - -- for (i=0; iinstance.filter; -- uint32_t subdir_filter = instance->instance.subdir_filter; -- int ret; -+ watcher.sys_watch = NULL; -+ watcher.sys_filter = watcher.filter; -+ watcher.sys_subdir_filter = watcher.subdir_filter; - -- /* -- * This is a remote database. Pointers that we were -- * given don't make sense locally. Initialize to NULL -- * in case sys_notify_watch fails. -- */ -- instances[i].sys_watch = NULL; -- -- ret = state->sys_notify_watch( -- db, state->sys_notify_ctx, path, -- &filter, &subdir_filter, -- notifyd_sys_callback, state->msg_ctx, -- &instance->sys_watch); -- if (ret != 0) { -- DBG_WARNING("inotify_watch returned %s\n", -- strerror(errno)); -- } -+ ret = state->sys_notify_watch(db, -+ state->sys_notify_ctx, -+ path, -+ &watcher.filter, -+ &watcher.subdir_filter, -+ notifyd_sys_callback, -+ state->msg_ctx, -+ &watcher.sys_watch); -+ if (ret != 0) { -+ DBG_WARNING("inotify_watch returned %s\n", strerror(errno)); - } - -+ memcpy(value.dptr, &watcher, sizeof(struct notifyd_watcher)); -+ - return 0; - } - -@@ -1193,21 +1287,17 @@ static int notifyd_db_del_syswatches(struct db_record *rec, void *private_data) - { - TDB_DATA key = dbwrap_record_get_key(rec); - TDB_DATA value = dbwrap_record_get_value(rec); -- struct notifyd_instance *instances = NULL; -- size_t num_instances = 0; -- size_t i; -+ struct notifyd_watcher watcher = {}; - bool ok; - -- ok = notifyd_parse_entry(value.dptr, value.dsize, &instances, -- &num_instances); -+ ok = notifyd_parse_entry(value.dptr, value.dsize, &watcher, NULL, NULL); - if (!ok) { - DBG_WARNING("Could not parse notifyd entry for %.*s\n", - (int)key.dsize, (char *)key.dptr); - return 0; - } -- for (i=0; ientries database - */ - --bool notifyd_parse_entry( -- uint8_t *buf, -- size_t buflen, -- struct notifyd_instance **instances, -- size_t *num_instances) -+/** -+ * @brief Parse a notifyd database entry. -+ * -+ * The memory we pass down needs to be aligned. If it isn't aligned we can run -+ * into obscure errors as we just point into the data buffer. -+ * -+ * @param data The data to parse -+ * @param data_len The length of the data to parse -+ * @param watcher A pointer to store the watcher data or NULL. -+ * @param instances A pointer to store the array of notify instances or NULL. -+ * @param pnum_instances The number of elements in the array. If you just want -+ * the number of elements pass NULL for the watcher and instances pointers. -+ * -+ * @return true on success, false if an error occurred. -+ */ -+bool notifyd_parse_entry(uint8_t *data, -+ size_t data_len, -+ struct notifyd_watcher *watcher, -+ struct notifyd_instance **instances, -+ size_t *pnum_instances) - { -- if ((buflen % sizeof(struct notifyd_instance)) != 0) { -- DBG_WARNING("invalid buffer size: %zu\n", buflen); -+ size_t ilen; -+ -+ if (data_len < sizeof(struct notifyd_watcher)) { - return false; - } - -- if (instances != NULL) { -- *instances = (struct notifyd_instance *)buf; -+ if (watcher != NULL) { -+ *watcher = *((struct notifyd_watcher *)(uintptr_t)data); - } -- if (num_instances != NULL) { -- *num_instances = buflen / sizeof(struct notifyd_instance); -+ -+ ilen = data_len - sizeof(struct notifyd_watcher); -+ if ((ilen % sizeof(struct notifyd_instance)) != 0) { -+ return false; -+ } -+ -+ if (pnum_instances != NULL) { -+ *pnum_instances = ilen / sizeof(struct notifyd_instance); - } -+ if (instances != NULL) { -+ /* The (uintptr_t) cast removes a warning from -Wcast-align. */ -+ *instances = -+ (struct notifyd_instance *)(uintptr_t) -+ (data + sizeof(struct notifyd_watcher)); -+ } -+ - return true; - } -diff --git a/source3/smbd/notifyd/notifyd_private.h b/source3/smbd/notifyd/notifyd_private.h -index 36c08f47c54..db8e6e1c005 100644 ---- a/source3/smbd/notifyd/notifyd_private.h -+++ b/source3/smbd/notifyd/notifyd_private.h -@@ -20,30 +20,48 @@ - #include "lib/util/server_id.h" - #include "notifyd.h" - -+ - /* -- * notifyd's representation of a notify instance -+ * Representation of a watcher for a path -+ * -+ * This will be stored in the db. - */ --struct notifyd_instance { -- struct server_id client; -- struct notify_instance instance; -- -- void *sys_watch; /* inotify/fam/etc handle */ -+struct notifyd_watcher { -+ /* -+ * This is an intersections of the filter the watcher is listening for. -+ */ -+ uint32_t filter; -+ uint32_t subdir_filter; - - /* -- * Filters after sys_watch took responsibility of some bits -+ * Those are inout variables passed to the sys_watcher. The sys_watcher -+ * will remove the bits it can't handle. - */ -- uint32_t internal_filter; -- uint32_t internal_subdir_filter; -+ uint32_t sys_filter; -+ uint32_t sys_subdir_filter; -+ -+ /* The handle for inotify/fam etc. */ -+ void *sys_watch; -+}; -+ -+/* -+ * Representation of a notifyd instance -+ * -+ * This will be stored in the db. -+ */ -+struct notifyd_instance { -+ struct server_id client; -+ struct notify_instance instance; - }; - - /* - * Parse an entry in the notifyd_context->entries database - */ - --bool notifyd_parse_entry( -- uint8_t *buf, -- size_t buflen, -- struct notifyd_instance **instances, -- size_t *num_instances); -+bool notifyd_parse_entry(uint8_t *data, -+ size_t data_len, -+ struct notifyd_watcher *watcher, -+ struct notifyd_instance **instances, -+ size_t *num_instances); - - #endif --- -2.46.1 - diff --git a/samba.spec b/samba.spec index ba9f3ed..9dbc887 100644 --- a/samba.spec +++ b/samba.spec @@ -148,7 +148,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.21.3 +%global samba_version 4.22.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -163,7 +163,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc1 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -176,7 +176,7 @@ %global libdcerpc_so_version 0 %global libndr_krb5pac_so_version 0 %global libndr_nbt_so_version 0 -%global libndr_so_version 5 +%global libndr_so_version 6 %global libndr_standard_so_version 0 %global libnetapi_so_version 1 %global libsamba_credentials_so_version 1 @@ -193,9 +193,9 @@ %global libsmbclient_so_version 0 %global libwbclient_so_version 0 -%global talloc_version 2.4.2 -%global tdb_version 1.4.12 -%global tevent_version 0.16.1 +%global talloc_version 2.4.3 +%global tdb_version 1.4.13 +%global tevent_version 0.16.2 %global required_mit_krb5 1.20.1 @@ -250,10 +250,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.21.0-s3-notifyd.patch -Patch1: samba-4-21-pycrypt.patch -Patch2: samba-4-21-fix-smbreadline.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -2666,8 +2662,11 @@ fi %{python3_sitearch}/samba/dnsresolver.py %dir %{python3_sitearch}/samba/domain %{python3_sitearch}/samba/domain/__init__.py +%dir %{python3_sitearch}/samba/domain/__pycache__ %{python3_sitearch}/samba/domain/__pycache__/__init__.*.pyc +%dir %{python3_sitearch}/samba/domain/models %{python3_sitearch}/samba/domain/models/__init__.py +%dir %{python3_sitearch}/samba/domain/models/__pycache__ %{python3_sitearch}/samba/domain/models/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/domain/models/__pycache__/auth_policy.*.pyc %{python3_sitearch}/samba/domain/models/__pycache__/auth_silo.*.pyc @@ -2876,28 +2875,28 @@ fi %dir %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/__pycache__/__init__.*.pyc %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy -%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/__init__.py -%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__ -%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/__init__.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/computer_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/policy.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_from.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/service_allowed_to_authenticate_to.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_from.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/policy/__pycache__/user_allowed_to_authenticate_to.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/policy/computer_allowed_to_authenticate_to.py +%{python3_sitearch}/samba/netcmd/domain/auth/policy/policy.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_from.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/service_allowed_to_authenticate_to.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_from.py %{python3_sitearch}/samba/netcmd/domain/auth/policy/user_allowed_to_authenticate_to.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo %{python3_sitearch}/samba/netcmd/domain/auth/silo/__init__.py -%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py %dir %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__ %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/member.*.pyc %{python3_sitearch}/samba/netcmd/domain/auth/silo/__pycache__/silo.*.pyc +%{python3_sitearch}/samba/netcmd/domain/auth/silo/member.py %{python3_sitearch}/samba/netcmd/domain/auth/silo/silo.py %{python3_sitearch}/samba/netcmd/domain/backup.py %dir %{python3_sitearch}/samba/netcmd/domain/claim @@ -2950,6 +2949,7 @@ fi %{python3_sitearch}/samba/netcmd/schema.py %dir %{python3_sitearch}/samba/netcmd/service_account %{python3_sitearch}/samba/netcmd/service_account/__init__.py +%dir %{python3_sitearch}/samba/netcmd/service_account/__pycache__ %{python3_sitearch}/samba/netcmd/service_account/__pycache__/__init__.*.pyc %{python3_sitearch}/samba/netcmd/service_account/__pycache__/group_msa_membership.*.pyc %{python3_sitearch}/samba/netcmd/service_account/__pycache__/service_account.*.pyc @@ -3238,6 +3238,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/py_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/registry.*.pyc %{python3_sitearch}/samba/tests/__pycache__/reparsepoints.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/rust.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3idmapdb.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3param.*.pyc %{python3_sitearch}/samba/tests/__pycache__/s3passdb.*.pyc @@ -3471,6 +3472,7 @@ fi %{python3_sitearch}/samba/tests/krb5/__pycache__/kpasswd_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/lockout_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc +%{python3_sitearch}/samba/tests/krb5/__pycache__/netlogon.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/nt_hash_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pac_align_tests.*.pyc %{python3_sitearch}/samba/tests/krb5/__pycache__/pkinit_tests.*.pyc @@ -3513,6 +3515,7 @@ fi %{python3_sitearch}/samba/tests/krb5/kpasswd_tests.py %{python3_sitearch}/samba/tests/krb5/lockout_tests.py %{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py +%{python3_sitearch}/samba/tests/krb5/netlogon.py %{python3_sitearch}/samba/tests/krb5/nt_hash_tests.py %{python3_sitearch}/samba/tests/krb5/pac_align_tests.py %{python3_sitearch}/samba/tests/krb5/pkinit_tests.py @@ -3585,6 +3588,7 @@ fi %{python3_sitearch}/samba/tests/py_credentials.py %{python3_sitearch}/samba/tests/registry.py %{python3_sitearch}/samba/tests/reparsepoints.py +%{python3_sitearch}/samba/tests/rust.py %{python3_sitearch}/samba/tests/s3idmapdb.py %{python3_sitearch}/samba/tests/s3param.py %{python3_sitearch}/samba/tests/s3passdb.py @@ -3801,6 +3805,7 @@ fi %config(noreplace) %{_sysconfdir}/ctdb/ctdb.conf %config(noreplace) %{_sysconfdir}/ctdb/notify.sh %config(noreplace) %{_sysconfdir}/ctdb/debug-hung-script.sh +%config(noreplace) %{_sysconfdir}/ctdb/ctdb-backup-persistent-tdbs.sh %config(noreplace) %{_sysconfdir}/ctdb/ctdb-crash-cleanup.sh %config(noreplace) %{_sysconfdir}/ctdb/debug_locks.sh @@ -3844,8 +3849,8 @@ fi %{_libexecdir}/ctdb/ctdb_natgw %{_libexecdir}/ctdb/ctdb-path %{_libexecdir}/ctdb/ctdb_recovery_helper +%{_libexecdir}/ctdb/ctdb_smnotify_helper %{_libexecdir}/ctdb/ctdb_takeover_helper -%{_libexecdir}/ctdb/smnotify %{_libexecdir}/ctdb/statd_callout %{_libexecdir}/ctdb/statd_callout_helper %{_libexecdir}/ctdb/tdb_mutex_check @@ -3894,6 +3899,7 @@ fi %{_datadir}/ctdb/events/legacy/60.nfs.script %{_datadir}/ctdb/events/legacy/70.iscsi.script %{_datadir}/ctdb/events/legacy/91.lvs.script +%{_datadir}/ctdb/events/legacy/95.database.script %dir %{_datadir}/ctdb/scripts %{_datadir}/ctdb/scripts/winbind_ctdb_updatekeytab.sh diff --git a/sources b/sources index 1055c45..300da04 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.21.3.tar.xz) = 62eb3bfe1aa1cc8aa68055d4caf21bdea6d6f5b0f767566bef1da210100b5dd17b7d60f5c47da01b0123d3a2c1c3689b1960ef2c2cbd4f804ff998ead994fc3f -SHA512 (samba-4.21.3.tar.asc) = 11e40d32b783b7d57d3f35fe96a17e897719f65d796d965b371dfb58b8cf1f8ffe60c3047bea8c2b2b0d475fa55cd25237b9ba84d44b3d65a8cd53c6af760957 +SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf +SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b From 67e7277c752d1795e50066139c904e3c7b62a162 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 13 Feb 2025 23:53:18 +0100 Subject: [PATCH 039/101] Update to Samba 4.22.0rc2 - resolves: rhbz#2345547 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 9dbc887..7e88c49 100644 --- a/samba.spec +++ b/samba.spec @@ -163,7 +163,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc1 +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index 300da04..b75ed0a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc1.tar.xz) = 70cefc0c84456ab88971c3eefeb287cf3366c83b6f726c8bcd9c209f7e891390d44230303cedf3ec989749a85a96adb3f5b64bf49b05e10289a0f52669eb3caf -SHA512 (samba-4.22.0rc1.tar.asc) = 07fefd436fac1d5f8344e0a6cfcaa89c36ecb555f3c1484def24febe5c63df386021a726049245e5d08a636b9fddee8725e9cd09406555343b255a79903b768b +SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90 +SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd From cb85d85e0f490da7cf6ca5fe93a38852aabcaaaa Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 11:52:05 +0100 Subject: [PATCH 040/101] Make %bcond switches easier to understand This also removes support for building on rhel8. --- samba.spec | 99 ++++++++++++++---------------------------------------- 1 file changed, 25 insertions(+), 74 deletions(-) diff --git a/samba.spec b/samba.spec index 7e88c49..680bd4f 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,7 @@ # or # rpmbuild --rebuild --with testsuite samba.src.rpm # -%bcond_with testsuite +%bcond testsuite 0 # Build with internal talloc, tevent, tdb # @@ -14,132 +14,97 @@ # or # rpmbuild --rebuild --with=testsuite --with=includelibs samba.src.rpm # -%bcond_with includelibs +%bcond includelibs 0 # fedpkg mockbuild --with=ccache -%bcond_with ccache +%bcond ccache 0 # ctdb is enabled by default, you can disable it with: --without clustering -%bcond_without clustering +%bcond clustering 1 # Define _make_verbose if it doesn't exist (RHEL8) %{!?_make_verbose:%define _make_verbose V=1 VERBOSE=1} # Build with Active Directory Domain Controller support by default on Fedora %if 0%{?fedora} -%bcond_without dc +%bcond dc 1 %else -%bcond_with dc +%bcond dc 0 %endif # Build a libsmbclient package by default -%bcond_without libsmbclient +%bcond libsmbclient 1 # Build a libwbclient package by default -%bcond_without libwbclient +%bcond libwbclient 1 # Build with winexe by default %if 0%{?rhel} %ifarch x86_64 -%bcond_without winexe +%bcond winexe 1 %else -%bcond_with winexe +%bcond winexe 0 #endifarch %endif %else -%bcond_without winexe +%bcond winexe 1 %endif # Build vfs_ceph module and ctdb cepth mutex helper by default on 64bit Fedora %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_cephfs -%bcond_without ceph_mutex +%bcond vfs_cephfs 1 +%bcond ceph_mutex 1 %else -%bcond_with vfs_cephfs -%bcond_with ceph_mutex +%bcond vfs_cephfs 0 +%bcond ceph_mutex 0 #endifarch %endif %else -%bcond_with vfs_cephfs -%bcond_with ceph_mutex +%bcond vfs_cephfs 0 +%bcond ceph_mutex 0 #endif fedora %endif -# Build vfs_gluster module by default on 64bit Fedora -%global is_rhgs 0 -%if "%{dist}" == ".el7rhgs" || "%{dist}" == ".el8rhgs" -%global is_rhgs 1 -%endif - %if 0%{?fedora} %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_glusterfs +%bcond vfs_glusterfs 1 %else -%bcond_with vfs_glusterfs +%bcond vfs_glusterfs 0 #endifarch %endif -#else rhel -%else - -%if 0%{?is_rhgs} -# Enable on rhgs x86_64 -%ifarch x86_64 -%bcond_without vfs_glusterfs -%else -%bcond_with vfs_glusterfs -#endifarch -%endif -%else -%bcond_with vfs_glusterfs -#endif is_rhgs -%endif - #endif fedora %endif # Build vfs_io_uring module by default on 64bit Fedora -%if 0%{?fedora} || 0%{?rhel} >= 8 - %ifarch aarch64 ppc64le s390x x86_64 riscv64 -%bcond_without vfs_io_uring +%bcond vfs_io_uring 1 %else -%bcond_with vfs_io_uring +%bcond vfs_io_uring 0 #endifarch %endif -%else -%bcond_with vfs_io_uring -#endif fedora || rhel >= 8 -%endif - # Build the ctdb-pcp-pmda package by default on Fedora, except for i686 where # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 -%bcond_without pcp_pmda +%bcond pcp_pmda 1 %endif %else -%bcond_with pcp_pmda +%bcond pcp_pmda 0 %endif # Build the etcd helpers by default on Fedora %if 0%{?fedora} -%bcond_without etcd_mutex +%bcond etcd_mutex 1 %else -%bcond_with etcd_mutex -%endif - -%if 0%{?fedora} || 0%{?rhel} >= 9 -%bcond_without gpupdate -%else -%bcond_with gpupdate +%bcond etcd_mutex 0 %endif %ifarch aarch64 ppc64le s390x x86_64 @@ -379,9 +344,7 @@ BuildRequires: librados-devel BuildRequires: python3-etcd %endif -%if %{with gpupdate} BuildRequires: cepces-certmonger >= 0.3.8 -%endif # pidl requirements BuildRequires: perl(ExtUtils::MakeMaker) @@ -775,7 +738,6 @@ Samba VFS module for GlusterFS integration. %endif ### GPUPDATE -%if %{with gpupdate} %package gpupdate Summary: Samba GPO support for clients Requires: cepces-certmonger @@ -789,9 +751,6 @@ Requires: python3-%{name}-dc = %{samba_depver} This package provides the samba-gpupdate tool to apply Group Policy Objects (GPO) on Samba clients. -#endif with gpupdate -%endif - ### KRB5-PRINTING %package krb5-printing Summary: Samba CUPS backend for printing with Kerberos @@ -1542,11 +1501,6 @@ for i in \ done %endif -%if %{without gpupdate} -rm -f %{buildroot}%{_sbindir}/samba-gpupdate -rm -f %{buildroot}%{_mandir}/man8/samba-gpupdate.8* -%endif - %if %{without vfs_glusterfs} rm -f %{buildroot}%{_mandir}/man8/vfs_glusterfs.8* %endif @@ -2444,12 +2398,9 @@ fi %endif ### GPUPDATE -%if %{with gpupdate} %files gpupdate %{_mandir}/man8/samba-gpupdate.8* %{_sbindir}/samba-gpupdate -#endif with gpupdate -%endif ### KRB5-PRINTING %files krb5-printing From 314544c636c2987c2399dcbd87234d6d95459fb0 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 14:30:24 +0100 Subject: [PATCH 041/101] Add LICENSE file of libldb --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 680bd4f..9c84080 100644 --- a/samba.spec +++ b/samba.spec @@ -3892,6 +3892,7 @@ fi %endif %files -n libldb +%license lib/ldb/LICENSE %{_libdir}/libldb.so.* %dir %{_libdir}/samba %{_libdir}/samba/libldb-key-value-private-samba.so From 036c40ef5eb24c660d9e2ac71dbbe80dcf7ddf63 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Feb 2025 19:05:42 +0100 Subject: [PATCH 042/101] Fix the '--with includelibs' build --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index 9c84080..9e37fbb 100644 --- a/samba.spec +++ b/samba.spec @@ -3013,6 +3013,7 @@ fi %if %{with includelibs} %{_libdir}/samba/libpyldb-util.cpython*.so +%{_libdir}/samba/libpytalloc-util.cpython*.so %{python3_sitearch}/__pycache__/_ldb_text*.pyc %{python3_sitearch}/__pycache__/_tdb_text*.pyc @@ -3021,8 +3022,7 @@ fi %{python3_sitearch}/_tdb_text.py %{python3_sitearch}/_tevent.cpython*.so %{python3_sitearch}/ldb.cpython*.so -#FIXME why is it missing? -#%{python3_sitearch}/talloc.cpython*.so +%{python3_sitearch}/talloc.cpython*.so %{python3_sitearch}/tdb.cpython*.so %{python3_sitearch}/tevent.py #endif with includelibs From 4e6ca9ecfb75a192cfc49ce7591e8afe88ca9fba Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 18 Feb 2025 11:00:44 +0100 Subject: [PATCH 043/101] Fix libldb built with '--with includelibs' --- samba.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/samba.spec b/samba.spec index 9e37fbb..cc94374 100644 --- a/samba.spec +++ b/samba.spec @@ -1205,9 +1205,12 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB %package -n libldb Summary: A schema-less, ldap like, API and database License: LGPL-3.0-or-later +%if %{without includelibs} Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} +# /endif without includelibs +%endif Provides: bundled(libreplace) Obsoletes: libldb < 0:2.10 @@ -1223,9 +1226,12 @@ servers, or use local tdb databases. Summary: Developer tools for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} +%if %{without includelibs} Requires: libtdb-devel%{?_isa} >= %{tdb_version} Requires: libtalloc-devel%{?_isa} >= %{talloc_version} Requires: libtevent-devel%{?_isa} >= %{tevent_version} +# /endif without includelibs +%endif Obsoletes: libldb-devel < 0:2.10 Provides: libldb-devel = 0:2.10 @@ -1250,7 +1256,10 @@ Tools to manage LDB files Summary: Python bindings for the LDB library License: LGPL-3.0-or-later Requires: libldb%{?_isa} = %{samba_depver} +%if %{without includelibs} Requires: python3-tdb%{?_isa} >= %{tdb_version} +# /endif without includelibs +%endif Requires: samba-client-libs = %{samba_depver} %{?python_provide:%python_provide python3-ldb} From c4883ac1e7043a7ec8f3673b9d419c8e43290a7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 20 Feb 2025 18:39:08 +0100 Subject: [PATCH 044/101] Update to Samba 4.22.0rc3 - resolves: rhbz#2346803 Guenther --- samba.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index cc94374..71388b2 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -3511,9 +3511,11 @@ fi %dir %{python3_sitearch}/samba/tests/ndr %{python3_sitearch}/samba/tests/ndr/gkdi.py %{python3_sitearch}/samba/tests/ndr/gmsa.py +%{python3_sitearch}/samba/tests/ndr/sd.py %dir %{python3_sitearch}/samba/tests/ndr/__pycache__ %{python3_sitearch}/samba/tests/ndr/__pycache__/gkdi.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/gmsa.*.pyc +%{python3_sitearch}/samba/tests/ndr/__pycache__/sd.*.pyc %{python3_sitearch}/samba/tests/ndr/__pycache__/wbint.*.pyc %{python3_sitearch}/samba/tests/ndr/wbint.py %{python3_sitearch}/samba/tests/netbios.py diff --git a/sources b/sources index b75ed0a..a7d3db0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc2.tar.xz) = e0211687c51e0261a170a1d84d44ce82d65e44ff0f18f92fd59dff464037efbc9408c532d5717f9e1ba6cce9160cbd27be60c16b3d5b6b707c48f71503621d90 -SHA512 (samba-4.22.0rc2.tar.asc) = aac019083d039f633dc6f3255972832c8071a7415bb7bb2ee355e2a0095118a1c6351daaa70c5c7e95b0524094f2443ca9331f50ae5e2776ebd0c89309bd03fd +SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6 +SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222 From c295775181cbe26686635dadeb9feb38c16615be Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 27 Feb 2025 20:00:34 +0100 Subject: [PATCH 045/101] Update to Samba 4.22.0rc4 - resolves: rhbz#2348758 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 71388b2..1c9b659 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index a7d3db0..2a41d3e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc3.tar.xz) = fbfd87cbb874e8818061dfb5cc962e80148b8fe68ffa414c9345e70b49777b237c5f6eb633d546d12d47a3027e9da9098a7c08e91f6f87237e1515181e0b73d6 -SHA512 (samba-4.22.0rc3.tar.asc) = ba9ab3ecdd6912f302c9ba1cb8c12cce1d390c6703528796a7d75e6281d578d9bc19df7e612ebc4e6c7d58b964e0aebf108061f08da8af57668424e7ce968222 +SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca +SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c From 6744eb181dae65b117b56a7c9deae7a0cee98f23 Mon Sep 17 00:00:00 2001 From: David Abdurachmanov Date: Wed, 11 Dec 2024 17:45:11 +0200 Subject: [PATCH 046/101] Enable lmdb on riscv64 Solves configuration error: [..] Checking for a 64-bit host to support lmdb : ok Checking for lmdb >= 0.9.16 : not found Checking for header lmdb.h : no Checking for lmdb >= 0.9.16 via header check : not found Samba AD DC and --enable-selftest requires lmdb 0.9.16 or later [..] Signed-off-by: David Abdurachmanov --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index 1c9b659..f40570f 100644 --- a/samba.spec +++ b/samba.spec @@ -107,7 +107,7 @@ %bcond etcd_mutex 0 %endif -%ifarch aarch64 ppc64le s390x x86_64 +%ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond lmdb 1 %else %bcond lmdb 0 From 947b0b72d5d1ec7e3f3e62b19bab6329ec182673 Mon Sep 17 00:00:00 2001 From: Andrea Bolognani Date: Tue, 25 Feb 2025 20:48:03 +0100 Subject: [PATCH 047/101] Re-enable mold on riscv64 mold didn't build successfully on riscv64 back when riscv64 support was added to samba, but that has changed since and today there is no longer any reason not to use it. Signed-off-by: Andrea Bolognani --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index f40570f..ac9f967 100644 --- a/samba.spec +++ b/samba.spec @@ -315,7 +315,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) -%ifnarch i686 riscv64 +%ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold %endif From 7ebad9bdd168b4fce18a0ef2face757a5a4487ae Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:41:36 +0100 Subject: [PATCH 048/101] Set version for bundled libreplace --- samba.spec | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/samba.spec b/samba.spec index ac9f967..2aa6242 100644 --- a/samba.spec +++ b/samba.spec @@ -249,7 +249,7 @@ Obsoletes: samba-swat < %{samba_depver} Provides: samba4-swat = %{samba_depver} Obsoletes: samba4-swat < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} BuildRequires: make BuildRequires: gcc @@ -441,7 +441,7 @@ Obsoletes: samba4-client < %{samba_depver} Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description client The %{name}-client package provides some SMB/CIFS clients to complement @@ -494,7 +494,7 @@ Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} @@ -536,7 +536,7 @@ Requires: libnetapi = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description common-tools The samba-common-tools package contains tools for SMB/CIFS clients. @@ -606,7 +606,7 @@ Requires: bind-utils Provides: samba4-dc = %{samba_depver} Obsoletes: samba4-dc < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc The samba-dc package provides AD Domain Controller functionality @@ -634,7 +634,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-dc-libs = %{samba_depver} Obsoletes: samba4-dc-libs < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc-libs The %{name}-dc-libs package contains the libraries needed by the DC to @@ -653,7 +653,7 @@ Requires: bind Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description dc-bind-dlz The %{name}-dc-bind-dlz package contains the libraries for bind to manage all @@ -689,7 +689,7 @@ Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-cephfs Samba VFS module for Ceph distributed storage system integration. @@ -706,7 +706,7 @@ Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-iouring Samba VFS module for io_uring instance integration. @@ -731,7 +731,7 @@ Requires: libwbclient = %{samba_depver} Obsoletes: samba-glusterfs < %{samba_depver} Provides: samba-glusterfs = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description vfs-glusterfs Samba VFS module for GlusterFS integration. @@ -791,7 +791,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-libs = %{samba_depver} Obsoletes: samba4-libs < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description libs The %{name}-libs package contains the libraries needed by programs that link @@ -892,7 +892,7 @@ Requires: libsmbclient = %{samba_depver} Requires: libwbclient = %{samba_depver} %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description -n python3-%{name} The python3-%{name} package contains the Python 3 libraries needed by programs @@ -966,7 +966,7 @@ Requires: perl(Archive::Tar) Provides: samba4-test = %{samba_depver} Obsoletes: samba4-test < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description test %{name}-test provides testing tools for both the server and client @@ -986,7 +986,7 @@ Requires: libwbclient = %{samba_depver} Provides: %{name}-test-devel = %{samba_depver} Obsoletes: %{name}-test-devel < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description test-libs %{name}-test-libs provides libraries required by the testing tools. @@ -1030,7 +1030,7 @@ Obsoletes: samba4-winbind < %{samba_depver} # Old NetworkManager expects the dispatcher scripts in a different place Conflicts: NetworkManager < 1.20 -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind The samba-winbind package provides the winbind NSS library, and some client @@ -1053,7 +1053,7 @@ Requires: libwbclient = %{samba_depver} Provides: samba4-winbind-clients = %{samba_depver} Obsoletes: samba4-winbind-clients < %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-clients The samba-winbind-clients package provides the wbinfo and ntlm_auth @@ -1083,7 +1083,7 @@ Requires(post): %{_sbindir}/update-alternatives Requires(postun): %{_sbindir}/update-alternatives Requires(preun): %{_sbindir}/update-alternatives -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-krb5-locator The winbind krb5 locator is a plugin for the system kerberos library to allow @@ -1099,7 +1099,7 @@ Requires: libwbclient = %{samba_depver} %endif Requires: pam -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winbind-modules The samba-winbind-modules package provides the NSS library and a PAM module @@ -1115,7 +1115,7 @@ Requires: %{name}-common-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description winexe Winexe is a Remote Windows-command executor @@ -1151,7 +1151,7 @@ Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} %description -n ctdb CTDB is a cluster implementation of the TDB database used by Samba and other @@ -1212,7 +1212,7 @@ Requires: libtevent%{?_isa} >= %{tevent_version} # /endif without includelibs %endif -Provides: bundled(libreplace) +Provides: bundled(libreplace) = %{samba_depver} Obsoletes: libldb < 0:2.10 Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} From 1b2e68adffe00a7f5a881cc3901106a257e847f4 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:43:32 +0100 Subject: [PATCH 049/101] Add missing /run/ctdb dir to files list --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 2aa6242..78d3c22 100644 --- a/samba.spec +++ b/samba.spec @@ -3835,6 +3835,8 @@ fi %{_mandir}/man7/ctdb-tunables.7.gz %{_mandir}/man7/ctdb-statistics.7.gz +%ghost %dir /run/ctdb + %{_tmpfilesdir}/ctdb.conf %{_unitdir}/ctdb.service From e1991f29eccc30163711bb8f4a0192697bd3c548 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 10:32:35 +0100 Subject: [PATCH 050/101] Set samba-usershare to noarch It only includes configuration files. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 78d3c22..605fedb 100644 --- a/samba.spec +++ b/samba.spec @@ -996,6 +996,7 @@ Provides: bundled(libreplace) = %{samba_depver} Summary: Provides support for non-root user shares Requires: %{name} = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} +BuildArch: noarch %description usershares Installing this package will provide a configuration file, group and From f00c21e2a89e49b9aeb5a4915869dc392f99e429 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:01:51 +0100 Subject: [PATCH 051/101] Set samba-tools to noarch This only include a python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 605fedb..03442a5 100644 --- a/samba.spec +++ b/samba.spec @@ -556,6 +556,7 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg %endif +BuildArch: noarch %description tools The samba-tools package contains tools for Samba servers From e4ac2d5dcb832c64a9c7ecf28fa61272d3497d16 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:02:47 +0100 Subject: [PATCH 052/101] Set samba-gpupdate to noarch This only includes python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 03442a5..8cfd96c 100644 --- a/samba.spec +++ b/samba.spec @@ -747,6 +747,7 @@ Requires: %{name}-ldb-ldap-modules = %{samba_depver} Requires: python3-%{name} = %{samba_depver} # samba-tool needs python3-samba-dc also on non-dc build Requires: python3-%{name}-dc = %{samba_depver} +BuildArch: noarch %description gpupdate This package provides the samba-gpupdate tool to apply Group Policy Objects From 8ee5558015bd0da1c51388fb219c4fb0f608a473 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:03:58 +0100 Subject: [PATCH 053/101] Set ctdb-etcd-mutex to noarch This only includes python scripts. --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index 8cfd96c..941ad1a 100644 --- a/samba.spec +++ b/samba.spec @@ -1182,6 +1182,7 @@ Performance Co-Pilot (PCP) support for CTDB Summary: CTDB ETCD mutex helper Requires: ctdb = %{samba_depver} Requires: python3-etcd +BuildArch: noarch %description -n ctdb-etcd-mutex Support for using an existing ETCD cluster as a mutex helper for CTDB From 417731acd07046213951b3614bf13d73dae3b8ee Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 11:06:07 +0100 Subject: [PATCH 054/101] Use spaces instead of tabs for krb5-printing scripts Removes rpmlint warnings --- samba.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 941ad1a..bde77c1 100644 --- a/samba.spec +++ b/samba.spec @@ -1650,12 +1650,12 @@ fi %post krb5-printing %{_sbindir}/update-alternatives --install %{_libexecdir}/samba/cups_backend_smb \ - cups_backend_smb \ - %{_libexecdir}/samba/smbspool_krb5_wrapper 50 + cups_backend_smb \ + %{_libexecdir}/samba/smbspool_krb5_wrapper 50 %postun krb5-printing if [ $1 -eq 0 ] ; then - %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper + %{_sbindir}/update-alternatives --remove cups_backend_smb %{_libexecdir}/samba/smbspool_krb5_wrapper fi %ldconfig_scriptlets libs From 21e22997d47dd5c656e95a18ae8b8741fdf449c8 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 14:01:29 +0100 Subject: [PATCH 055/101] Revert "Set samba-tools to noarch" This reverts commit f00c21e2a89e49b9aeb5a4915869dc392f99e429. We can't set it to noarch as koji complains that "Requires: lmdb" is present on some arches and not on others. --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index bde77c1..bd6a4ec 100644 --- a/samba.spec +++ b/samba.spec @@ -556,7 +556,6 @@ Requires: lmdb Requires: tdb-tools Requires: python3-gpg %endif -BuildArch: noarch %description tools The samba-tools package contains tools for Samba servers From 30ff8554df8fb3435491d5959145abd59a60ecb6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:10:31 +0100 Subject: [PATCH 056/101] Update to Samba 4.22.0 - resolves: rhbz#2350342 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index bd6a4ec..d6d6e9d 100644 --- a/samba.spec +++ b/samba.spec @@ -128,7 +128,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index 2a41d3e..914331f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0rc4.tar.xz) = 050f13471a5b21db7e9bf0a68326e2a821811b3a779758e275c7bcafeebe4534c0797e6beb76335ec31ab3a1b0a97c66d62b9c87ea4585d151810a0159946aca -SHA512 (samba-4.22.0rc4.tar.asc) = f3d114f427935c3a3a5fc4e29a1ab9929163219fe0cc1a446df45cf2098a561b0765ed1ebab14e20d82b86328e2d1a8f03b565537b8e1fc539245fb93e55250c +SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88 +SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900 From 0cb9860a40530163c1f6893ed04e7e4d59d5757a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:23:22 +0100 Subject: [PATCH 057/101] Turn on SMB 3.1.1 Unix Extensions in default smb.conf Guenther --- smb.conf.example | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/smb.conf.example b/smb.conf.example index 4e6b5d4..271f13b 100644 --- a/smb.conf.example +++ b/smb.conf.example @@ -269,6 +269,13 @@ ; map system = no ; store dos attributes = yes +# Turn on SMB 3.1.1 Unix Extensions by default +# +# Note: The Linux Kernel SMB3 client will negotiate unix extensions by default, +# find more info in man mount.smb3(8). Linux 6.13 will finally support special +# filetypes and symlink handling. + + smb3 unix extensions = yes #============================ Share Definitions ============================== From b508f2ed7a9797fcbf82c9e2eee69832c5d20282 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 6 Mar 2025 16:23:22 +0100 Subject: [PATCH 058/101] Turn on SMB 3.1.1 Unix Extensions in vendor smb.conf as well... Guenther --- smb.conf.vendor | 2 ++ 1 file changed, 2 insertions(+) diff --git a/smb.conf.vendor b/smb.conf.vendor index e45384d..748c6e5 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,6 +18,8 @@ load printers = yes cups options = raw + smb3 unix extensions = yes + # Install samba-usershares package for support include = /etc/samba/usershares.conf From 40bd3a26e8685d077cf7818dbc8e3e16a2181d5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 18 Apr 2025 02:26:37 +0200 Subject: [PATCH 059/101] Update to Samba 4.22.1 - resolves: rhbz#2360776 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index d6d6e9d..531958b 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.0 +%global samba_version 4.22.1 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 914331f..8e2875d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.0.tar.xz) = 649c8808cf88e1f8df55e9df32cbb0a87afa0b5fe13b220fb5ee00506ed94f76073c9196866903a6061ea945670fc0a85f4c67940c86a18198e1cda22a75ea88 -SHA512 (samba-4.22.0.tar.asc) = 0098927156b01667d69e2850caf64156129d5da5aea557774acb43d4403d50759d48cf1c976ede4e7f312d75b639002aa1c11337e48922c7d7c5eeb0d057e900 +SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67 +SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341 From b8a889b232cd2519d49fa87dbda960fa19f18f3e Mon Sep 17 00:00:00 2001 From: Python Maint Date: Thu, 5 Jun 2025 00:08:08 +0200 Subject: [PATCH 060/101] Rebuilt for Python 3.14 From eb8dac413e347d2b662b93045d9fcf964d6b45f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 5 Jun 2025 19:14:20 +0200 Subject: [PATCH 061/101] Update to Samba 4.22.2 - resolves: rhbz#2370468 - resolves: rhbz#2370455 - Security fix for CVE-2025-0620 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 531958b..a4eca83 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.1 +%global samba_version 4.22.2 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 8e2875d..d93d58f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.1.tar.xz) = 34c5e63da50ccbf68f59d8fcea23711a18374a3f6e112cb62dde86ad084a4be0857ff347c763de2ae0eb14fb9991cf226d74c522ae61571feb518cec752dca67 -SHA512 (samba-4.22.1.tar.asc) = dd574647892f992312bdfeea9f1202a0a16cef667418e9cd239c7d6cca68f4dd0f34fbafca5c2d67fbc7b8ee888ca6798c4909960ce1b7eba39d8461f29f3341 +SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351 +SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe From e9a8536578eda0bae0a91d467b271f5c86e033fa Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 6 Jun 2025 09:34:20 +0200 Subject: [PATCH 062/101] Rebuilt for Python 3.14 From 64f8b2a48455f504c8018a6f929c672170d6aa98 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 10 Jun 2025 14:08:56 +0200 Subject: [PATCH 063/101] Install /run/ctdb Fix following report: rpm --verify ctdb-0:4.22.2-3.el9.x86_64 .M....... g /run/ctdb M Mode differs (includes permissions and file type) --- samba.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/samba.spec b/samba.spec index a4eca83..d044cbd 100644 --- a/samba.spec +++ b/samba.spec @@ -1439,6 +1439,7 @@ install -d -m 0755 %{buildroot}/var/lib/samba/sysvol install -d -m 0755 %{buildroot}/var/lib/samba/usershares install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged install -d -m 0755 %{buildroot}/var/log/samba/old +install -d -m 0755 %{buildroot}/run/ctdb install -d -m 0755 %{buildroot}/run/samba install -d -m 0755 %{buildroot}/run/winbindd install -d -m 0755 %{buildroot}/%{_libdir}/samba From ac5f4a1f4b8f3ed80469febdf56c7dd2519162cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Tue, 10 Jun 2025 14:11:41 +0200 Subject: [PATCH 064/101] Move libreplace-private-samba.so to samba-common-libs Fix this rpmdeps report: VERIFY Subpackage libldb on x86_64 carries 'Requires: libreplace-private-samba.so()(64bit)' which comes from subpackage samba-client-libs but does not carry an explicit package version requirement. Please add 'Requires: samba-client-libs = %{version}-%{release}' to the spec file to avoid the need to test interoperability between various combinations of old and new subpackages. --- samba.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samba.spec b/samba.spec index d044cbd..68508b7 100644 --- a/samba.spec +++ b/samba.spec @@ -1212,10 +1212,10 @@ License: LGPL-3.0-or-later Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} +Requires: samba-common-libs = %{samba_depver} # /endif without includelibs %endif -Provides: bundled(libreplace) = %{samba_depver} Obsoletes: libldb < 0:2.10 Provides: libldb = 0:2.10 Provides: libldb = %{samba_depver} @@ -1997,7 +1997,6 @@ fi %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so %{_libdir}/samba/libprinting-migrate-private-samba.so -%{_libdir}/samba/libreplace-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so %{_libdir}/samba/libsamba-debug-private-samba.so @@ -2080,6 +2079,7 @@ fi %files common-libs # common libraries %{_libdir}/samba/libcmdline-private-samba.so +%{_libdir}/samba/libreplace-private-samba.so %dir %{_libdir}/samba/ldb From 060552411c704e9f5f965ded37e9b1c9e8373692 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 23 Jun 2025 10:14:07 +0200 Subject: [PATCH 065/101] smb.conf: Remove the '@' for NIX groups, we removed NIS support --- smb.conf.vendor | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/smb.conf.vendor b/smb.conf.vendor index 748c6e5..cbb2e0f 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -40,7 +40,8 @@ [print$] comment = Printer Drivers path = /var/lib/samba/drivers - write list = @printadmin root - force group = @printadmin + # printadmin is a local group + write list = printadmin root + force group = printadmin create mask = 0664 directory mask = 0775 From d5056e867a933be92f93c22c7e3c47f37af380b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 8 Jul 2025 00:50:10 +0200 Subject: [PATCH 066/101] Update to Samba 4.22.3 - resolves: #2376873 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 68508b7..f59cd87 100644 --- a/samba.spec +++ b/samba.spec @@ -113,7 +113,7 @@ %bcond lmdb 0 %endif -%global samba_version 4.22.2 +%global samba_version 4.22.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index d93d58f..c47ad40 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.2.tar.xz) = 8ce34210797e531c7624a033d4b68a424d7e698872cdac826109a66930257fad41396bca4b90d7a0fc8551ef2a640d8d8b875cf2115146360acee354d6483351 -SHA512 (samba-4.22.2.tar.asc) = 68c1dae279b732c7fcdab014fc670b6d90c0f139be53176d1275c756a30f28c86d40cd4e4edb90aab871470274ce65d58aae27e2d8eba5d5c1ebafbb192626fe +SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c +SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e From b40f280be5c9cc340c245d69dfd554891cedd4ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Thu, 10 Jul 2025 21:46:16 +0200 Subject: [PATCH 067/101] Fix get_kdc_ip_string handling for secondary KDCs - resolves: bzso#15881 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ++++++++++++++++++++++++++++ samba.spec | 2 ++ 2 files changed, 36 insertions(+) create mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch new file mode 100644 index 0000000..9277c9b --- /dev/null +++ b/samba-4.22.x-get_kdc_ip_string.patch @@ -0,0 +1,34 @@ +From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 +From: Ralph Boehme +Date: Fri, 4 Jul 2025 17:50:40 +0200 +Subject: [PATCH] libads: fix get_kdc_ip_string() ... +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 + +Signed-off-by: Ralph Boehme +Reviewed-by: Guenther Deschner + +Autobuild-User(master): Günther Deschner +Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 +--- + source3/libads/kerberos.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c +index 75803500d31..145bc36cdb2 100644 +--- a/source3/libads/kerberos.c ++++ b/source3/libads/kerberos.c +@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, + + if (!NT_STATUS_IS_OK(status)) { + DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); ++ result = talloc_move(mem_ctx, &kdc_str); + goto out; + } + +-- +2.50.0 + diff --git a/samba.spec b/samba.spec index f59cd87..7da5ef4 100644 --- a/samba.spec +++ b/samba.spec @@ -215,6 +215,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.22.x-get_kdc_ip_string.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From 5c93354123f7302192a52b305334853f6d2ef56d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 17:53:14 +0000 Subject: [PATCH 068/101] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From ad5439e191ee3e9dab69e76b148b78207e66fb19 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Franti=C5=A1ek=20Zatloukal?= Date: Wed, 6 Aug 2025 09:57:46 +0200 Subject: [PATCH 069/101] Rebuilt for icu 77.1 From 052edc4ab62c26380f1865674a88047a41201db4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Tue, 12 Aug 2025 22:09:33 +0200 Subject: [PATCH 070/101] Update to Samba 4.23.0rc1 - resolves: #2387090 Guenther --- samba-4.22.x-get_kdc_ip_string.patch | 34 ------------ samba.spec | 78 +++++++++++++++++++++++++--- sources | 4 +- 3 files changed, 73 insertions(+), 43 deletions(-) delete mode 100644 samba-4.22.x-get_kdc_ip_string.patch diff --git a/samba-4.22.x-get_kdc_ip_string.patch b/samba-4.22.x-get_kdc_ip_string.patch deleted file mode 100644 index 9277c9b..0000000 --- a/samba-4.22.x-get_kdc_ip_string.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 88572cc8f629a737a1d5b33d5800f3692895233f Mon Sep 17 00:00:00 2001 -From: Ralph Boehme -Date: Fri, 4 Jul 2025 17:50:40 +0200 -Subject: [PATCH] libads: fix get_kdc_ip_string() ... -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15881 - -Signed-off-by: Ralph Boehme -Reviewed-by: Guenther Deschner - -Autobuild-User(master): Günther Deschner -Autobuild-Date(master): Mon Jul 7 16:46:29 UTC 2025 on atb-devel-224 ---- - source3/libads/kerberos.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c -index 75803500d31..145bc36cdb2 100644 ---- a/source3/libads/kerberos.c -+++ b/source3/libads/kerberos.c -@@ -1230,6 +1230,7 @@ static char *get_kdc_ip_string(char *mem_ctx, - - if (!NT_STATUS_IS_OK(status)) { - DBG_DEBUG("netlogon_pings failed: %s\n", nt_errstr(status)); -+ result = talloc_move(mem_ctx, &kdc_str); - goto out; - } - --- -2.50.0 - diff --git a/samba.spec b/samba.spec index 7da5ef4..bebd14a 100644 --- a/samba.spec +++ b/samba.spec @@ -107,13 +107,20 @@ %bcond etcd_mutex 0 %endif +# Build the prometheus exporter by default on Fedora +%if 0%{?fedora} +%bcond prometheus 1 +%else +%bcond prometheus 0 +%endif + %ifarch aarch64 ppc64le s390x x86_64 riscv64 %bcond lmdb 1 %else %bcond lmdb 0 %endif -%global samba_version 4.22.3 +%global samba_version 4.23.0 # The release field is extended: # [.][.]%%{?dist}[.] @@ -128,7 +135,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release %nil +%global pre_release rc1 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -159,8 +166,8 @@ %global libwbclient_so_version 0 %global talloc_version 2.4.3 -%global tdb_version 1.4.13 -%global tevent_version 0.16.2 +%global tdb_version 1.4.14 +%global tevent_version 0.17.1 %global required_mit_krb5 1.20.1 @@ -215,8 +222,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-4.22.x-get_kdc_ip_string.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -345,6 +350,9 @@ BuildRequires: librados-devel %if %{with etcd_mutex} BuildRequires: python3-etcd %endif +%if %{with prometheus} +BuildRequires: libevent-devel +%endif BuildRequires: cepces-certmonger >= 0.3.8 @@ -1206,6 +1214,18 @@ Support for using an existing CEPH cluster as a mutex helper for CTDB #endif with clustering %endif +%if %{with prometheus} + +%package prometheus +Summary: SMB Prometheus exporter +Requires: samba = %{samba_depver} + +%description prometheus +Support for exporting metrics via Prometheus + +#endif with prometheus +%endif + ### LIBLDB %package -n libldb Summary: A schema-less, ldap like, API and database @@ -1357,6 +1377,8 @@ if [ -n "${CCACHE}" ]; then fi %endif +# workaround https://gitlab.com/ita1024/waf/-/issues/2472 +export PYTHONARCHDIR=%{python3_sitearch} %configure \ --enable-fhs \ --with-piddir=/run \ @@ -1396,6 +1418,9 @@ fi %endif %if %{with etcd_mutex} --enable-etcd-reclock \ +%endif +%if %{with prometheus} + --with-prometheus-exporter \ %endif --with-profiling-data \ --with-systemd \ @@ -1995,22 +2020,25 @@ fi %{_libdir}/samba/libndr-samba4-private-samba.so %{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so +%{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so +%{_libdir}/samba/libngtcp2-private-samba.so %{_libdir}/samba/libnpa-tstream-private-samba.so %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so %{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so %{_libdir}/samba/libsamba-debug-private-samba.so %{_libdir}/samba/libsamba-modules-private-samba.so %{_libdir}/samba/libsamba-security-private-samba.so +%{_libdir}/samba/libsamba-security-trusts-private-samba.so %{_libdir}/samba/libsamba-sockets-private-samba.so %{_libdir}/samba/libsamba3-util-private-samba.so %{_libdir}/samba/libsamdb-common-private-samba.so %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so %{_libdir}/samba/libserver-role-private-samba.so -%{_libdir}/samba/libsmb-transport-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so %{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so @@ -2106,6 +2134,7 @@ fi %{_mandir}/man8/net.8* %{_mandir}/man8/pdbedit.8* %{_mandir}/man8/smbpasswd.8* +%{_datadir}/locale/*/LC_MESSAGES/net.mo ### TOOLS %files tools @@ -2228,6 +2257,7 @@ fi %{_libdir}/samba/service/dns.so %{_libdir}/samba/service/dns_update.so %{_libdir}/samba/service/drepl.so +%{_libdir}/samba/service/ft_scanner.so %{_libdir}/samba/service/kcc.so %{_libdir}/samba/service/kdc.so %{_libdir}/samba/service/ldap.so @@ -2580,6 +2610,7 @@ fi %{python3_sitearch}/samba/dcerpc/atsvc.*.so %{python3_sitearch}/samba/dcerpc/auth.*.so %{python3_sitearch}/samba/dcerpc/base.*.so +%{python3_sitearch}/samba/dcerpc/bcrypt_rsakey_blob.*.so %{python3_sitearch}/samba/dcerpc/claims.*.so %{python3_sitearch}/samba/dcerpc/conditional_ace.*.so %{python3_sitearch}/samba/dcerpc/dcerpc.*.so @@ -2595,6 +2626,7 @@ fi %{python3_sitearch}/samba/dcerpc/idmap.*.so %{python3_sitearch}/samba/dcerpc/initshutdown.*.so %{python3_sitearch}/samba/dcerpc/irpc.*.so +%{python3_sitearch}/samba/dcerpc/keycredlink.*.so %{python3_sitearch}/samba/dcerpc/krb5ccache.*.so %{python3_sitearch}/samba/dcerpc/krb5pac.*.so %{python3_sitearch}/samba/dcerpc/lsa.*.so @@ -2616,6 +2648,7 @@ fi %{python3_sitearch}/samba/dcerpc/spoolss.*.so %{python3_sitearch}/samba/dcerpc/srvsvc.*.so %{python3_sitearch}/samba/dcerpc/svcctl.*.so +%{python3_sitearch}/samba/dcerpc/tpm20_rsakey_blob.*.so %{python3_sitearch}/samba/dcerpc/unixinfo.*.so %{python3_sitearch}/samba/dcerpc/winbind.*.so %{python3_sitearch}/samba/dcerpc/windows_event_ids.*.so @@ -3119,6 +3152,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/auth_log_netlogon_bad_creds.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_samlogon.*.pyc %{python3_sitearch}/samba/tests/__pycache__/auth_log_winbind.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/bcrypt_rsakey_blob.*.pyc %{python3_sitearch}/samba/tests/__pycache__/common.*.pyc %{python3_sitearch}/samba/tests/__pycache__/complex_expressions.*.pyc %{python3_sitearch}/samba/tests/__pycache__/compression.*.pyc @@ -3160,6 +3194,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/hostconfig.*.pyc %{python3_sitearch}/samba/tests/__pycache__/imports.*.pyc %{python3_sitearch}/samba/tests/__pycache__/join.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/key_credential_link.*.pyc %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc @@ -3237,6 +3272,7 @@ fi %{python3_sitearch}/samba/tests/__pycache__/subunitrun.*.pyc %{python3_sitearch}/samba/tests/__pycache__/tdb_util.*.pyc %{python3_sitearch}/samba/tests/__pycache__/token_factory.*.pyc +%{python3_sitearch}/samba/tests/__pycache__/tpm20_rsakey_blob.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgrade.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovision.*.pyc %{python3_sitearch}/samba/tests/__pycache__/upgradeprovisionneeddc.*.pyc @@ -3254,6 +3290,7 @@ fi %{python3_sitearch}/samba/tests/auth_log_pass_change.py %{python3_sitearch}/samba/tests/auth_log_samlogon.py %{python3_sitearch}/samba/tests/auth_log_winbind.py +%{python3_sitearch}/samba/tests/bcrypt_rsakey_blob.py %dir %{python3_sitearch}/samba/tests/blackbox %{python3_sitearch}/samba/tests/blackbox/__init__.py %dir %{python3_sitearch}/samba/tests/blackbox/__pycache__ @@ -3414,6 +3451,7 @@ fi %{python3_sitearch}/samba/tests/kcc/graph_utils.py %{python3_sitearch}/samba/tests/kcc/kcc_utils.py %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py +%{python3_sitearch}/samba/tests/key_credential_link.py %dir %{python3_sitearch}/samba/tests/krb5 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__ %{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc @@ -3529,6 +3567,12 @@ fi %{python3_sitearch}/samba/tests/net_join_no_spnego.py %{python3_sitearch}/samba/tests/net_join.py %{python3_sitearch}/samba/tests/netlogonsvc.py +%dir %{python3_sitearch}/samba/tests/nss +%dir %{python3_sitearch}/samba/tests/nss/__pycache__ +%{python3_sitearch}/samba/tests/nss/__pycache__/base.*.pyc +%{python3_sitearch}/samba/tests/nss/__pycache__/group.*.pyc +%{python3_sitearch}/samba/tests/nss/base.py +%{python3_sitearch}/samba/tests/nss/group.py %{python3_sitearch}/samba/tests/ntacls.py %{python3_sitearch}/samba/tests/ntacls_backup.py %{python3_sitearch}/samba/tests/ntlmdisabled.py @@ -3689,10 +3733,21 @@ fi %{python3_sitearch}/samba/tests/subunitrun.py %{python3_sitearch}/samba/tests/tdb_util.py %{python3_sitearch}/samba/tests/token_factory.py +%{python3_sitearch}/samba/tests/tpm20_rsakey_blob.py %{python3_sitearch}/samba/tests/upgrade.py %{python3_sitearch}/samba/tests/upgradeprovision.py %{python3_sitearch}/samba/tests/upgradeprovisionneeddc.py %{python3_sitearch}/samba/tests/usage.py +%dir %{python3_sitearch}/samba/tests/varlink +%dir %{python3_sitearch}/samba/tests/varlink/__pycache__ +%{python3_sitearch}/samba/tests/varlink/__pycache__/base.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getgrouprecord.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getmemberships.*.pyc +%{python3_sitearch}/samba/tests/varlink/__pycache__/getuserrecord.*.pyc +%{python3_sitearch}/samba/tests/varlink/base.py +%{python3_sitearch}/samba/tests/varlink/getgrouprecord.py +%{python3_sitearch}/samba/tests/varlink/getmemberships.py +%{python3_sitearch}/samba/tests/varlink/getuserrecord.py %{python3_sitearch}/samba/tests/xattr.py ### TEST @@ -3761,6 +3816,7 @@ fi %config(noreplace) %{_sysconfdir}/security/pam_winbind.conf %{_mandir}/man5/pam_winbind.conf.5* %{_mandir}/man8/pam_winbind.8* +%{_datadir}/locale/*/LC_MESSAGES/pam_winbind.mo %if %{with clustering} %files -n ctdb @@ -3910,6 +3966,13 @@ fi %{_mandir}/man1/winexe.1.gz %endif +%if %{with prometheus} +%files prometheus +%{_bindir}/smb_prometheus_endpoint +%{_mandir}/man8/smb_prometheus_endpoint.8.gz +#endif with prometheus + +%endif %files -n libldb %license lib/ldb/LICENSE %{_libdir}/libldb.so.* @@ -3933,6 +3996,7 @@ fi %{_libdir}/samba/ldb/server_sort.so %{_libdir}/samba/ldb/skel.so %{_libdir}/samba/ldb/tdb.so +%{_libdir}/samba/ldb/trust_notify.so %files -n libldb-devel %{_includedir}/samba-4.0/ldb_module.h diff --git a/sources b/sources index c47ad40..ddc3910 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.22.3.tar.xz) = 426f5128eefc8e96677e507d6980756e7bc70d063c62a9d38d5c33b9c3eb54aaffe1fab5432e09f50d6dfc898635952df8122b2a1a9ee45a6a01702f3c91f43c -SHA512 (samba-4.22.3.tar.asc) = 612d3bec57048168e5c0f95c2ce28daaf0dd29282ba34af26a590ff20c6187f5efaa5b717577d445df4f4752ded6f8ee139ab878b8ccb4cf41c2a38fb8b4694e +SHA512 (samba-4.23.0rc1.tar.xz) = 6472b7445c138abb69185954c2ba86164fa500d8e267cf26ca6208f78599abcd6af282c19a7609cb72dc2d40d68956cdef3599d27dbf7e30d6b9b1f02d0cddea +SHA512 (samba-4.23.0rc1.tar.asc) = 56c9f8a4357599c52ad62e5ddf342c7e0eee4eb3f3c874f77280f06684e00aaf19d3a6d8bea9da8e63f8f79c4f6f28b0bdf3997dbe5213b17b3b4679e5fe5441 From c2bf86b8d2dc38adaded41822a69127cce364e47 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Sun, 17 Aug 2025 23:05:41 -0400 Subject: [PATCH 071/101] Move trust_notify module to -dc subpackage This module is not built in ELN, resulting in a file not found error when packaging libldb. Its build conditions are the same as the dns_notify module already in -dc. --- samba.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samba.spec b/samba.spec index bebd14a..5811a12 100644 --- a/samba.spec +++ b/samba.spec @@ -2212,6 +2212,7 @@ fi %{_libdir}/samba/ldb/subtree_delete.so %{_libdir}/samba/ldb/subtree_rename.so %{_libdir}/samba/ldb/tombstone_reanimate.so +%{_libdir}/samba/ldb/trust_notify.so %{_libdir}/samba/ldb/unique_object_sids.so %{_libdir}/samba/ldb/update_keytab.so %{_libdir}/samba/ldb/vlv.so @@ -3996,7 +3997,6 @@ fi %{_libdir}/samba/ldb/server_sort.so %{_libdir}/samba/ldb/skel.so %{_libdir}/samba/ldb/tdb.so -%{_libdir}/samba/ldb/trust_notify.so %files -n libldb-devel %{_includedir}/samba-4.0/ldb_module.h From c108db5e55fd5b9b4e9a5b8062744e4b7796dac6 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 18 Aug 2025 13:57:35 +0200 Subject: [PATCH 072/101] Rebuilt for Python 3.14.0rc2 bytecode From e6a975e42205afdb48c4c0e56c7ae97d61630788 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 22 Aug 2025 21:51:03 +0200 Subject: [PATCH 073/101] Update to Samba 4.23.0rc2 - resolves: #2387090 Guenther --- samba.spec | 5 +++-- sources | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/samba.spec b/samba.spec index 5811a12..76df67c 100644 --- a/samba.spec +++ b/samba.spec @@ -102,7 +102,8 @@ # Build the etcd helpers by default on Fedora %if 0%{?fedora} -%bcond etcd_mutex 1 +# disable etcd mutex helper as etcd is orphaned in Fedora now +%bcond etcd_mutex 0 %else %bcond etcd_mutex 0 %endif @@ -135,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc1 +%global pre_release rc2 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif diff --git a/sources b/sources index ddc3910..24013e1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc1.tar.xz) = 6472b7445c138abb69185954c2ba86164fa500d8e267cf26ca6208f78599abcd6af282c19a7609cb72dc2d40d68956cdef3599d27dbf7e30d6b9b1f02d0cddea -SHA512 (samba-4.23.0rc1.tar.asc) = 56c9f8a4357599c52ad62e5ddf342c7e0eee4eb3f3c874f77280f06684e00aaf19d3a6d8bea9da8e63f8f79c4f6f28b0bdf3997dbe5213b17b3b4679e5fe5441 +SHA512 (samba-4.23.0rc2.tar.xz) = 44c8fab0523038270295b1d4ea9d535df04deb91dfe08680e1bde0b621eb6146ff9157ec97e9c0f0fb95ae33aaf66903a192b486b2df35899b6c5d4a57e09ee9 +SHA512 (samba-4.23.0rc2.tar.asc) = 7bdc54eb7bf4736123ea889f18ff0aa29eca91d2ab25fbfaeed431a0c7d193167526312bf051e58c70d2d9de0dfa9a5cdc9d8177f6f144c1b2d32c8ed2d0631d From 83273a97b1fb10bb6db374215af67549ef94637a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 29 Aug 2025 23:32:47 +0200 Subject: [PATCH 074/101] Update to Samba 4.23.0rc3 - resolves: #2387090 Guenther --- samba.spec | 4 +++- sources | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 76df67c..3e1a5fd 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc2 +%global pre_release rc3 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -3361,6 +3361,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/__pycache__/array.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/bare.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc +%{python3_sitearch}/samba/tests/dcerpc/__pycache__/dfs.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc %{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc @@ -3381,6 +3382,7 @@ fi %{python3_sitearch}/samba/tests/dcerpc/array.py %{python3_sitearch}/samba/tests/dcerpc/bare.py %{python3_sitearch}/samba/tests/dcerpc/binding.py +%{python3_sitearch}/samba/tests/dcerpc/dfs.py %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py %{python3_sitearch}/samba/tests/dcerpc/integer.py %{python3_sitearch}/samba/tests/dcerpc/lsa.py diff --git a/sources b/sources index 24013e1..168a85d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc2.tar.xz) = 44c8fab0523038270295b1d4ea9d535df04deb91dfe08680e1bde0b621eb6146ff9157ec97e9c0f0fb95ae33aaf66903a192b486b2df35899b6c5d4a57e09ee9 -SHA512 (samba-4.23.0rc2.tar.asc) = 7bdc54eb7bf4736123ea889f18ff0aa29eca91d2ab25fbfaeed431a0c7d193167526312bf051e58c70d2d9de0dfa9a5cdc9d8177f6f144c1b2d32c8ed2d0631d +SHA512 (samba-4.23.0rc3.tar.xz) = 1e8b9bec0e42d387a0b4665d395ec63bcb9b84353c62be0ed253dfe79c1ff44f13a8a1825f2a1eba4c8f209cae55e0b3ed7f89b39884ec73b05383b0008a5249 +SHA512 (samba-4.23.0rc3.tar.asc) = 727d328c0f4bd075d927bcfdb86083c3e6e9f066c938d5232e655c676d78f936453bc0d39bf271d0f8371f33e8ffe30aa376ad6461ca0be8d34ebca01553c3ab From a6119e2bb3d77153a87af9be96ca2140a9da6316 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 2 Sep 2025 10:47:58 +0300 Subject: [PATCH 075/101] Fix FreeIPA trust to AD - resolves: rhbz#2392626 Signed-off-by: Alexander Bokovoy --- samba-bz15902.patch | 167 ++++++++++++++++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 168 insertions(+) create mode 100644 samba-bz15902.patch diff --git a/samba-bz15902.patch b/samba-bz15902.patch new file mode 100644 index 0000000..659eecc --- /dev/null +++ b/samba-bz15902.patch @@ -0,0 +1,167 @@ +From 00b900e82ac0d859562ec88825975a2d9fbe1040 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Tue, 2 Sep 2025 10:36:11 +0300 +Subject: [PATCH] krb5: handle GSS-Proxy credentials lifetime +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +GSS-Proxy stores its credential in encrypted form in the Kerberos ccache +with a start and end time of 0 and a server principal in the realm named +'X-GSSPROXY:'. This credential is accessed through GSS-Proxy interposer +mechanism in MIT Kerberos and cannot be analysed with raw krb5 API. + +As MIT Kerberos has no krb5_cc_get_lifetime() implementation, add check +for the GSS-Proxy credential to smb_krb5_cc_get_lifetime() wrapper to +return KRB5_PLUGIN_NO_HANDLE. The two places where +smb_krb5_cc_get_lifetime() is used then handle this return code to avoid +deciding on the 'expired' lifetime to cause a kinit. + +This fixes FreeIPA use case where an IPA API endpoint uses Samba Python +bindings with a GSS-Proxy-controlled credential cache. + +Bug: https://bugzilla.samba.org/show_bug.cgi?id=15902 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Pavel Filipenský + +Autobuild-User(master): Pavel Filipensky +Autobuild-Date(master): Wed Sep 3 10:15:50 UTC 2025 on atb-devel-224 + +(cherry picked from commit c00b98ad840706cda222bb610d0d4860b98c72d4) +--- + auth/credentials/credentials_krb5.c | 36 +++++++++++++++++++++-------- + lib/krb5_wrap/krb5_samba.c | 35 ++++++++++++++++++++++++++-- + 2 files changed, 59 insertions(+), 12 deletions(-) + +diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c +index 4dc7e7be67e..8d289e26781 100644 +--- a/auth/credentials/credentials_krb5.c ++++ b/auth/credentials/credentials_krb5.c +@@ -687,7 +687,14 @@ _PUBLIC_ int cli_credentials_get_named_ccache(struct cli_credentials *cred, + bool kinit_required = false; + ret = smb_krb5_cc_get_lifetime(cred->ccache->smb_krb5_context->krb5_context, + cred->ccache->ccache, &lifetime); +- if (ret == KRB5_CC_END || ret == ENOENT) { ++ if (ret == KRB5_PLUGIN_NO_HANDLE) { ++ /* ++ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted ++ * GSSProxy credential. We don't know its lifetime but assume it ++ * is a valid one. Acquiring it will show the lifetime. ++ */ ++ kinit_required = false; ++ } else if (ret == KRB5_CC_END || ret == ENOENT) { + kinit_required = true; + } else if (ret == 0) { + if (lifetime == 0) { +@@ -800,18 +807,27 @@ _PUBLIC_ bool cli_credentials_get_ccache_name_obtained( + if (ret == KRB5_CC_END || ret == ENOENT) { + return false; + } +- if (ret != 0) { ++ ++ /* ++ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted ++ * GSSProxy credential. We don't know its lifetime but assume it ++ * is a valid one. Acquiring it will show the lifetime. ++ * */ ++ if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE) { + return false; + } +- if (lifetime == 0) { +- return false; +- } else if (lifetime < 300) { +- if (cred->password_obtained >= cred->ccache_obtained) { +- /* +- * we have a password to re-kinit +- * so let the caller try that. +- */ ++ ++ if (ret == 0) { ++ if (lifetime == 0) { + return false; ++ } else if (lifetime < 300) { ++ if (cred->password_obtained >= cred->ccache_obtained) { ++ /* ++ * we have a password to re-kinit ++ * so let the caller try that. ++ */ ++ return false; ++ } + } + } + +diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c +index f9d91a4f0c1..dcf91348d1a 100644 +--- a/lib/krb5_wrap/krb5_samba.c ++++ b/lib/krb5_wrap/krb5_samba.c +@@ -3025,6 +3025,8 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + krb5_creds cred; + krb5_timestamp endtime = 0; + krb5_timestamp now; ++ char *realm = NULL; ++ TALLOC_CTX *mem_ctx = NULL; + + *t = 0; + +@@ -3038,12 +3040,37 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + return kerr; + } + ++ mem_ctx = talloc_stackframe(); ++ if (mem_ctx == NULL) { ++ krb5_cc_end_seq_get(context, id, &cursor); ++ return ENOMEM; ++ } ++ + while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) { + if (krb5_is_config_principal(context, cred.server)) { + krb5_free_cred_contents(context, &cred); + continue; + } + ++ realm = smb_krb5_principal_get_realm(mem_ctx, context, cred.server); ++ if (realm == NULL) { ++ krb5_free_cred_contents(context, &cred); ++ kerr = ENOMEM; ++ break; ++ } ++ ++ /* ++ * 'X-GSSPROXY:' is the realm for an encrypted credential stored ++ * by the GSSProxy. There are no other creds in such ccache and ++ * we cannot see the actual lifetime (it is set to 0), ++ * indicate to the caller they need to handle this themselves. ++ */ ++ if (strcmp(realm, "X-GSSPROXY:") == 0) { ++ krb5_free_cred_contents(context, &cred); ++ kerr = KRB5_PLUGIN_NO_HANDLE; ++ break; ++ } ++ + #ifndef HAVE_FLAGS_IN_KRB5_CREDS + if (cred.ticket_flags & TKT_FLG_INITIAL) { + #else +@@ -3073,13 +3100,17 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, + krb5_free_cred_contents(context, &cred); + } + ++ krb5_cc_end_seq_get(context, id, &cursor); ++ talloc_free(mem_ctx); ++ if (kerr == ENOMEM || kerr == KRB5_PLUGIN_NO_HANDLE) { ++ return kerr; ++ } ++ + if (now < endtime) { + *t = (time_t) (endtime - now); + kerr = 0; + } + +- krb5_cc_end_seq_get(context, id, &cursor); +- + return kerr; + } + #endif /* HAVE_KRB5_CC_GET_LIFETIME */ +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index 3e1a5fd..aa68a70 100644 --- a/samba.spec +++ b/samba.spec @@ -222,6 +222,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-bz15902.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 5a96c9042742117afd7b42a742495e578ae06db4 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 3 Sep 2025 15:44:06 +0300 Subject: [PATCH 076/101] Disable PCP 7.0.0 support PCP 7.0.0 API has changed, needs more work in ctdb https://bugzilla.samba.org/show_bug.cgi?id=15904 - resolves: rhbz#2392879 Signed-off-by: Alexander Bokovoy --- samba-pcp-7.0.0.patch | 63 +++++++++++++++++++++++++++++++++++++++++++ samba.spec | 3 +++ 2 files changed, 66 insertions(+) create mode 100644 samba-pcp-7.0.0.patch diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch new file mode 100644 index 0000000..953bc46 --- /dev/null +++ b/samba-pcp-7.0.0.patch @@ -0,0 +1,63 @@ +From edede7256f7bfa25186e22b3c5f1aab9a56ac141 Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Wed, 3 Sep 2025 15:42:46 +0300 +Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 + +Signed-off-by: Alexander Bokovoy +--- + ctdb/utils/pmda/pmda_ctdb.c | 4 ++++ + ctdb/wscript | 20 +++++++++----------- + 2 files changed, 13 insertions(+), 11 deletions(-) + +diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c +index 7ac8a3b38d1..a8d6704c8a9 100644 +--- a/ctdb/utils/pmda/pmda_ctdb.c ++++ b/ctdb/utils/pmda/pmda_ctdb.c +@@ -39,9 +39,13 @@ + + #define pmID_cluster(id) id->cluster + #define pmID_item(id) id->item ++#ifndef pmGetProgname + #define pmGetProgname() pmProgname ++#endif ++#ifndef pmSetProgname + #define pmSetProgname(a) __pmSetProgname(a) + #endif ++#endif + + #include "domain.h" + +diff --git a/ctdb/wscript b/ctdb/wscript +index e9cd89436a3..15dedb1c432 100644 +--- a/ctdb/wscript ++++ b/ctdb/wscript +@@ -226,17 +226,15 @@ def configure(conf): + + have_pmda = False + if Options.options.ctdb_pmda: +- pmda_support = True +- +- if not conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', +- together=True): +- pmda_support = False +- if not conf.CHECK_FUNCS_IN('pmProgname', 'pcp'): +- pmda_support = False +- if not conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda'): +- pmda_support = False +- if pmda_support: +- conf.CHECK_TYPE_IN('__pmID_int', 'pcp/pmapi.h pcp/impl.h') ++ checks = [conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', ++ together=True), ++ conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda')] ++ ++ have_progname = [conf.CHECK_FUNCS_IN('pmProgname', 'pcp'), ++ conf.CHECK_FUNCS_IN('pmGetProgname', 'pcp')] ++ ++ if all(checks) and any(have_progname): ++ conf.CHECK_TYPE_IN('__pmID_int', 'libpcp.h pcp/pmapi.h pcp/impl.h') + have_pmda = True + else: + Logs.error("PMDA support not available") +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index aa68a70..8a8a21e 100644 --- a/samba.spec +++ b/samba.spec @@ -94,8 +94,10 @@ # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 +%if 0%{?fedora} < 43 %bcond pcp_pmda 1 %endif +%endif %else %bcond pcp_pmda 0 %endif @@ -223,6 +225,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore Patch0: samba-bz15902.patch +Patch1: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From beb6a110890db1bd1c6d5f1ef7602cc21d84ec6b Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Thu, 4 Sep 2025 09:25:26 +0300 Subject: [PATCH 077/101] Restore PCP support - resolves: rhbz#2392879 Signed-off-by: Alexander Bokovoy --- samba-pcp-7.0.0.patch | 17 +++++++++++++---- samba.spec | 2 -- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch index 953bc46..1b2c6a5 100644 --- a/samba-pcp-7.0.0.patch +++ b/samba-pcp-7.0.0.patch @@ -1,16 +1,16 @@ -From edede7256f7bfa25186e22b3c5f1aab9a56ac141 Mon Sep 17 00:00:00 2001 +From 4b74db174b92e00eb4c342c77adcb8140851d025 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Wed, 3 Sep 2025 15:42:46 +0300 Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 Signed-off-by: Alexander Bokovoy --- - ctdb/utils/pmda/pmda_ctdb.c | 4 ++++ + ctdb/utils/pmda/pmda_ctdb.c | 6 +++++- ctdb/wscript | 20 +++++++++----------- - 2 files changed, 13 insertions(+), 11 deletions(-) + 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 7ac8a3b38d1..a8d6704c8a9 100644 +index 7ac8a3b38d1..75ae1079dc4 100644 --- a/ctdb/utils/pmda/pmda_ctdb.c +++ b/ctdb/utils/pmda/pmda_ctdb.c @@ -39,9 +39,13 @@ @@ -27,6 +27,15 @@ index 7ac8a3b38d1..a8d6704c8a9 100644 #include "domain.h" +@@ -450,7 +454,7 @@ err_out: + * instance domain evaluation. + */ + static int +-pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmResult **resp, pmdaExt *pmda) ++pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmdaResult **resp, pmdaExt *pmda) + { + int ret; + diff --git a/ctdb/wscript b/ctdb/wscript index e9cd89436a3..15dedb1c432 100644 --- a/ctdb/wscript diff --git a/samba.spec b/samba.spec index 8a8a21e..1d9ef9a 100644 --- a/samba.spec +++ b/samba.spec @@ -94,10 +94,8 @@ # pcp is no longer supported %if 0%{?fedora} %ifnarch i686 -%if 0%{?fedora} < 43 %bcond pcp_pmda 1 %endif -%endif %else %bcond pcp_pmda 0 %endif From e0762b936f9c379833168f93bde983aa8b82131c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 10 Sep 2025 10:28:22 +0200 Subject: [PATCH 078/101] Update to Samba 4.23.0rc4 - resolves: #2393434 Guenther --- samba-bz15902.patch | 167 -------------------------------------------- samba.spec | 5 +- sources | 4 +- 3 files changed, 4 insertions(+), 172 deletions(-) delete mode 100644 samba-bz15902.patch diff --git a/samba-bz15902.patch b/samba-bz15902.patch deleted file mode 100644 index 659eecc..0000000 --- a/samba-bz15902.patch +++ /dev/null @@ -1,167 +0,0 @@ -From 00b900e82ac0d859562ec88825975a2d9fbe1040 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Tue, 2 Sep 2025 10:36:11 +0300 -Subject: [PATCH] krb5: handle GSS-Proxy credentials lifetime -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -GSS-Proxy stores its credential in encrypted form in the Kerberos ccache -with a start and end time of 0 and a server principal in the realm named -'X-GSSPROXY:'. This credential is accessed through GSS-Proxy interposer -mechanism in MIT Kerberos and cannot be analysed with raw krb5 API. - -As MIT Kerberos has no krb5_cc_get_lifetime() implementation, add check -for the GSS-Proxy credential to smb_krb5_cc_get_lifetime() wrapper to -return KRB5_PLUGIN_NO_HANDLE. The two places where -smb_krb5_cc_get_lifetime() is used then handle this return code to avoid -deciding on the 'expired' lifetime to cause a kinit. - -This fixes FreeIPA use case where an IPA API endpoint uses Samba Python -bindings with a GSS-Proxy-controlled credential cache. - -Bug: https://bugzilla.samba.org/show_bug.cgi?id=15902 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Pavel Filipenský - -Autobuild-User(master): Pavel Filipensky -Autobuild-Date(master): Wed Sep 3 10:15:50 UTC 2025 on atb-devel-224 - -(cherry picked from commit c00b98ad840706cda222bb610d0d4860b98c72d4) ---- - auth/credentials/credentials_krb5.c | 36 +++++++++++++++++++++-------- - lib/krb5_wrap/krb5_samba.c | 35 ++++++++++++++++++++++++++-- - 2 files changed, 59 insertions(+), 12 deletions(-) - -diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c -index 4dc7e7be67e..8d289e26781 100644 ---- a/auth/credentials/credentials_krb5.c -+++ b/auth/credentials/credentials_krb5.c -@@ -687,7 +687,14 @@ _PUBLIC_ int cli_credentials_get_named_ccache(struct cli_credentials *cred, - bool kinit_required = false; - ret = smb_krb5_cc_get_lifetime(cred->ccache->smb_krb5_context->krb5_context, - cred->ccache->ccache, &lifetime); -- if (ret == KRB5_CC_END || ret == ENOENT) { -+ if (ret == KRB5_PLUGIN_NO_HANDLE) { -+ /* -+ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted -+ * GSSProxy credential. We don't know its lifetime but assume it -+ * is a valid one. Acquiring it will show the lifetime. -+ */ -+ kinit_required = false; -+ } else if (ret == KRB5_CC_END || ret == ENOENT) { - kinit_required = true; - } else if (ret == 0) { - if (lifetime == 0) { -@@ -800,18 +807,27 @@ _PUBLIC_ bool cli_credentials_get_ccache_name_obtained( - if (ret == KRB5_CC_END || ret == ENOENT) { - return false; - } -- if (ret != 0) { -+ -+ /* -+ * KRB5_PLUGIN_NO_HANDLE is a special case of the encrypted -+ * GSSProxy credential. We don't know its lifetime but assume it -+ * is a valid one. Acquiring it will show the lifetime. -+ * */ -+ if (ret != 0 && ret != KRB5_PLUGIN_NO_HANDLE) { - return false; - } -- if (lifetime == 0) { -- return false; -- } else if (lifetime < 300) { -- if (cred->password_obtained >= cred->ccache_obtained) { -- /* -- * we have a password to re-kinit -- * so let the caller try that. -- */ -+ -+ if (ret == 0) { -+ if (lifetime == 0) { - return false; -+ } else if (lifetime < 300) { -+ if (cred->password_obtained >= cred->ccache_obtained) { -+ /* -+ * we have a password to re-kinit -+ * so let the caller try that. -+ */ -+ return false; -+ } - } - } - -diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c -index f9d91a4f0c1..dcf91348d1a 100644 ---- a/lib/krb5_wrap/krb5_samba.c -+++ b/lib/krb5_wrap/krb5_samba.c -@@ -3025,6 +3025,8 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - krb5_creds cred; - krb5_timestamp endtime = 0; - krb5_timestamp now; -+ char *realm = NULL; -+ TALLOC_CTX *mem_ctx = NULL; - - *t = 0; - -@@ -3038,12 +3040,37 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - return kerr; - } - -+ mem_ctx = talloc_stackframe(); -+ if (mem_ctx == NULL) { -+ krb5_cc_end_seq_get(context, id, &cursor); -+ return ENOMEM; -+ } -+ - while ((kerr = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) { - if (krb5_is_config_principal(context, cred.server)) { - krb5_free_cred_contents(context, &cred); - continue; - } - -+ realm = smb_krb5_principal_get_realm(mem_ctx, context, cred.server); -+ if (realm == NULL) { -+ krb5_free_cred_contents(context, &cred); -+ kerr = ENOMEM; -+ break; -+ } -+ -+ /* -+ * 'X-GSSPROXY:' is the realm for an encrypted credential stored -+ * by the GSSProxy. There are no other creds in such ccache and -+ * we cannot see the actual lifetime (it is set to 0), -+ * indicate to the caller they need to handle this themselves. -+ */ -+ if (strcmp(realm, "X-GSSPROXY:") == 0) { -+ krb5_free_cred_contents(context, &cred); -+ kerr = KRB5_PLUGIN_NO_HANDLE; -+ break; -+ } -+ - #ifndef HAVE_FLAGS_IN_KRB5_CREDS - if (cred.ticket_flags & TKT_FLG_INITIAL) { - #else -@@ -3073,13 +3100,17 @@ krb5_error_code smb_krb5_cc_get_lifetime(krb5_context context, - krb5_free_cred_contents(context, &cred); - } - -+ krb5_cc_end_seq_get(context, id, &cursor); -+ talloc_free(mem_ctx); -+ if (kerr == ENOMEM || kerr == KRB5_PLUGIN_NO_HANDLE) { -+ return kerr; -+ } -+ - if (now < endtime) { - *t = (time_t) (endtime - now); - kerr = 0; - } - -- krb5_cc_end_seq_get(context, id, &cursor); -- - return kerr; - } - #endif /* HAVE_KRB5_CC_GET_LIFETIME */ --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 1d9ef9a..5cebd13 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc3 +%global pre_release rc4 %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -222,8 +222,7 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-bz15902.patch -Patch1: samba-pcp-7.0.0.patch +Patch0: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} diff --git a/sources b/sources index 168a85d..a13eeba 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc3.tar.xz) = 1e8b9bec0e42d387a0b4665d395ec63bcb9b84353c62be0ed253dfe79c1ff44f13a8a1825f2a1eba4c8f209cae55e0b3ed7f89b39884ec73b05383b0008a5249 -SHA512 (samba-4.23.0rc3.tar.asc) = 727d328c0f4bd075d927bcfdb86083c3e6e9f066c938d5232e655c676d78f936453bc0d39bf271d0f8371f33e8ffe30aa376ad6461ca0be8d34ebca01553c3ab +SHA512 (samba-4.23.0rc4.tar.xz) = 0e31cce7b6627d07c0d6caa4be6e7e962c5c32bb426532584f5d429c9354c5e9a3180c6cb6c2cabe0daad130c78fb43cf0b304b515d1e0a92e67e0e581539dba +SHA512 (samba-4.23.0rc4.tar.asc) = 068891e289c62ce8602ea6524c05c0348cc21853597e3e192bf932d3a4b7fb514925950828bc97375492aa30e5937761911f0ade2af202ddaec504f105fec580 From 86832ccc3983caa58af6bcc646f1bccabaa9b7e5 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 14:55:35 +0200 Subject: [PATCH 079/101] Update to version 4.23.0 - resolves: rhbz#2394791 --- samba-pcp-7.0.0.patch | 72 ------------------------------------------- samba.spec | 8 +++-- 2 files changed, 6 insertions(+), 74 deletions(-) delete mode 100644 samba-pcp-7.0.0.patch diff --git a/samba-pcp-7.0.0.patch b/samba-pcp-7.0.0.patch deleted file mode 100644 index 1b2c6a5..0000000 --- a/samba-pcp-7.0.0.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 4b74db174b92e00eb4c342c77adcb8140851d025 Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Wed, 3 Sep 2025 15:42:46 +0300 -Subject: [PATCH] ctdb/wscript: fix build against PCP 7.0.0 - -Signed-off-by: Alexander Bokovoy ---- - ctdb/utils/pmda/pmda_ctdb.c | 6 +++++- - ctdb/wscript | 20 +++++++++----------- - 2 files changed, 14 insertions(+), 12 deletions(-) - -diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 7ac8a3b38d1..75ae1079dc4 100644 ---- a/ctdb/utils/pmda/pmda_ctdb.c -+++ b/ctdb/utils/pmda/pmda_ctdb.c -@@ -39,9 +39,13 @@ - - #define pmID_cluster(id) id->cluster - #define pmID_item(id) id->item -+#ifndef pmGetProgname - #define pmGetProgname() pmProgname -+#endif -+#ifndef pmSetProgname - #define pmSetProgname(a) __pmSetProgname(a) - #endif -+#endif - - #include "domain.h" - -@@ -450,7 +454,7 @@ err_out: - * instance domain evaluation. - */ - static int --pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmResult **resp, pmdaExt *pmda) -+pmda_ctdb_fetch(int numpmid, pmID pmidlist[], pmdaResult **resp, pmdaExt *pmda) - { - int ret; - -diff --git a/ctdb/wscript b/ctdb/wscript -index e9cd89436a3..15dedb1c432 100644 ---- a/ctdb/wscript -+++ b/ctdb/wscript -@@ -226,17 +226,15 @@ def configure(conf): - - have_pmda = False - if Options.options.ctdb_pmda: -- pmda_support = True -- -- if not conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', -- together=True): -- pmda_support = False -- if not conf.CHECK_FUNCS_IN('pmProgname', 'pcp'): -- pmda_support = False -- if not conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda'): -- pmda_support = False -- if pmda_support: -- conf.CHECK_TYPE_IN('__pmID_int', 'pcp/pmapi.h pcp/impl.h') -+ checks = [conf.CHECK_HEADERS('pcp/pmapi.h pcp/impl.h pcp/pmda.h', -+ together=True), -+ conf.CHECK_FUNCS_IN('pmdaDaemon', 'pcp_pmda')] -+ -+ have_progname = [conf.CHECK_FUNCS_IN('pmProgname', 'pcp'), -+ conf.CHECK_FUNCS_IN('pmGetProgname', 'pcp')] -+ -+ if all(checks) and any(have_progname): -+ conf.CHECK_TYPE_IN('__pmID_int', 'libpcp.h pcp/pmapi.h pcp/impl.h') - have_pmda = True - else: - Logs.error("PMDA support not available") --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 5cebd13..dca57e4 100644 --- a/samba.spec +++ b/samba.spec @@ -136,7 +136,7 @@ # default is 1). %global samba_release %autorelease -%global pre_release rc4 +%global pre_release %nil %if "x%{?pre_release}" != "x" %global samba_release %autorelease -p -e %pre_release %endif @@ -222,7 +222,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-pcp-7.0.0.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} @@ -323,6 +322,11 @@ BuildRequires: xz BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) +# TODO FIXME This is not in RHEL yet +%if 0%{?fedora} >= 34 +BuildRequires: pkgconfig(libngtcp2) +BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) +%endif %ifnarch i686 %if 0%{?fedora} >= 37 From 0bc0416ee8ae7375d809c566d6ecfcba9b2beb04 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 15:03:30 +0200 Subject: [PATCH 080/101] Remove `smb3 unix extensions = yes` from smb.conf This is enabled by default now. --- smb.conf.vendor | 2 -- sources | 4 ++-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/smb.conf.vendor b/smb.conf.vendor index cbb2e0f..f237c86 100644 --- a/smb.conf.vendor +++ b/smb.conf.vendor @@ -18,8 +18,6 @@ load printers = yes cups options = raw - smb3 unix extensions = yes - # Install samba-usershares package for support include = /etc/samba/usershares.conf diff --git a/sources b/sources index a13eeba..e69f8ff 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0rc4.tar.xz) = 0e31cce7b6627d07c0d6caa4be6e7e962c5c32bb426532584f5d429c9354c5e9a3180c6cb6c2cabe0daad130c78fb43cf0b304b515d1e0a92e67e0e581539dba -SHA512 (samba-4.23.0rc4.tar.asc) = 068891e289c62ce8602ea6524c05c0348cc21853597e3e192bf932d3a4b7fb514925950828bc97375492aa30e5937761911f0ade2af202ddaec504f105fec580 +SHA512 (samba-4.23.0.tar.xz) = 660b35a99544a868b11b24ea3c2ed58de5f68c7fc12d3ea71bc84724285eee4375d13ccf357f0248352fab344d76303660e09598f5f1988f3d0f8e76c535a781 +SHA512 (samba-4.23.0.tar.asc) = 508587816e941cd8dc9f65b7f05c828ce859fb7f74a01a200f685c5188c79c916b4d5b167b71298c53cc8a01d6e17a272ea773980488af532a85308fd1142156 From 54c3bbd3f168e8816d279498b3d18435d9a4081b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 12 Sep 2025 18:04:02 +0200 Subject: [PATCH 081/101] Fix building ctdb with PCP 7.0.0 --- samba-fix-ctdb-pcp-7-support.patch | 36 ++++++++++++++++++++++++++++++ samba.spec | 6 ++++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 samba-fix-ctdb-pcp-7-support.patch diff --git a/samba-fix-ctdb-pcp-7-support.patch b/samba-fix-ctdb-pcp-7-support.patch new file mode 100644 index 0000000..116a4ff --- /dev/null +++ b/samba-fix-ctdb-pcp-7-support.patch @@ -0,0 +1,36 @@ +From 56be6583e8a32cd4dcdfcd3a1f072cc7642668e4 Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 12 Sep 2025 15:37:38 +0200 +Subject: [PATCH] ctdb: Fix redefinitoin of pmdaResult + +../../ctdb/utils/pmda/pmda_ctdb.c:52:9: warning: 'pmdaResult' redefined + 52 | #define pmdaResult pmResult + | ^~~~~~~~~~ +In file included from ../../ctdb/utils/pmda/pmda_ctdb.c:35: +/usr/include/pcp/pmda.h:30:9: note: this is the location of the previous definition + 30 | #define pmdaResult pmResult_v2 + | ^~~~~~~~~~ + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15904 + +Signed-off-by: Andreas Schneider +--- + ctdb/utils/pmda/pmda_ctdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c +index 9845f26defb..5c09aca7b84 100644 +--- a/ctdb/utils/pmda/pmda_ctdb.c ++++ b/ctdb/utils/pmda/pmda_ctdb.c +@@ -48,7 +48,7 @@ + #define pmSetProgname(a) __pmSetProgname(a) + #endif + +-#ifdef HAVE_STRUCT_PMRESULT ++#if !defined(pmdaResult) && defined(HAVE_STRUCT_PMRESULT) + #define pmdaResult pmResult + #endif + +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index dca57e4..a68adfa 100644 --- a/samba.spec +++ b/samba.spec @@ -223,6 +223,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-fix-ctdb-pcp-7-support.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} @@ -323,7 +325,7 @@ BuildRequires: zlib-devel >= 1.2.3 BuildRequires: pkgconfig(libsystemd) # TODO FIXME This is not in RHEL yet -%if 0%{?fedora} >= 34 +%if 0%{?fedora} >= 43 BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) %endif @@ -2026,8 +2028,10 @@ fi %{_libdir}/samba/libndr-samba4-private-samba.so %{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so +%if 0%{?rhel} %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so %{_libdir}/samba/libngtcp2-private-samba.so +%endif %{_libdir}/samba/libnpa-tstream-private-samba.so %{_libdir}/samba/libposix-eadb-private-samba.so %{_libdir}/samba/libprinter-driver-private-samba.so From b40a7310d3f6cc89d9b97bd587235793ad42a4b9 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 15 Sep 2025 10:43:55 +0200 Subject: [PATCH 082/101] Build with systemd-userdb support --- samba.spec | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/samba.spec b/samba.spec index a68adfa..406e975 100644 --- a/samba.spec +++ b/samba.spec @@ -121,6 +121,12 @@ %bcond lmdb 0 %endif +%if 0%{?fedora} >= 43 +%bcond varlink 1 +%else +%bcond varlink 0 +%endif + %global samba_version 4.23.0 # The release field is extended: @@ -330,6 +336,10 @@ BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) %endif +%if %{with varlink} +BuildRequires: pkgconfig(libvarlink) >= 24 +%endif + %ifnarch i686 %if 0%{?fedora} >= 37 BuildRequires: mold @@ -1429,6 +1439,9 @@ export PYTHONARCHDIR=%{python3_sitearch} %endif %if %{with prometheus} --with-prometheus-exporter \ +%endif +%if %{with varlink} + --with-systemd-userdb \ %endif --with-profiling-data \ --with-systemd \ From 07953f426e3bacaaab66308f0cc460811ce9a29d Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 23 Sep 2025 11:40:30 +0300 Subject: [PATCH 083/101] Fix DLZ crash on unconfigured Samba AD system and rebuild against Python 3.14.0rc3 - Resolves: rhbz#2396621 - Resolves: rhbz#2397242 Signed-off-by: Alexander Bokovoy --- samba-dlz-crash-fix.patch | 53 +++++++++++++++++++++++++++++++++++++++ samba.spec | 1 + 2 files changed, 54 insertions(+) create mode 100644 samba-dlz-crash-fix.patch diff --git a/samba-dlz-crash-fix.patch b/samba-dlz-crash-fix.patch new file mode 100644 index 0000000..e3e84b2 --- /dev/null +++ b/samba-dlz-crash-fix.patch @@ -0,0 +1,53 @@ +From 821cf798d87162b1f3b5d7388891d15fea0a969a Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Fri, 19 Sep 2025 16:23:41 +0300 +Subject: [PATCH] Fix crash in DLZ plugin for incorrect setup + +When bind is not yet setup properly, logging errors should be done +through the temporary handle. + +BUG: https://bugzilla.samba.org/show_bug.cgi?id=15920 + +Signed-off-by: Alexander Bokovoy +Reviewed-by: Douglas Bagnall + +Autobuild-User(master): Douglas Bagnall +Autobuild-Date(master): Sat Sep 20 06:49:37 UTC 2025 on atb-devel-224 +--- + source4/dns_server/dlz_bind9.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c +index e5c9679835e..2a2430caba2 100644 +--- a/source4/dns_server/dlz_bind9.c ++++ b/source4/dns_server/dlz_bind9.c +@@ -671,6 +671,9 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, + } + va_end(ap); + ++ /* starting from here, we can only use state->log() until ++ * dlz_bind9_state is assigned */ ++ + /* Do not install samba signal handlers */ + fault_setup_disable(); + +@@ -727,11 +730,11 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, + } + + if (!file_exist(state->options.url)) { +- dlz_bind9_state->log(ISC_LOG_ERROR, +- "samba_dlz: dlz_create could not find '%s'; " +- "trying old location '%s/dns/sam.ldb' instead", +- state->options.url, +- lpcfg_private_dir(state->lp)); ++ state->log(ISC_LOG_ERROR, ++ "samba_dlz: dlz_create could not find '%s'; " ++ "trying old location '%s/dns/sam.ldb' instead", ++ state->options.url, ++ lpcfg_private_dir(state->lp)); + state->options.url = talloc_asprintf(state, + "%s/dns/sam.ldb", + lpcfg_private_dir(state->lp)); +-- +2.51.0 + diff --git a/samba.spec b/samba.spec index 406e975..4846712 100644 --- a/samba.spec +++ b/samba.spec @@ -230,6 +230,7 @@ Source201: README.downgrade Source202: samba.abignore Patch0: samba-fix-ctdb-pcp-7-support.patch +Patch1: samba-dlz-crash-fix.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} From 4e3699d8b510bcd13d65116dca74012906d32a31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Mon, 29 Sep 2025 14:14:11 +0200 Subject: [PATCH 084/101] Update to Samba 4.23.1 - resolves: #2399755 Guenther --- samba-dlz-crash-fix.patch | 53 ------------------------------ samba-fix-ctdb-pcp-7-support.patch | 36 -------------------- samba.spec | 5 +-- sources | 4 +-- 4 files changed, 3 insertions(+), 95 deletions(-) delete mode 100644 samba-dlz-crash-fix.patch delete mode 100644 samba-fix-ctdb-pcp-7-support.patch diff --git a/samba-dlz-crash-fix.patch b/samba-dlz-crash-fix.patch deleted file mode 100644 index e3e84b2..0000000 --- a/samba-dlz-crash-fix.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 821cf798d87162b1f3b5d7388891d15fea0a969a Mon Sep 17 00:00:00 2001 -From: Alexander Bokovoy -Date: Fri, 19 Sep 2025 16:23:41 +0300 -Subject: [PATCH] Fix crash in DLZ plugin for incorrect setup - -When bind is not yet setup properly, logging errors should be done -through the temporary handle. - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15920 - -Signed-off-by: Alexander Bokovoy -Reviewed-by: Douglas Bagnall - -Autobuild-User(master): Douglas Bagnall -Autobuild-Date(master): Sat Sep 20 06:49:37 UTC 2025 on atb-devel-224 ---- - source4/dns_server/dlz_bind9.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c -index e5c9679835e..2a2430caba2 100644 ---- a/source4/dns_server/dlz_bind9.c -+++ b/source4/dns_server/dlz_bind9.c -@@ -671,6 +671,9 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, - } - va_end(ap); - -+ /* starting from here, we can only use state->log() until -+ * dlz_bind9_state is assigned */ -+ - /* Do not install samba signal handlers */ - fault_setup_disable(); - -@@ -727,11 +730,11 @@ _PUBLIC_ isc_result_t dlz_create(const char *dlzname, - } - - if (!file_exist(state->options.url)) { -- dlz_bind9_state->log(ISC_LOG_ERROR, -- "samba_dlz: dlz_create could not find '%s'; " -- "trying old location '%s/dns/sam.ldb' instead", -- state->options.url, -- lpcfg_private_dir(state->lp)); -+ state->log(ISC_LOG_ERROR, -+ "samba_dlz: dlz_create could not find '%s'; " -+ "trying old location '%s/dns/sam.ldb' instead", -+ state->options.url, -+ lpcfg_private_dir(state->lp)); - state->options.url = talloc_asprintf(state, - "%s/dns/sam.ldb", - lpcfg_private_dir(state->lp)); --- -2.51.0 - diff --git a/samba-fix-ctdb-pcp-7-support.patch b/samba-fix-ctdb-pcp-7-support.patch deleted file mode 100644 index 116a4ff..0000000 --- a/samba-fix-ctdb-pcp-7-support.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 56be6583e8a32cd4dcdfcd3a1f072cc7642668e4 Mon Sep 17 00:00:00 2001 -From: Andreas Schneider -Date: Fri, 12 Sep 2025 15:37:38 +0200 -Subject: [PATCH] ctdb: Fix redefinitoin of pmdaResult - -../../ctdb/utils/pmda/pmda_ctdb.c:52:9: warning: 'pmdaResult' redefined - 52 | #define pmdaResult pmResult - | ^~~~~~~~~~ -In file included from ../../ctdb/utils/pmda/pmda_ctdb.c:35: -/usr/include/pcp/pmda.h:30:9: note: this is the location of the previous definition - 30 | #define pmdaResult pmResult_v2 - | ^~~~~~~~~~ - -BUG: https://bugzilla.samba.org/show_bug.cgi?id=15904 - -Signed-off-by: Andreas Schneider ---- - ctdb/utils/pmda/pmda_ctdb.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/ctdb/utils/pmda/pmda_ctdb.c b/ctdb/utils/pmda/pmda_ctdb.c -index 9845f26defb..5c09aca7b84 100644 ---- a/ctdb/utils/pmda/pmda_ctdb.c -+++ b/ctdb/utils/pmda/pmda_ctdb.c -@@ -48,7 +48,7 @@ - #define pmSetProgname(a) __pmSetProgname(a) - #endif - --#ifdef HAVE_STRUCT_PMRESULT -+#if !defined(pmdaResult) && defined(HAVE_STRUCT_PMRESULT) - #define pmdaResult pmResult - #endif - --- -2.51.0 - diff --git a/samba.spec b/samba.spec index 4846712..493c0bf 100644 --- a/samba.spec +++ b/samba.spec @@ -127,7 +127,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.0 +%global samba_version 4.23.1 # The release field is extended: # [.][.]%%{?dist}[.] @@ -229,9 +229,6 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore -Patch0: samba-fix-ctdb-pcp-7-support.patch -Patch1: samba-dlz-crash-fix.patch - Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} diff --git a/sources b/sources index e69f8ff..1bea503 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.0.tar.xz) = 660b35a99544a868b11b24ea3c2ed58de5f68c7fc12d3ea71bc84724285eee4375d13ccf357f0248352fab344d76303660e09598f5f1988f3d0f8e76c535a781 -SHA512 (samba-4.23.0.tar.asc) = 508587816e941cd8dc9f65b7f05c828ce859fb7f74a01a200f685c5188c79c916b4d5b167b71298c53cc8a01d6e17a272ea773980488af532a85308fd1142156 +SHA512 (samba-4.23.1.tar.xz) = d6e2863dc729b2c4feb337634ad80d9f8cb244455dbdb035f6d164ed722c07e507d2018d68221beada429d6e2c00aa36bfbfcc788e96e34225bb963beb2e017e +SHA512 (samba-4.23.1.tar.asc) = cea22d67e374b4350bd78e941ec60655b4176b7c24dc3514f476608f91c5806f1dc11aed66a237dec82ed31979eeeacac91f2191c3b9fe415920f762a0085118 From c05bf06122c9f8f630c5435c3ebe7d04046472c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Wed, 15 Oct 2025 23:27:11 +0200 Subject: [PATCH 085/101] Update to Samba 4.23.2 - resolves: rhbz#2404204 - resolves: rhbz#2391698 - Security fix for CVE-2025-9640 - resolves: rhbz#2394377 - Security fix for CVE-2025-10230 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 493c0bf..d6e2912 100644 --- a/samba.spec +++ b/samba.spec @@ -127,7 +127,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.1 +%global samba_version 4.23.2 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 1bea503..4af6c05 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.1.tar.xz) = d6e2863dc729b2c4feb337634ad80d9f8cb244455dbdb035f6d164ed722c07e507d2018d68221beada429d6e2c00aa36bfbfcc788e96e34225bb963beb2e017e -SHA512 (samba-4.23.1.tar.asc) = cea22d67e374b4350bd78e941ec60655b4176b7c24dc3514f476608f91c5806f1dc11aed66a237dec82ed31979eeeacac91f2191c3b9fe415920f762a0085118 +SHA512 (samba-4.23.2.tar.xz) = ffc9415d76244a199ef23cb39da7b97ec07b7fd061f84ba6185ac3a45e6b6942d0196945ac6d7e72f137787eafb2811220227c2c72a006fdfc903f90caa4673f +SHA512 (samba-4.23.2.tar.asc) = 775a8e321ea63193b027e6c2f351f9532b93cb6662571dc30bf2150624649afc425d3c9a0bfdea92ac093d25a1aee71d7ff6e4a47d44b2286074cf7ac6cdea98 From efaa5fdc6d2a13fc842f453c360f76a8f8ed587e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Tue, 4 Mar 2025 20:08:17 +0100 Subject: [PATCH 086/101] Fix --with testsuite [skip changelog] --- samba.spec | 48 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/samba.spec b/samba.spec index d6e2912..08d2cb9 100644 --- a/samba.spec +++ b/samba.spec @@ -6,7 +6,17 @@ # or # rpmbuild --rebuild --with testsuite samba.src.rpm # +# If you just want to run a single test, you can use: +# fedpkg mockbuild --with testsuite -- --define 'SAMBA_TESTS regex' samba.src.rpm +# or +# rpmbuild --rebuild --with testsuite --define='SAMBA_TESTS regex' samba.src.rpm +# %bcond testsuite 0 +%if %{with testsuite} +# As the file list is empty for running just the tests, we have empty debuginfo +# package. Disable it to avoid error reporting. +%global debug_package %{nil} +%endif # Build with internal talloc, tevent, tdb # @@ -1328,6 +1338,13 @@ xzcat %{SOURCE0} | gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} - # Make sure we do not build with heimdal code rm -rfv third_party/heimdal +%if %{with testsuite} +# WARNING: Don't change that for production! +# +# Shorten the priviliged dir, as unix sockets only have 108 chars +sed -i 's/#define WINBINDD_PRIV_SOCKET_SUBDIR.*/#define WINBINDD_PRIV_SOCKET_SUBDIR "wb_priv"/' nsswitch/winbind_struct_protocol.h +%endif + %build %if %{with includelibs} %global _talloc_lib ,talloc,pytalloc,pytalloc-util @@ -1619,20 +1636,37 @@ touch %{buildroot}%{_libexecdir}/ctdb/statd_callout # in the timestamp so the year 2038 problem is deferred till 2446. # https://bugzilla.samba.org/show_bug.cgi?id=14546 # -for t in samba3.smb2.timestamps.time_t_15032385535 \ - samba3.smb2.timestamps.time_t_10000000000 \ - samba3.smb2.timestamps.time_t_4294967295 \ - ; do - echo "^$t" >> selftest/knownfail.d/fedora.%{dist} -done -cat selftest/knownfail.d/fedora.%{dist} +if [ "$(df --portability --print-type "$(pwd)" | grep -c ext4)" == "1" ]; then + cat > selftest/knownfail.d/fedora%{dist} << EOF +^samba3.smb2.timestamps.time_t_15032385535 +^samba3.smb2.timestamps.time_t_10000000000 +^samba3.smb2.timestamps.time_t_4294967295 +EOF +fi + +echo +echo "Content of selftest/knownfail.d/fedora%{dist}:" +cat selftest/knownfail.d/fedora%{dist} || true + +cat >> selftest/skip << EOF +# FIXME: Investigate why it fails. Might be CUPS is not running? +^samba3.rpc.spoolss.printserver +EOF + +echo +echo "Content of selftest/skip:" +cat selftest/skip export TDB_NO_FSYNC=1 export NMBD_DONT_LOG_STDOUT=1 export SMBD_DONT_LOG_STDOUT=1 export WINBINDD_DONT_LOG_STDOUT=1 export SAMBA_DCERPCD_DONT_LOG_STDOUT=1 +%if "x%{?SAMBA_TESTS}" != "x" +%{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 TESTS="%{SAMBA_TESTS}" +%else %{__make} %{?_smp_mflags} test FAIL_IMMEDIATELY=1 +%endif #endif with testsuite %endif From 80c8f322115895534520fe5a4c6159ff629fe13a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 7 Nov 2025 16:41:40 +0100 Subject: [PATCH 087/101] Update to Samba 4.23.3 - resolves: #2413362 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 08d2cb9..25b8dbc 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.2 +%global samba_version 4.23.3 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index 4af6c05..d966a50 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.2.tar.xz) = ffc9415d76244a199ef23cb39da7b97ec07b7fd061f84ba6185ac3a45e6b6942d0196945ac6d7e72f137787eafb2811220227c2c72a006fdfc903f90caa4673f -SHA512 (samba-4.23.2.tar.asc) = 775a8e321ea63193b027e6c2f351f9532b93cb6662571dc30bf2150624649afc425d3c9a0bfdea92ac093d25a1aee71d7ff6e4a47d44b2286074cf7ac6cdea98 +SHA512 (samba-4.23.3.tar.xz) = 5cb15c8eeda14dc4317b239864a4b7aa50b9c16a49ac9aefdc06ba6bde9b869fee2955eb21ed4620b73bb68682d368821869594fd106f3387e9ced9978483e7e +SHA512 (samba-4.23.3.tar.asc) = 27804ead26f8363d2a84b8ad37495a60b28c80b002e3c7420d434792c893355bd2652a8222825dbc877acbba65db18c4a648eaec218d69f275428b6f6d8a990e From 4af627337110534bd4de9e18adc758c2e7c1b093 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 10 Nov 2025 13:20:07 +0100 Subject: [PATCH 088/101] Update gitignore [skip changelog] --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index a695288..47652a9 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ /samba-*.tar.xz /samba-*.tar.asc +/*.rpm +/results_samba From fb14cf225b29844693fd6240ba590d7c77622d00 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Fri, 14 Nov 2025 19:10:30 +0100 Subject: [PATCH 089/101] Add hint that we bundle ngtcp2 if not provided by the system --- samba.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/samba.spec b/samba.spec index 25b8dbc..789eb43 100644 --- a/samba.spec +++ b/samba.spec @@ -342,6 +342,8 @@ BuildRequires: pkgconfig(libsystemd) %if 0%{?fedora} >= 43 BuildRequires: pkgconfig(libngtcp2) BuildRequires: pkgconfig(libngtcp2_crypto_gnutls) +%else +Provides: bundled(ngtcp2) %endif %if %{with varlink} From 8c46386794df75e98db1520c6f03cc26e14e8c1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCnther=20Deschner?= Date: Fri, 12 Dec 2025 17:04:18 +0100 Subject: [PATCH 090/101] Update to Samba 4.23.4 - resolves: #2421764 Guenther --- samba.spec | 2 +- sources | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/samba.spec b/samba.spec index 789eb43..9b87190 100644 --- a/samba.spec +++ b/samba.spec @@ -137,7 +137,7 @@ %bcond varlink 0 %endif -%global samba_version 4.23.3 +%global samba_version 4.23.4 # The release field is extended: # [.][.]%%{?dist}[.] diff --git a/sources b/sources index d966a50..01648ec 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (samba-4.23.3.tar.xz) = 5cb15c8eeda14dc4317b239864a4b7aa50b9c16a49ac9aefdc06ba6bde9b869fee2955eb21ed4620b73bb68682d368821869594fd106f3387e9ced9978483e7e -SHA512 (samba-4.23.3.tar.asc) = 27804ead26f8363d2a84b8ad37495a60b28c80b002e3c7420d434792c893355bd2652a8222825dbc877acbba65db18c4a648eaec218d69f275428b6f6d8a990e +SHA512 (samba-4.23.4.tar.xz) = 58979aa8a83e8210918f4f1adbcadff329e57a9cd25d7aba98d18f54a2e790a7ef3cc6b9fb3303d492d33d67f4a135849a419c95644d14e53a39654736d486ac +SHA512 (samba-4.23.4.tar.asc) = 0981ce6a43202953cdc7ceae77fa0e3b4ab853991430dde4df6daa163984de6c7ca3f3a3037376659d3bdaedcc108cdd7a77ce0ac24d0a1add56c7103fca7dce From a170fadc8dd6bcea5ed3839b6086643e43d06f71 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 12 Jan 2026 10:05:53 +0100 Subject: [PATCH 091/101] Do not redeclare cmocka functions This might cause issues when compiling with newer cmocka versions. --- samba-4.23-fix-cmocka.patch | 38 +++++++++++++++++++++++++++++++++++++ samba.spec | 2 ++ 2 files changed, 40 insertions(+) create mode 100644 samba-4.23-fix-cmocka.patch diff --git a/samba-4.23-fix-cmocka.patch b/samba-4.23-fix-cmocka.patch new file mode 100644 index 0000000..26289d6 --- /dev/null +++ b/samba-4.23-fix-cmocka.patch @@ -0,0 +1,38 @@ +From b1ec803f420b2c6d3c5c83d70c6875a7f36b15fc Mon Sep 17 00:00:00 2001 +From: Andreas Schneider +Date: Fri, 21 Nov 2025 15:33:32 +0100 +Subject: [PATCH] s4:dsdb: Do not declare cm_print_error() + +This is part of the cmocka.h header file. + +Signed-off-by: Andreas Schneider +Reviewed-by: Martin Schwenke +Reviewed-by: Volker Lendecke + +Autobuild-User(master): Volker Lendecke +Autobuild-Date(master): Mon Nov 24 11:28:08 UTC 2025 on atb-devel-224 + +(cherry picked from commit 5a981663e4f677042ba80191770100aecff2120a) +--- + source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c +index f7075f3485e..12c464b49c7 100644 +--- a/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c ++++ b/source4/dsdb/samdb/ldb_modules/tests/test_group_audit.c +@@ -103,11 +103,6 @@ void audit_message_send( + + #define check_group_change_message(m, u, a, e) \ + _check_group_change_message(m, u, a, e, __FILE__, __LINE__); +-/* +- * declare the internal cmocka cm_print_error so that we can output messages +- * in sub unit format +- */ +-void cm_print_error(const char * const format, ...); + + /* + * Validate a group change JSON audit message +-- +2.52.0 + diff --git a/samba.spec b/samba.spec index 9b87190..2e3fe75 100644 --- a/samba.spec +++ b/samba.spec @@ -239,6 +239,8 @@ Source18: samba-winbind-systemd-sysusers.conf Source201: README.downgrade Source202: samba.abignore +Patch0: samba-4.23-fix-cmocka.patch + Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} From 4a23ce5b7a021fac72e887bf4f71f843b150c987 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 08:01:17 +0100 Subject: [PATCH 092/101] Remove unneeded dependency to samba-common-libs --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index 2e3fe75..647fc92 100644 --- a/samba.spec +++ b/samba.spec @@ -1264,7 +1264,6 @@ License: LGPL-3.0-or-later Requires: libtalloc%{?_isa} >= %{talloc_version} Requires: libtdb%{?_isa} >= %{tdb_version} Requires: libtevent%{?_isa} >= %{tevent_version} -Requires: samba-common-libs = %{samba_depver} # /endif without includelibs %endif From b8395d93a751e2417fd1dd28e5cc09501ac2bb24 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 10:53:10 +0100 Subject: [PATCH 093/101] Create a core-libs sub-package to split up library dependencies --- samba.spec | 135 +++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 100 insertions(+), 35 deletions(-) diff --git a/samba.spec b/samba.spec index 647fc92..c72ba68 100644 --- a/samba.spec +++ b/samba.spec @@ -488,12 +488,26 @@ The %{name}-client package provides some SMB/CIFS clients to complement the built-in SMB/CIFS filesystem in Linux. These clients allow access of SMB/CIFS shares and printing to SMB/CIFS printers. +### CORE-LIBS +%package core-libs +Summary: Samba core libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} + +Provides: bundled(libreplace) = %{samba_depver} + +%description core-libs +The samba-core-libs package contains foundational libraries needed by +both Samba servers and clients. This includes error handling, utilities, +and NDR serialization support. + ### CLIENT-LIBS %package client-libs Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -528,7 +542,7 @@ packages of Samba. Summary: Libraries used by both Samba servers and clients Requires(pre): samba-common = %{samba_depver} Requires: samba-common = %{samba_depver} -Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -890,7 +904,7 @@ suite. %if %{with libwbclient} %package -n libwbclient Summary: The winbind client library -Requires: %{name}-client-libs = %{samba_depver} +# libwbclient.so only links to libc - no samba library dependencies needed Conflicts: sssd-libwbclient %description -n libwbclient @@ -2009,6 +2023,45 @@ fi #endif with includelibs %endif +### CORE-LIBS +%files core-libs +%dir %{_libdir}/samba + +# +# Tier 0: Private libraries - libc only dependencies +# +%{_libdir}/samba/libreplace-private-samba.so +%{_libdir}/samba/libsocket-blocking-private-samba.so +%{_libdir}/samba/libsys-rw-private-samba.so +%{_libdir}/samba/libtime-basic-private-samba.so + +# +# Tier 1: Private libraries - system libs (libtalloc, libsystemd) +# +%{_libdir}/samba/libsamba-debug-private-samba.so +%{_libdir}/samba/libserver-role-private-samba.so + +# +# Tier 1: Public libraries - system libs (libtalloc) +# +%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* + +# +# Tier 2: Private libraries - adds gnutls +# +%{_libdir}/samba/libgenrand-private-samba.so + +# +# Tier 2: Public libraries - adds gnutls, icu, tevent +# +%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* +%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* + +# +# Tier 3: Public libraries - NDR serialization (depends on Tier 1-2) +# +%{_libdir}/libndr.so.%{libndr_so_version}* + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* @@ -2017,18 +2070,12 @@ fi %{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* %{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* %{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* -%{_libdir}/libndr.so.%{libndr_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* -%{_libdir}/libsamba-errors.so.%{libsamba_errors_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* -%{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* %{_libdir}/libsamdb.so.%{libsamdb_so_version}* %{_libdir}/libsmbconf.so.%{libsmbconf_so_version}* %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* -%{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* - -%dir %{_libdir}/samba %{_libdir}/samba/libCHARSET3-private-samba.so %{_libdir}/samba/libMESSAGING-SEND-private-samba.so %{_libdir}/samba/libMESSAGING-private-samba.so @@ -2049,19 +2096,14 @@ fi %{_libdir}/samba/libcmdline-contexts-private-samba.so %{_libdir}/samba/libcommon-auth-private-samba.so %{_libdir}/samba/libctdb-event-client-private-samba.so -%{_libdir}/samba/libdbwrap-private-samba.so %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so %{_libdir}/samba/libdcerpc-samba-private-samba.so %{_libdir}/samba/libevents-private-samba.so -%{_libdir}/samba/libflag-mapping-private-samba.so -%{_libdir}/samba/libgenrand-private-samba.so %{_libdir}/samba/libgensec-private-samba.so %{_libdir}/samba/libgpext-private-samba.so %{_libdir}/samba/libgpo-private-samba.so %{_libdir}/samba/libgse-private-samba.so %{_libdir}/samba/libhttp-private-samba.so -%{_libdir}/samba/libinterfaces-private-samba.so -%{_libdir}/samba/libiov-buf-private-samba.so %{_libdir}/samba/libkrb5samba-private-samba.so %{_libdir}/samba/libldbsamba-private-samba.so %{_libdir}/samba/liblibcli-lsa3-private-samba.so @@ -2087,32 +2129,32 @@ fi %{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so -%{_libdir}/samba/libsamba-debug-private-samba.so %{_libdir}/samba/libsamba-modules-private-samba.so -%{_libdir}/samba/libsamba-security-private-samba.so %{_libdir}/samba/libsamba-security-trusts-private-samba.so %{_libdir}/samba/libsamba-sockets-private-samba.so -%{_libdir}/samba/libsamba3-util-private-samba.so %{_libdir}/samba/libsamdb-common-private-samba.so %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so -%{_libdir}/samba/libserver-role-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so %{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so %{_libdir}/samba/libsmbldaphelper-private-samba.so -%{_libdir}/samba/libstable-sort-private-samba.so -%{_libdir}/samba/libsys-rw-private-samba.so -%{_libdir}/samba/libsocket-blocking-private-samba.so -%{_libdir}/samba/libtalloc-report-printf-private-samba.so -%{_libdir}/samba/libtalloc-report-private-samba.so -%{_libdir}/samba/libtdb-wrap-private-samba.so -%{_libdir}/samba/libtime-basic-private-samba.so %{_libdir}/samba/libtorture-private-samba.so %{_libdir}/samba/libutil-crypt-private-samba.so -%{_libdir}/samba/libutil-reg-private-samba.so -%{_libdir}/samba/libutil-setid-private-samba.so -%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Command line library +# +%{_libdir}/samba/libcmdline-private-samba.so + +# +# Password database modules (depend on libsamba-passdb) +# +%dir %{_libdir}/samba/ldb +%dir %{_libdir}/samba/pdb +%{_libdir}/samba/pdb/ldapsam.so +%{_libdir}/samba/pdb/smbpasswd.so +%{_libdir}/samba/pdb/tdbsam.so %if %{without libwbclient} %{_libdir}/samba/libwbclient.so.* @@ -2165,16 +2207,39 @@ fi ### COMMON-LIBS %files common-libs -# common libraries -%{_libdir}/samba/libcmdline-private-samba.so -%{_libdir}/samba/libreplace-private-samba.so -%dir %{_libdir}/samba/ldb +# +# Tier 0: libc only dependencies +# +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so -%dir %{_libdir}/samba/pdb -%{_libdir}/samba/pdb/ldapsam.so -%{_libdir}/samba/pdb/smbpasswd.so -%{_libdir}/samba/pdb/tdbsam.so +# +# Tier 1: system libs only (libtalloc) +# +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so + +# +# Tier 2: depends on core-libs (debug, replace) +# +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so + +# +# Tier 3: depends on core-libs (util, errors, ndr) +# +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so + +# +# Tier 4: depends on core-libs + Tier 3 libs +# +%{_libdir}/samba/libsamba-security-private-samba.so ### COMMON-TOOLS %files common-tools From fcd8668e55e701de2421c6b27425a4c942673bd7 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 11:24:56 +0100 Subject: [PATCH 094/101] Add gating test to detect dependency changes in samba libraries [skip changelog] --- gating.yaml | 6 ++ tests/deps-check.fmf | 13 +++++ tests/deps-check.sh | 133 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 152 insertions(+) create mode 100644 gating.yaml create mode 100644 tests/deps-check.fmf create mode 100755 tests/deps-check.sh diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..c2182c7 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,6 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf new file mode 100644 index 0000000..878b8b2 --- /dev/null +++ b/tests/deps-check.fmf @@ -0,0 +1,13 @@ +summary: Check samba package dependency structure +description: | + Verify that samba library packages maintain correct dependency hierarchy: + - samba-core-libs has no samba-*-libs dependencies + - samba-common-libs depends on samba-core-libs (not samba-client-libs) + - libwbclient has no samba-*-libs dependencies +test: ./deps-check.sh +framework: shell +require: + - samba-core-libs + - samba-common-libs + - samba-client-libs + - libwbclient diff --git a/tests/deps-check.sh b/tests/deps-check.sh new file mode 100755 index 0000000..622e88a --- /dev/null +++ b/tests/deps-check.sh @@ -0,0 +1,133 @@ +#!/bin/bash +# +# Samba package dependency structure verification +# +# This test ensures that the samba library package dependencies don't regress. +# The expected hierarchy is: +# +# samba-core-libs (no samba-*-libs dependencies) +# ^ +# | +# samba-common-libs (depends on samba-core-libs only) +# ^ +# | +# samba-client-libs (depends on samba-core-libs + samba-common-libs) +# +# libwbclient (no samba-*-libs dependencies - only links to libc) +# +# NOTE: This test checks RESOLVED dependencies, not just explicit Requires. +# A library requirement like 'libfoo.so' is resolved to the package that +# provides it, ensuring we catch indirect dependencies. +# + +set -e + +ERRORS=0 + +# Get all packages that a package depends on (resolved) +# This resolves library deps like 'libfoo.so' to actual package names +get_resolved_deps() { + local pkg="$1" + + rpm -qR "$pkg" 2>/dev/null | while read -r req; do + # Skip rpmlib and config requirements + [[ "$req" =~ ^rpmlib ]] && continue + [[ "$req" =~ ^config ]] && continue + [[ "$req" =~ ^/ ]] && continue + + # Get the package that provides this requirement + provider=$(rpm -q --whatprovides "$req" 2>/dev/null | head -1) + if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then + # Extract just the package name (remove version-release.arch) + echo "${provider%%-[0-9]*}" + fi + done | sort -u +} + +# Check that a package does NOT depend on packages matching a pattern +# This checks RESOLVED dependencies (what packages actually get pulled in) +check_no_resolved_dep() { + local pkg="$1" + local pattern="$2" + local description="$3" + + if ! rpm -q "$pkg" &>/dev/null; then + echo "SKIP: $pkg not installed" + return 0 + fi + + local bad_deps + # Exclude the package itself from the check + bad_deps=$(get_resolved_deps "$pkg" | grep -v "^${pkg}$" | grep -E "$pattern" || true) + + if [ -n "$bad_deps" ]; then + echo "FAIL: $pkg depends on $description" + echo " Found: $bad_deps" + ERRORS=$((ERRORS + 1)) + return 1 + fi + echo "PASS: $pkg does not depend on $description" + return 0 +} + +# Check that a package DOES depend on a specific package +check_has_resolved_dep() { + local pkg="$1" + local expected="$2" + + if ! rpm -q "$pkg" &>/dev/null; then + echo "SKIP: $pkg not installed" + return 0 + fi + + if get_resolved_deps "$pkg" | grep -qF "$expected"; then + echo "PASS: $pkg depends on $expected" + return 0 + fi + echo "FAIL: $pkg does not depend on $expected" + ERRORS=$((ERRORS + 1)) + return 1 +} + +echo "=== Samba Package Dependency Checks ===" +echo "" +echo "Checking resolved dependencies (library deps resolved to packages)" +echo "" + +# 1. samba-core-libs must NOT depend on any samba-*-libs packages +echo "--- samba-core-libs ---" +check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba-*-libs package" + +echo "" + +# 2. samba-common-libs must depend on samba-core-libs +# but NOT samba-client-libs +echo "--- samba-common-libs ---" +check_has_resolved_dep samba-common-libs "samba-core-libs" +check_no_resolved_dep samba-common-libs "^samba-client-libs$" "samba-client-libs" + +echo "" + +# 3. samba-client-libs must depend on samba-core-libs and samba-common-libs +# but NOT samba-libs +echo "--- samba-client-libs ---" +check_has_resolved_dep samba-client-libs "samba-core-libs" +check_has_resolved_dep samba-client-libs "samba-common-libs" +check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs" + +echo "" + +# 4. libwbclient must NOT depend on any samba-*-libs packages +echo "--- libwbclient ---" +check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" + +echo "" +echo "=== Summary ===" + +if [ $ERRORS -gt 0 ]; then + echo "FAILED: $ERRORS dependency check(s) failed" + exit 1 +fi + +echo "All dependency checks passed" +exit 0 From baa9e6f8c0c9594e05f953d54cf2e8fd720404c6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 12:23:39 +0100 Subject: [PATCH 095/101] Move libraries from samba-client-libs to samba-libs --- samba.spec | 30 +++++++++++++++++------------- tests/deps-check.fmf | 7 +++++++ tests/deps-check.sh | 26 ++++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 13 deletions(-) diff --git a/samba.spec b/samba.spec index c72ba68..ccb55fc 100644 --- a/samba.spec +++ b/samba.spec @@ -2078,11 +2078,9 @@ fi %{_libdir}/libsmbldap.so.%{libsmbldap_so_version}* %{_libdir}/samba/libCHARSET3-private-samba.so %{_libdir}/samba/libMESSAGING-SEND-private-samba.so -%{_libdir}/samba/libMESSAGING-private-samba.so %{_libdir}/samba/libaddns-private-samba.so %{_libdir}/samba/libads-private-samba.so %{_libdir}/samba/libasn1util-private-samba.so -%{_libdir}/samba/libauth-private-samba.so %{_libdir}/samba/libauthkrb5-private-samba.so %{_libdir}/samba/libcli-cldap-private-samba.so %{_libdir}/samba/libcli-ldap-common-private-samba.so @@ -2095,13 +2093,10 @@ fi %{_libdir}/samba/libcluster-private-samba.so %{_libdir}/samba/libcmdline-contexts-private-samba.so %{_libdir}/samba/libcommon-auth-private-samba.so -%{_libdir}/samba/libctdb-event-client-private-samba.so %{_libdir}/samba/libdcerpc-pkt-auth-private-samba.so %{_libdir}/samba/libdcerpc-samba-private-samba.so %{_libdir}/samba/libevents-private-samba.so %{_libdir}/samba/libgensec-private-samba.so -%{_libdir}/samba/libgpext-private-samba.so -%{_libdir}/samba/libgpo-private-samba.so %{_libdir}/samba/libgse-private-samba.so %{_libdir}/samba/libhttp-private-samba.so %{_libdir}/samba/libkrb5samba-private-samba.so @@ -2116,16 +2111,12 @@ fi %{_libdir}/samba/libmsrpc3-private-samba.so %{_libdir}/samba/libndr-samba-private-samba.so %{_libdir}/samba/libndr-samba4-private-samba.so -%{_libdir}/samba/libnet-keytab-private-samba.so %{_libdir}/samba/libnetif-private-samba.so %if 0%{?rhel} %{_libdir}/samba/libngtcp2-crypto-gnutls-private-samba.so %{_libdir}/samba/libngtcp2-private-samba.so %endif %{_libdir}/samba/libnpa-tstream-private-samba.so -%{_libdir}/samba/libposix-eadb-private-samba.so -%{_libdir}/samba/libprinter-driver-private-samba.so -%{_libdir}/samba/libprinting-migrate-private-samba.so %{_libdir}/samba/libquic-private-samba.so %{_libdir}/samba/libregistry-private-samba.so %{_libdir}/samba/libsamba-cluster-support-private-samba.so @@ -2136,11 +2127,7 @@ fi %{_libdir}/samba/libsecrets3-private-samba.so %{_libdir}/samba/libserver-id-db-private-samba.so %{_libdir}/samba/libsmbclient-raw-private-samba.so -%{_libdir}/samba/libsmbd-base-private-samba.so %{_libdir}/samba/libsmbd-shim-private-samba.so -%{_libdir}/samba/libsmbldaphelper-private-samba.so -%{_libdir}/samba/libtorture-private-samba.so -%{_libdir}/samba/libutil-crypt-private-samba.so # # Command line library @@ -2597,6 +2584,23 @@ fi %{_libdir}/samba/libRPC-SERVER-LOOP-private-samba.so %{_libdir}/samba/libRPC-WORKER-private-samba.so +# +# Server-side libraries (not used by libsmbclient) +# +%{_libdir}/samba/libauth-private-samba.so +%{_libdir}/samba/libctdb-event-client-private-samba.so +%{_libdir}/samba/libgpext-private-samba.so +%{_libdir}/samba/libgpo-private-samba.so +%{_libdir}/samba/libMESSAGING-private-samba.so +%{_libdir}/samba/libnet-keytab-private-samba.so +%{_libdir}/samba/libposix-eadb-private-samba.so +%{_libdir}/samba/libprinter-driver-private-samba.so +%{_libdir}/samba/libprinting-migrate-private-samba.so +%{_libdir}/samba/libsmbd-base-private-samba.so +%{_libdir}/samba/libsmbldaphelper-private-samba.so +%{_libdir}/samba/libtorture-private-samba.so +%{_libdir}/samba/libutil-crypt-private-samba.so + ### LIBNETAPI %files -n libnetapi %{_libdir}/libnetapi.so.%{libnetapi_so_version}* diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf index 878b8b2..959093e 100644 --- a/tests/deps-check.fmf +++ b/tests/deps-check.fmf @@ -3,11 +3,18 @@ description: | Verify that samba library packages maintain correct dependency hierarchy: - samba-core-libs has no samba-*-libs dependencies - samba-common-libs depends on samba-core-libs (not samba-client-libs) + - samba-client-libs depends on core-libs + common-libs (not samba-libs) - libwbclient has no samba-*-libs dependencies + - samba-client depends on samba-client-libs (not samba-libs) + - libsmbclient depends on samba-client-libs (not samba-libs) + - libldb has no samba-*-libs dependencies test: ./deps-check.sh framework: shell require: - samba-core-libs - samba-common-libs - samba-client-libs + - samba-client - libwbclient + - libsmbclient + - libldb diff --git a/tests/deps-check.sh b/tests/deps-check.sh index 622e88a..017c01d 100755 --- a/tests/deps-check.sh +++ b/tests/deps-check.sh @@ -15,6 +15,9 @@ # # libwbclient (no samba-*-libs dependencies - only links to libc) # +# samba-client (depends on samba-client-libs, NOT samba-libs) +# libsmbclient (depends on samba-client-libs, NOT samba-libs) +# # NOTE: This test checks RESOLVED dependencies, not just explicit Requires. # A library requirement like 'libfoo.so' is resolved to the package that # provides it, ensuring we catch indirect dependencies. @@ -121,6 +124,29 @@ echo "" echo "--- libwbclient ---" check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" +echo "" + +# 5. samba-client must depend on samba-client-libs but NOT samba-libs +# (client tools should not pull in server libraries) +echo "--- samba-client ---" +check_has_resolved_dep samba-client "samba-client-libs" +check_no_resolved_dep samba-client "^samba-libs$" "samba-libs" + +echo "" + +# 6. libsmbclient must depend on samba-client-libs but NOT samba-libs +# (SMB client library should not pull in server libraries) +echo "--- libsmbclient ---" +check_has_resolved_dep libsmbclient "samba-client-libs" +check_no_resolved_dep libsmbclient "^samba-libs$" "samba-libs" + +echo "" + +# 7. libldb must NOT depend on any samba-*-libs packages +# (libldb is a standalone database library) +echo "--- libldb ---" +check_no_resolved_dep libldb "^samba-.*-libs$" "any samba-*-libs package" + echo "" echo "=== Summary ===" From dab569ad7194d1c3a2b51e50df08b20fdb00ce60 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 12:46:37 +0100 Subject: [PATCH 096/101] Create a samba-ndr-libs package and drop samba-common-libs This should help sssd to reduce some of its dependencies. --- samba.spec | 216 ++++++++++++++++++++++--------------------- tests/deps-check.fmf | 10 +- tests/deps-check.sh | 40 ++++---- 3 files changed, 141 insertions(+), 125 deletions(-) diff --git a/samba.spec b/samba.spec index ccb55fc..da855ba 100644 --- a/samba.spec +++ b/samba.spec @@ -243,7 +243,7 @@ Patch0: samba-4.23-fix-cmocka.patch Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -465,7 +465,7 @@ Unix. Summary: Samba client programs Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libsmbclient} @@ -496,18 +496,54 @@ Requires: %{name}-common = %{samba_depver} Provides: bundled(libreplace) = %{samba_depver} +%if %{without dc} && %{without testsuite} +Obsoletes: samba-dc < %{samba_depver} +Obsoletes: samba-dc-libs < %{samba_depver} +Obsoletes: samba-dc-bind-dlz < %{samba_depver} +%endif + +# ctdb-tests package has been dropped if we do not build the testsuite +%if %{with clustering} +%if %{without testsuite} +Obsoletes: ctdb-tests < %{samba_depver} +Obsoletes: ctdb-tests-debuginfo < %{samba_depver} +# endif without testsuite +%endif +# endif with clustering +%endif + +# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions +# of the distro +%if %{without vfs_glusterfs} +Obsoletes: samba-vfs-glusterfs < %{samba_depver} +# endif without vfs_glusterfs +%endif + %description core-libs The samba-core-libs package contains foundational libraries needed by both Samba servers and clients. This includes error handling, utilities, -and NDR serialization support. +and basic support libraries. + +### NDR-LIBS +%package ndr-libs +Summary: Samba NDR libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} + +Provides: %{name}-common-libs = %{samba_depver} +Obsoletes: %{name}-common-libs < %{samba_depver} + +%description ndr-libs +The samba-ndr-libs package contains NDR (Network Data Representation) +encoding libraries used by both Samba servers and clients. ### CLIENT-LIBS %package client-libs Summary: Samba client libraries Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} Requires: libwbclient = %{samba_depver} @@ -537,50 +573,10 @@ Obsoletes: samba4-common < %{samba_depver} samba-common provides files necessary for both the server and client packages of Samba. -### COMMON-LIBS -%package common-libs -Summary: Libraries used by both Samba servers and clients -Requires(pre): samba-common = %{samba_depver} -Requires: samba-common = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} -Requires: libldb = %{samba_depver} -%if %{with libwbclient} -Requires: libwbclient = %{samba_depver} -%endif - -Provides: bundled(libreplace) = %{samba_depver} - -%if %{without dc} && %{without testsuite} -Obsoletes: samba-dc < %{samba_depver} -Obsoletes: samba-dc-libs < %{samba_depver} -Obsoletes: samba-dc-bind-dlz < %{samba_depver} -%endif - -# ctdb-tests package has been dropped if we do not build the testsuite -%if %{with clustering} -%if %{without testsuite} -Obsoletes: ctdb-tests < %{samba_depver} -Obsoletes: ctdb-tests-debuginfo < %{samba_depver} -# endif without testsuite -%endif -# endif with clustering -%endif - -# We only build glusterfs for RHGS and Fedora, so obsolete it on other versions -# of the distro -%if %{without vfs_glusterfs} -Obsoletes: samba-vfs-glusterfs < %{samba_depver} -# endif without vfs_glusterfs -%endif - -%description common-libs -The samba-common-libs package contains internal libraries needed by the -SMB/CIFS clients. - ### COMMON-TOOLS %package common-tools Summary: Tools for Samba clients -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: samba-ldb-ldap-modules = %{samba_depver} @@ -618,7 +614,7 @@ and for GPO management on domain members. ### RPC %package dcerpc Summary: DCE RPC binaries -Requires: samba-common-libs = %{samba_depver} +Requires: samba-ndr-libs = %{samba_depver} Requires: samba-client-libs = %{samba_depver} Requires: samba-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -636,7 +632,7 @@ The samba-dcerpc package contains binaries that serve DCERPC over named pipes. Summary: Samba AD Domain Controller Requires: %{name} = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-tools = %{samba_depver} Requires: %{name}-libs = %{samba_depver} @@ -680,7 +676,7 @@ The samba-dc-provision package provides files to setup a domain controller %package dc-libs Summary: Samba AD Domain Controller Libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -718,8 +714,10 @@ name server related details of Samba AD. ### DEVEL %package devel Summary: Developer tools for Samba libraries -Requires: %{name}-libs = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: libnetapi = %{samba_depver} @@ -774,7 +772,7 @@ Summary: Samba VFS module for GlusterFS Requires: glusterfs-api >= 3.4.0.16 Requires: glusterfs >= 3.4.0.16 Requires: %{name} = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -825,7 +823,7 @@ the Kerberos credentials cache of the user issuing the print job. %package ldb-ldap-modules Summary: Samba ldap modules for ldb Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -836,7 +834,7 @@ samba-gpupdate. ### LIBS %package libs Summary: Samba libraries -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -857,7 +855,7 @@ against the SMB, RPC and other protocols provided by the Samba suite. Summary: The NETAPI library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -879,7 +877,7 @@ develop programs that link against the NETAPI library in the Samba suite. Summary: The SMB client library Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: libldb = %{samba_depver} %if %{with libwbclient} @@ -929,7 +927,7 @@ library. %package -n python3-%{name} Summary: Samba Python3 libraries Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-dc-libs = %{samba_depver} Requires: python3-cryptography @@ -999,7 +997,7 @@ Requires: %{name} = %{samba_depver} Requires: %{name}-common = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-test-libs = %{samba_depver} @@ -1030,7 +1028,7 @@ packages of Samba. ### TEST-LIBS %package test-libs Summary: Libraries need by the testing tools for Samba servers and clients -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: libldb = %{samba_depver} @@ -1063,8 +1061,8 @@ as a user using the `net usershare` command. Summary: Samba winbind Requires(pre): %{name}-common = %{samba_depver} Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} -Requires(post): %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} +Requires(post): %{name}-ndr-libs = %{samba_depver} Requires: %{name}-common-tools = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires(post): %{name}-client-libs = %{samba_depver} @@ -1097,7 +1095,7 @@ Windows user and group accounts on Linux. %package winbind-clients Summary: Samba winbind clients Requires: %{name}-common = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-libs = %{samba_depver} Requires: %{name}-winbind = %{samba_depver} @@ -1167,7 +1165,7 @@ necessary to communicate to the Winbind Daemon Summary: Samba Winexe Windows Binary License: GPL-3.0-only Requires: %{name}-client-libs = %{samba_depver} -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: libldb = %{samba_depver} Requires: libwbclient = %{samba_depver} @@ -1182,7 +1180,7 @@ Winexe is a Remote Windows-command executor %package -n ctdb Summary: A Clustered Database based on Samba's Trivial Database (TDB) -Requires: %{name}-common-libs = %{samba_depver} +Requires: %{name}-ndr-libs = %{samba_depver} Requires: %{name}-client-libs = %{samba_depver} Requires: %{name}-winbind-clients = %{samba_depver} @@ -1729,7 +1727,7 @@ fi %ldconfig_scriptlets client-libs -%ldconfig_scriptlets common-libs +%ldconfig_scriptlets ndr-libs %if %{with dc} %ldconfig_scriptlets dc-libs @@ -2057,19 +2055,59 @@ fi %{_libdir}/libsamba-util.so.%{libsamba_util_so_version}* %{_libdir}/libtevent-util.so.%{libtevent_util_so_version}* +### NDR-LIBS +%files ndr-libs + # -# Tier 3: Public libraries - NDR serialization (depends on Tier 1-2) +# Core NDR library # %{_libdir}/libndr.so.%{libndr_so_version}* +# +# Tier 0: libc only dependencies +# +%{_libdir}/samba/libutil-setid-private-samba.so +%{_libdir}/samba/libutil-tdb-private-samba.so + +# +# Tier 1: system libs only (libtalloc) +# +%{_libdir}/samba/libiov-buf-private-samba.so +%{_libdir}/samba/libstable-sort-private-samba.so +%{_libdir}/samba/libtalloc-report-private-samba.so +%{_libdir}/samba/libtalloc-report-printf-private-samba.so + +# +# Tier 2: depends on core-libs (debug, replace) +# +%{_libdir}/samba/libflag-mapping-private-samba.so +%{_libdir}/samba/libinterfaces-private-samba.so +%{_libdir}/samba/libtdb-wrap-private-samba.so + +# +# Tier 3: depends on core-libs (util, errors, ndr) +# +%{_libdir}/samba/libdbwrap-private-samba.so +%{_libdir}/samba/libsamba3-util-private-samba.so +%{_libdir}/samba/libutil-reg-private-samba.so + +# +# Tier 4: depends on core-libs + Tier 3 libs +# +%{_libdir}/samba/libsamba-security-private-samba.so + +# +# NDR encoding libraries +# +%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* +%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* +%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* + ### CLIENT-LIBS %files client-libs %{_libdir}/libdcerpc-binding.so.%{libdcerpc_binding_so_version}* %{_libdir}/libdcerpc-server-core.so.%{libdcerpc_server_core_so_version}* %{_libdir}/libdcerpc.so.%{libdcerpc_so_version}* -%{_libdir}/libndr-krb5pac.so.%{libndr_krb5pac_so_version}* -%{_libdir}/libndr-nbt.so.%{libndr_nbt_so_version}* -%{_libdir}/libndr-standard.so.%{libndr_standard_so_version}* %{_libdir}/libsamba-credentials.so.%{libsamba_credentials_so_version}* %{_libdir}/libsamba-hostconfig.so.%{libsamba_hostconfig_so_version}* %{_libdir}/libsamba-passdb.so.%{libsamba_passdb_so_version}* @@ -2139,7 +2177,6 @@ fi # %dir %{_libdir}/samba/ldb %dir %{_libdir}/samba/pdb -%{_libdir}/samba/pdb/ldapsam.so %{_libdir}/samba/pdb/smbpasswd.so %{_libdir}/samba/pdb/tdbsam.so @@ -2192,42 +2229,6 @@ fi %{_mandir}/man5/smbpasswd.5* %{_mandir}/man7/samba.7* -### COMMON-LIBS -%files common-libs - -# -# Tier 0: libc only dependencies -# -%{_libdir}/samba/libutil-setid-private-samba.so -%{_libdir}/samba/libutil-tdb-private-samba.so - -# -# Tier 1: system libs only (libtalloc) -# -%{_libdir}/samba/libiov-buf-private-samba.so -%{_libdir}/samba/libstable-sort-private-samba.so -%{_libdir}/samba/libtalloc-report-private-samba.so -%{_libdir}/samba/libtalloc-report-printf-private-samba.so - -# -# Tier 2: depends on core-libs (debug, replace) -# -%{_libdir}/samba/libflag-mapping-private-samba.so -%{_libdir}/samba/libinterfaces-private-samba.so -%{_libdir}/samba/libtdb-wrap-private-samba.so - -# -# Tier 3: depends on core-libs (util, errors, ndr) -# -%{_libdir}/samba/libdbwrap-private-samba.so -%{_libdir}/samba/libsamba3-util-private-samba.so -%{_libdir}/samba/libutil-reg-private-samba.so - -# -# Tier 4: depends on core-libs + Tier 3 libs -# -%{_libdir}/samba/libsamba-security-private-samba.so - ### COMMON-TOOLS %files common-tools %{_bindir}/net @@ -2601,6 +2602,11 @@ fi %{_libdir}/samba/libtorture-private-samba.so %{_libdir}/samba/libutil-crypt-private-samba.so +# +# Password database modules (server-side, links to libsmbldaphelper) +# +%{_libdir}/samba/pdb/ldapsam.so + ### LIBNETAPI %files -n libnetapi %{_libdir}/libnetapi.so.%{libnetapi_so_version}* diff --git a/tests/deps-check.fmf b/tests/deps-check.fmf index 959093e..c1452d0 100644 --- a/tests/deps-check.fmf +++ b/tests/deps-check.fmf @@ -2,18 +2,20 @@ summary: Check samba package dependency structure description: | Verify that samba library packages maintain correct dependency hierarchy: - samba-core-libs has no samba-*-libs dependencies - - samba-common-libs depends on samba-core-libs (not samba-client-libs) - - samba-client-libs depends on core-libs + common-libs (not samba-libs) - - libwbclient has no samba-*-libs dependencies + - samba-ndr-libs depends on samba-core-libs (not samba-client-libs or samba-libs) + - samba-client-libs depends on core-libs + ndr-libs (not samba-libs) - samba-client depends on samba-client-libs (not samba-libs) + - samba-libs does not depend on samba-dc-libs - libsmbclient depends on samba-client-libs (not samba-libs) + - libwbclient has no samba-*-libs dependencies - libldb has no samba-*-libs dependencies test: ./deps-check.sh framework: shell require: - samba-core-libs - - samba-common-libs + - samba-ndr-libs - samba-client-libs + - samba-libs - samba-client - libwbclient - libsmbclient diff --git a/tests/deps-check.sh b/tests/deps-check.sh index 017c01d..ce49074 100755 --- a/tests/deps-check.sh +++ b/tests/deps-check.sh @@ -8,10 +8,10 @@ # samba-core-libs (no samba-*-libs dependencies) # ^ # | -# samba-common-libs (depends on samba-core-libs only) +# samba-ndr-libs (depends on samba-core-libs only) # ^ # | -# samba-client-libs (depends on samba-core-libs + samba-common-libs) +# samba-client-libs (depends on samba-core-libs + samba-ndr-libs) # # libwbclient (no samba-*-libs dependencies - only links to libc) # @@ -32,14 +32,14 @@ ERRORS=0 get_resolved_deps() { local pkg="$1" - rpm -qR "$pkg" 2>/dev/null | while read -r req; do + rpm --query --requires "$pkg" 2>/dev/null | while read -r req; do # Skip rpmlib and config requirements [[ "$req" =~ ^rpmlib ]] && continue [[ "$req" =~ ^config ]] && continue [[ "$req" =~ ^/ ]] && continue # Get the package that provides this requirement - provider=$(rpm -q --whatprovides "$req" 2>/dev/null | head -1) + provider=$(rpm --query --whatprovides "$req" 2>/dev/null | head -1) if [ -n "$provider" ] && [ "$provider" != "no package provides $req" ]; then # Extract just the package name (remove version-release.arch) echo "${provider%%-[0-9]*}" @@ -54,7 +54,7 @@ check_no_resolved_dep() { local pattern="$2" local description="$3" - if ! rpm -q "$pkg" &>/dev/null; then + if ! rpm --query "$pkg" &>/dev/null; then echo "SKIP: $pkg not installed" return 0 fi @@ -78,7 +78,7 @@ check_has_resolved_dep() { local pkg="$1" local expected="$2" - if ! rpm -q "$pkg" &>/dev/null; then + if ! rpm --query "$pkg" &>/dev/null; then echo "SKIP: $pkg not installed" return 0 fi @@ -99,30 +99,31 @@ echo "" # 1. samba-core-libs must NOT depend on any samba-*-libs packages echo "--- samba-core-libs ---" -check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep samba-core-libs "^samba-.*-libs$" "any samba*-libs package" echo "" -# 2. samba-common-libs must depend on samba-core-libs -# but NOT samba-client-libs -echo "--- samba-common-libs ---" -check_has_resolved_dep samba-common-libs "samba-core-libs" -check_no_resolved_dep samba-common-libs "^samba-client-libs$" "samba-client-libs" +# 2. samba-ndr-libs must depend on samba-core-libs +# but NOT samba-client-libs or samba-libs +echo "--- samba-ndr-libs ---" +check_has_resolved_dep samba-ndr-libs "samba-core-libs" +check_no_resolved_dep samba-ndr-libs "^samba-client-libs$" "samba-client-libs" +check_no_resolved_dep samba-ndr-libs "^samba-libs$" "samba-libs" echo "" -# 3. samba-client-libs must depend on samba-core-libs and samba-common-libs +# 3. samba-client-libs must depend on samba-core-libs and samba-ndr-libs # but NOT samba-libs echo "--- samba-client-libs ---" check_has_resolved_dep samba-client-libs "samba-core-libs" -check_has_resolved_dep samba-client-libs "samba-common-libs" +check_has_resolved_dep samba-client-libs "samba-ndr-libs" check_no_resolved_dep samba-client-libs "^samba-libs$" "samba-libs" echo "" # 4. libwbclient must NOT depend on any samba-*-libs packages echo "--- libwbclient ---" -check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep libwbclient "^samba-.*-libs$" "any samba*-libs package" echo "" @@ -145,7 +146,14 @@ echo "" # 7. libldb must NOT depend on any samba-*-libs packages # (libldb is a standalone database library) echo "--- libldb ---" -check_no_resolved_dep libldb "^samba-.*-libs$" "any samba-*-libs package" +check_no_resolved_dep libldb "^samba-.*-libs$" "any samba*-libs package" + +echo "" + +# 8. samba-libs must NOT depend on samba-dc-libs +# (server libraries should not pull in DC-specific libraries) +echo "--- samba-libs ---" +check_no_resolved_dep samba-libs "^samba-dc-libs$" "samba-dc-libs" echo "" echo "=== Summary ===" From da7dc3fa610fd20c6e5a2776fc3bec213c1163b6 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 14:28:18 +0100 Subject: [PATCH 097/101] Add missing tmt files [skip changelog] --- .fmf/version | 1 + plans.fmf | 4 ++++ 2 files changed, 5 insertions(+) create mode 100644 .fmf/version create mode 100644 plans.fmf diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..e6427de --- /dev/null +++ b/plans.fmf @@ -0,0 +1,4 @@ +discover: + how: fmf +execute: + how: tmt From 6af45b81d32d8b941a8bfcadc8cf302ad2bbdd0b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:11:15 +0100 Subject: [PATCH 098/101] Add /usr/bin/nmbd to rpminspect.yml /usr/sbin/nmbd is a symlink to /usr/bin/nmbd on Fedora. [skip changelog] --- rpminspect.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index c1455e2..b30fdbe 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -4,6 +4,7 @@ inspections: badfuncs: ignore: + - /usr/bin/nmbd - /usr/bin/nmblookup - /usr/bin/smbtorture - /usr/lib*/libndr.so.* From dca7b1cb88abf129b7f421b1b867d5eb068de56e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:35:54 +0100 Subject: [PATCH 099/101] Move Obsoletes to ndr-package which more or less was common-libs [skip changelog] --- samba.spec | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/samba.spec b/samba.spec index da855ba..cdeefca 100644 --- a/samba.spec +++ b/samba.spec @@ -496,6 +496,21 @@ Requires: %{name}-common = %{samba_depver} Provides: bundled(libreplace) = %{samba_depver} +%description core-libs +The samba-core-libs package contains foundational libraries needed by +both Samba servers and clients. This includes error handling, utilities, +and basic support libraries. + +### NDR-LIBS +%package ndr-libs +Summary: Samba NDR libraries +Requires(pre): %{name}-common = %{samba_depver} +Requires: %{name}-common = %{samba_depver} +Requires: %{name}-core-libs = %{samba_depver} + +Provides: %{name}-common-libs = %{samba_depver} +Obsoletes: %{name}-common-libs < %{samba_depver} + %if %{without dc} && %{without testsuite} Obsoletes: samba-dc < %{samba_depver} Obsoletes: samba-dc-libs < %{samba_depver} @@ -519,21 +534,6 @@ Obsoletes: samba-vfs-glusterfs < %{samba_depver} # endif without vfs_glusterfs %endif -%description core-libs -The samba-core-libs package contains foundational libraries needed by -both Samba servers and clients. This includes error handling, utilities, -and basic support libraries. - -### NDR-LIBS -%package ndr-libs -Summary: Samba NDR libraries -Requires(pre): %{name}-common = %{samba_depver} -Requires: %{name}-common = %{samba_depver} -Requires: %{name}-core-libs = %{samba_depver} - -Provides: %{name}-common-libs = %{samba_depver} -Obsoletes: %{name}-common-libs < %{samba_depver} - %description ndr-libs The samba-ndr-libs package contains NDR (Network Data Representation) encoding libraries used by both Samba servers and clients. From 1f4ee5276f515f685bd1ba2f03eaed47402514ac Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Wed, 14 Jan 2026 16:10:15 +0100 Subject: [PATCH 100/101] Remove duplicate libdsdb-module-private-samba.so --- samba.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/samba.spec b/samba.spec index cdeefca..b49a21a 100644 --- a/samba.spec +++ b/samba.spec @@ -3904,7 +3904,6 @@ fi %if %{with dc} %{_libdir}/samba/libdlz-bind9-for-torture-private-samba.so %endif -%{_libdir}/samba/libdsdb-module-private-samba.so ### USERSHARES %files usershares From 58df5ed52bbd18e89ba9316f9f8a69ab4800910b Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 15 Jan 2026 17:21:14 +0100 Subject: [PATCH 101/101] rpminspect: Don't run annocheck on test binaries [skip changelog] --- rpminspect.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index b30fdbe..f736bfa 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -26,3 +26,10 @@ abidiff: debuginfo: ignore: - /usr/lib*/libdcerpc-samr.so.* + +annocheck: + ignore: + - /usr/bin/gentest + - /usr/bin/locktest + - /usr/bin/masktest + - /usr/bin/smbtorture