Fix libtalloc/libldb version mismatch

Guenther

.gitignore

@@ -245,3 +245,25 @@ samba-3.6.0pre1.tar.gz
 /samba-4.14.1.tar.asc
 /samba-4.14.2.tar.xz
 /samba-4.14.2.tar.asc
+/samba-4.14.3.tar.xz
+/samba-4.14.3.tar.asc
+/samba-4.14.4.tar.xz
+/samba-4.14.4.tar.asc
+/samba-4.14.5.tar.xz
+/samba-4.14.5.tar.asc
+/samba-4.14.6.tar.xz
+/samba-4.14.6.tar.asc
+/samba-4.14.7.tar.asc
+/samba-4.14.7.tar.xz
+/samba-4.14.8.tar.xz
+/samba-4.14.8.tar.asc
+/samba-4.14.9.tar.xz
+/samba-4.14.9.tar.asc
+/samba-4.14.10.tar.xz
+/samba-4.14.10.tar.asc
+/samba-4.14.11.tar.xz
+/samba-4.14.11.tar.asc
+/samba-4.14.12.tar.xz
+/samba-4.14.12.tar.asc
+/samba-4.14.13.tar.xz
+/samba-4.14.13.tar.asc

samba-s4u.patch

@@ -1,19 +1,18 @@
-From fe300549844509624d944b93fc64dc6d382e71c1 Mon Sep 17 00:00:00 2001
+From e649f9aedfa8a0d5caa241743bb4191927430879 Mon Sep 17 00:00:00 2001
 From: Isaac Boukris <iboukris@gmail.com>
 Date: Fri, 27 Sep 2019 18:25:03 +0300
-Subject: [PATCH 3/7] mit-kdc: add basic loacl realm S4U support
+Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support
 
 Signed-off-by: Isaac Boukris <iboukris@gmail.com>
 Pair-Programmed-With: Andreas Schneider <asn@samba.org>
 ---
- source4/kdc/mit-kdb/kdb_samba_policies.c      | 148 +++++++++---------
- source4/kdc/mit_samba.c                       |  47 ++----
- source4/kdc/mit_samba.h                       |   6 +-
- wscript_configure_system_mitkrb5              |   3 +
- 6 files changed, 91 insertions(+), 115 deletions(-)
+ source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------
+ source4/kdc/mit_samba.c                  |  47 ++-------
+ source4/kdc/mit_samba.h                  |   6 +-
+ 3 files changed, 71 insertions(+), 106 deletions(-)
 
 diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c
-index 9197551ed61..944324d9a2f 100644
+index 7bc9a7b3347..fc20bfed2f4 100644
 --- a/source4/kdc/mit-kdb/kdb_samba_policies.c
 +++ b/source4/kdc/mit-kdb/kdb_samba_policies.c
 @@ -192,13 +192,17 @@ static krb5_error_code ks_verify_pac(krb5_context context,
@@ -134,16 +133,15 @@ index 9197551ed61..944324d9a2f 100644
  
  	return code;
  }
-@@ -324,7 +335,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- {
- #endif
+@@ -328,6 +339,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 	krb5_authdata **pac_auth_data = NULL;
  	krb5_authdata **authdata = NULL;
--	krb5_boolean is_as_req;
+ 	krb5_boolean is_as_req;
 +	krb5_const_principal pac_client;
  	krb5_error_code code;
  	krb5_pac pac = NULL;
  	krb5_data pac_data;
-@@ -334,24 +345,21 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+@@ -341,11 +353,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
  	krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;
  #endif
  
@@ -152,13 +150,13 @@ index 9197551ed61..944324d9a2f 100644
 -		return KRB5_KDB_DBTYPE_NOSUP;
 -	}
 -
--	is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
--
--	if (is_as_req && (flags & KRB5_KDB_FLAG_INCLUDE_PAC)) {
--		code = ks_get_pac(context, client, client_key, &pac);
--		if (code != 0) {
--			goto done;
--		}
+ 	is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);
+ 
+ 	/*
+@@ -406,6 +413,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 		ks_client_princ = client->princ;
+ 	}
+ 
 +	/* In protocol transition, we are currently not provided with the tgt
 +	 * client name to verify the PAC, we could probably skip the name
 +	 * verification and just verify the signatures, but since we don't
@@ -166,59 +164,31 @@ index 9197551ed61..944324d9a2f 100644
 +	if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {
 +		pac_client = server->princ;
 +	} else {
-+		pac_client = client_princ;
- 	}
- 
--	if (!is_as_req) {
-+	/* TGS request */
-+	if (!(flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY)) {
- 		code = ks_verify_pac(context,
- 				     flags,
--				     client_princ,
-+				     pac_client,
- 				     client,
- 				     server,
- 				     krbtgt,
-@@ -363,14 +371,28 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 		if (code != 0) {
- 			goto done;
- 		}
-+
-+		/* We require PAC as we don't support LSA_TRUST_TYPE_MIT */
-+		if (pac == NULL) {
-+			code = KRB5_KDB_DBTYPE_NOSUP;
-+			goto done;
-+		}
- 	}
- 
--	if (pac == NULL && client != NULL) {
-+	if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {
-+		krb5_pac_free(context, pac);
-+		pac = NULL;
++		pac_client = ks_client_princ;
 +	}
- 
-+	/* AS request or local realm protocol transition */
-+	if ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) ||
-+	    (client != NULL && (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION))) {
- 		code = ks_get_pac(context, client, client_key, &pac);
- 		if (code != 0) {
- 			goto done;
- 		}
-+		/* We require a pac! */
-+		SMB_ASSERT(pac != NULL);
++
+ 	if (client_entry == NULL) {
+ 		client_entry = client;
  	}
+@@ -470,7 +487,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
  
- 	if (pac == NULL) {
-@@ -379,7 +401,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
- 	}
- 
- 	code = krb5_pac_sign(context, pac, authtime, client_princ,
+ 			code = ks_verify_pac(context,
+ 					     flags,
+-					     ks_client_princ,
++					     pac_client,
+ 					     client_entry,
+ 					     server,
+ 					     krbtgt,
+@@ -510,7 +527,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+ 		  is_as_req ? "AS-REQ" : "TGS-REQ",
+ 		  client_name);
+ 	code = krb5_pac_sign(context, pac, authtime, ks_client_princ,
 -			server_key, krbtgt_key, &pac_data);
 +			     server_key, krbtgt_key, &pac_data);
  	if (code != 0) {
  		DBG_ERR("krb5_pac_sign failed: %d\n", code);
  		goto done;
-@@ -405,11 +427,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
+@@ -536,12 +553,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,
  					      KRB5_AUTHDATA_IF_RELEVANT,
  					      authdata,
  					      signed_auth_data);
@@ -227,10 +197,11 @@ index 9197551ed61..944324d9a2f 100644
 -	}
 -
 -	code = 0;
- 
+-
  done:
- 	krb5_pac_free(context, pac);
-@@ -432,32 +449,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
+ 	if (client_entry != NULL && client_entry != client) {
+ 		ks_free_principal(context, client_entry);
+@@ -567,32 +578,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
  	 * server; -> delegating service
  	 * proxy; -> target principal
  	 */
@@ -265,10 +236,10 @@ index 9197551ed61..944324d9a2f 100644
  
  
 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
-index 54dcd545ea1..f23327c9613 100644
+index e015c5a52db..2a48d731501 100644
 --- a/source4/kdc/mit_samba.c
 +++ b/source4/kdc/mit_samba.c
-@@ -467,7 +467,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
+@@ -475,7 +475,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
  krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
  				    krb5_context context,
  				    int flags,
@@ -276,7 +247,7 @@ index 54dcd545ea1..f23327c9613 100644
  				    krb5_db_entry *client,
  				    krb5_db_entry *server,
  				    krb5_db_entry *krbtgt,
-@@ -615,7 +614,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
+@@ -639,7 +638,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
  								  context,
  								  *pac,
  								  server->princ,
@@ -285,7 +256,7 @@ index 54dcd545ea1..f23327c9613 100644
  								  deleg_blob);
  		if (!NT_STATUS_IS_OK(nt_status)) {
  			DEBUG(0, ("Update delegation info failed: %s\n",
-@@ -937,41 +936,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
+@@ -961,41 +960,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,
  }
  
  int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
@@ -338,7 +309,7 @@ index 54dcd545ea1..f23327c9613 100644
  
  static krb5_error_code mit_samba_change_pwd_error(krb5_context context,
 diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h
-index ba824557bd5..5aadf206443 100644
+index 636c77ec97c..9cb00c9610e 100644
 --- a/source4/kdc/mit_samba.h
 +++ b/source4/kdc/mit_samba.h
 @@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
@@ -362,12 +333,13 @@ index ba824557bd5..5aadf206443 100644
  int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
  				      char *pwd,
 -- 
-2.25.4
+2.33.1
 
-From ff1b225493ede3d43cfad571770dacb73f75ec42 Mon Sep 17 00:00:00 2001
+
+From 9eca7b08a3987d6320d6584e146005bbc01720f6 Mon Sep 17 00:00:00 2001
 From: Isaac Boukris <iboukris@gmail.com>
 Date: Fri, 27 Sep 2019 18:35:30 +0300
-Subject: [PATCH 5/7] krb5-mit: enable S4U client support for MIT build
+Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build
 
 Signed-off-by: Isaac Boukris <iboukris@gmail.com>
 Pair-Programmed-With: Andreas Schneider <asn@samba.org>
@@ -375,13 +347,13 @@ Pair-Programmed-With: Andreas Schneider <asn@samba.org>
  lib/krb5_wrap/krb5_samba.c            | 185 ++++++++++++++++++++++++++
  lib/krb5_wrap/krb5_samba.h            |   2 -
  source4/auth/kerberos/kerberos_util.c |  11 --
- 4 files changed, 185 insertions(+), 14 deletions(-)
+ 3 files changed, 185 insertions(+), 13 deletions(-)
 
 diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
-index 20ce86c708d..e72ab3c30f7 100644
+index fff5b4e2a22..791b417d5ba 100644
 --- a/lib/krb5_wrap/krb5_samba.c
 +++ b/lib/krb5_wrap/krb5_samba.c
-@@ -2568,6 +2568,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
+@@ -2694,6 +2694,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,
  
  	return 0;
  }
@@ -574,7 +546,7 @@ index 20ce86c708d..e72ab3c30f7 100644
  
  #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)
 diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h
-index ca9a893e4f7..3264ce5eb3b 100644
+index 56a2a975278..5af9c6d73c1 100644
 --- a/lib/krb5_wrap/krb5_samba.h
 +++ b/lib/krb5_wrap/krb5_samba.h
 @@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx,
@@ -639,14 +611,13 @@ index 544d9d853cc..c14d8c72d8c 100644
  				ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context,
  								     ccache,
 -- 
-2.25.4
+2.33.1
 
 
-
-From cf1b9bdc09180d68e2b30258839d2f78b7af9c62 Mon Sep 17 00:00:00 2001
+From 80289eca2bb614aacd0df86bcf7ad7027c080671 Mon Sep 17 00:00:00 2001
 From: Isaac Boukris <iboukris@gmail.com>
 Date: Sat, 19 Sep 2020 14:16:20 +0200
-Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code
+Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code
 
 ---
  source4/heimdal/lib/hdb/hdb.h | 1 +
@@ -656,7 +627,7 @@ Subject: [PATCH 7/7] wip: for canonicalization with new MIT kdc code
  4 files changed, 11 insertions(+), 2 deletions(-)
 
 diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h
-index 6a09ecb6fe1..bc5211fef35 100644
+index 5ef9d9565f3..dafaffc6c2d 100644
 --- a/source4/heimdal/lib/hdb/hdb.h
 +++ b/source4/heimdal/lib/hdb/hdb.h
 @@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };
@@ -668,7 +639,7 @@ index 6a09ecb6fe1..bc5211fef35 100644
  /* hdb_capability_flags */
  #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1
 diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
-index a560a1cd84b..c27b6a8ef4c 100644
+index aff74f2ee71..d16b4c3329a 100644
 --- a/source4/kdc/db-glue.c
 +++ b/source4/kdc/db-glue.c
 @@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
@@ -696,7 +667,7 @@ index a560a1cd84b..c27b6a8ef4c 100644
  		ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);
  		if (ret) {
 diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
-index f23327c9613..4084e893cc2 100644
+index 2a48d731501..a8d3e7ed493 100644
 --- a/source4/kdc/mit_samba.c
 +++ b/source4/kdc/mit_samba.c
 @@ -198,6 +198,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
@@ -722,5 +693,5 @@ index c929acccce6..a9115ec23d7 100644
  void sdb_free_entry(struct sdb_entry_ex *e);
  void free_sdb_entry(struct sdb_entry *s);
 -- 
-2.25.4
+2.33.1
 

samba.spec

@@ -106,21 +106,28 @@
 #endif fedora
 %endif
 
+# Build the ctdb-pcp-pmda package by default on Fedora
+%if 0%{?fedora}
+%bcond_without pcp_pmda
+%else
+%bcond_with pcp_pmda
+%endif
+
 %define samba_requires_eq()  %(LC_ALL="C" echo '%*' | xargs -r rpm -q --qf 'Requires: %%{name} = %%{epoch}:%%{version}\\n' | sed -e 's/ (none):/ /' -e 's/ 0:/ /' | grep -v "is not")
 
 %global main_release 0
 
-%global samba_version 4.14.2
+%global samba_version 4.14.13
 %global talloc_version 2.3.2
 %global tdb_version 1.4.3
 %global tevent_version 0.10.2
-%global ldb_version 2.3.0
+%global ldb_version 2.3.3
 # This should be rc1 or nil
 %global pre_release %nil
 
-%global samba_release %{main_release}%{?dist}
+%global samba_release %{main_release}
 %if "x%{?pre_release}" != "x"
-%global samba_release 0.%{main_release}.%{pre_release}%{?dist}
+%global samba_release 0.%{main_release}.%{pre_release}
 %endif
 
 # This is a network daemon, do a hardened build
@@ -145,7 +152,7 @@
 
 Name:           samba
 Version:        %{samba_version}
-Release:        %{samba_release}
+Release:        %{samba_release}%{?dist}
 
 %if 0%{?rhel}
 Epoch:          0
@@ -176,7 +183,8 @@ Source13:       pam_winbind.conf
 Source14:       samba.pamd
 
 Source201:      README.downgrade
-Patch1:         samba-s4u.patch
+
+Patch0:         samba-s4u.patch
 
 Requires(pre): /usr/sbin/groupadd
 Requires(post): systemd
@@ -214,6 +222,8 @@ Obsoletes: samba-swat < %{samba_depver}
 Provides: samba4-swat = %{samba_depver}
 Obsoletes: samba4-swat < %{samba_depver}
 
+Provides: bundled(libreplace)
+
 BuildRequires: make
 BuildRequires: gcc
 BuildRequires: avahi-devel
@@ -283,6 +293,10 @@ BuildRequires: libcephfs-devel
 BuildRequires: liburing-devel >= 0.4
 %endif
 
+%if %{with pcp_pmda}
+BuildRequires: pcp-libs-devel
+%endif
+
 %if %{with dc} || %{with testsuite}
 # Add python3-iso8601 to avoid that the
 # version in Samba is being packaged
@@ -310,6 +324,7 @@ BuildRequires: libtdb-devel >= %{tdb_version}
 BuildRequires: python3-tdb >= %{tdb_version}
 
 BuildRequires: libldb-devel >= %{ldb_version}
+BuildRequires: python3-ldb >= %{ldb_version}
 BuildRequires: python3-ldb-devel >= %{ldb_version}
 %else
 BuildRequires: lmdb-devel
@@ -355,6 +370,8 @@ Obsoletes: samba4-client < %{samba_depver}
 Requires(post): %{_sbindir}/update-alternatives
 Requires(postun): %{_sbindir}/update-alternatives
 
+Provides: bundled(libreplace)
+
 %description client
 The %{name}-client package provides some SMB/CIFS clients to complement
 the built-in SMB/CIFS filesystem in Linux. These clients allow access
@@ -386,12 +403,14 @@ Recommends:     logrotate
 Provides: samba4-common = %{samba_depver}
 Obsoletes: samba4-common < %{samba_depver}
 
-%if %{with dc} || %{with testsuite}
+%if %{without dc} && %{without testsuite}
 Obsoletes: samba-dc < %{samba_depver}
 Obsoletes: samba-dc-libs < %{samba_depver}
 Obsoletes: samba-dc-bind-dlz < %{samba_depver}
 %endif
 
+Provides: bundled(libreplace)
+
 %description common
 samba-common provides files necessary for both the server and client
 packages of Samba.
@@ -406,6 +425,8 @@ Requires: %{name}-client-libs = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
 
+Provides: bundled(libreplace)
+
 %description common-libs
 The samba-common-libs package contains internal libraries needed by the
 SMB/CIFS clients.
@@ -420,6 +441,8 @@ Requires: samba-libs = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
 
+Provides: bundled(libreplace)
+
 %description common-tools
 The samba-common-tools package contains tools for Samba servers and
 SMB/CIFS clients.
@@ -457,6 +480,8 @@ Requires: krb5-server >= %{required_mit_krb5}
 Provides: samba4-dc = %{samba_depver}
 Obsoletes: samba4-dc < %{samba_depver}
 
+Provides: bundled(libreplace)
+
 %description dc
 The samba-dc package provides AD Domain Controller functionality
 
@@ -477,6 +502,8 @@ Requires: %{name}-libs = %{samba_depver}
 Provides: samba4-dc-libs = %{samba_depver}
 Obsoletes: samba4-dc-libs < %{samba_depver}
 
+Provides: bundled(libreplace)
+
 %description dc-libs
 The %{name}-dc-libs package contains the libraries needed by the DC to
 link against the SMB, RPC and other protocols.
@@ -489,6 +516,8 @@ Requires: %{name}-dc-libs = %{samba_depver}
 Requires: %{name}-dc = %{samba_depver}
 Requires: bind
 
+Provides: bundled(libreplace)
+
 %description dc-bind-dlz
 The %{name}-dc-bind-dlz package contains the libraries for bind to manage all
 name server related details of Samba AD.
@@ -516,6 +545,8 @@ Summary: Samba VFS module for Ceph distributed storage system
 Requires: %{name} = %{samba_depver}
 Requires: %{name}-libs = %{samba_depver}
 
+Provides: bundled(libreplace)
+
 %description vfs-cephfs
 Samba VFS module for Ceph distributed storage system integration.
 #endif with vfs_cephfs
@@ -538,6 +569,8 @@ Requires: libwbclient = %{samba_depver}
 Obsoletes: samba-glusterfs < %{samba_depver}
 Provides: samba-glusterfs = %{samba_depver}
 
+Provides: bundled(libreplace)
+
 %description vfs-glusterfs
 Samba VFS module for GlusterFS integration.
 %endif
@@ -569,6 +602,8 @@ Requires: libwbclient = %{samba_depver}
 Provides: samba4-libs = %{samba_depver}
 Obsoletes: samba4-libs < %{samba_depver}
 
+Provides: bundled(libreplace)
+
 %description libs
 The %{name}-libs package contains the libraries needed by programs that link
 against the SMB, RPC and other protocols provided by the Samba suite.
@@ -641,6 +676,8 @@ Requires: libsmbclient = %{samba_depver}
 Requires: libwbclient = %{samba_depver}
 %endif
 
+Provides: bundled(libreplace)
+
 %description -n python3-%{name}
 The python3-%{name} package contains the Python 3 libraries needed by programs
 that use SMB, RPC and other Samba provided protocols in Python 3 programs.
@@ -650,7 +687,7 @@ Summary: Samba python devel files
 Requires: python3-%{name} = %{samba_depver}
 
 %description -n python3-%{name}-devel
-The python3-%{name}-devel package contains the Python 3 defel files.
+The python3-%{name}-devel package contains the Python 3 devel files.
 
 %package -n python3-samba-test
 Summary: Samba Python libraries
@@ -715,6 +752,8 @@ Requires: perl(Archive::Tar)
 Provides: samba4-test = %{samba_depver}
 Obsoletes: samba4-test < %{samba_depver}
 
+Provides: bundled(libreplace)
+
 %description test
 %{name}-test provides testing tools for both the server and client
 packages of Samba.
@@ -732,6 +771,8 @@ Requires: libwbclient = %{samba_depver}
 Provides: %{name}-test-devel = %{samba_depver}
 Obsoletes: %{name}-test-devel < %{samba_depver}
 
+Provides: bundled(libreplace)
+
 %description test-libs
 %{name}-test-libs provides libraries required by the testing tools.
 
@@ -757,6 +798,8 @@ Obsoletes: samba4-winbind < %{samba_depver}
 # Old NetworkManager expects the dispatcher scripts in a different place
 Conflicts: NetworkManager < 1.20
 
+Provides: bundled(libreplace)
+
 %description winbind
 The samba-winbind package provides the winbind NSS library, and some client
 tools.  Winbind enables Linux to be a full member in Windows domains and to use
@@ -777,6 +820,8 @@ Requires: libwbclient = %{samba_depver}
 Provides: samba4-winbind-clients = %{samba_depver}
 Obsoletes: samba4-winbind-clients < %{samba_depver}
 
+Provides: bundled(libreplace)
+
 %description winbind-clients
 The samba-winbind-clients package provides the wbinfo and ntlm_auth
 tool.
@@ -804,6 +849,8 @@ Requires(post): %{_sbindir}/update-alternatives
 Requires(postun): %{_sbindir}/update-alternatives
 Requires(preun): %{_sbindir}/update-alternatives
 
+Provides: bundled(libreplace)
+
 %description winbind-krb5-locator
 The winbind krb5 locator is a plugin for the system kerberos library to allow
 the local kerberos library to use the same KDC as samba and winbind use
@@ -818,6 +865,8 @@ Requires: libwbclient = %{samba_depver}
 %endif
 Requires: pam
 
+Provides: bundled(libreplace)
+
 %description winbind-modules
 The samba-winbind-modules package provides the NSS library and a PAM module
 necessary to communicate to the Winbind Daemon
@@ -829,6 +878,8 @@ Summary: Samba Winexe Windows Binary
 License: GPLv3
 Requires: %{name}-client-libs = %{samba_depver}
 
+Provides: bundled(libreplace)
+
 %description winexe
 Winexe is a Remote Windows®-command executor
 %endif
@@ -862,6 +913,8 @@ Requires(post): systemd-units
 Requires(preun): systemd-units
 Requires(postun): systemd-units
 
+Provides: bundled(libreplace)
+
 %description -n ctdb
 CTDB is a cluster implementation of the TDB database used by Samba and other
 projects to store temporary data. If an application is already using TDB for
@@ -891,6 +944,20 @@ and use CTDB instead.
 
 #endif with selftest
 %endif
+
+%if %{with pcp_pmda}
+
+%package -n ctdb-pcp-pmda
+Summary: CTDB PCP pmda support
+Requires: ctdb = %{samba_depver}
+Requires: pcp-libs
+
+%description -n ctdb-pcp-pmda
+Performance Co-Pilot (PCP) support for CTDB
+
+#endif with pcp_pmda
+%endif
+
 #endif with clustering
 %endif
 
@@ -980,6 +1047,9 @@ export LDFLAGS="%{__global_ldflags} -fuse-ld=gold"
 %endif
 %if %{with testsuite}
         --enable-selftest \
+%endif
+%if %{with pcp_pmda}
+        --enable-pmda \
 %endif
         --with-profiling-data \
         --with-systemd \
@@ -1012,7 +1082,6 @@ install -d -m 0755 %{buildroot}/var/lib/samba/scripts
 install -d -m 0755 %{buildroot}/var/lib/samba/sysvol
 install -d -m 0755 %{buildroot}/var/lib/samba/winbindd_privileged
 install -d -m 0755 %{buildroot}/var/log/samba/old
-install -d -m 0755 %{buildroot}/var/spool/samba
 install -d -m 0755 %{buildroot}/run/samba
 install -d -m 0755 %{buildroot}/run/winbindd
 install -d -m 0755 %{buildroot}/%{_libdir}/samba
@@ -1454,7 +1523,6 @@ fi
 
 %{_unitdir}/nmb.service
 %{_unitdir}/smb.service
-%attr(1777,root,root) %dir /var/spool/samba
 %dir %{_sysconfdir}/openldap/schema
 %config %{_sysconfdir}/openldap/schema/samba.schema
 %config(noreplace) %{_sysconfdir}/pam.d/samba
@@ -1513,7 +1581,7 @@ fi
 %{_bindir}/cifsdd
 %{_bindir}/dbwrap_tool
 %{_bindir}/dumpmscat
-%{_bindir}/findsmb
+%exclude %{_bindir}/findsmb
 %{_bindir}/mvxattr
 %{_bindir}/mdfind
 %{_bindir}/nmblookup
@@ -1542,7 +1610,7 @@ fi
 %{_mandir}/man1/regpatch.1*
 %{_mandir}/man1/regshell.1*
 %{_mandir}/man1/regtree.1*
-%{_mandir}/man1/findsmb.1*
+%exclude %{_mandir}/man1/findsmb.1*
 %{_mandir}/man1/log2pcap.1*
 %{_mandir}/man1/mdfind.1*
 %{_mandir}/man1/mvxattr.1*
@@ -1629,6 +1697,7 @@ fi
 %{_libdir}/samba/libcommon-auth-samba4.so
 %{_libdir}/samba/libctdb-event-client-samba4.so
 %{_libdir}/samba/libdbwrap-samba4.so
+%{_libdir}/samba/libdcerpc-pkt-auth-samba4.so
 %{_libdir}/samba/libdcerpc-samba-samba4.so
 %{_libdir}/samba/libevents-samba4.so
 %{_libdir}/samba/libflag-mapping-samba4.so
@@ -2208,6 +2277,7 @@ fi
 %{python3_sitearch}/samba/dcerpc/idmap.*.so
 %{python3_sitearch}/samba/dcerpc/initshutdown.*.so
 %{python3_sitearch}/samba/dcerpc/irpc.*.so
+%{python3_sitearch}/samba/dcerpc/krb5ccache.*.so
 %{python3_sitearch}/samba/dcerpc/krb5pac.*.so
 %{python3_sitearch}/samba/dcerpc/lsa.*.so
 %{python3_sitearch}/samba/dcerpc/messaging.*.so
@@ -2493,6 +2563,7 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/dns_tkey.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dns_wildcard.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/dsdb_api.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_lock.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/dsdb_schema_attributes.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/docs.*.pyc
@@ -2511,6 +2582,8 @@ fi
 %{python3_sitearch}/samba/tests/__pycache__/krb5_credentials.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/ldap_raw.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/ldap_referrals.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/ldap_spn.*.pyc
+%{python3_sitearch}/samba/tests/__pycache__/ldap_upn_sam_account.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/loadparm.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/libsmb.*.pyc
 %{python3_sitearch}/samba/tests/__pycache__/lsa_string.*.pyc
@@ -2632,6 +2705,7 @@ fi
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/binding.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/dnsserver.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/integer.*.pyc
+%{python3_sitearch}/samba/tests/dcerpc/__pycache__/lsa.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/mdssvc.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/misc.*.pyc
 %{python3_sitearch}/samba/tests/dcerpc/__pycache__/raw_protocol.*.pyc
@@ -2651,6 +2725,7 @@ fi
 %{python3_sitearch}/samba/tests/dcerpc/createtrustrelax.py
 %{python3_sitearch}/samba/tests/dcerpc/dnsserver.py
 %{python3_sitearch}/samba/tests/dcerpc/integer.py
+%{python3_sitearch}/samba/tests/dcerpc/lsa.py
 %{python3_sitearch}/samba/tests/dcerpc/mdssvc.py
 %{python3_sitearch}/samba/tests/dcerpc/misc.py
 %{python3_sitearch}/samba/tests/dcerpc/raw_protocol.py
@@ -2676,6 +2751,7 @@ fi
 %{python3_sitearch}/samba/tests/dns_tkey.py
 %{python3_sitearch}/samba/tests/dns_wildcard.py
 %{python3_sitearch}/samba/tests/dsdb.py
+%{python3_sitearch}/samba/tests/dsdb_api.py
 %{python3_sitearch}/samba/tests/dsdb_lock.py
 %{python3_sitearch}/samba/tests/dsdb_schema_attributes.py
 %{python3_sitearch}/samba/tests/docs.py
@@ -2713,33 +2789,61 @@ fi
 %{python3_sitearch}/samba/tests/kcc/ldif_import_export.py
 %dir %{python3_sitearch}/samba/tests/krb5
 %dir %{python3_sitearch}/samba/tests/krb5/__pycache__
+%{python3_sitearch}/samba/tests/krb5/__pycache__/alias_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/as_canonicalization_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/as_req_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/compatability_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/fast_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kcrypto.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_base_test.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/kdc_tgs_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/ms_kile_client_principal_lookup_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/raw_testcase.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_constants.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/rfc4120_pyasn1.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/spn_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/test_ccache.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/test_idmap_nss.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/test_ldap.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/test_min_domain_uid.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/test_rpc.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/test_smb.*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/rodc_tests*.pyc
+%{python3_sitearch}/samba/tests/krb5/__pycache__/salt_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/simple_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/s4u_tests.*.pyc
 %{python3_sitearch}/samba/tests/krb5/__pycache__/xrealm_tests.*.pyc
+%{python3_sitearch}/samba/tests/krb5/alias_tests.py
 %{python3_sitearch}/samba/tests/krb5/as_canonicalization_tests.py
+%{python3_sitearch}/samba/tests/krb5/as_req_tests.py
 %{python3_sitearch}/samba/tests/krb5/compatability_tests.py
+%{python3_sitearch}/samba/tests/krb5/fast_tests.py
 %{python3_sitearch}/samba/tests/krb5/kcrypto.py
 %{python3_sitearch}/samba/tests/krb5/kdc_base_test.py
 %{python3_sitearch}/samba/tests/krb5/kdc_tests.py
 %{python3_sitearch}/samba/tests/krb5/kdc_tgs_tests.py
+%{python3_sitearch}/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py
 %{python3_sitearch}/samba/tests/krb5/raw_testcase.py
 %{python3_sitearch}/samba/tests/krb5/rfc4120_constants.py
 %{python3_sitearch}/samba/tests/krb5/rfc4120_pyasn1.py
+%{python3_sitearch}/samba/tests/krb5/rodc_tests.py
+%{python3_sitearch}/samba/tests/krb5/salt_tests.py
 %{python3_sitearch}/samba/tests/krb5/simple_tests.py
+%{python3_sitearch}/samba/tests/krb5/spn_tests.py
 %{python3_sitearch}/samba/tests/krb5/s4u_tests.py
+%{python3_sitearch}/samba/tests/krb5/test_ccache.py
+%{python3_sitearch}/samba/tests/krb5/test_idmap_nss.py
+%{python3_sitearch}/samba/tests/krb5/test_ldap.py
+%{python3_sitearch}/samba/tests/krb5/test_min_domain_uid.py
+%{python3_sitearch}/samba/tests/krb5/test_rpc.py
+%{python3_sitearch}/samba/tests/krb5/test_smb.py
 %{python3_sitearch}/samba/tests/krb5/xrealm_tests.py
 %{python3_sitearch}/samba/tests/krb5_credentials.py
 %{python3_sitearch}/samba/tests/ldap_raw.py
 %{python3_sitearch}/samba/tests/ldap_referrals.py
+%{python3_sitearch}/samba/tests/ldap_spn.py
+%{python3_sitearch}/samba/tests/ldap_upn_sam_account.py
 %{python3_sitearch}/samba/tests/libsmb.py
 %{python3_sitearch}/samba/tests/loadparm.py
 %{python3_sitearch}/samba/tests/lsa_string.py
@@ -3828,6 +3932,19 @@ fi
 #endif with selftest
 %endif
 
+%if %{with pcp_pmda}
+%files -n ctdb-pcp-pmda
+%dir %{_localstatedir}/lib/pcp/pmdas/ctdb
+%{_localstatedir}/lib/pcp/pmdas/ctdb/Install
+%{_localstatedir}/lib/pcp/pmdas/ctdb/README
+%{_localstatedir}/lib/pcp/pmdas/ctdb/Remove
+%{_localstatedir}/lib/pcp/pmdas/ctdb/domain.h
+%{_localstatedir}/lib/pcp/pmdas/ctdb/help
+%{_localstatedir}/lib/pcp/pmdas/ctdb/pmdactdb
+%{_localstatedir}/lib/pcp/pmdas/ctdb/pmns
+#endif with pcp_pmda
+%endif
+
 #endif with clustering
 %endif
 
@@ -3839,6 +3956,83 @@ fi
 %endif
 
 %changelog
+* Mon Apr 04 2022 Guenther Deschner <gdeschner@redhat.com> - 4.14.13-0
+- Update to Samba 4.14.13
+
+* Mon Jan 31 2022 Pavel Filipenský <pfilipen@redhat.com> - 4.14.12-0
+- Update to Samba 4.14.12
+- resolves: #2046120, #2048566 - Security fixes for CVE-2021-44141
+- resolves: #2046146, #2048570 - Security fixes for CVE-2021-44142
+- resolves: #2046134, #2048568 - Security fixes for CVE-2022-0336
+
+* Wed Dec 15 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.11-0
+- Update to Samba 4.14.11
+
+* Sat Nov 13 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.10-2
+- Fix IPA DC schannel support
+
+* Thu Nov 11 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.10-1
+- Fix winbind trusted domain regression
+- related: #2021716
+
+* Tue Nov 09 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.10-0
+- Update to Samba 4.14.10
+- resolves: #2019660, #2021711 - Security fixes for CVE-2016-2124
+- resolves: #2019672, #2021716 - Security fixes for CVE-2020-25717
+- resolves: #2019726, #2021718 - Security fixes for CVE-2020-25718
+- resolves: #2019732, #2021719 - Security fixes for CVE-2020-25719
+- resolves: #2021728, #2021729 - Security fixes for CVE-2020-25721
+- resolves: #2019764, #2021721 - Security fixes for CVE-2020-25722
+- resolves: #2021726, #2021727 - Security fixes for CVE-2021-3738
+- resolves: #2019666, #2021715 - Security fixes for CVE-2021-23192
+
+* Wed Oct 27 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.9-0
+- Update to Samba 4.14.9
+
+* Tue Oct 05 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.8-0
+- Update to Samba 4.14.8
+
+* Tue Aug 24 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.7-0
+- Update to Samba 4.14.7
+
+* Mon Jul 19 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.6-2
+- Fix ctdb-pcp-pmda install
+- resolves: #1983369
+
+* Wed Jul 14 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.6-1
+- Build with pcp-pmda support by default on Fedora
+- resolves: #1552276
+
+* Tue Jul 13 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.6-0
+- Update to Samba 4.14.6
+- resolves: #1981764
+
+* Tue Jun 01 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.5-0
+- Update to Samba 4.14.5
+- resolves: #1966456
+
+* Thu Apr 29 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.4-0
+- Update to Samba 4.14.4
+- resolves: #1949442, #1955027 - Security fixes for CVE-2021-20254
+- resolves: #1955011
+
+* Wed Apr 28 2021 Anoop C S <anoopcs@samba.org> - 4.14.3-1
+- resolves: #1954263 - wrong conditional build check of AD DC
+
+* Tue Apr 20 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.3-0
+- Update to Samba 4.14.3
+- resolves: #1951531
+
+* Mon Apr 19 2021 Michal Ambroz <rebus _AT seznam.cz> - 4.14.2-3
+- Added python3-ldb to BR
+
+* Mon Apr 19 2021 Andreas Schneider <asn@redhat.com> - 4.12.2-2
+- resolves: #1949295 - Remove findsmb script
+
+* Wed Apr 07 2021 Alexander Bokovoy <abokovoy@redhat.com> - 4.14.2-1
+- Fix memory leaks in RPC server
+- resolves: #1946950
+
 * Thu Mar 25 2021 Guenther Deschner <gdeschner@redhat.com> - 4.14.2-0
 - Update to Samba 4.14.2
 - related: #1941400, #1942496 - Security fixes for CVE-2020-27840

smb.conf.example

@@ -281,7 +281,7 @@
 
 [printers]
 	comment = All Printers
-	path = /var/spool/samba
+	path = /var/tmp
 	browseable = no
 	guest ok = no
 	writable = no

sources

@@ -1,2 +1,2 @@
-SHA512 (samba-4.14.2.tar.xz) = 5353cf67eac165afc0443639266354402f8d20437f8cd9389ff33201ab8261aacd21cfb9140b5816a9c39e2471fe6bce405d5b99103b1410768f56619010429d
-SHA512 (samba-4.14.2.tar.asc) = 586d8a38be861195f87f4d23149c5483494a7fdbb530f4707b8ce0cfb39723ca0b6c5d9c1064c6235d1bb652558c5c113482d46163982e67c78bff2238605e25
+SHA512 (samba-4.14.13.tar.xz) = 0424549c3bb28ed8a6e376592f5d0916c010d76b6555b34b3c81adfaec9356b42f739a6b8653534f6f694fddc8b2383fea7c8aad4c6618b845e4fa0257c7f6d9
+SHA512 (samba-4.14.13.tar.asc) = b0e35a6281285d70d0c5ea7a788c67e4f3b143cf70472088d454e68cbdad30a383018df45865fd1b73f4ab0508f7d8129c79f791047860b202416d02aa757ee5