Now that .py files are globally compiled into .pyc files, we can get
rid of the samba4 specific logic doing this compilation.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Samuel Martin <s.martin49@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
With systemd, samba4 will need some special temporary files to be
created on each boot, as explained in:
packaging/systemd/README
Install the provided template file as configuration.
However, this is not enough, as even the log directory is a tmpfs in
the default Buildroot configuration, so we must also create the log
directory on each boot. Hence we append this to the template installed
above.
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Gustavo Zacarias <gustavo@zacarias.com.ar>
Acked-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes a few regressions from the previous security bump.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes:
CVE-2016-2118 - A man in the middle can intercept any DCERPC traffic
between a client and a server in order toimpersonate the client and get
the same privileges as the authenticated user account.
CVE-2016-2115 - The protection of DCERPC communication over ncacn_np
(which is the default for most the file server related protocols) is
inherited from the underlying SMB connection. Samba doesn't enforce SMB
signing for this kind of SMB connections by default, which makes man in
the middle attacks possible.
CVE-2016-2114 - Due to a bug Samba doesn't enforce required smb signing,
even if explicitly configured.
CVE-2016-2113 - Man in the middle attacks are possible for client
triggered LDAP connections (with ldaps://) and ncacn_http connections
(with https://).
CVE-2016-2112 - A man in the middle is able to downgrade LDAP
connections to no integrity protection. It's possible to attack client
and server with this.
CVE-2016-2111 - When Samba is configured as Domain Controller it allows
remote attackers to spoof the computer name of a secure channel's
endpoints, and obtain sensitive session information, by running a
crafted application and leveraging the ability to sniff network traffic.
CVE-2016-2110 - The feature negotiation of NTLMSSP is not downgrade
protected. A man in the middle is able to clear even required flags,
especially NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.
CVE-2015-5370 - Errors in Samba DCE-RPC code can lead to denial of
service (crashes and high cpu consumption) and man in the middle
attacks.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
libaio support is now automatic so drop the enable/disable (it will fall
back to pthread aio if libaio is not present).
0002-build-improve-stack-protector-check.patch is upstream so remove it.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Even though it's inherited by the python dependency it's more clear this
way for graph-depends, since it's used by the waf buildsystem.
And even though we have a hard dependency on python for the distro this
python could ostensibly be 3.x which isn't compatible with the bundled
waf series (1.5.x) in samba (as of current shipping version and upcoming
4.4.x series).
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes:
CVE-2015-7560 - Authenticated client could cause Samba to overwrite ACLs
with incorrect owner/group.
CVE-2016-0771 - Malicious request can cause the Samba internal DNS
server to crash or unintentionally return uninitialized memory.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
It's used for some small functions like md5 support, non-essential since
samba has an internal fallback for those, but still add it for
predictability.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes:
CVE-2015-7540 - Remote DoS in Samba (AD) LDAP server
CVE-2015-3223 - Denial of service in Samba Active Directory server
CVE-2015-5252 - Insufficient symlink verification in smbd)
CVE-2015-5299 - Missing access control check in shadow copy code
CVE-2015-5296 - Samba client requesting encryption vulnerable to
downgrade attack
CVE-2015-8467 - Denial of service attack against Windows Active
Directory server
CVE-2015-5330 - Remote memory read in Samba LDAP server
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The package comes with usable .service files for smbd, nmbd and
winbind, but does not install them.
[Thomas: use relative paths for the symbolic links.]
Signed-off-by: Alex Suykov <alex.suykov@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
It's required for packages that need libsmbclient.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
When ncurses wide is enabled samba doesn't automatically find the
appropiate ncurses-config script and finds the host variant (which is
non-widec) which leaks improper library directories into the build.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Now with support for AD DC, ADS and clustering features.
All dropped patches are upstream.
[Thomas: move indentation fixes to a separate patch.]
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
In preparation to the bump of samba4 to 4.2, let's re-indent the
samba4.mk to the usual Buildroot convention.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes CVE-2014-8143 - dsdb-samldb: Check for extended access rights
before we allow changes to userAccountControl.
Also rename patches to new naming convention.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS,
make the same change for FOO_CONF_OPT.
Sed command used:
find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g'
Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Also tweak library moves since uClibc doesn't do $ORIGIN and libreplace
is found that way now.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Lots of bugfixes, enhancements to provisioning and printing support via
cups.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fixes:
CVE-2014-0244 (Denial of service - CPU loop)
CVE-2014-3493 (Denial of service - Server crash/memory corruption)
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes CVE-2014-0178 (Malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response)
and CVE-2014-0239 (dns: Don't reply to replies).
Patches 0001 and 0002 are now part of the 4.1.x release branch.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Update the package to use patches that have been applied upstream and
update their status comment accordingly.
f_fsid checks have been fixed via upstream patch that allows the cache
to work properly on the result.
Builtin heimdal tools can be worked around via the --bundled-libraries
option to disable those components (even if they are not libraries it
can be done that way).
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Bump to the latest 4.1.7 version and improve the cross-build logic.
With the new patches the build is basically architecture-agnostic making
it possible to ditch the arch-specific cache to use a generic one.
Some toolchains might not be too happy with samba4 because of bitrot,
hopefully we'll find and fix or blacklist those with autobuilder help.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Add automatic readline support since it's used when available.
Also add a patch to update to new-style typedefs that were removed from
readline 6.3 that causes build breakage. Fixes:
http://autobuild.buildroot.net/results/b13/b137c237ff6df81dd10f7895278d1f2f5d2326de/
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Samba 4.1.x uses the waf build system which isn't very cross-compile
friendly, and also some tests are formulated in a way that isn't
cross-build friendly either by needing to run them.
For this reason the samba4 build system includes a way to define
answers for many of the tests, but this support isn't complete
and some tests still want to be executed.
Samba 4.1.x also requires a proper answers file for each architecture,
and at the moment i've only tested for ARM and PowerPC so only those
architectures are supported to begin with. To add support for another
architecture basically copy one of the cache files to the proper name,
enable it in Config.in and adjust endianess and all of the "size of"
answers. I'm in the process of automating the sizeof and endianess
answers within the samba build system to make them cross friendly
to simplify the answers file to just one generic linux variant.
The 3.6.x branch is still security supported for the forseeable future.
I'm currently working with samba upstream to solve many of these
issues but this will probably happen with the yet unreleased
4.2 branch only.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
