Package: samba Version: 2:4.5.12+dfsg-2+deb9u3 Severity: normal Tags: patch
Dear Maintainer, Samba ignores the UNIX secondary groups of the UNIX user; then file permissions (based on those secondary groups) fail. (Instead, Samba adds the "Windows groups" that the "Windows user" belongs to, but that is probably useless or wrong for file accesses.) The following patch seems to solve the issue. (Seems to me that Samba4.9 suffers from the same issue.) Cheers, Paul Paul Szabo p...@maths.usyd.edu.au http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of Sydney Australia -- System Information: Debian Release: 9.5 APT prefers stable APT policy: (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.110-pk09.23-amd64 (SMP w/4 CPU cores) Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages samba depends on: ii adduser 3.115 ii dpkg 1.18.25 ii init-system-helpers 1.48 ii libbsd0 0.8.3-1 ii libc6 2.24-11+deb9u3 ii libldb1 2:1.1.27-1+b1 ii libpam-modules 1.1.8-3.6 ii libpam-runtime 1.1.8-3.6 ii libpopt0 1.16-10+b2 ii libpython2.7 2.7.13-2+deb9u3 ii libtalloc2 2.1.8-1 ii libtdb1 1.3.11-2 ii libtevent0 0.9.31-1 ii libwbclient0 2:4.5.12+dfsg-2+deb9u3 ii lsb-base 9.20161125 ii procps 2:3.3.12-3+deb9u1 ii python 2.7.13-2 ii python-dnspython 1.15.0-1 ii python-samba 2:4.5.12+dfsg-2+deb9u3 ii python2.7 2.7.13-2+deb9u3 ii samba-common 2:4.5.12+dfsg-2+deb9u3 ii samba-common-bin 2:4.5.12+dfsg-2+deb9u3 ii samba-libs 2:4.5.12+dfsg-2+deb9u3 ii tdb-tools 1.3.11-2 ii update-inetd 4.44 Versions of packages samba recommends: ii attr 1:2.4.47-2+b2 ii logrotate 3.11.0-0.1 ii samba-dsdb-modules 2:4.5.12+dfsg-2+deb9u3 ii samba-vfs-modules 2:4.5.12+dfsg-2+deb9u3 Versions of packages samba suggests: pn bind9 <none> pn bind9utils <none> pn ctdb <none> pn ldb-tools <none> ii ntp 1:4.2.8p10+dfsg-3+deb9u2 pn smbldap-tools <none> pn ufw <none> ii winbind 2:4.5.12+dfsg-2+deb9u3 -- no debconf information
--- ./samba-4.5.12/source3/auth/auth_util.c.orig 2016-12-09 01:09:52.000000000 +1100 +++ ./samba-4.5.12/source3/auth/auth_util.c 2018-10-29 08:53:21.216263177 +1100 @@ -531,6 +531,7 @@ /* Just copy the token, it has already been finalised * (nasty hack to support a cached guest/system session_info */ + /* PSz - I have not noticed that this copy would succeed... */ session_info->security_token = dup_nt_token(session_info, server_info->security_token); if (!session_info->security_token) { @@ -551,6 +552,16 @@ return NT_STATUS_OK; } +/* + * DEBUG(10, ("PSz - as things were after copy of server_info->security_token\n")); + * security_token_debug(DBGC_AUTH, 10, session_info->security_token); + * debug_unix_user_token(DBGC_AUTH, 10, + * session_info->unix_token->uid, + * session_info->unix_token->gid, + * session_info->unix_token->ngroups, + * session_info->unix_token->groups); + */ + /* * If winbind is not around, we can not make much use of the SIDs the * domain controller provided us with. Likewise if the user name was @@ -578,47 +589,93 @@ &session_info->security_token); } +/* + * DEBUG(10, ("PSz - as things were after create_token_from_username/create_local_nt_token_from_info3\n")); + * security_token_debug(DBGC_AUTH, 10, session_info->security_token); + * debug_unix_user_token(DBGC_AUTH, 10, + * session_info->unix_token->uid, + * session_info->unix_token->gid, + * session_info->unix_token->ngroups, + * session_info->unix_token->groups); + */ + if (!NT_STATUS_IS_OK(status)) { return status; } /* Convert the SIDs to gids. */ + /* + * PSz - Why zero them here? May have initialized them already, + * in copy of security_token. Was that wrong (wasted)? + */ session_info->unix_token->ngroups = 0; session_info->unix_token->groups = NULL; - t = session_info->security_token; - - ids = talloc_array(talloc_tos(), struct unixid, - t->num_sids); - if (ids == NULL) { - return NT_STATUS_NO_MEMORY; - } - - if (!sids_to_unixids(t->sids, t->num_sids, ids)) { - TALLOC_FREE(ids); - return NT_STATUS_NO_MEMORY; + DEBUG(10, ("PSz - create_local_token() used to add SID groups ... doing UNIX groups instead\n")); + /* + * PSz - Used to get SIDs from security_token, convert to GID + * and add to GROUPS; then later convert each GID back to SID + * and add back into security_token. + * We may not "need" those NT groups in our UNIX groups, and + * adding them back seems useless. + */ +/* + * t = session_info->security_token; + * + * ids = talloc_array(talloc_tos(), struct unixid, + * t->num_sids); + * if (ids == NULL) { + * return NT_STATUS_NO_MEMORY; + * } + * + * if (!sids_to_unixids(t->sids, t->num_sids, ids)) { + * TALLOC_FREE(ids); + * return NT_STATUS_NO_MEMORY; + * } + * + * for (i=0; i<t->num_sids; i++) { + * + * if (i == 0 && ids[i].type != ID_TYPE_BOTH) { + * continue; + * } + * + * if (ids[i].type != ID_TYPE_GID && + * ids[i].type != ID_TYPE_BOTH) { + * DEBUG(10, ("Could not convert SID %s to gid, " + * "ignoring it\n", + * sid_string_dbg(&t->sids[i]))); + * continue; + * } + * if (!add_gid_to_array_unique(session_info, ids[i].id, + * &session_info->unix_token->groups, + * &session_info->unix_token->ngroups)) { + * return NT_STATUS_NO_MEMORY; + * } + * } + */ + /* PSz - Add UNIX groups, instead. */ + if (1) { + gid_t *gids = NULL; + uint32_t num_gids = 0; + struct passwd *pass = NULL; + int i; + pass = getpwuid_alloc(mem_ctx, session_info->unix_token->uid); + if (pass) { + if (getgroups_unix_user(mem_ctx, pass->pw_name, pass->pw_gid, &gids, &num_gids)) { + for (i=0; i<num_gids; i++) { + if (!add_gid_to_array_unique( + session_info, gids[i], + &session_info->unix_token->groups, + &session_info->unix_token->ngroups)) { + DEBUG(3, ("Failed to add UNIX GID %d (number %d of %d) to unix_token\n", gids[i], i, num_gids)); + return NT_STATUS_NO_MEMORY; + } + } + } + } } - for (i=0; i<t->num_sids; i++) { - - if (i == 0 && ids[i].type != ID_TYPE_BOTH) { - continue; - } - - if (ids[i].type != ID_TYPE_GID && - ids[i].type != ID_TYPE_BOTH) { - DEBUG(10, ("Could not convert SID %s to gid, " - "ignoring it\n", - sid_string_dbg(&t->sids[i]))); - continue; - } - if (!add_gid_to_array_unique(session_info, ids[i].id, - &session_info->unix_token->groups, - &session_info->unix_token->ngroups)) { - return NT_STATUS_NO_MEMORY; - } - } /* * Add the "Unix Group" SID for each gid to catch mapped groups