mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-13 12:32:59 +02:00
b33473414d
- Update from 4.14.3 to 4.14.4
- Update of rootfile not required
- Changelog
Release Notes for Samba 4.14.4 April 29, 2021
This is a security release in order to address the following defect:
o CVE-2021-20254: Negative idmap cache entries can cause incorrect
group entries in the Samba file server process token.
Details
o CVE-2021-20254:
The Samba smbd file server must map Windows group identities (SIDs) into unix
group ids (gids). The code that performs this had a flaw that could allow it
to read data beyond the end of the array in the case where a negative cache
entry had been added to the mapping cache. This could cause the calling code
to return those values into the process token that stores the group
membership for a user.
Most commonly this flaw caused the calling code to crash, but an alert user
(Peter Eriksson, IT Department, Linköping University) found this flaw by
noticing an unprivileged user was able to delete a file within a network
share that they should have been disallowed access to.
Analysis of the code paths has not allowed us to discover a way for a
remote user to be able to trigger this flaw reproducibly or on demand,
but this CVE has been issued out of an abundance of caution.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
125 lines
4.4 KiB
Plaintext
125 lines
4.4 KiB
Plaintext
###############################################################################
|
|
# #
|
|
# IPFire.org - A linux based firewall #
|
|
# Copyright (C) 2007-2020 IPFire Team <info@ipfire.org> #
|
|
# #
|
|
# This program is free software: you can redistribute it and/or modify #
|
|
# it under the terms of the GNU General Public License as published by #
|
|
# the Free Software Foundation, either version 3 of the License, or #
|
|
# (at your option) any later version. #
|
|
# #
|
|
# This program is distributed in the hope that it will be useful, #
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
|
# GNU General Public License for more details. #
|
|
# #
|
|
# You should have received a copy of the GNU General Public License #
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
|
|
# #
|
|
###############################################################################
|
|
|
|
###############################################################################
|
|
# Definitions
|
|
###############################################################################
|
|
|
|
include Config
|
|
|
|
VER = 4.14.4
|
|
|
|
THISAPP = samba-$(VER)
|
|
DL_FILE = $(THISAPP).tar.gz
|
|
DL_FROM = $(URL_IPFIRE)
|
|
DIR_APP = $(DIR_SRC)/$(THISAPP)
|
|
TARGET = $(DIR_INFO)/$(THISAPP)
|
|
PROG = samba
|
|
PAK_VER = 79
|
|
|
|
DEPS = avahi cups libtirpc krb5 perl-Parse-Yapp
|
|
|
|
###############################################################################
|
|
# Top-level Rules
|
|
###############################################################################
|
|
|
|
objects = $(DL_FILE)
|
|
|
|
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
|
|
|
|
$(DL_FILE)_MD5 = 171629ad42b4b303107e8b0fff942a1f
|
|
|
|
install : $(TARGET)
|
|
|
|
check : $(patsubst %,$(DIR_CHK)/%,$(objects))
|
|
|
|
download :$(patsubst %,$(DIR_DL)/%,$(objects))
|
|
|
|
md5 : $(subst %,%_MD5,$(objects))
|
|
|
|
dist:
|
|
@$(PAK)
|
|
|
|
###############################################################################
|
|
# Downloading, checking, md5sum
|
|
###############################################################################
|
|
|
|
$(patsubst %,$(DIR_CHK)/%,$(objects)) :
|
|
@$(CHECK)
|
|
|
|
$(patsubst %,$(DIR_DL)/%,$(objects)) :
|
|
@$(LOAD)
|
|
|
|
$(subst %,%_MD5,$(objects)) :
|
|
@$(MD5)
|
|
|
|
###############################################################################
|
|
# Installation Details
|
|
###############################################################################
|
|
|
|
$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
|
|
@$(PREBUILD)
|
|
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE)
|
|
cd $(DIR_APP) && ./configure \
|
|
--prefix=/usr \
|
|
--libdir=/usr/lib/ \
|
|
--sysconfdir=/var/ipfire \
|
|
--localstatedir=/var \
|
|
--without-ad-dc \
|
|
--with-cachedir=/var/lib/samba \
|
|
--with-lockdir=/var/lib/samba \
|
|
--with-piddir=/var/run \
|
|
--with-ads \
|
|
--with-acl-support \
|
|
--with-sendfile-support \
|
|
--with-winbind \
|
|
--enable-avahi \
|
|
--enable-cups \
|
|
--enable-fhs \
|
|
--with-syslog
|
|
cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
|
|
cd $(DIR_APP) && make install
|
|
|
|
-mkdir -p /var/ipfire/samba
|
|
cd $(DIR_APP)/source3 && install -v -m644 ../examples/smb.conf.default /var/ipfire/samba
|
|
cp -vrf $(DIR_SRC)/config/samba/* /var/ipfire/samba/
|
|
chown nobody:nobody -R /var/ipfire/samba/
|
|
cat /var/ipfire/samba/global /var/ipfire/samba/shares > /var/ipfire/samba/smb.conf
|
|
rm -rf /var/lib/samba/private
|
|
ln -s /var/ipfire/samba/private /var/lib/samba/private
|
|
install -v -m 644 $(DIR_SRC)/config/backup/includes/samba /var/ipfire/backup/addons/includes/samba
|
|
|
|
-mkdir -p /var/lib/samba/winbindd_privileged
|
|
chmod 750 /var/lib/samba/winbindd_privileged
|
|
chgrp wbpriv /var/lib/samba/winbindd_privileged
|
|
|
|
# Create spool directory for print jobs
|
|
mkdir -p /var/spool/samba
|
|
chmod -v 1777 /var/spool/samba/
|
|
|
|
# Install password change helper script
|
|
install -m 755 $(DIR_SRC)/config/samba/samba-change-password /usr/sbin/samba-change-password
|
|
|
|
#install initscripts
|
|
$(call INSTALL_INITSCRIPT,samba)
|
|
|
|
@rm -rf $(DIR_APP)
|
|
@$(POSTBUILD)
|