pam_cifscreds.so not supplied in package

The attachment "Suggested modifications to debian/{rules,control}" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

Status changed to 'Confirmed' because the bug affects multiple users.

This bug was fixed in the package cifs-utils - 2:6.6-5ubuntu1

---------------
cifs-utils (2:6.6-5ubuntu1) zesty; urgency=low

  * Merge from Debian unstable (LP: #1660372). Remaining changes:
    - debian/patches/stat_systemd-ask-password.patch: also check for
      /bin/systemd-ask-password before trying to use systemd's tools.

cifs-utils (2:6.6-5) unstable; urgency=low

  * Set architecture to linux-any.

cifs-utils (2:6.6-4) unstable; urgency=medium

  * Add pam_cifscreds (Closes: #848140, LP: #1611816). Patch by David Mcbride

cifs-utils (2:6.6-3) unstable; urgency=medium

  * Use correct idmapwb.so path in postinst/prerm (Closes: #848275)

cifs-utils (2:6.6-2) unstable; urgency=medium

  * Add me to uploaders
  * Create idmap-plugin symlink using update-alternatives (Closes: #845532).
    Thanks Alessandro Larcher for reporting.

cifs-utils (2:6.6-1) unstable; urgency=medium

  * Team upload
  * New upstream release

 -- Dave Chiluk <email address hidden> Tue, 03 May 2016 17:30:11 +0000

Attaching Debdiff against Xenial 6.4-1_ubuntu1

Attaching debdiff against Yakkety - 6.5-2ubuntu1

Subscribed Ubuntu-Sponsors as I don't have ability to upload directly.

I've uploaded this to the SRU queues for review by the SRU team. Thanks!

Hello David, or anyone else affected,

Accepted cifs-utils into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cifs-utils/2:6.5-2ubuntu2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello David, or anyone else affected,

Accepted cifs-utils into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cifs-utils/2:6.4-1ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Could this be easily backported to Trusty?

I have successfully tested version 2:6.4-1ubuntu1.1 on Xenial, and assert that the new version of the package works for me. Thanks!

13:07 <rbasak> bdmurray: opinion on releasing bug 1611816 to xenial-updates? It's not verified on Yakkety, and it seems unlikely that anyone will. So that would create a feature regression on Xenial->Yakkety upgrade ("any such feature must then also be added to any newer supported Ubuntu release")

13:08 <rbasak> So should I hold releasing pending verification of Yakkety as well?

@David, thank you for verifying 2:6.4-1ubuntu1.1 on Xenial for us. I'm not sure if I should release to xenial-updates if I cannot also release to yakkety-updates, and I've asked the question. In the meantime, if you could verification the package in yakkety-proposed anyway, that would help regardless.

I'm going to verify this for yakkety.

(unless someone beats me to it, of course :)

Verification for yakkety amd64:

package from proposed:
  Version table:
 *** 2:6.5-2ubuntu2 500
        500 http://br.archive.ubuntu.com/ubuntu yakkety-proposed/main amd64 Packages

PAM module is installed:
root@15-89:~# ll /lib/x86_64-linux-gnu/security/pam_cifscreds.so
-rw-r--r-- 1 root root 14176 Feb 28 21:58 /lib/x86_64-linux-gnu/security/pam_cifscreds.so

/etc/pam.d/login file modified to include pam_keyinit and pam_cifscreds: http://pastebin.ubuntu.com/24455401/

Mounted a samba share as root and connecting user "andreas" with the multiuser option:
root@15-89:~# mount -t cifs //ds216.lowtech/downloads /downloads -o username=andreas,multiuser
Password for andreas@//ds216.lowtech/downloads: ************************
root@15-89:~# ll /downloads/
total 414032
drwxrwxrwx 1 root root 0 Apr 20 20:23 ./
drwxr-xr-x 25 root root 4096 Apr 25 17:33 ../
drwxr-xr-x 1 1026 users 0 Aug 14 2016 humblebundle/
drwxr-xr-x 1 1026 users 0 Aug 18 2016 isos/
-rw-r--r-- 1 1026 users 265777840 Sep 9 2014 KSP_demo_linux.zip
(...)

Verified user ubuntu cannot see that:
root@15-89:~# sudo -u ubuntu -H ls -l /downloads/
ls: cannot access '/downloads/': Permission denied

Switch to a terminal and login as ubuntu, using the same password that the ubuntu user has on the samba share:

15-89 login: ubuntu
Password:
Last login: Tue Apr 25 17:34:30 UTC 2017 from 10.0.5.1 on pts/1
Welcome to Ubuntu 16.10 (GNU/Linux 4.8.0-49-generic x86_64)
(...)

Verify we have a cifs logon key in the kernel keyring:
ubuntu@15-89:~$ keyctl show
Session Keyring
 595619243 --alswrv 1000 1000 keyring: _ses
 525246747 --alswrv 1000 65534 \_ keyring: _uid.1000
 470618469 ----sw-v 0 0 \_ logon: cifs:a:10.10.222.255

And we can see the /downloads share now:
ubuntu@15-89:~$ ls -lah /downloads/
total 405M
dr-xr-xr-x 1 root root 0 Apr 20 20:23 .
drwxr-xr-x 25 root root 4.0K Apr 25 17:33 ..
drwxr-xr-x 1 1026 users 0 Aug 14 2016 humblebundle
drwxr-xr-x 1 1026 users 0 Aug 18 2016 isos
-rw-r--r-- 1 1026 users 254M Sep 9 2014 KSP_demo_linux.zip
(...)

Meanwhile, /var/log/syslog has this to say:
Apr 25 17:34:46 15-89 login[1237]: pam_cifscreds(login:auth): password stored
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): OPEN 1
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): UID:1000 [0] GID:1000 [0]
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): GET SESSION = 993549428
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): GET SESSION = 993549428
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): JOIN = 595619243

And /var/log/auth.log:
Apr 25 17:34:46 15-89 login[1237]: pam_cifscreds(login:session): credential key for \\10.10.222.255\ubuntu added

For the record, I also tried yakkety on i386:

 *** 2:6.5-2ubuntu2 500
        500 http://br.archive.ubuntu.com/ubuntu yakkety-proposed/main i386 Packages

root@22-96:~# ll /lib/i386-linux-gnu/security/pam_cifscreds.so
-rw-r--r-- 1 root root 13568 Feb 28 21:58 /lib/i386-linux-gnu/security/pam_cifscreds.so

I performed the same test as for amd64 and it also worked.

==> /var/log/auth.log <==
Apr 25 18:51:23 22-96 login[1155]: pam_cifscreds(login:session): credential key for \\10.10.222.255\ubuntu added

This bug was fixed in the package cifs-utils - 2:6.5-2ubuntu2

---------------
cifs-utils (2:6.5-2ubuntu2) yakkety; urgency=low

  * Add pam_cifscreds (LP: #1611816). Patch by David McBride.

 -- Keith Ward <email address hidden> Tue, 28 Feb 2017 13:58:35 -0800

The verification of the Stable Release Update for cifs-utils has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package cifs-utils - 2:6.4-1ubuntu1.1

---------------
cifs-utils (2:6.4-1ubuntu1.1) xenial; urgency=low

  * Add pam_cifscreds (LP: #1611816). Patch by David McBride.

 -- Keith Ward <email address hidden> Tue, 28 Feb 2017 14:01:32 -0800