Merge ~ahasenack/ubuntu/+source/samba:pam-winbind-1677329 into ~usd-import-team/ubuntu/+source/samba:ubuntu/devel

[Andreas Hasenack]

Fix patch d/p/fix-1584485.patch to link the wbclient library into the pam_winbind.so module. Without this library, the module lacks certain symbols and fails to load. The patch was also changed to fail the build if there are missing symbols in this particular module. (LP: #1677329)
Added DEP3 header to d/p/fix-1584485.patch

I'm not comfortable with the samba4 build system to assert that my change is the correct one. I would very much like to have the original fix-1584485 patch author to chime in on this change. So far I did a basic auth test (see https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1677329/comments/10) which exercised pam_winbind and nsswinbind in a NT4 style domain join, but there are many more code paths to check here (password changes, AD style joins, kerberos, etc).

https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1677329/comments/7 shows the output from dpkg-shlibdeps without this change, and comment 9 shows the same command output after the change. No more unresolved symbols in pam_winbind.so

Some options:
a) upload to artful, exercise there, and do the same for the zesty SRU
b) upload to artful, but for the zesty SRU, remove the fix-1584485.patch until we are happy artful's samba is fine.
c) remove patch from artful and zesty until patch author can chime in

Zesty and Artful currently can't use pam_winbind in any capacity because of this bug.

88ffe93... by Marc Deslauriers on 2017-05-19

Import patches-unapplied version 2:4.5.8+dfsg-0ubuntu0.17.04.2 to ubuntu/zesty-security

Imported using git-ubuntu import.

Publish parent: 84a9aa9cdfcd48fee8b98f22ca1ee19ab98e8bb7

New changelog entries:
  * SECURITY UPDATE: remote code execution from a writable share
    - debian/patches/CVE-2017-7494.patch: refuse to open pipe names with a
      slash inside in source3/rpc_server/srv_pipe.c.
    - CVE-2017-7494

3af8dd0... by Marc Deslauriers on 2017-05-19

Update ubuntu/devel from 2:4.5.8+dfsg-0ubuntu0.17.04.1 to 2:4.5.8+dfsg-0ubuntu0.17.04.2

Prior ubuntu/devel commit: b7258fc419d667afcbfc4b69d14cd42e25362cb1
New ubuntu/devel commit: 88ffe933ac78bef22c5e227540c7e2cebe1f73ac

0c93c66... by Marc Deslauriers on 2017-05-24

Import patches-unapplied version 2:4.5.8+dfsg-0ubuntu1 to ubuntu/artful-proposed

Imported using git-ubuntu import.

Publish parent: 90e722435dad6dc33223a22b841b1c0be88c9cab

New changelog entries:
  * SECURITY UPDATE: remote code execution from a writable share
    - debian/patches/CVE-2017-7494.patch: refuse to open pipe names with a
      slash inside in source3/rpc_server/srv_pipe.c.
    - CVE-2017-7494

1a32148... by Marc Deslauriers on 2017-05-24

Update ubuntu/devel from 2:4.5.8+dfsg-0ubuntu0.17.04.2 to 2:4.5.8+dfsg-0ubuntu1

Prior ubuntu/devel commit: 3af8dd0b5cc581d586422b4b03eff72ae642b84c
New ubuntu/devel commit: 0c93c66bbf24ab40933b247d30bcb16715ff4a43

[Nish Aravamudan (nacc)]

I would squash HEAD down to HEAD^.

Also, note that: 2:4.5.8+dfsg-0ubuntu1 is already published in artful, per rmadison.

Finally, I wonder if we should follow our merge workflow here, to ease it later, and make the commit message of a change match it's changelog entry.

[Nish Aravamudan (nacc)]

review: Needs Fixing

faa8b34... by Andreas Hasenack on 2017-06-08

  * Fix patch d/p/fix-1584485.patch to link the wbclient library into
    the pam_winbind.so module. Without this library, the module lacks certain
    symbols and fails to load. The patch was also changed to fail the build if
    there are missing symbols in this particular module. (LP: #1677329,
    LP: #1644428, Closes: #833287)

c6cbf55... by Andreas Hasenack on 2017-06-08

changelog

47b7712... by Andreas Hasenack on 2017-06-08

  * Added DEP3 header to d/p/fix-1584485.patch

1588383... by Andreas Hasenack on 2017-06-08

changelog

99588f2... by Andreas Hasenack on 2017-06-13

Updated bug list in the DEP3 header.

[Andreas Hasenack (ahasenack)]

I asked upstream (Debian and Samba) for a review of this patch:

https://lists.samba.org/archive/samba-technical/2017-June/121139.html

That could take a while, so until that happens, I'm proposing a different MP to fix this for now and that is to revert the broken patch one more time.

722f2d7... by Andreas Hasenack on 2017-07-13

Updated DEP3 headers

Unmerged commits

722f2d7... by Andreas Hasenack on 2017-07-13

Updated DEP3 headers

99588f2... by Andreas Hasenack on 2017-06-13

Updated bug list in the DEP3 header.

1588383... by Andreas Hasenack on 2017-06-08

changelog

47b7712... by Andreas Hasenack on 2017-06-08

  * Added DEP3 header to d/p/fix-1584485.patch

c6cbf55... by Andreas Hasenack on 2017-06-08

changelog

faa8b34... by Andreas Hasenack on 2017-06-08

  * Fix patch d/p/fix-1584485.patch to link the wbclient library into
    the pam_winbind.so module. Without this library, the module lacks certain
    symbols and fails to load. The patch was also changed to fail the build if
    there are missing symbols in this particular module. (LP: #1677329,
    LP: #1644428, Closes: #833287)

1a32148... by Marc Deslauriers on 2017-05-24

Update ubuntu/devel from 2:4.5.8+dfsg-0ubuntu0.17.04.2 to 2:4.5.8+dfsg-0ubuntu1

Prior ubuntu/devel commit: 3af8dd0b5cc581d586422b4b03eff72ae642b84c
New ubuntu/devel commit: 0c93c66bbf24ab40933b247d30bcb16715ff4a43

0c93c66... by Marc Deslauriers on 2017-05-24

Import patches-unapplied version 2:4.5.8+dfsg-0ubuntu1 to ubuntu/artful-proposed

Imported using git-ubuntu import.

Publish parent: 90e722435dad6dc33223a22b841b1c0be88c9cab

New changelog entries:
  * SECURITY UPDATE: remote code execution from a writable share
    - debian/patches/CVE-2017-7494.patch: refuse to open pipe names with a
      slash inside in source3/rpc_server/srv_pipe.c.
    - CVE-2017-7494

90e7224... by Marc Deslauriers on 2017-04-21

Import patches-unapplied version 2:4.5.8+dfsg-0ubuntu0.17.04.1 to ubuntu/artful-proposed

Imported using usd-importer.

Publish parent: 15e3cf274dfab190084d584ff4300aacebaef453
Changelog parent: 84a9aa9cdfcd48fee8b98f22ca1ee19ab98e8bb7

84a9aa9... by Marc Deslauriers on 2017-04-21

Import patches-unapplied version 2:4.5.8+dfsg-0ubuntu0.17.04.1 to ubuntu/zesty-security

Imported using usd-importer.

Publish parent: 607f0090218d9ebd0d6d672e405326932400065c

New changelog entries:
  * SECURITY UPDATE: Symlink race allows access outside share definition
    - Updated to new upstream release 4.5.8.
    - CVE-2017-2619

diff --git a/debian/changelog b/debian/changelog
index 47ac7a3..c6d1960 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+samba (2:4.5.8+dfsg-0ubuntu2) artful; urgency=medium
+
+  * Fix patch d/p/fix-1584485.patch to link the wbclient library into
+    the pam_winbind.so module. Without this library, the module lacks certain
+    symbols and fails to load. The patch was also changed to fail the build if
+    there are missing symbols in this particular module.  (LP: #1677329,
+    LP: #1644428, Closes: #833287)
+  * Added DEP3 header to d/p/fix-1584485.patch
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 08 Jun 2017 16:23:49 -0600
+
 samba (2:4.5.8+dfsg-0ubuntu1) artful; urgency=medium
 
   * SECURITY UPDATE: remote code execution from a writable share
diff --git a/debian/patches/fix-1584485.patch b/debian/patches/fix-1584485.patch
index 37fa744..6b36319 100644
--- a/debian/patches/fix-1584485.patch
+++ b/debian/patches/fix-1584485.patch
@@ -1,3 +1,20 @@
+This patch statically links libnss-winbind and libpam-winbind against the
+samba-libs to prevent upgrade problems with running processes being
+incompatible with old libraries or the other way around.
+The original version of this patch produced a pam_winbind.so module that
+had missing symbols and could not be loaded (LP: #1677329). It was then
+updated to also link in wbclient, which provided the missing symbols, and
+allow_undefined_symbols was changed from True to False for the pam module
+to trigger build failures should this happen again.
+
+Author: Jorge Niedbalski <[e-mail]>
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833287
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1584485
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1677329
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1644428
+Last-Update: 2017-05-08
+Origin: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1584485/comments/17
+
 --- samba-4.4.5+dfsg.orig/buildtools/wafsamba/wafsamba.py
 +++ samba-4.4.5+dfsg/buildtools/wafsamba/wafsamba.py
 @@ -140,7 +140,8 @@ def SAMBA_LIBRARY(bld, libname, source,
@@ -83,12 +100,12 @@
  	bld.SAMBA_LIBRARY('pamwinbind',
  		source='pam_winbind.c',
 -		deps='talloc wbclient winbind-client tiniparser pam samba_intl',
-+		deps='pamwinbind-static',
++		deps='wbclient pamwinbind-static',
  		cflags='-DLOCALEDIR=\"%s/locale\"' % bld.env.DATADIR,
  		realname='pam_winbind.so',
 -		install_path='${PAMMODULESDIR}'
 +		install_path='${PAMMODULESDIR}',
-+		allow_undefined_symbols=True
++		allow_undefined_symbols=False
  		)
  
  if bld.CONFIG_SET('HAVE_KRB5_LOCATE_PLUGIN_H'):