Merge ~ahasenack/ubuntu/+source/samba:disco-smbd-startup-with-winbind-1806035 into ubuntu/+source/samba:ubuntu/devel

[Andreas Hasenack]

This is the upstream fix for this issue.

bileto ticket (ongoing as I write this): https://bileto.ubuntu.com/#/ticket/3573

To test:
* confirming the bug first:
lxc launch ubuntu-daily:disco disco-samba-winbind
lxc exec disco-samba-winbind bash
apt update && apt dist-upgrade -y
echo "deb http://archive.ubuntu.com/ubuntu disco-proposed main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list
apt update
apt install samba winbind -y
The above confirms the bug: smbd fails to start

Testing the fix:
add-apt-repository ppa:ci-train-ppa-service/3573 -y -u
apt install samba winbind

This time, smbd should start just fine.

I verified it with a manual build of samba, while bileto is still building things.

[Andreas Hasenack (ahasenack)]

I forgot that bileto won't pass because it needs proposed enabled.

[Christian Ehrhardt  (paelzer)]

LGTM thanks for the effort

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, tagged and uploaded

diff --git a/debian/changelog b/debian/changelog
index 444b0ec..d1cbc37 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+samba (2:4.9.2+dfsg-2ubuntu2) disco; urgency=medium
+
+  * d/p/smbd-startup-with-winbind.patch: ignore create_builtin_guests()
+    failing without a valid idmap configuration. This fixes the smbd startup
+    on a standalone server where winbind is available and running. Thanks to
+    Stefan Metzmacher <[e-mail]>. (LP: #1806035)
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 21 Dec 2018 10:39:23 -0200
+
 samba (2:4.9.2+dfsg-2ubuntu1) disco; urgency=medium
 
   * Merge with Debian unstable. Remaining changes:
diff --git a/debian/patches/series b/debian/patches/series
index 3a53630..87563de 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -13,3 +13,4 @@ CVE-2018-16851-master.patch
 CVE-2018-16852-v4-9-v2.patch
 mit-kdc-experimental-v4-7.patch
 CVE-2018-16857-v4-9.patch
+smbd-startup-with-winbind.patch
diff --git a/debian/patches/smbd-startup-with-winbind.patch b/debian/patches/smbd-startup-with-winbind.patch
new file mode 100644
index 0000000..dda4258
--- /dev/null
+++ b/debian/patches/smbd-startup-with-winbind.patch
@@ -0,0 +1,55 @@
+From 1e8931dfc24a2576a3b1fe9115c4ccbfefbbd298 Mon Sep 17 00:00:00 2001
+From: Stefan Metzmacher <[e-mail]>
+Date: Wed, 19 Dec 2018 09:38:33 +0100
+Subject: [PATCH] s3:auth: ignore create_builtin_guests() failing without a
+ valid idmap configuration
+
+This happens on standalone servers, where winbindd is automatically
+started by init scripts if it's installed. But it's not really
+used and may not have a valid idmap configuration (
+"idmap config * : range" has no default!)
+
+BUG: https://bugzilla.samba.org/show_bug.cgi?id=13697
+
+Signed-off-by: Stefan Metzmacher <[e-mail]>
+Reviewed-by: Alexander Bokovoy <[e-mail]>
+(cherry picked from commit 865538fabaea33741f5fa542dbc3f2e08308c2c1)
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1806035
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=909465
+Origin: https://attachments.samba.org/attachment.cgi?id=14752
+---
+ source3/auth/token_util.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/source3/auth/token_util.c b/source3/auth/token_util.c
+index f5b0e6944335..ee38d6c9645b 100644
+--- a/source3/auth/token_util.c
++++ b/source3/auth/token_util.c
+@@ -745,7 +745,23 @@ NTSTATUS finalize_local_nt_token(struct security_token *result,
+ 		status = create_builtin_guests(domain_sid);
+ 		unbecome_root();
+ 
+-		if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
++		/*
++		 * NT_STATUS_PROTOCOL_UNREACHABLE:
++		 * => winbindd is not running.
++		 *
++		 * NT_STATUS_ACCESS_DENIED:
++		 * => no idmap config at all
++		 * and wbint_AllocateGid()/winbind_allocate_gid()
++		 * failed.
++		 *
++		 * NT_STATUS_NO_SUCH_GROUP:
++		 * => no idmap config at all and
++		 * "tdbsam:map builtin = no" means
++		 * wbint_Sids2UnixIDs() fails.
++		 */
++		if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE) ||
++		    NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) ||
++		    NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_GROUP)) {
+ 			/*
+ 			 * Add BUILTIN\Guests directly to token.
+ 			 * But only if the token already indicates
+-- 
+2.17.1
+