~samba-team/cifs-utils/trunk : changes

~samba-team/cifs-utils/trunk » Changes from revision 566

From Revision 566 to 547

Rev	Summary	Authors	Tags	Date
566	cifs-utils: bump version to 7.0 cifs-utils: bump version to 7.0 Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>	Pavel Shilovsky		1 year ago
565	cifs-utils: don't return uninitialized value in cifs_gss_get... cifs-utils: don't return uninitialized value in cifs_gss_get_req If the first malloc fails, maj_stat is uninitialized and used as the return value through the GSS_ERROR() macro. Use GSS_S_FAILURE to indicate a miscellaneous error. Signed-off-by: atheik <atteh.mailbox@gmail.com>	atheik		1 year ago
564	cifs-utils: make GSSAPI usage compatible with Heimdal cifs-utils: make GSSAPI usage compatible with Heimdal The gssapi symbols are in gssapi_krb5 and gssapi in MIT and Heimdal Kerberos, respectively. Including gssapi_generic.h is not necessary. Signed-off-by: atheik <atteh.mailbox@gmail.com>	atheik		1 year ago
563	cifs-utils: work around missing krb5_free_string in Heimdal cifs-utils: work around missing krb5_free_string in Heimdal The krb5_free_string function is not present in Heimdal and instead krb5_xfree should be used for freeing the string allocation done by krb5_cc_get_full_name. Heimdal documentation does specify that krb5_xfree should be used here and krb5_unparse_name is freed with just free. Signed-off-by: atheik <atteh.mailbox@gmail.com>	atheik		1 year ago
562	fix warnings for -Waddress-of-packed-member fix warnings for -Waddress-of-packed-member When structure members are packed, GCC will issue a warning that taking an address of the packed structure member might cause an unaligned access. In all cases where this happen we simply can use a local variable instead and then assign the result in a proper way. Signed-off-by: Alexander Bokovoy <ab@samba.org>	Alexander Bokovoy		1 year ago
561	setcifsacl: fix memory allocation for struct cifs_ace setcifsacl: fix memory allocation for struct cifs_ace We don't have 'struct cifs_aces' so the correct struct name is 'struct cifs_ace'. The code only worked because 'struct unknown ' is compatible with 'struct cifs_ace '. Signed-off-by: Alexander Bokovoy <ab@samba.org>	Alexander Bokovoy		1 year ago
560	setcifsacl: fix comparison of actions reported by covscan setcifsacl: fix comparison of actions reported by covscan Signed-off-by: Alexander Bokovoy <ab@samba.org>	Alexander Bokovoy		1 year ago
559	cifs.upcall: remove unused variable and fix syslog message cifs.upcall: remove unused variable and fix syslog message The code already checks arg->have and has no use for local 'have' variable other than syslog() print. That variable is not initialized and the intent is really to use arg->have instead. Signed-off-by: Alexander Bokovoy <ab@samba.org>	Alexander Bokovoy		1 year ago
558	cifs.upcall: Switch to RFC principal type naming cifs.upcall: Switch to RFC principal type naming Switch from old-style MIT krb5 gss_nt_service_name principal type constant name to the now preferred GSS_C_NT_HOSTBASED_SERVICE. Signed-off-by: Michael Weiser <michael.weiser@atos.net>	Michael Weiser		1 year ago
557	man-pages: Update cifs.upcall to mention GSS_USE_PROXY man-pages: Update cifs.upcall to mention GSS_USE_PROXY Add ENVIRONMENT VARIABLES section with the usage of gssproxy as a credential retrieval method. Signed-off-by: Jacob Shivers <jshivers@redhat.com>	Jacob Shivers		1 year ago
556	cifs.upcall: fix compiler warning cifs.upcall: fix compiler warning Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>	Ronnie Sahlberg		1 year ago
555	cifs.upcall: add gssproxy support cifs.upcall: add gssproxy support Add support for gssproxy usage through GSS-API. If no useable ticket cache or keytab can be found, fall on through into credential handling anyway but then divert into GSS routines. If no gssproxy is available this will still error out silently because no ticket cache is available. With gssproxy enabled, credentials can be retrieved from there and allow unattended access to shares e.g. from batch jobs. Signed-off-by: Michael Weiser <michael.weiser@atos.net>	Michael Weiser		1 year ago
554	cifs-utils: bump version to 6.15 cifs-utils: bump version to 6.15 Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>	Pavel Shilovsky	cifs-utils-6.15	1 year ago
553	mount.cifs: fix verbose messages on option parsing mount.cifs: fix verbose messages on option parsing When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may lead to information disclosure in particular conditions when the credentials file given is sensitive and contains '=' signs. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15026 Signed-off-by: Jeffrey Bencteux <jbe@improsec.com> Reviewed-by: David Disseldorp <ddiss@suse.de>	Jeffrey Bencteux		1 year ago
552	CVE-2022-27239: mount.cifs: fix length check for ip option p... CVE-2022-27239: mount.cifs: fix length check for ip option parsing Previous check was true whatever the length of the input string was, leading to a buffer overflow in the subsequent strcpy call. Bug: https://bugzilla.samba.org/show_bug.cgi?id=15025 Signed-off-by: Jeffrey Bencteux <jbe@improsec.com> Reviewed-by: David Disseldorp <ddiss@suse.de>	Jeffrey Bencteux		1 year ago
551	cifs-utils: bump version to 6.14 cifs-utils: bump version to 6.14 Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>	Pavel Shilovsky	cifs-utils-6.14	2 years ago
550	setcifsacl: fix formatting setcifsacl: fix formatting Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>	Pavel Shilovsky		2 years ago
549	smbinfo: add support for new key dump ioctl smbinfo: add support for new key dump ioctl * try new one first, fall back on old one otherwise => retrocompatible * use better cipher descriptions Signed-off-by: Aurelien Aptel <aaptel@suse.com>	Aurelien Aptel		2 years ago
548	mount.cifs: fix crash when mount point does not exist mount.cifs: fix crash when mount point does not exist @mountpointp is initially set to a statically allocated string in main(), and if we fail to update it in acquire_mountpoint(), make sure to set it to NULL and avoid freeing it at mount_exit. This fixes the following crash $ mount.cifs //srv/share /mnt/foo/bar -o ... Couldn't chdir to /mnt/foo/bar: No such file or directory munmap_chunk(): invalid pointer Aborted Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz> Reviewed-by: Aurelien Aptel <aaptel@suse.com>	Paulo Alcantara		2 years ago
547	cifs.upcall: fix regression in kerberos mount cifs.upcall: fix regression in kerberos mount The fix for CVE-2021-20208 in commit e461afd ("cifs.upcall: try to use container ipc/uts/net/pid/mnt/user namespaces") introduced a regression for kerberos mounts when cifs-utils is built with libcap-ng. It makes mount fail with ENOKEY "Required key not available". Current state: mount.cifs '---> mount() ---> kernel negprot, session setup (need security blob for krb) request_key("cifs.spnego", payload="pid=%d;username=...") upcall /sbin/request-key <--------------' reads /etc/request-keys.conf dispatch cifs.spnego request calls /usr/sbin/cifs.upcall <key id> - drop privileges (capabilities) - fetch keyid - parse payload - switch to mount.cifs namespaces - call krb5_xxx() funcs - generate security blob - set key value to security blob '-----------------------------------> kernel put blob in session setup packet continue auth open tcon get share root setup superblock mount.cifs mount() returns <-----------' By the time cifs.upcall tries to switch to namespaces, enough capabilities have dropped in trim_capabilities() that it makes setns() fail with EPERM. setns() requires CAP_SYS_ADMIN. With libcap trim_capabilities() is a no-op. This fix: - moves the namespace switch earlier so that operations like setgroups(), setgid(), scanning of pid environment, ... happens in the contained namespaces. - moves trim_capabilities() after the namespace switch - moves the string processing to decode the key request payload in a child process with minimum capabilities. the decoded data is shared with the parent process via shared memory obtained with mmap(). Fixes: e461afd ("cifs.upcall: try to use container ipc/uts/net/pid/mnt/user namespaces") Signed-off-by: Aurelien Aptel <aaptel@suse.com>	Aurelien Aptel		2 years ago

Older »