[SCM] Samba Shared Repository - branch v4-10-test updated
Karolin Seeger
kseeger at samba.org
Tue Sep 3 08:30:08 UTC 2019
The branch, v4-10-test has been updated
via 981f8b164d3 VERSION: Bump version up to 4.10.9.
via 2aa3ab95763 Merge tag 'samba-4.10.8' into v4-10-test
via 2d587a11d5f VERSION: Disable GIT_SNAPSHOT for the 4.10.8 release.
via 3761e4787f0 WHATSNEW: Add release notes for Samba 4.10.8.
via 661a7cdb0ab CVE-2019-10197: smbd: split change_to_user_impersonate() out of change_to_user_internal()
via 962d4a98b50 CVE-2019-10197: test_smbclient_s3.sh: add regression test for the no permission on share root problem
via d1d48f20a25 CVE-2019-10197: selftest: make fsrvp_share its own independent subdirectory
via 0af5d11c762 CVE-2019-10197: smbd: make sure we reset current_user.{need,done}_chdir in become_root()
via fd0d3986bba CVE-2019-10197: smbd: make sure that change_to_user_internal() always resets current_user.done_chdir
via cf67b48f779 CVE-2019-10197: smbd: separate out impersonation debug info into a new function.
via 523f9f15b02 VERSION: Bump version up to 4.10.8...
from 040a483956a ctdb-daemon: Make node inactive in the NODE_STOP control
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-test
- Log -----------------------------------------------------------------
commit 981f8b164d34fdb88814613570b53f34ed8b1e4b
Author: Karolin Seeger <kseeger at samba.org>
Date: Tue Sep 3 10:29:32 2019 +0200
VERSION: Bump version up to 4.10.9.
Signed-off-by: Karolin Seeger <kseeger at samba.org>
commit 2aa3ab95763426c52f5c381626f5e5849a7402d6
Merge: 040a483956a 2d587a11d5f
Author: Karolin Seeger <kseeger at samba.org>
Date: Tue Sep 3 10:29:10 2019 +0200
Merge tag 'samba-4.10.8' into v4-10-test
samba: tag release samba-4.10.8
-----------------------------------------------------------------------
Summary of changes:
VERSION | 2 +-
WHATSNEW.txt | 62 ++++++++++++++++++++++++++++++-
selftest/target/Samba3.pm | 19 +++++++++-
source3/script/tests/test_smbclient_s3.sh | 30 +++++++++++++++
source3/smbd/uid.c | 62 ++++++++++++++++++++++---------
5 files changed, 152 insertions(+), 23 deletions(-)
Changeset truncated at 500 lines:
diff --git a/VERSION b/VERSION
index 9b87c578f95..de839df43fe 100644
--- a/VERSION
+++ b/VERSION
@@ -25,7 +25,7 @@
########################################################
SAMBA_VERSION_MAJOR=4
SAMBA_VERSION_MINOR=10
-SAMBA_VERSION_RELEASE=8
+SAMBA_VERSION_RELEASE=9
########################################################
# If a official release has a serious bug #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 09eebbc6274..54c9c8fcabe 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,3 +1,61 @@
+ ==============================
+ Release Notes for Samba 4.10.8
+ September 3, 2019
+ ==============================
+
+
+This is a security release in order to address the following defect:
+
+o CVE-2019-10197: Combination of parameters and permissions can allow user
+ to escape from the share path definition.
+
+=======
+Details
+=======
+
+o CVE-2019-10197:
+ Under certain parameter configurations, when an SMB client accesses a network
+ share and the user does not have permission to access the share root
+ directory, it is possible for the user to escape from the share to see the
+ complete '/' filesystem. Unix permission checks in the kernel are still
+ enforced.
+
+
+Changes since 4.10.7:
+---------------------
+
+o Jeremy Allison <jra at samba.org>
+ * BUG 14035: CVE-2019-10197: Permissions check deny can allow user to escape
+ from the share.
+
+o Stefan Metzmacher <metze at samba.org>
+ * BUG 14035: CVE-2019-10197: Permissions check deny can allow user to escape
+ from the share.
+
+
+#######################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the "Samba 4.1 and newer" product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
==============================
Release Notes for Samba 4.10.7
August 22, 2019
@@ -76,8 +134,8 @@ database (https://bugzilla.samba.org/).
======================================================================
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
==============================
Release Notes for Samba 4.10.6
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 9d88253c9fe..2f491441815 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -1516,6 +1516,9 @@ sub provision($$$$$$$$$)
my $ro_shrdir="$shrdir/root-tmp";
push(@dirs,$ro_shrdir);
+ my $noperm_shrdir="$shrdir/noperm-tmp";
+ push(@dirs,$noperm_shrdir);
+
my $msdfs_shrdir="$shrdir/msdfsshare";
push(@dirs,$msdfs_shrdir);
@@ -1540,6 +1543,9 @@ sub provision($$$$$$$$$)
my $widelinks_linkdir="$shrdir/widelinks_foo";
push(@dirs,$widelinks_linkdir);
+ my $fsrvp_shrdir="$shrdir/fsrvp";
+ push(@dirs,$fsrvp_shrdir);
+
my $shadow_tstdir="$shrdir/shadow";
push(@dirs,$shadow_tstdir);
my $shadow_mntdir="$shadow_tstdir/mount";
@@ -1583,6 +1589,11 @@ sub provision($$$$$$$$$)
chmod 0755, $piddir;
+ ##
+ ## Create a directory without permissions to enter
+ ##
+ chmod 0000, $noperm_shrdir;
+
##
## create ro and msdfs share layout
##
@@ -1899,6 +1910,10 @@ sub provision($$$$$$$$$)
[ro-tmp]
path = $ro_shrdir
guest ok = yes
+[noperm]
+ path = $noperm_shrdir
+ wide links = yes
+ guest ok = yes
[write-list-tmp]
path = $shrdir
read only = yes
@@ -2083,14 +2098,14 @@ sub provision($$$$$$$$$)
guest ok = yes
[fsrvp_share]
- path = $shrdir
+ path = $fsrvp_shrdir
comment = fake shapshots using rsync
vfs objects = shell_snap shadow_copy2
shell_snap:check path command = $fake_snap_pl --check
shell_snap:create command = $fake_snap_pl --create
shell_snap:delete command = $fake_snap_pl --delete
# a relative path here fails, the snapshot dir is no longer found
- shadow:snapdir = $shrdir/.snapshots
+ shadow:snapdir = $fsrvp_shrdir/.snapshots
[shadow1]
path = $shadow_shrdir
diff --git a/source3/script/tests/test_smbclient_s3.sh b/source3/script/tests/test_smbclient_s3.sh
index bf033ccd2fb..0bae1d78fac 100755
--- a/source3/script/tests/test_smbclient_s3.sh
+++ b/source3/script/tests/test_smbclient_s3.sh
@@ -1329,6 +1329,32 @@ EOF
fi
}
+#
+# Regression test for CVE-2019-10197
+# we should always get ACCESS_DENIED
+#
+test_noperm_share_regression()
+{
+ cmd='$SMBCLIENT -U$USERNAME%$PASSWORD //$SERVER/noperm -I $SERVER_IP $LOCAL_ADDARGS -c "ls;ls" 2>&1'
+ eval echo "$cmd"
+ out=`eval $cmd`
+ ret=$?
+ if [ $ret -eq 0 ] ; then
+ echo "$out"
+ echo "failed accessing no perm share should not work"
+ return 1
+ fi
+
+ num=`echo "$out" | grep 'NT_STATUS_ACCESS_DENIED' | wc -l`
+ if [ "$num" -ne "2" ] ; then
+ echo "$out"
+ echo "failed num[$num] - two NT_STATUS_ACCESS_DENIED lines expected"
+ return 1
+ fi
+
+ return 0
+}
+
# Test smbclient deltree command
test_deltree()
{
@@ -1857,6 +1883,10 @@ testit "follow local symlinks" \
test_local_symlinks || \
failed=`expr $failed + 1`
+testit "noperm share regression" \
+ test_noperm_share_regression || \
+ failed=`expr $failed + 1`
+
testit "smbclient deltree command" \
test_deltree || \
failed=`expr $failed + 1`
diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c
index a4bcb747d37..5c39baade5c 100644
--- a/source3/smbd/uid.c
+++ b/source3/smbd/uid.c
@@ -279,14 +279,36 @@ static bool check_user_ok(connection_struct *conn,
return(True);
}
+static void print_impersonation_info(connection_struct *conn)
+{
+ struct smb_filename *cwdfname = NULL;
+
+ if (!CHECK_DEBUGLVL(DBGLVL_INFO)) {
+ return;
+ }
+
+ cwdfname = vfs_GetWd(talloc_tos(), conn);
+ if (cwdfname == NULL) {
+ return;
+ }
+
+ DBG_INFO("Impersonated user: uid=(%d,%d), gid=(%d,%d), cwd=[%s]\n",
+ (int)getuid(),
+ (int)geteuid(),
+ (int)getgid(),
+ (int)getegid(),
+ cwdfname->base_name);
+ TALLOC_FREE(cwdfname);
+}
+
/****************************************************************************
Become the user of a connection number without changing the security context
stack, but modify the current_user entries.
****************************************************************************/
-static bool change_to_user_internal(connection_struct *conn,
- const struct auth_session_info *session_info,
- uint64_t vuid)
+static bool change_to_user_impersonate(connection_struct *conn,
+ const struct auth_session_info *session_info,
+ uint64_t vuid)
{
int snum;
gid_t gid;
@@ -299,7 +321,6 @@ static bool change_to_user_internal(connection_struct *conn,
if ((current_user.conn == conn) &&
(current_user.vuid == vuid) &&
- (current_user.need_chdir == conn->tcon_done) &&
(current_user.ut.uid == session_info->unix_token->uid))
{
DBG_INFO("Skipping user change - already user\n");
@@ -404,7 +425,22 @@ static bool change_to_user_internal(connection_struct *conn,
current_user.conn = conn;
current_user.vuid = vuid;
+ return true;
+}
+
+static bool change_to_user_internal(connection_struct *conn,
+ const struct auth_session_info *session_info,
+ uint64_t vuid)
+{
+ bool ok;
+
+ ok = change_to_user_impersonate(conn, session_info, vuid);
+ if (!ok) {
+ return false;
+ }
+
current_user.need_chdir = conn->tcon_done;
+ current_user.done_chdir = false;
if (current_user.need_chdir) {
ok = chdir_current_service(conn);
@@ -415,20 +451,7 @@ static bool change_to_user_internal(connection_struct *conn,
current_user.done_chdir = true;
}
- if (CHECK_DEBUGLVL(DBGLVL_INFO)) {
- struct smb_filename *cwdfname = vfs_GetWd(talloc_tos(), conn);
- if (cwdfname == NULL) {
- return false;
- }
- DBG_INFO("Impersonated user: uid=(%d,%d), gid=(%d,%d), cwd=[%s]\n",
- (int)getuid(),
- (int)geteuid(),
- (int)getgid(),
- (int)getegid(),
- cwdfname->base_name);
- TALLOC_FREE(cwdfname);
- }
-
+ print_impersonation_info(conn);
return true;
}
@@ -614,6 +637,9 @@ void smbd_become_root(void)
}
push_conn_ctx();
set_root_sec_ctx();
+
+ current_user.need_chdir = false;
+ current_user.done_chdir = false;
}
/* Unbecome the root user */
--
Samba Shared Repository
More information about the samba-cvs
mailing list