RHBA-2010:0300 - Bug Fix Advisory

Topic

Updated samba packages that contain various bugfixes
are now available.

Description

Samba is a suite of programs used by machines to share files, printers,
and other information.

This package addresses the following bugs:

• previously, the man pages and usage messages for rpcclient,

smbcacls, samba-client, smbget, smbtree, and pdbedit contained
errors, omissions, and outdated information. Users could not
therefore rely on the provided documentation to use these programs.
The documentation for each of these components has been reviewed and
corrected and no longer contains misleading information. (BZ#457082,
BZ#457096, BZ#457097, BZ#457192, BZ#457195, BZ#457203, BZ#457384,
BZ#457385)

• Samba stores its own Kerberos configuration in

/var/cache/samba/smb_krb5. Previously, although the "net ads join"
command used this configuration and was able to join an Active
Directory, "net ads testjoin" and "net ads leave" ignored the samba-
specific file and tried to use the configuration in /etc/krb5.conf
instead. These commands would therefore fail when authentication
through Kerberos was needed. "net ads testjoin" and "net ads leave" now
use /var/cache/samba/smb_krb5 and therefore work with authenticated
Active Directory resources. (BZ#509170)

• cifs.upcall performs certain CIFS-related tasks for the kernel in

user space. The version of cifs.upcall included with previous versions
of Samba could not provide the kernel with the credentials cache
path stored in the KRB5CCNAME environment variable. Attempts to mount
CIFS shares through fstab as a normal user would therefore fail.
The version of cifs.upcall included with Red Hat Enterprise Linux 5.5
can now provide the kernel with the credentials cache path, and
CIFS shares can therefore be mounted for normal users. (BZ#517195)

• previously, when handling a POSIX open call, Samba did not account

for the SMB_O_CREAT, SMB_O_EXCL, or SMB_O_TRUNC flags. As a result,
Samba would respond with STATUS_INVALID_PARAMETER to any of these
flags instead of honoring the call. Samba now recognizes these
flags and honors POSIX open calls that use them. (BZ#522866)

• when setting the "allow trusted domain = no" parameter on a Samba server

it would not have any effect on the configuration and Samba would still
attempt to contact trusted domains. By refreshing the trusted domain cache
only if the parameter "allow trusted domain = yes" is set, Samba no longer
attempts to contact trusted domains when "allow trusted domain = no".
(BZ#526065)

• mount.cifs would fail to correctly authenticate when a credentials file

was used. As a result, any mount operation that used a credentials file
would fail. By correcting the newlines during the parsing routines during
mounting the issue has been fixed. mount.cifs now works correctly when
authenticating with a credentials file. (BZ#532153)

• mounting and unmounting a CIFS filesystem quickly would eventually lead

to the CIFS mounts becoming unmountable. The issue has been corrected by
linking mtab.o to the building of mount.cifs and unmount.cifs. CIFS mounts
no longer become unmountable when performing quick mounting and unmounting
of the filesystem. (BZ#533912)

• kdebase conflicted with Samba 3. Samba 2 components libsmbclient and

libsmbclient-devel are now available as independent rpms and can be
installed alongside Samba 3. By separating out these packages it allows for
kdebase to reference its dependencies independent of a Samba installation,
correcting the conflict. (BZ#555654)

Users of Samba should upgrade to these updated packages, which resolve
these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 457082 - samba-client: manual page of rpcclient is incomplete/incorrect
• BZ - 457096 - smbcacls -t does nothing, not even the argument validation
• BZ - 457097 - samba-client: manual page and usage message of smbcacls is incomplete/incorrect
• BZ - 457192 - samba-client: manual page of smbclient is incomplete/incorrect
• BZ - 457195 - samba-client: manual page of smbget doesn't mention -O|--stdout parameter
• BZ - 457203 - samba-client: manual page and usage message of smbtree is incomplete/incorrect
• BZ - 457384 - samba-common: manual page and usage message of pdbedit is incomplete/incorrect
• BZ - 457385 - pdbedit -N doesn't work without -r specified
• BZ - 517195 - cifs.upcall does not find/read existing credentials from KRB5CCNAME
• BZ - 522866 - samba occasionally returning -EINVAL on what looks like valid posix open call
• BZ - 532153 - mount.cifs reads credentials file incorrectly

CVEs

(none)

References

(none)