wbinfo: allow to define a custom krb5ccname for kerberized pam auth.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

(cherry picked from commit 73e6feff9b3f30e70d84fe256aff239fafdfdb95)
s3-winbindd: support the DIR pragma for raw kerberos user pam authentication.

It is currently only available in MIT. In addition, allow to define custom
filepaths for FILE, WRFILE and DIR pragmas and substitute one occurence of the
%u pattern.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Pair-Programmed-With: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

(cherry picked from commit 7ad3a367d52b1f123c318946d654e95639202130)
pam_winbind: update documentation for "DIR" krb5ccname pragma.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Jul 24 02:43:10 CEST 2013 on sn-devel-104

(cherry picked from commit 9adfe82a1785aa6a7baefb435072a0a81dfb13cb)

The last 3 patches address bug #10043 - Allow to change the default location for
Kerberos credential caches.
s4-winbind: Add special case for BUILTIN domain

This should mean that lookups for the BUILTIN domain cause less trouble
then they have in the past, because they will no longer go via the
trusted domain handler.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Jun 20 15:30:00 CEST 2013 on sn-devel-104
(cherry picked from commit 88c72fceb1c86752c52651bdea5b116806dd92c5)
service_stream: Log if the connection termination is deferred or not (bug #9820)

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit df929d6feb857668ad9da277213e9fae1480ff63)
s4-winbindd: Do not terminate a connection that is still pending (bug #9820)

Instead, wait until the call attempts to reply, and let it terminate then

(often this happens in the attempt to then write to the broken pipe).

Andrew Bartlett

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 2505d48e4fbcd8a805a88ad0b05fb1a16a588197)
s4:rpc_server: make sure we don't terminate a connection with pending requests (bug #9820)

Sadly we may have nested event loops, which won't work correctly with
broken connections, that's why we have to do this...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Jul 10 08:47:38 CEST 2013 on sn-devel-104
(cherry picked from commit e6a58d370403e818bc2cfb8389751b78adcc14fd)
s4:server: avoid calling into nss_winbind from within 'samba'

The most important part is that the 'winbind_server' doesn't
recurse into itself. This could happen if the krb5 libraries
call getlogin().

As we may run in single process mode, we need to set
_NO_WINBINDD=1 everywhere, the only exception is the forked
'smbd'.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

The last 5 patches address bug #9820 - crash of winbind after "ls -l
/usr/local/samba/var/locks/sysvol".
s4-lib/socket: Allocate a the larger sockaddr_un and not just a sockaddr_in in unixdom_get_peer_addr()

This caused crashes in _tsocket_address_bsd_from_sockaddr() when we
read past the end of the allocation.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit e9ae36e9683372b86f1efbd29904722a33fea083)
VERSION: Bump version number up to 4.0.8.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
Fix bug #10010 - Missing integer wrap protection in EA list reading can cause server to loop with DOS.

Ensure we never wrap whilst adding client provided input.

Signed-off-by: Jeremy Allison <jra@samba.org>
Fix bug #10010 - Missing integer wrap protection in EA list reading can cause server to loop with DOS.

Fix client-side parsing also. Found by David Disseldorp <ddiss@suse.de>
CVE-2013-4124

Signed-off-by: Jeremy Allison <jra@samba.org>
WHATSNEW: Add release notes for Samba 4.0.8.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
s4-lib/socket: Allocate a the larger sockaddr_un and not just a sockaddr_in in unixdom_get_my_addr()

This caused crashes in _tsocket_address_bsd_from_sockaddr() when we
read past the end of the allocation.

(similar to commit e9ae36e9683372b86f1efbd29904722a33fea083)

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10042

Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jul 24 14:37:43 CEST 2013 on sn-devel-104
(cherry picked from commit 077dfd0a89a854c21b91b0f871d034fd9fe82a9a)

Autobuild-User(v4-0-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-0-test): Mon Aug  5 11:54:46 CEST 2013 on sn-devel-104
Merge tag 'samba-4.0.8' into v4-0-test

samba: tag release samba-4.0.8
VERSION: Bump version number up to 4.0.9.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
security.idl: add new security_secinfo bits

[MS-DTYP].pdf 2.4.7

Signed-off-by: Gregor Beck <gbeck@sernet.de>
Fix bug 9678 - Windows 8 Roaming profiles fail

Windows 8 tries to set 'ATTRIBUTE_SECURITY_INFORMATION' on some
dirs. Ignoring it makes roaming profiles work again.
Just like w2k3 gracefully ignore all the other bits.

Signed-off-by: Gregor Beck <gbeck@sernet.de>

Autobuild-User(v4-0-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-0-test): Mon Aug  5 22:00:52 CEST 2013 on sn-devel-104
Add ea_list_has_invalid_name() function.

Invalid character list probed from Windows Server 2012.

Bug 9992: Windows error 0x800700FE when copying files with xattr names containing ":"

Signed-off-by: Jeremy Allison <jra@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Ensure set_ea cannot set invalid Windows EA names.

Bug 9992 - Windows error 0x800700FE when copying files with xattr names containing ":"

Signed-off-by: Jeremy Allison <jra@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>