VERSION: Bump version up to 4.1.0rc5...

and re-enable git snapshots.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
Merge tag 'samba-4.1.0rc4' into v4-1-test

samba: tag release samba-4.1.0rc4
Revert "Support UPN_DNS_INFO in the PAC"

This reverts commit a6be8a97f705247c1b1cbb0595887d8924740a71.

We fail (often) to parse a krb5pac type 12 buffer due to the incomplete change
which came in via a6be8a97f705247c1b1cbb0595887d8924740a71. This change came
into master and has only been released in RCs so no regression to published
4.0.x releases. We should revert this for 4.1 for now until we can make it work
in all cases (see work on this in
https://git.samba.org/?p=gd/samba/.git;a=shortlog;h=refs/heads/master-krb5pac_type12).
Without this revert the entire PAC parsing may fail which can effect serious
implications (krb5 smb session setup not working).

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10178

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Oct  3 17:08:46 CEST 2013 on sn-devel-104
(cherry picked from commit 8b51eabf319689d45ce1f8492c4372b49eecb794)
s3-winbind: Don't set a default directory for DIR.

There is not default so you should always have to specify a directory in
the config file.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
s3-winbind: Add support for the kernel krb5 keyring buffer.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
doc: Update documentation of pam_winbind krb5 support.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Tue Sep 10 15:35:20 CEST 2013 on sn-devel-104

The last 3 patches address bug #10132 - pam_winbindd should support the KEYRING
ccache type.

Autobuild-User(v4-1-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-1-test): Mon Oct  7 12:21:29 CEST 2013 on sn-devel-104
WHATSNEW: Add release notes for Samba 4.1.0.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
VERSION: Bump version number up to 4.1.0...

and disable git snapshots for the 4.1.0 release.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
VERSION: Bump version number up to 4.1.1...

and re-enable git snapshots.

Signed-off-by: Karolin Seeger <kseeger@samba.org>
Fix bug #10229 - No access check verification on stream files.

https://bugzilla.samba.org/show_bug.cgi?id=10229

We need to check if the requested access mask
could be used to open the underlying file (if
it existed), as we're passing in zero for the
access mask to the base filename.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: David Disseldorp <ddiss@suse.de>
(cherry picked from commit 60f922bf1bd8816eacbb32c24793ad1f97a1d9f2)
Add regression test for bug #10229 - No access check verification on stream files.

Checks against a file with attribute READONLY, and
a security descriptor denying WRITE_DATA access.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: David Disseldorp <ddiss@suse.de>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Nov  4 23:10:10 CET 2013 on sn-devel-104
(cherry picked from commit 65882152cc7ccaba0e7903862b99ca93594ed080)

The last two patches address bug #10235 - CVE-2013-4475: No access
check verification on stream files.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10235
CVE-2013-4476: lib-util: add file_check_permissions()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
CVE-2013-4476: lib-util: split out file_save_mode() from file_save()

file_save_mode() writes files with specified mode.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
CVE-2013-4476: samba-tool provision: create ${private_dir}/tls with mode 0700

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
CVE-2013-4476: selftest/Samba4: use umask 0077 within mk_keyblobs()

We should generate private keys with 0600.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Pair-Programmed-With: Björn Baumbach <bb@sernet.de>

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
CVE-2013-4476: s4:libtls: Create tls private key file (key.pem) with mode 0600

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
CVE-2013-4476: s4:libtls: check for safe permissions of tls private key file (key.pem)

If the tls key is not owned by root or has not mode 0600 samba will not
start up.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Björn Baumbach <bb@sernet.de>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
WHATSNEW: Add release notes for Samba 4.1.1.

Bug 10234 - CVE-2013-4476: key.pem world readable
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10234

Bug 10235 - CVE-2013-4475: No access check verification on stream files
(bug #10229: https://bugzilla.samba.org/show_bug.cgi?id=10229).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10235

Signed-off-by: Karolin Seeger <kseeger@samba.org>
VERSION: Disable git snapshots for the 4.1.1 release.

Bug 10234 - CVE-2013-4476: key.pem world readable
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10234

Bug 10235 - CVE-2013-4475: No access check verification on stream files
(BUG: https://bugzilla.samba.org/show_bug.cgi?id=10229).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10235

Signed-off-by: Karolin Seeger <kseeger@samba.org>
Merge tag 'samba-4.1.1' into zentyal

samba: tag release samba-4.1.1