Fix bug #10063 - source3/lib/util.c:1493 leaking memory w/ pam_winbind.so / winbind

Don't use talloc_tos() in something that can be linked to in pam_winbindd.so

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>

Autobuild-User(master): Simo Sorce <idra@samba.org>
Autobuild-Date(master): Sat Aug 24 02:28:28 CEST 2013 on sn-devel-104
(cherry picked from commit 9423d5afb71e272298f4858d82f436e19ee2b07f)

Autobuild-User(v4-0-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-0-test): Tue Aug 27 11:39:07 CEST 2013 on sn-devel-104
smbd: Fix a profile problem

When trying to read a profile, under certain circumstances Windows tries
to read with its machine account first. The profile previously written
was stored with an ACL that only allows access for the user and not
the machine. Windows should get an NT_STATUS_ACCESS_DENIED when using
the machine account, making it retry with the user account (which would
then succeed).

Samba under these circumstances erroneously gives
NT_STATUS_OBJECT_PATH_NOT_FOUND, which makes Windows give up and not
retry. The reasons is the "dropbox" patch in unix_convert, turning EACCESS
on the last path component to OBJECT_PATH_NOT_FOUND. This patch makes
the dropbox behaviour only kick in when we are creating a file. I think
this is an abstraction violation. unix_convert() should not have to know
about the create_disposition, but given that we have pathname resolution
separated from the core open code right now this is the best we can do.

Signed-off-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
Reviewed-by: Jeremy Allison <jra@samba.org>
smbd: Simplify dropbox special case in unix_convert

EACCESS needs special treatment: If we want to create a fresh file,
return OBJECT_PATH_NOT_FOUND, so that the client will continue creating
the file. If the client wants us to open a potentially existing file,
we need to correctly return ACCESS_DENIED.

This patch makes this behaviour hopefully a bit clearer than the code
before did.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Aug 26 12:14:26 CEST 2013 on sn-devel-104

The last 2 patches address bug #10114 - Dropbox (write-only-directory) case
isn't handled correctly in pathname lookup.
s3: Fix some blank line endings

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Sep 27 07:57:03 CEST 2012 on sn-devel-104
(cherry picked from commit aad669b53eca99f86c2e630bf3f2e9f594fed9c1)
Fix bug #9166 - Starting smbd or nmbd with stdin from /dev/null results in "EOF on stdin"

Only install the stdin handler if it's a pipe or fifo.

Signed-off-by: Jeremy Allison <jra@samba.org>
Fix the erroneous masking of chmod requests via the UNIX extensions.

Changed from switch statement to if, as "create mask", "force create mode"
are only applied to new files, not existing ones. "directory mask",
"force directory mode" are only applied to new directories, not existing
ones.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
(cherry picked from commit bd0156988b34feaf91c3046f7ec78f0833222395)
Allow UNIX extensions client to act on open fsp instead of pathname if available.

Eliminates possible race condition on pathname op.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
(cherry picked from commit f1ff97fc022adaacaa23b7da250be6f7d51c6ac7)
Fix the UNIX extensions CHOWN calls to use FCHOWN if available, else LCHOWN.

UNIX extensions calls must never deref links.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Aug 26 20:19:46 CEST 2013 on sn-devel-104

(cherry picked from commit d1593a20f3a5ebf287477dfa8f5ab31dca3dd0c3)

The last 3 patches address bug #10121 - masks incorrectly applied to UNIX
extension permission changes.

Autobuild-User(v4-0-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-0-test): Fri Aug 30 12:34:12 CEST 2013 on sn-devel-104
python/pyglue: filter out loopback and linklocal addresses unless all_interfaces is given

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10030

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Bjoern Jacke <bj@sernet.de>
(cherry picked from commit 0e6aca40413fb3cfd4300f282204a69743be4a65)
s4:samba_upgradedns: don't pass linklocal=False to interface_ips_v6()

This is the default...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Bjoern Jacke <bj@sernet.de>
(cherry picked from commit 9edc0276c742194ec381c266acedf3216ccf1c69)
python/provision: remove unused linklocal=False argument from interface_ips_v6()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Bjoern Jacke <bj@sernet.de>

Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Fri Aug 30 17:33:58 CEST 2013 on sn-devel-104

(cherry picked from commit 3430448fc01ce3fbe0606a2c239d3c98a5b78361)

The last 3 patches address bug #10030 - ::1 added to nameserver on join.
s3:lib/gencache: place gencache.tdb into /var/cache/samba

/var/lock/samba is located on tmpfs on newer systems,
but we want to keep things like the server affinity cache
across reboots.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 54529fd354275cfb4ece407f95ef34675b202ea3)

Fix bug #9802 - gencache.tdb should be moved to /var/cache/samba.

Autobuild-User(v4-0-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-0-test): Mon Sep  2 11:57:51 CEST 2013 on sn-devel-104
selftest: Fix specification of --machinepass to actually set a unique password

Because perl does not assert on dereferencing an invalid hash key
we did not notice that the passwords were being set to machine, not
machineloCalMemberPass.

Andrew Bartlett
Reviewed-by: Jeremy Allison <jra@samba.org>

(cherry picked from commit 166288b162e7b658b48bc908c71f635928edc5b5)
scripting/join.py: Handle creating the dns-NAME account during a DC join

This will ensure that the DLZ plugin works out of the box when joining a second Samba DC to the
domain.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit b106d9090e8f8f44f02059d2ced3d10066787060)
scripting/samba_upgradedns: Tighten up exception and attribute list handling

This avoids asking for attributes that will not be used, and looks only for the
expected exceptions, rather than all exceptions.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit d19c437a36b26e71c24bc25e672d714e21ba50bd)
selftest: Test creation of the dns-SERVER account during selftest

We do this by having the samba-tool domain dcpromo for promoted_vampire_dc also create a
dns-SERVER account.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit e281037c9bfa68ca3dc564ec7a36e5c790024902)
selftest: Start internal DNS server on domain provisioned for BIND9_DLZ

This shows that the internal server can use the dns-SERVER account.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 013c4990c6f1412dd25592bf177ceffab4b5d16d)
selftest: Add a basic test of samba_upgradedns

This does not check that the command runs correctly, but does at least check
that the command runs to completion without errors.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 16b26eafa75280e576333975cff5dd1505c118fa)
torture: Ensure that GSSAPI and SPNEGO packets are accepted by dlz_bind9

This exercises some more of the dlz_bind9 code outside BIND, by
sending in a ticket to be access checked, wrapped either in SPNEGO or
just in GSSAPI.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Sep  4 11:25:10 CEST 2013 on sn-devel-104

(cherry picked from commit 38e43961c01f6f491b069e7106fe2a2ec80bd840)

The last 7 patches address bug #9091 - When replicating DNS for bind9_dlz we
need to create the server-DNS account remotely.
s3:smbd: return NT_STATUS_INFO_LENGTH_MISMATCH for GetInfo in case output_buffer_length is too small

Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
(cherry picked from commit a93f9c3d33e442c84d0c9da7eb5d25ca4b54fc33)