buildroot/package/samba4, branch 2016.08

package/samba4: security bump to 4.4.5

2016-07-08T08:57:25+00:00

Fixes CVE-2016-2119 https://www.samba.org/samba/security/CVE-2016-2119.html Signed-off-by: Bernd Kuhls Signed-off-by: Thomas Petazzoni

package/samba4: Change tmpfiles path

2016-07-02T16:50:36+00:00

Per the documentation: https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html The order of path by priorites is: /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf /usr/lib/tmpfiles.d/*.conf For the user to be able to override our tmpfiles easily, it's better to place our files in /usr/lib/tmpfiles.d/ Signed-off-by: Maxime Hadjinlian Reviewed-by: "Yann E. MORIN" Signed-off-by: Thomas Petazzoni

samba4: bump to version 4.4.4

2016-06-08T05:55:19+00:00

Signed-off-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni

Merge branch 'next'

2016-06-01T15:55:16+00:00

Signed-off-by: Peter Korsgaard

samba4: remove compilation of .pyc files

2016-05-26T20:08:36+00:00

Now that .py files are globally compiled into .pyc files, we can get rid of the samba4 specific logic doing this compilation. Signed-off-by: Thomas Petazzoni Reviewed-by: Samuel Martin Signed-off-by: Thomas Petazzoni

package/samba4: create tempfile with systemd

2016-05-16T19:25:42+00:00

With systemd, samba4 will need some special temporary files to be created on each boot, as explained in: packaging/systemd/README Install the provided template file as configuration. However, this is not enough, as even the log directory is a tmpfs in the default Buildroot configuration, so we must also create the log directory on each boot. Hence we append this to the template installed above. Signed-off-by: "Yann E. MORIN" Cc: Gustavo Zacarias Acked-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

samba4: bump to version 4.4.3

2016-05-02T15:19:19+00:00

Fixes a few regressions from the previous security bump. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

samba4: security bump to version 4.4.2

2016-04-12T21:12:42+00:00

Fixes: CVE-2016-2118 - A man in the middle can intercept any DCERPC traffic between a client and a server in order toimpersonate the client and get the same privileges as the authenticated user account. CVE-2016-2115 - The protection of DCERPC communication over ncacn_np (which is the default for most the file server related protocols) is inherited from the underlying SMB connection. Samba doesn't enforce SMB signing for this kind of SMB connections by default, which makes man in the middle attacks possible. CVE-2016-2114 - Due to a bug Samba doesn't enforce required smb signing, even if explicitly configured. CVE-2016-2113 - Man in the middle attacks are possible for client triggered LDAP connections (with ldaps://) and ncacn_http connections (with https://). CVE-2016-2112 - A man in the middle is able to downgrade LDAP connections to no integrity protection. It's possible to attack client and server with this. CVE-2016-2111 - When Samba is configured as Domain Controller it allows remote attackers to spoof the computer name of a secure channel's endpoints, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic. CVE-2016-2110 - The feature negotiation of NTLMSSP is not downgrade protected. A man in the middle is able to clear even required flags, especially NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL. CVE-2015-5370 - Errors in Samba DCE-RPC code can lead to denial of service (crashes and high cpu consumption) and man in the middle attacks. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

samba4: drop --with-gettext configure option

2016-03-25T21:38:41+00:00

The --with-gettext=X configure option was silently dropped from the 4.4.0 release and it errors out since it's unknown. Fixes: http://autobuild.buildroot.net/results/3c0/3c0800fd6cc7a217a866cd9cf63d5f91dcbfd306/ Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

samba4: bump to version 4.4.0

2016-03-24T21:44:14+00:00

libaio support is now automatic so drop the enable/disable (it will fall back to pthread aio if libaio is not present). 0002-build-improve-stack-protector-check.patch is upstream so remove it. Signed-off-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni