Activity log for bug #1951490

Date Who What changed Old value New value Message
2021-11-19 01:24:10 Florian Lentz bug added bug
2021-11-22 14:35:55 Launchpad Janitor samba (Ubuntu): status New Confirmed
2021-11-23 12:43:56 Marc Deslauriers bug watch added https://bugzilla.samba.org/show_bug.cgi?id=14867
2021-11-23 12:43:56 Marc Deslauriers bug task added samba
2021-11-23 15:29:26 Lucas Kanashiro bug added subscriber Ubuntu Server
2021-11-23 15:29:32 Lucas Kanashiro tags server-todo
2021-12-14 20:16:32 Mikael Broström bug added subscriber Mikael Broström
2022-01-27 10:52:00 Paride Legovini bug added subscriber Ubuntu Security Team
2022-01-27 10:58:37 Paride Legovini tags server-todo regression-update server-next
2022-01-27 11:19:28 Paride Legovini samba (Ubuntu): importance Undecided High
2022-02-02 16:18:51 Paride Legovini samba (Ubuntu): assignee Ubuntu Security Team (ubuntu-security)
2022-02-17 07:15:16 Sebastian Chrostek bug added subscriber Sebastian Chrostek
2022-02-23 16:06:38 Christian Ehrhardt  tags regression-update server-next regression-update server-todo
2022-02-24 06:02:22 Christian Ehrhardt  attachment added bug-fix by mdeslaur as tested by Sebastian https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1951490/+attachment/5563300/+files/fix-lp-1951490.debdiff
2022-02-24 06:02:32 Christian Ehrhardt  samba (Ubuntu): assignee Ubuntu Security Team (ubuntu-security) Christian Ehrhardt  (paelzer)
2022-02-24 06:02:40 Christian Ehrhardt  tags regression-update server-todo regression-update server-next
2022-02-24 06:39:23 Christian Ehrhardt  samba (Ubuntu): assignee Christian Ehrhardt  (paelzer)
2022-02-24 08:25:28 Ubuntu Foundations Team Bug Bot tags regression-update server-next patch regression-update server-next
2022-03-07 13:25:25 Christian Ehrhardt  tags patch regression-update server-next patch regression-update server-todo
2022-03-09 16:16:45 Christian Ehrhardt  samba (Ubuntu): assignee Andreas Hasenack (ahasenack)
2022-03-09 16:16:59 Christian Ehrhardt  nominated for series Ubuntu Focal
2022-03-09 16:16:59 Christian Ehrhardt  bug task added samba (Ubuntu Focal)
2022-03-09 16:16:59 Christian Ehrhardt  nominated for series Ubuntu Jammy
2022-03-09 16:16:59 Christian Ehrhardt  bug task added samba (Ubuntu Jammy)
2022-03-09 16:16:59 Christian Ehrhardt  nominated for series Ubuntu Impish
2022-03-09 16:16:59 Christian Ehrhardt  bug task added samba (Ubuntu Impish)
2022-03-09 19:08:29 Andreas Hasenack samba (Ubuntu Jammy): status Confirmed In Progress
2022-03-09 20:54:15 Andreas Hasenack samba (Ubuntu Focal): assignee Andreas Hasenack (ahasenack)
2022-03-09 20:54:18 Andreas Hasenack samba (Ubuntu Impish): assignee Andreas Hasenack (ahasenack)
2022-03-09 20:54:21 Andreas Hasenack samba (Ubuntu Impish): status New In Progress
2022-03-09 20:54:22 Andreas Hasenack samba (Ubuntu Focal): status New In Progress
2022-03-10 13:59:50 Andreas Hasenack description After updating my AD-DC to samba 4.13 I am unable to print from normal user accounts (Windows is logging "Win32 error code returned by the print processor: 50. The request is not supported."). Also the Log is full with entries like this: [2021/11/19 01:48:37.496949, 0] ../../source3/rpc_server/rpc_server.c:1086(dcesrv_auth_gensec_prepare) dcesrv_auth_gensec_prepare: Failed to prepare gensec: NT_STATUS_INVALID_SERVER_STATE Enabling debug logs show that this is caused by the ownership of a directory which samba complains is not matching: [2021/11/19 01:48:37.482365, 4, effective(30000XX, 100), real(30000XX, 0)] ../../source3/rpc_server/rpc_ncacn_np.c:110(make_internal_rpc_pipe_socketpair) Create of internal pipe \pipe\spoolss requested [2021/11/19 01:48:37.485785, 3, effective(30000XX, 100), real(30000XX, 0)] ../../lib/util/util.c:483(directory_create_or_exist_strict) directory_create_or_exist_strict: invalid ownership on directory /var/lib/samba/private/msg.sock [2021/11/19 01:48:37.485807, 1, effective(30000XX, 100), real(30000XX, 0)] ../../source3/auth/auth_samba4.c:248(prepare_gensec) imessaging_init failed That is, because /var/lib/samba/private/msg.sock is owned by root:root in my case (and it gets created with those permissions aswell if I delete it), but https://github.com/samba-team/samba/blob/db11778b57610e24324aa4342f89918f66157d71/source4/lib/messaging/messaging.c#L507 uses geteuid() which is sometimes the user ID of the connecting user (as can be seen above, XX is the number that represents the uid of the windows user connecting). I am not sure if this is also the cause for the printing issue, but this spam in the log is super annoying aswell and should be fixed. Futher information about the system: Description: Ubuntu 20.04.3 LTS Release: 20.04 Arch: amd64 Samba-Version: 2:4.13.14+dfsg-0ubuntu0.20.04.1 [Impact] * An explanation of the effects of the bug on users and * justification for backporting the fix to the stable release. * In addition, it is helpful, but not required, to include an explanation of how the upload fixes this bug. [Test Plan] * detailed instructions how to reproduce the bug * these should allow someone who is not familiar with the affected package to reproduce the bug and verify that the updated package fixes the problem. * if other testing is appropriate to perform before landing this update, this should also be described here. [Where problems could occur] * Think about what the upload changes in the software. Imagine the change is wrong or breaks something else: how would this show up? * It is assumed that any SRU candidate patch is well-tested before upload and has a low overall risk of regression, but it's important to make the effort to think about what ''could'' happen in the event of a regression. * This must '''never''' be "None" or "Low", or entirely an argument as to why your upload is low risk. * This both shows the SRU team that the risks have been considered, and provides guidance to testers in regression-testing the SRU. [Other Info] * Anything else you think is useful to include * Anticipate questions from users, SRU, +1 maintenance, security teams and the Technical Board * and address these questions in advance [Original Description] After updating my AD-DC to samba 4.13 I am unable to print from normal user accounts (Windows is logging "Win32 error code returned by the print processor: 50. The request is not supported."). Also the Log is full with entries like this: [2021/11/19 01:48:37.496949, 0] ../../source3/rpc_server/rpc_server.c:1086(dcesrv_auth_gensec_prepare)    dcesrv_auth_gensec_prepare: Failed to prepare gensec: NT_STATUS_INVALID_SERVER_STATE Enabling debug logs show that this is caused by the ownership of a directory which samba complains is not matching: [2021/11/19 01:48:37.482365, 4, effective(30000XX, 100), real(30000XX, 0)] ../../source3/rpc_server/rpc_ncacn_np.c:110(make_internal_rpc_pipe_socketpair)   Create of internal pipe \pipe\spoolss requested [2021/11/19 01:48:37.485785, 3, effective(30000XX, 100), real(30000XX, 0)] ../../lib/util/util.c:483(directory_create_or_exist_strict)   directory_create_or_exist_strict: invalid ownership on directory /var/lib/samba/private/msg.sock [2021/11/19 01:48:37.485807, 1, effective(30000XX, 100), real(30000XX, 0)] ../../source3/auth/auth_samba4.c:248(prepare_gensec)   imessaging_init failed That is, because /var/lib/samba/private/msg.sock is owned by root:root in my case (and it gets created with those permissions aswell if I delete it), but https://github.com/samba-team/samba/blob/db11778b57610e24324aa4342f89918f66157d71/source4/lib/messaging/messaging.c#L507 uses geteuid() which is sometimes the user ID of the connecting user (as can be seen above, XX is the number that represents the uid of the windows user connecting). I am not sure if this is also the cause for the printing issue, but this spam in the log is super annoying aswell and should be fixed. Futher information about the system: Description: Ubuntu 20.04.3 LTS Release: 20.04 Arch: amd64 Samba-Version: 2:4.13.14+dfsg-0ubuntu0.20.04.1
2022-03-10 13:59:54 Andreas Hasenack samba (Ubuntu Impish): importance Undecided High
2022-03-10 13:59:56 Andreas Hasenack samba (Ubuntu Focal): importance Undecided High
2022-03-10 14:02:30 Andreas Hasenack description [Impact] * An explanation of the effects of the bug on users and * justification for backporting the fix to the stable release. * In addition, it is helpful, but not required, to include an explanation of how the upload fixes this bug. [Test Plan] * detailed instructions how to reproduce the bug * these should allow someone who is not familiar with the affected package to reproduce the bug and verify that the updated package fixes the problem. * if other testing is appropriate to perform before landing this update, this should also be described here. [Where problems could occur] * Think about what the upload changes in the software. Imagine the change is wrong or breaks something else: how would this show up? * It is assumed that any SRU candidate patch is well-tested before upload and has a low overall risk of regression, but it's important to make the effort to think about what ''could'' happen in the event of a regression. * This must '''never''' be "None" or "Low", or entirely an argument as to why your upload is low risk. * This both shows the SRU team that the risks have been considered, and provides guidance to testers in regression-testing the SRU. [Other Info] * Anything else you think is useful to include * Anticipate questions from users, SRU, +1 maintenance, security teams and the Technical Board * and address these questions in advance [Original Description] After updating my AD-DC to samba 4.13 I am unable to print from normal user accounts (Windows is logging "Win32 error code returned by the print processor: 50. The request is not supported."). Also the Log is full with entries like this: [2021/11/19 01:48:37.496949, 0] ../../source3/rpc_server/rpc_server.c:1086(dcesrv_auth_gensec_prepare)    dcesrv_auth_gensec_prepare: Failed to prepare gensec: NT_STATUS_INVALID_SERVER_STATE Enabling debug logs show that this is caused by the ownership of a directory which samba complains is not matching: [2021/11/19 01:48:37.482365, 4, effective(30000XX, 100), real(30000XX, 0)] ../../source3/rpc_server/rpc_ncacn_np.c:110(make_internal_rpc_pipe_socketpair)   Create of internal pipe \pipe\spoolss requested [2021/11/19 01:48:37.485785, 3, effective(30000XX, 100), real(30000XX, 0)] ../../lib/util/util.c:483(directory_create_or_exist_strict)   directory_create_or_exist_strict: invalid ownership on directory /var/lib/samba/private/msg.sock [2021/11/19 01:48:37.485807, 1, effective(30000XX, 100), real(30000XX, 0)] ../../source3/auth/auth_samba4.c:248(prepare_gensec)   imessaging_init failed That is, because /var/lib/samba/private/msg.sock is owned by root:root in my case (and it gets created with those permissions aswell if I delete it), but https://github.com/samba-team/samba/blob/db11778b57610e24324aa4342f89918f66157d71/source4/lib/messaging/messaging.c#L507 uses geteuid() which is sometimes the user ID of the connecting user (as can be seen above, XX is the number that represents the uid of the windows user connecting). I am not sure if this is also the cause for the printing issue, but this spam in the log is super annoying aswell and should be fixed. Futher information about the system: Description: Ubuntu 20.04.3 LTS Release: 20.04 Arch: amd64 Samba-Version: 2:4.13.14+dfsg-0ubuntu0.20.04.1 [Impact] After installing the 2021-10 Monthly Rollup patch (KB5006743), printing no longer works. [Test Plan] Bringing up a test environment for this issue is complex, as it involves: - setting up a samba AD controller - setting up printing on said controller - joining windows 7 to the directory - applying (or not) the KB5006743 update for testing before and after We thus will rely on community members to test this fix. The test is: print from an unprivileged normal user account. [Where problems could occur]  * Think about what the upload changes in the software. Imagine the change is    wrong or breaks something else: how would this show up?  * It is assumed that any SRU candidate patch is well-tested before    upload and has a low overall risk of regression, but it's important    to make the effort to think about what ''could'' happen in the    event of a regression.  * This must '''never''' be "None" or "Low", or entirely an argument as to why    your upload is low risk.  * This both shows the SRU team that the risks have been considered,    and provides guidance to testers in regression-testing the SRU. [Other Info]  * Anything else you think is useful to include  * Anticipate questions from users, SRU, +1 maintenance, security teams and the Technical Board  * and address these questions in advance [Original Description] After updating my AD-DC to samba 4.13 I am unable to print from normal user accounts (Windows is logging "Win32 error code returned by the print processor: 50. The request is not supported."). Also the Log is full with entries like this: [2021/11/19 01:48:37.496949, 0] ../../source3/rpc_server/rpc_server.c:1086(dcesrv_auth_gensec_prepare)    dcesrv_auth_gensec_prepare: Failed to prepare gensec: NT_STATUS_INVALID_SERVER_STATE Enabling debug logs show that this is caused by the ownership of a directory which samba complains is not matching: [2021/11/19 01:48:37.482365, 4, effective(30000XX, 100), real(30000XX, 0)] ../../source3/rpc_server/rpc_ncacn_np.c:110(make_internal_rpc_pipe_socketpair)   Create of internal pipe \pipe\spoolss requested [2021/11/19 01:48:37.485785, 3, effective(30000XX, 100), real(30000XX, 0)] ../../lib/util/util.c:483(directory_create_or_exist_strict)   directory_create_or_exist_strict: invalid ownership on directory /var/lib/samba/private/msg.sock [2021/11/19 01:48:37.485807, 1, effective(30000XX, 100), real(30000XX, 0)] ../../source3/auth/auth_samba4.c:248(prepare_gensec)   imessaging_init failed That is, because /var/lib/samba/private/msg.sock is owned by root:root in my case (and it gets created with those permissions aswell if I delete it), but https://github.com/samba-team/samba/blob/db11778b57610e24324aa4342f89918f66157d71/source4/lib/messaging/messaging.c#L507 uses geteuid() which is sometimes the user ID of the connecting user (as can be seen above, XX is the number that represents the uid of the windows user connecting). I am not sure if this is also the cause for the printing issue, but this spam in the log is super annoying aswell and should be fixed. Futher information about the system: Description: Ubuntu 20.04.3 LTS Release: 20.04 Arch: amd64 Samba-Version: 2:4.13.14+dfsg-0ubuntu0.20.04.1
2022-03-10 14:28:42 Andreas Hasenack description [Impact] After installing the 2021-10 Monthly Rollup patch (KB5006743), printing no longer works. [Test Plan] Bringing up a test environment for this issue is complex, as it involves: - setting up a samba AD controller - setting up printing on said controller - joining windows 7 to the directory - applying (or not) the KB5006743 update for testing before and after We thus will rely on community members to test this fix. The test is: print from an unprivileged normal user account. [Where problems could occur]  * Think about what the upload changes in the software. Imagine the change is    wrong or breaks something else: how would this show up?  * It is assumed that any SRU candidate patch is well-tested before    upload and has a low overall risk of regression, but it's important    to make the effort to think about what ''could'' happen in the    event of a regression.  * This must '''never''' be "None" or "Low", or entirely an argument as to why    your upload is low risk.  * This both shows the SRU team that the risks have been considered,    and provides guidance to testers in regression-testing the SRU. [Other Info]  * Anything else you think is useful to include  * Anticipate questions from users, SRU, +1 maintenance, security teams and the Technical Board  * and address these questions in advance [Original Description] After updating my AD-DC to samba 4.13 I am unable to print from normal user accounts (Windows is logging "Win32 error code returned by the print processor: 50. The request is not supported."). Also the Log is full with entries like this: [2021/11/19 01:48:37.496949, 0] ../../source3/rpc_server/rpc_server.c:1086(dcesrv_auth_gensec_prepare)    dcesrv_auth_gensec_prepare: Failed to prepare gensec: NT_STATUS_INVALID_SERVER_STATE Enabling debug logs show that this is caused by the ownership of a directory which samba complains is not matching: [2021/11/19 01:48:37.482365, 4, effective(30000XX, 100), real(30000XX, 0)] ../../source3/rpc_server/rpc_ncacn_np.c:110(make_internal_rpc_pipe_socketpair)   Create of internal pipe \pipe\spoolss requested [2021/11/19 01:48:37.485785, 3, effective(30000XX, 100), real(30000XX, 0)] ../../lib/util/util.c:483(directory_create_or_exist_strict)   directory_create_or_exist_strict: invalid ownership on directory /var/lib/samba/private/msg.sock [2021/11/19 01:48:37.485807, 1, effective(30000XX, 100), real(30000XX, 0)] ../../source3/auth/auth_samba4.c:248(prepare_gensec)   imessaging_init failed That is, because /var/lib/samba/private/msg.sock is owned by root:root in my case (and it gets created with those permissions aswell if I delete it), but https://github.com/samba-team/samba/blob/db11778b57610e24324aa4342f89918f66157d71/source4/lib/messaging/messaging.c#L507 uses geteuid() which is sometimes the user ID of the connecting user (as can be seen above, XX is the number that represents the uid of the windows user connecting). I am not sure if this is also the cause for the printing issue, but this spam in the log is super annoying aswell and should be fixed. Futher information about the system: Description: Ubuntu 20.04.3 LTS Release: 20.04 Arch: amd64 Samba-Version: 2:4.13.14+dfsg-0ubuntu0.20.04.1 [Impact] After installing the 2021-10 Monthly Rollup patch (KB5006743), printing no longer works. [Test Plan] Bringing up a test environment for this issue is complex, as it involves: - setting up a samba AD controller (perhaps a plain NT controller is sufficient) - setting up printing on said controller - joining windows 7 to the directory - applying (or not) the KB5006743 update for testing before and after We thus will rely on community members to test this fix. The test is: print from an unprivileged normal user account. [Where problems could occur] Samba is a complex piece of software, specially when used in the Active Directory Domain Controller role. Printing doesn't make it simpler. The configuration file smb.conf is reloaded periodically in the background if there were changes, so I don't think a service restart would uncover previously undetected invalid configuration. Calls to switch privileges for a specific function must come in pairs, and that is the case with this fix with regard to become/unbecome_root. I grepped the code and this pair is used in many places, but always with a warning that the calls must be paired, and the function must not return without the unbecome_root call. This means mistakes could be made, but this patch seems to have paid attention to this important detail. There is no verification whether unbecome_root succeeded in this patch, but that seems to be the pattern everywhere else. Maybe the function panics() if it fails, I couldn't verify that. [Other Info] Not at this time. [Original Description] After updating my AD-DC to samba 4.13 I am unable to print from normal user accounts (Windows is logging "Win32 error code returned by the print processor: 50. The request is not supported."). Also the Log is full with entries like this: [2021/11/19 01:48:37.496949, 0] ../../source3/rpc_server/rpc_server.c:1086(dcesrv_auth_gensec_prepare)    dcesrv_auth_gensec_prepare: Failed to prepare gensec: NT_STATUS_INVALID_SERVER_STATE Enabling debug logs show that this is caused by the ownership of a directory which samba complains is not matching: [2021/11/19 01:48:37.482365, 4, effective(30000XX, 100), real(30000XX, 0)] ../../source3/rpc_server/rpc_ncacn_np.c:110(make_internal_rpc_pipe_socketpair)   Create of internal pipe \pipe\spoolss requested [2021/11/19 01:48:37.485785, 3, effective(30000XX, 100), real(30000XX, 0)] ../../lib/util/util.c:483(directory_create_or_exist_strict)   directory_create_or_exist_strict: invalid ownership on directory /var/lib/samba/private/msg.sock [2021/11/19 01:48:37.485807, 1, effective(30000XX, 100), real(30000XX, 0)] ../../source3/auth/auth_samba4.c:248(prepare_gensec)   imessaging_init failed That is, because /var/lib/samba/private/msg.sock is owned by root:root in my case (and it gets created with those permissions aswell if I delete it), but https://github.com/samba-team/samba/blob/db11778b57610e24324aa4342f89918f66157d71/source4/lib/messaging/messaging.c#L507 uses geteuid() which is sometimes the user ID of the connecting user (as can be seen above, XX is the number that represents the uid of the windows user connecting). I am not sure if this is also the cause for the printing issue, but this spam in the log is super annoying aswell and should be fixed. Futher information about the system: Description: Ubuntu 20.04.3 LTS Release: 20.04 Arch: amd64 Samba-Version: 2:4.13.14+dfsg-0ubuntu0.20.04.1
2022-03-10 14:30:48 Launchpad Janitor merge proposal linked https://code.launchpad.net/~ahasenack/ubuntu/+source/samba/+git/samba/+merge/416666
2022-03-10 14:31:49 Launchpad Janitor merge proposal linked https://code.launchpad.net/~ahasenack/ubuntu/+source/samba/+git/samba/+merge/416667
2022-03-10 14:32:18 Launchpad Janitor merge proposal linked https://code.launchpad.net/~ahasenack/ubuntu/+source/samba/+git/samba/+merge/416668
2022-03-11 18:24:34 Launchpad Janitor samba (Ubuntu Jammy): status In Progress Fix Released
2022-03-17 09:42:32 Łukasz Zemczak samba (Ubuntu Impish): status In Progress Fix Committed
2022-03-17 09:42:34 Łukasz Zemczak bug added subscriber Ubuntu Stable Release Updates Team
2022-03-17 09:42:35 Łukasz Zemczak bug added subscriber SRU Verification
2022-03-17 09:42:38 Łukasz Zemczak tags patch regression-update server-todo patch regression-update server-todo verification-needed verification-needed-impish
2022-03-17 09:43:29 Łukasz Zemczak samba (Ubuntu Focal): status In Progress Fix Committed
2022-03-17 09:43:34 Łukasz Zemczak tags patch regression-update server-todo verification-needed verification-needed-impish patch regression-update server-todo verification-needed verification-needed-focal verification-needed-impish
2022-03-17 13:51:18 Andreas Hasenack bug added subscriber Andreas Hasenack
2022-03-30 19:44:18 Sebastian Chrostek tags patch regression-update server-todo verification-needed verification-needed-focal verification-needed-impish patch regression-update server-todo verification-done-focal verification-needed verification-needed-impish
2022-04-04 08:19:40 Łukasz Zemczak removed subscriber Ubuntu Stable Release Updates Team
2022-04-04 08:19:39 Launchpad Janitor samba (Ubuntu Focal): status Fix Committed Fix Released
2022-05-18 15:22:45 Christian Ehrhardt  tags patch regression-update server-todo verification-done-focal verification-needed verification-needed-impish patch regression-update verification-done-focal verification-needed verification-needed-impish
2022-06-06 13:13:15 Launchpad Janitor merge proposal linked https://code.launchpad.net/~ahasenack/ubuntu/+source/samba/+git/samba/+merge/423998
2022-06-06 13:20:47 Launchpad Janitor merge proposal linked https://code.launchpad.net/~ahasenack/ubuntu/+source/samba/+git/samba/+merge/423999
2022-06-06 13:53:00 Launchpad Janitor merge proposal linked https://code.launchpad.net/~ahasenack/ubuntu/+source/samba/+git/samba/+merge/424001
2022-07-18 22:57:00 Brian Murray samba (Ubuntu Impish): status Fix Committed Won't Fix