Samba 3.0.5 Security release

4 files changed, 406 insertions, 32 deletions

diff --git a/net-fs/samba/ChangeLog b/net-fs/samba/ChangeLog
index a166883c274a..c69aeeb7e8aa 100644
--- a/net-fs/samba/ChangeLog
+++ b/net-fs/samba/ChangeLog
@@ -1,6 +1,11 @@
 # ChangeLog for net-fs/samba
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-fs/samba/ChangeLog,v 1.89 2004/07/13 23:39:23 kloeri Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-fs/samba/ChangeLog,v 1.90 2004/07/22 14:46:42 mglauche Exp $
+
+*samba-3.0.5 (22 Jul 2004)
+
+  22 Jul 2004; Michael Glauche <mglauche@gentoo.org> samba-3.0.5.ebuild:
+  Version bump, fixes 2 buffer overruns.
 
   14 Jul 2004; Bryan Østergaard <kloeri@gentoo.org> samba-3.0.4-r1.ebuild:
   Stable on alpha.
diff --git a/net-fs/samba/Manifest b/net-fs/samba/Manifest
index ab9d6c343ce7..e5f4e0d4c2ec 100644
--- a/net-fs/samba/Manifest
+++ b/net-fs/samba/Manifest
@@ -1,44 +1,36 @@
------BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
-
-MD5 7bb830f107c1336e0b136ad7aacd5e5f ChangeLog 17476
-MD5 63bc25b07c7404f26d602e69ddad747e metadata.xml 458
 MD5 7d7c900829bc2bdf39895d5890a0d20d samba-3.0.4-r1.ebuild 11146
 MD5 633511d04d7a7d7702c17089c85ba697 samba-3.0.1-r1.ebuild 11333
 MD5 df4f73693b725799675e37ba3f90643f samba-3.0.2a-r2.ebuild 12249
+MD5 2f1e0fb8c339d77eb6d02d2dd736d486 ChangeLog 17621
+MD5 63bc25b07c7404f26d602e69ddad747e metadata.xml 458
+MD5 df85655b2e290c92aae00898f8a41642 samba-3.0.5.ebuild 11143
+MD5 ccc96fcdc7493be42da52364061c6c17 files/winbind-init 484
+MD5 fcebd975211fecf647f6cecf26ba5c96 files/samba-3.0.4.patch 8086
+MD5 e89b19f1e62e257cbaa23a44a0362a58 files/swat.xinetd 527
+MD5 20997c75e29fec20efbb2cd6695cd3a9 files/recycle.conf 776
+MD5 a7cc90ba23d86b1d90f65645826dde19 files/smbldap_conf.pm 7095
+MD5 cbaa5a39d9bd67b13f8131b426a4256b files/samba-2.2.5-gp-reloc-fix.patch 431
+MD5 7ee5edc70bf80888c776f5808f865996 files/nsswitch.conf-wins 392
+MD5 341521b710d02d57a70acd49b1d4c06b files/samba-conf 1291
+MD5 83b384d6b47ecbf20525cc9a7baaa77a files/samba-init 1093
 MD5 fd2382184b6a07e63cb07ff26b578fd2 files/config-svc-smbd+nmbd 784
-MD5 a86336201c2eced7a6e5a5138514e2f7 files/digest-samba-3.0.4-r1 203
-MD5 de43ff30dd5f1431590fd62a997e71b4 files/samba-3.0.4-python-setup.patch 833
-MD5 f3a4b3b0a8162ae87779846d7e6adbbf files/digest-samba-3.0.1-r1 202
-MD5 519576a9448b86f1a7baab18204533a5 files/lmhosts 126
 MD5 f402c2c4103f4c13ac3cc5fa165940db files/nonroot-bind.diff 757
 MD5 5d3129a0f6bcbec6ec91d217881a34e1 files/nsswitch.conf-winbind 298
-MD5 7ee5edc70bf80888c776f5808f865996 files/nsswitch.conf-wins 392
-MD5 20997c75e29fec20efbb2cd6695cd3a9 files/recycle.conf 776
-MD5 cbaa5a39d9bd67b13f8131b426a4256b files/samba-2.2.5-gp-reloc-fix.patch 431
-MD5 8289eda694b35875eec6df5cc3f50c86 files/samba-2.2.6-libresolv.patch 540
-MD5 60e527174c1b2c53126dbbedb3cae0f7 files/samba-2.2.8-statfs.patch 209
+MD5 519576a9448b86f1a7baab18204533a5 files/lmhosts 126
 MD5 516ca38dfc67b7cd7356f93ad2cf75b9 files/samba-3.0.0-python-setup.patch 767
-MD5 83b384d6b47ecbf20525cc9a7baaa77a files/samba-init 1093
-MD5 9560b7e29d3a65db029fc1800e84abcc files/samba-pdb_ldap-exop.patch 3921
-MD5 6b6683448cdc01d013bd2c61b4ed8e1e files/samba-slapd-include.conf 499
-MD5 6acf6a5e92ff2cfc5f09b88f5d01b63e files/samba-svc 975
-MD5 b6cdc1468e45f92f19873e0c6c5b6e94 files/samba.pam 332
 MD5 1eec486ab39a239e25a76b16a6fcd460 files/smb.conf.example 16183
+MD5 6b6683448cdc01d013bd2c61b4ed8e1e files/samba-slapd-include.conf 499
+MD5 60e527174c1b2c53126dbbedb3cae0f7 files/samba-2.2.8-statfs.patch 209
+MD5 43a38a5331805a2fa61e899f18413ccd files/digest-samba-3.0.5 203
+MD5 f3a4b3b0a8162ae87779846d7e6adbbf files/digest-samba-3.0.1-r1 202
+MD5 a86336201c2eced7a6e5a5138514e2f7 files/digest-samba-3.0.4-r1 203
 MD5 8c1f1e3655e12b85102ce257f3efad62 files/smb.conf.example-samba3 20762
-MD5 a7cc90ba23d86b1d90f65645826dde19 files/smbldap_conf.pm 7095
+MD5 9560b7e29d3a65db029fc1800e84abcc files/samba-pdb_ldap-exop.patch 3921
 MD5 3685eadb817d185b06476eca6c0c15c4 files/smbusers 204
-MD5 e89b19f1e62e257cbaa23a44a0362a58 files/swat.xinetd 527
 MD5 09195dd8ab25ce77ac51c0c05b4ab93c files/system-auth-winbind 869
-MD5 ccc96fcdc7493be42da52364061c6c17 files/winbind-init 484
-MD5 fcebd975211fecf647f6cecf26ba5c96 files/samba-3.0.4.patch 8086
-MD5 341521b710d02d57a70acd49b1d4c06b files/samba-conf 1291
 MD5 990fe15ff8a0e79f39069fff6475536d files/samba-3.0.2a-smbprint.patch 1224
+MD5 6acf6a5e92ff2cfc5f09b88f5d01b63e files/samba-svc 975
+MD5 b6cdc1468e45f92f19873e0c6c5b6e94 files/samba.pam 332
 MD5 81931e1d9764390841dec0d0f327a114 files/digest-samba-3.0.2a-r2 204
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1.2.4 (GNU/Linux)
-
-iD8DBQFA+fZdmdTrptrqvGERAgW1AJsFAMrzPCUKU+JHyDyjupjrYsHdOwCeJzRW
-zaefOcDIXaUZ09TxPnxHxOY=
-=dFtk
------END PGP SIGNATURE-----
+MD5 de43ff30dd5f1431590fd62a997e71b4 files/samba-3.0.4-python-setup.patch 833
+MD5 8289eda694b35875eec6df5cc3f50c86 files/samba-2.2.6-libresolv.patch 540
diff --git a/net-fs/samba/files/digest-samba-3.0.5 b/net-fs/samba/files/digest-samba-3.0.5
new file mode 100644
index 000000000000..43008dbb2a75
--- /dev/null
+++ b/net-fs/samba/files/digest-samba-3.0.5
@@ -0,0 +1,3 @@
+MD5 5896ad33676e3c26efaab5dcd897c466 samba-3.0.5.tar.gz 15076996
+MD5 5f173d549014985d681478897135915b samba-vscan-0.3.5.tar.bz2 161982
+MD5 34ef159fc49a2c30ff27b481dc8e1215 smbldap-tools-0.8.4.tgz 286290
diff --git a/net-fs/samba/samba-3.0.5.ebuild b/net-fs/samba/samba-3.0.5.ebuild
new file mode 100644
index 000000000000..526a9caad24a
--- /dev/null
+++ b/net-fs/samba/samba-3.0.5.ebuild
@@ -0,0 +1,374 @@
+# Copyright 1999-2004 Gentoo Foudation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-fs/samba/samba-3.0.5.ebuild,v 1.1 2004/07/22 14:46:42 mglauche Exp $
+
+inherit eutils
+
+IUSE="kerberos mysql postgres xml xml2 acl cups ldap pam readline python doc"
+IUSE="${IUSE} oav"
+
+DESCRIPTION="SAMBA is a suite of SMB and CIFS client/server programs for UNIX"
+HOMEPAGE="http://www.samba.org/
+	http://www.openantivirus.org/projects.php
+	http://samba.idealx.org"
+
+SMBLDAP_TOOLS_VER=0.8.4
+VSCAN_VER=0.3.5
+VSCAN_MODS="oav sophos fprotd fsav trend icap mksd kavp clamav nai"
+
+_CVS="-${PV/_/}"
+S=${WORKDIR}/${PN}${_CVS}
+
+SRC_URI="mirror://samba/${PN}${_CVS}.tar.gz
+	oav? mirror://sourceforge/openantivirus/${PN}-vscan-${VSCAN_VER}.tar.bz2
+	ldap? http://samba.idealx.org/dist/smbldap-tools-${SMBLDAP_TOOLS_VER}.tgz"
+
+_COMMON_DEPS="dev-libs/popt
+	readline? sys-libs/readline
+	ldap? ( kerberos? ( virtual/krb5 ) )
+	mysql? ( dev-db/mysql sys-libs/zlib )
+	postgres? ( dev-db/postgresql sys-libs/zlib )
+	xml? ( dev-libs/libxml2 sys-libs/zlib )
+	xml2? ( dev-libs/libxml2 sys-libs/zlib )
+	acl? sys-apps/acl
+	cups? net-print/cups
+	ldap? net-nds/openldap
+	pam? sys-libs/pam
+	python? dev-lang/python"
+DEPEND="sys-devel/autoconf
+	>=sys-apps/sed-4
+	${_COMMON_DEPS}"
+#IDEALX scripts are now using Net::LDAP
+RDEPEND="ldap? dev-perl/perl-ldap ${_COMMON_DEPS}"
+
+KEYWORDS="x86 ~ppc sparc ~mips hppa ~amd64 ~ia64 alpha ppc64"
+LICENSE="GPL-2"
+SLOT="0"
+
+src_unpack() {
+	local i
+	unpack ${A} || die
+	cd ${S} || die
+
+	# Clean up CVS
+	find . -name .cvsignore | xargs rm -f
+	find . -name CVS | xargs rm -rf
+
+	# Add patch(es)
+	# This patchset fixes Samba bugs #1315, #1319 and #1345
+	# courtesy of Gerald Carter (jerry@samba.org)
+	epatch ${FILESDIR}/samba-3.0.4.patch
+
+	#Next one is from eger@cc.gatech.edu :)
+	epatch ${FILESDIR}/samba-3.0.4-python-setup.patch || die
+	#Fix for bug #27858
+	if [ "${ARCH}" = "sparc" -o "${ARCH}" = "ppc" ]
+	then
+		cd ${S}/source/include
+		epatch ${FILESDIR}/samba-2.2.8-statfs.patch
+	fi
+	#Bug #36200; sys-kernel/linux-headers dependent
+	sed -i -e 's:#define LINUX_QUOTAS_2:#define LINUX_QUOTAS_1:' \
+		-e 's:<linux/quota.h>:<sys/quota.h>:' \
+		${S}/source/smbd/quotas.c
+
+	# For clean docs packaging sake.
+	rm -rf ${S}/examples.bin
+	cp -a ${S}/examples ${S}/examples.bin
+
+	# Prep samba-vscan source.
+	use oav && cp -a ${WORKDIR}/${PN}-vscan-${VSCAN_VER} ${S}/examples.bin/VFS
+
+	cd ${S}/source
+	echo "Running autoconf ..."
+	autoconf || die
+}
+
+src_compile() {
+	local i
+	local myconf
+	local mymods
+
+	#this is deprecated...
+	#mymods="nisplussam"
+	use xml || use xml2 && mymods="xml,${mymods}"
+	use mysql && mymods="mysql,${mymods}"
+	use postgres && mymods="pgsql,${mymods}"
+
+	[ -n "${mymods}" ] && myconf="--with-expsam=${mymods}"
+
+	use acl \
+		&& myconf="${myconf} --with-acl-support" \
+		|| myconf="${myconf} --without-acl-support"
+
+	use pam \
+		&& myconf="${myconf} --with-pam --with-pam_smbpass" \
+		|| myconf="${myconf} --without-pam --without-pam_smbpass"
+
+	use cups \
+		&& myconf="${myconf} --enable-cups" \
+		|| myconf="${myconf} --disable-cups"
+
+	use ldap \
+		&& myconf="${myconf} --with-ldap" \
+		|| myconf="${myconf} --without-ldap"
+	#this is for old samba 2.x compat
+	#myconf="${myconf} --with-ldapsam"
+	myconf="${myconf} --without-ldapsam"
+
+	if [ "${ARCH}" != "amd64" ]
+	then
+		use kerberos && use ldap \
+			&& myconf="${myconf} --with-ads" \
+			|| myconf="${myconf} --without-ads"
+	else
+		myconf="${myconf} --without-ads"
+	fi
+
+	use python \
+		&& myconf="${myconf} --with-python=yes" \
+		|| myconf="${myconf} --with-python=no"
+
+	use readline \
+		&& myconf="${myconf} --with-readline" \
+		|| myconf="${myconf} --without-readline"
+
+	einfo "\$myconf is: $myconf"
+
+	#default_{static,shared}_modules|source/configure
+	#/usr/lib/samba/auth/.............      AUTH_MODULES
+	#/usr/lib/samba/charset/		CHARSET_MODULES
+	#/usr/lib/samba/pdb/..............      PDB_MODULES
+	#/usr/lib/samba/rpc/		    RPC_MODULES
+	#/usr/lib/samba/vfs/..............      VFS_MODULES|source/Makefile
+	#/usr/lib/samba/lowcase.dat
+	#/usr/lib/samba/upcase.dat
+	#/usr/lib/samba/valid.dat
+
+	cd source
+	./configure \
+		--prefix=/usr \
+		--libdir=/usr/lib \
+		--with-swatdir=/usr/share/doc/${PF}/swat \
+		--localstatedir=/var \
+		--with-piddir=/var/run/samba \
+		--with-lockdir=/var/cache/samba \
+		--with-logfilebase=/var/log/samba \
+		--sysconfdir=/etc/samba \
+		--with-configdir=/etc/samba \
+		--with-privatedir=/etc/samba/private \
+		\
+		--enable-static \
+		--enable-shared \
+		--with-manpages-langs=en \
+		--without-spinlocks \
+		--with-libsmbclient \
+		--with-automount \
+		--with-smbmount \
+		--with-winbind \
+		--with-quotas \
+		--with-syslog \
+		--with-idmap \
+		--host=${CHOST} \
+		${myconf} || die
+
+	# Show install dirs
+	einfo "Dir conf:"
+	make showlayout
+
+	# Subshell make: some headers are to be compiled in sequence even for a 
+	# parallel make
+	make proto
+
+	# Compile main SAMBA pieces.
+	make everything || die "SAMBA pieces"
+	make rpctorture || ewarn "rpctorture didnt build"
+
+	# Build mount.cifs
+	cd ${S}/source
+	gcc ${CFLAGS} client/mount.cifs.c -o bin/mount.cifs
+	assert "mount.cifs compile problem"
+	# build smbget
+	make bin/smbget; assert "smbget compile error"
+
+	# Build selected samba-vscan plugins.
+	if use oav
+	then
+		cd ${S}/examples.bin/VFS/${PN}-vscan-${VSCAN_VER}
+		./configure
+		assert "bad ${PN}-vscan-${VSCAN_VER} ./configure"
+		# Do not use the Makefiles in the sub directories, use the Makefile
+		# generated by .configure in the top-level samba-vscan directory
+		# - suggested by Rainer Link, samba-vscan maintainer
+		make ${VSCAN_MODS}
+	fi
+
+	# Build mkntpasswd from the smbldap-tools.
+	if use ldap
+	then
+		cd ${WORKDIR}/smbldap-tools-${SMBLDAP_TOOLS_VER}
+		tar --no-same-owner -zxf mkntpwd.tar.gz
+		cd mkntpwd
+		VISUAL="" make || die "mkntpwd compile problem"
+	fi
+}
+
+src_install() {
+	local extra_bins="debug2html smbfilter talloctort mount.cifs smbget"
+	#smbsh editreg
+	extra_bins="${extra_bins} smbtorture msgtest masktest locktest \
+		locktest2 nsstest vfstest rpctorture"
+
+	cd ${S}/source
+	make DESTDIR=${D} install-everything
+
+	# Extra binary files, testing/torture progs
+	exeinto /usr/bin
+	for i in ${extra_bins}
+	do
+		[ -x ${S}/source/bin/${i} ] && doexe ${S}/source/bin/${i} && \
+		einfo "Extra binaries: ${i}"
+	done
+	# Installing these setuid-root allows users to (un)mount smbfs/cifs.
+	for i in /usr/bin/smbumount /usr/bin/smbmnt /usr/bin/mount.cifs
+	do
+		fperms 4111 ${i}
+		einfo "suid: ${i}"
+	done
+	# Nsswitch extensions. Make link for wins and winbind resolvers.
+	exeinto /lib
+	for i in wins winbind
+	do
+		doexe ${S}/source/nsswitch/libnss_${i}.so
+		( cd ${D}/lib; ln -s libnss_${i}.so libnss_${i}.so.2 )
+	done
+	exeinto /lib/security
+	doexe ${S}/source/nsswitch/pam_winbind.so
+	use pam && doexe ${S}/source/bin/pam_smbpass.so
+
+	# Links
+	# link /usr/bin/smbmount to /sbin/mount.smbfs which allows it
+	# to work transparently with the standard 'mount' command..
+	dodir /sbin
+	dosym /usr/bin/smbmount /sbin/mount.smbfs
+	dosym /usr/bin/mount.cifs /sbin/mount.cifs
+	# make the smb backend symlink for cups printing support..
+	if use cups; then
+		dodir /usr/lib/cups/backend
+		dosym /usr/bin/smbspool /usr/lib/cups/backend/smb
+	fi
+
+	# Install IDEALX scripts for LDAP backend administration.
+	if use ldap; then
+		# corrections as per bug #41796
+		cd ${WORKDIR}/smbldap-tools-${SMBLDAP_TOOLS_VER}
+		exeinto /usr/share/samba/scripts ; doexe smbldap-*
+		exeinto /usr/sbin ; doexe mkntpwd/mkntpwd
+		exeinto /etc/samba ; doexe smbldap_tools.pm
+		insinto /etc/smbldap-tools ; doins *.conf
+		fperms 644 /etc/smbldap-tools/smbldap.conf
+		fperms 600 /etc/smbldap-tools/smbldap_bind.conf
+		eval `perl '-V:installarchlib'`
+		dodir ${installarchlib}
+		#dosym /etc/samba/smbldap_conf.pm ${installarchlib}
+		#dosym /etc/samba/smbldap_conf.pm /usr/share/samba/scripts
+		dosym /etc/samba/smbldap_tools.pm ${installarchlib}
+		dosym /etc/samba/smbldap_tools.pm /usr/share/samba/scripts
+	fi
+
+	# VFS plugin modules
+	if use oav
+	then
+		exeinto /usr/lib/vfs
+		doexe ${S}/examples.bin/VFS/${PN}-vscan-${VSCAN_VER}/vscan-*.so
+	fi
+
+	# Python extensions.
+	if use python
+	then
+		cd ${S}/source
+		python python/setup.py install --root=${D} || die
+	fi
+
+	# General config files.
+	insinto /etc
+	insinto /etc/samba
+	doins ${FILESDIR}/smbusers
+	newins ${FILESDIR}/smb.conf.example-samba3 smb.conf.example
+	doins ${FILESDIR}/lmhosts
+	doins ${FILESDIR}/recycle.conf
+	insinto /etc/pam.d
+	newins ${FILESDIR}/samba.pam samba
+	doins ${FILESDIR}/system-auth-winbind
+	insinto /etc/xinetd.d
+	newins ${FILESDIR}/swat.xinetd swat
+	exeinto /etc/init.d; newexe ${FILESDIR}/samba-init samba
+	insinto /etc/conf.d; newins ${FILESDIR}/samba-conf samba
+	if use ldap; then
+		insinto /etc/openldap/schema
+		doins ${S}/examples/LDAP/samba.schema
+	fi
+
+	# Docs
+	docinto ""
+	dodoc ${S}/COPYING ${S}/Manifest ${S}/README ${S}/Roadmap ${S}/WHATSNEW.txt
+	docinto examples
+	dodoc ${FILESDIR}/nsswitch.conf-{wins,winbind}
+	cp -a ${S}/examples/* ${D}/usr/share/doc/${PF}/examples
+	if use oav; then
+		docinto ${PN}-vscan-${VSCAN_VER}
+		cd ${WORKDIR}/${PN}-vscan-${VSCAN_VER}
+		dodoc AUTHORS COPYING ChangeLog FAQ INSTALL NEWS README TODO
+		dodoc */*.conf
+	fi
+	if use ldap; then
+		docinto smbldap-tools-${SMBLDAP_TOOLS_VER}
+		cd ${WORKDIR}/smbldap-tools-${SMBLDAP_TOOLS_VER}
+		dodoc CONTRIBUTORS COPYING ChangeLog FILES INFRA INSTALL README TODO
+	fi
+	if ! use doc; then
+		rm -rf ${D}/usr/share/doc/${PF}/swat/help/{guide,howto,devel}
+		rm -rf ${D}/usr/share/doc/${PF}/swat/using_samba
+	fi
+	chown -R root:root ${D}/usr/share/doc/${PF}
+
+	# moving manpages
+	mv ${D}/usr/man ${D}/usr/share/man
+}
+
+pkg_postinst() {
+	# touch /etc/samba/smb.conf so that people installing samba just
+	# to mount smb shares don't get annoying warnings all the time..
+	[ ! -e ${ROOT}/etc/samba/smb.conf ] && touch ${ROOT}/etc/samba/smb.conf
+
+	# empty dirs..
+	install -m0700 -o root -g root -d ${ROOT}/etc/samba/private
+	install -m1777 -o root -g root -d ${ROOT}/var/spool/samba
+	install -m0755 -o root -g root -d ${ROOT}/var/log/samba
+	install -m0755 -o root -g root -d ${ROOT}/var/log/samba3
+	install -m0755 -o root -g root -d ${ROOT}/var/run/samba
+	install -m0755 -o root -g root -d ${ROOT}/var/cache/samba
+	install -m0755 -o root -g root -d ${ROOT}/var/lib/samba/{netlogon,profiles}
+	install -m0755 -o root -g root -d \
+		${ROOT}/var/lib/samba/printers/{W32X86,WIN40,W32ALPHA,W32MIPS,W32PPC}
+
+	ewarn ""
+	ewarn "If you are upgrading from a Samba version prior to 3.0.2, and you"
+	ewarn "use Samba's password database, you must run the following command:"
+	ewarn ""
+	ewarn "  pdbedit --force-initialized-passwords"
+	ewarn ""
+	if use ldap; then
+		ewarn "If you are upgrading from prior to 3.0.2, and you are using LDAP"
+		ewarn "for Samba authentication, you must check the sambaPwdLastSet"
+		ewarn "attribute on all accounts, and ensure it is not 0."
+		einfo ""
+		einfo "WARNING: the smbldap-tools conf file location has changed to"
+		einfo " /etc/smbldap-tools"
+		einfo "reconfiguration will be necessary."
+		einfo ""
+		einfo "WARNING: the names of the scripts in /usr/shared/samba/scripts"
+		einfo "have changed. Please update your /etc/samba/smb.conf."
+		einfo ""
+	fi
+}