Attachment 14624 Details for Bug 13678 – patch for master to disable the build by default (v2)

[patch] patch for master to disable the build by default (v2)

mit-kdc-experimental-master.patch (text/plain), 3.48 KB, created by Andrew Bartlett on 2018-11-07 20:42:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andrew Bartlett

Created: 2018-11-07 20:42:28 UTC

Size: 3.48 KB

patch

obsolete

>From 14ae9d8b32c65420b592ff41be690b62967d088a Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Tue, 6 Nov 2018 13:32:05 +1300
>Subject: [PATCH 1/2] CVE-2018-16853 build: The Samba AD DC, when build with
> MIT Kerberos is experimental
>
>This matches https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=13678
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
>---
> wscript | 17 +++++++++++++++++
> 1 file changed, 17 insertions(+)
>
>diff --git a/wscript b/wscript
>index c5d8e5bdd7d..e9d8a834aa2 100644
>--- a/wscript
>+++ b/wscript
>@@ -55,6 +55,14 @@ def options(opt):
>                    help='build Samba with system MIT Kerberos. ' +
>                         'You may specify list of paths where Kerberos is installed (e.g. /usr/local /usr/kerberos) to search krb5-config',
>                    action='callback', callback=system_mitkrb5_callback, dest='with_system_mitkrb5', default=False)
>+
>+    opt.add_option('--with-experimental-mit-ad-dc',
>+                   help='Enable the experimental MIT Kerberos-backed AD DC.  ' +
>+                   'Note that security patches are not issued for this configuration',
>+                   action='store_true',
>+                   dest='with_experimental_mit_ad_dc',
>+                   default=False)
>+
>     opt.add_option('--with-system-mitkdc',
>                    help=('Specify the path to the krb5kdc binary from MIT Kerberos'),
>                    type="string",
>@@ -214,7 +222,16 @@ def configure(conf):
>         conf.DEFINE('AD_DC_BUILD_IS_ENABLED', 1)
> 
>     if Options.options.with_system_mitkrb5:
>+        if not Options.options.with_experimental_mit_ad_dc and \
>+           not Options.options.without_ad_dc:
>+            raise Utils.WafError('The MIT Kerberos build of Samba as an AD DC ' +
>+                                 'is experimental. Therefore '
>+                                 '--with-system-mitkrb5 requires either ' +
>+                                 '--with-experimental-mit-ad-dc or ' +
>+                                 '--without-ad-dc')
>+
>         conf.PROCESS_SEPARATE_RULE('system_mitkrb5')
>+
>     if not (Options.options.without_ad_dc or Options.options.with_system_mitkrb5):
>         conf.DEFINE('AD_DC_BUILD_IS_ENABLED', 1)
> 
>-- 
>2.11.0
>
>
>From 714e89438d19df310cae3ab53bcb7e05f3fe9786 Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Tue, 6 Nov 2018 13:40:48 +1300
>Subject: [PATCH 2/2] CVE-2018-16853 WHATSNEW: The Samba AD DC, when build with
> MIT Kerberos is experimental
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=13678
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
>---
> WHATSNEW.txt | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
>diff --git a/WHATSNEW.txt b/WHATSNEW.txt
>index bdc3df78b23..72889c61f2f 100644
>--- a/WHATSNEW.txt
>+++ b/WHATSNEW.txt
>@@ -31,6 +31,16 @@ the backup and restore to account for the change in domain).
> REMOVED FEATURES
> ================
> 
>+MIT Kerberos build of the AD DC
>+-------------------------------
>+
>+While not removed, the MIT Kerberos build of the Samba AD DC is still
>+considered experimental.  Because Samba will not issue security
>+patches for this configuration, such builds now require the explicit
>+configure option: --with-experimental-mit-ad-dc
>+
>+For further details see
>+https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC
> 
> smb.conf changes
> ================
>-- 
>2.11.0
>

Flags:

dbagnall: review+

Actions: View

Attachments on bug 13678: 14606 | 14607 | 14624 | 14625 | 14633 | 14675