Attachment 14625 Details for Bug 13678 – patch for v4-7, v4-8, v4-9 to disable the build by default (v2)

[patch] patch for v4-7, v4-8, v4-9 to disable the build by default (v2)

mit-kdc-experimental-v4-7.patch (text/plain), 2.31 KB, created by Andrew Bartlett on 2018-11-07 20:43:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andrew Bartlett

Created: 2018-11-07 20:43:07 UTC

Size: 2.31 KB

patch

obsolete

>From d3b52c8a1866a63a54497da9931fa606b77d089a Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Tue, 6 Nov 2018 13:32:05 +1300
>Subject: [PATCH] CVE-2018-16853 build: The Samba AD DC, when build with MIT
> Kerberos is experimental
>
>This matches https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=13678
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
>---
> wscript | 17 +++++++++++++++++
> 1 file changed, 17 insertions(+)
>
>diff --git a/wscript b/wscript
>index 542a60cf819..c9a4de4982b 100644
>--- a/wscript
>+++ b/wscript
>@@ -52,6 +52,14 @@ def set_options(opt):
>                    help='build Samba with system MIT Kerberos. ' +
>                         'You may specify list of paths where Kerberos is installed (e.g. /usr/local /usr/kerberos) to search krb5-config',
>                    action='callback', callback=system_mitkrb5_callback, dest='with_system_mitkrb5', default=False)
>+
>+    opt.add_option('--with-experimental-mit-ad-dc',
>+                   help='Enable the experimental MIT Kerberos-backed AD DC.  ' +
>+                   'Note that security patches are not issued for this configuration',
>+                   action='store_true',
>+                   dest='with_experimental_mit_ad_dc',
>+                   default=False)
>+
>     opt.add_option('--with-system-mitkdc',
>                    help=('Specify the path to the krb5kdc binary from MIT Kerberos'),
>                    type="string",
>@@ -165,7 +173,16 @@ def configure(conf):
>         conf.DEFINE('AD_DC_BUILD_IS_ENABLED', 1)
> 
>     if Options.options.with_system_mitkrb5:
>+        if not Options.options.with_experimental_mit_ad_dc and \
>+           not Options.options.without_ad_dc:
>+            raise Utils.WafError('The MIT Kerberos build of Samba as an AD DC ' +
>+                                 'is experimental. Therefore '
>+                                 '--with-system-mitkrb5 requires either ' +
>+                                 '--with-experimental-mit-ad-dc or ' +
>+                                 '--without-ad-dc')
>+
>         conf.PROCESS_SEPARATE_RULE('system_mitkrb5')
>+
>     if not (Options.options.without_ad_dc or Options.options.with_system_mitkrb5):
>         conf.DEFINE('AD_DC_BUILD_IS_ENABLED', 1)
> 
>-- 
>2.11.0
>

Flags:

dbagnall: review+

Actions: View

Attachments on bug 13678: 14606 | 14607 | 14624 | 14625 | 14633 | 14675