Bug 13186 - winbind fails to translate uids to BUILTIN groups
winbind fails to translate uids to BUILTIN groups
Status: NEW
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Winbind
4.7.3
All Linux
: P5 regression
: ---
Assigned To: Samba QA Contact
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-12-12 15:37 UTC by Fabian Lesniak
Modified: 2017-12-14 17:00 UTC (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Fabian Lesniak 2017-12-12 15:37:48 UTC
I was running samba 4.5.12 as AD DC. I have no special settings for idmap or winbind in my smb.conf, thus everything should be set to the default for freshly provisioned domains. Files created using an admin account and therefore belonging to "BUILTIN\Administrators" (uid/gid 3000000) were resolved correctly:

# wbinfo --uid-info 3000000
BUILTIN\administrators:*:3000000:3000000::/srv/samba/home/administrators:/bin/bash
# wbinfo --gid-info=3000000
BUILTIN\administrators:x:3000000:
# l file-created-with-admin-account.txt
-rwxrwxr-x+ 1 BUILTIN\administrators users 0 12. Dez 16:11 file-created-with-admin-account.txt

After upgrading to 4.7.3, resolving uids of BUILTIN groups fails:

# wbinfo --uid-info=3000000
failed to call wbcGetpwuid: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for uid 3000000
# wbinfo --gid-info=3000000
BUILTIN\administrators:x:3000000:
# l file-created-with-admin-account.txt 
-rwxrwxr-x 1 3000000 users 0 12. Dez 15:11 file-created-with-admin-account.txt

However, in both cases, resolving as a gid works:
# wbinfo --gid-info=3000000
BUILTIN\administrators:x:3000000:

I bisected the bug the following commit between 4.5 and 4.6.0:
bce19a6efe1 winbind: Restructure wb_getpwsid

Before this commit, resolving 3000000 as uid works as expected.
After this commit and with any newer stable version (I tested 4.6.3, 4.6.11, 4.7.3), these uid can't be resolved.

bug 11757 is similar, but as far as I can see not a duplicated because it is older than the mentioned commit. Maybe it has the same root cause.

I tried to dig through the winbind query functions and noticed that resolving uid 3000000 to the corresponding SID works, but afterwards translating this SID to the name fails. I have not been able to find the root cause for that, but I'm curious to try if someone can point me in the right direction.