Bug 13503 - getpwnam resolves local system accounts to AD accounts
Summary: getpwnam resolves local system accounts to AD accounts
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Winbind (show other bugs)
Version: 4.8.3
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
Depends on:
Blocks: 13815
  Show dependency treegraph
Reported: 2018-07-03 11:45 UTC by Andreas Schneider
Modified: 2020-12-17 00:56 UTC (History)
6 users (show)

See Also:

Patch for 4.8 cherry-picked from master (7.25 KB, patch)
2018-07-05 07:55 UTC, Ralph Böhme
asn: review+
asn: review+
patch for 4.8 (8.59 KB, patch)
2018-08-10 06:25 UTC, Andreas Schneider
jra: review+
asn: review? (slow)
patch without test for v4.8 (972 bytes, patch)
2018-08-23 08:11 UTC, Andreas Schneider
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Schneider 2018-07-03 11:45:54 UTC
getpwnam resolves local system accounts to AD accounts.

This is normally how the lookup is done:

getent passwd ADDOMAIN/alice
ADDOMAIN/alice:*:100000:100006::/home/ADDOMAIN/Domain Users/alice:/bin/false

This should not resolve to an AD user, unless 'winbind use default domain = yes' is set:

getent passwd alice
ADDOMAIN/alice:*:100000:100006::/home/ADDOMAIN/Domain Users/alice:/bin/false

Patch will follow.
Comment 1 Ralph Böhme 2018-07-05 07:55:32 UTC
Created attachment 14280 [details]
Patch for 4.8 cherry-picked from master
Comment 2 Andreas Schneider 2018-07-05 08:55:43 UTC
Karolin, please add the patch to v4.8. Thanks
Comment 3 Karolin Seeger 2018-07-06 09:17:58 UTC
(In reply to Andreas Schneider from comment #2)
Pushed to autobuild-v4-8-test.
Comment 4 Karolin Seeger 2018-07-06 10:53:51 UTC
autobuild-v4-8-test fails with:

[344(1874)/2266 at 22m9s] samba3.wbinfo_user_info(ad_member:local)
UNEXPECTED(failure): samba3.wbinfo_user_info.getpwnam.local.alice(ad_member:local)
REASON: Exception: Exception: getent passwd alice
return code: 2, expected return code is: 0
Comment 5 Karolin Seeger 2018-07-10 10:40:48 UTC
Removed from v4-8-test to get the other changes through autobuild.
Comment 6 Andreas Schneider 2018-08-10 06:25:28 UTC
Created attachment 14405 [details]
patch for 4.8
Comment 7 Jeremy Allison 2018-08-10 16:27:22 UTC
Re-assigning to Karolin for inclusion in 4.8.next.
Comment 8 Karolin Seeger 2018-08-14 11:01:17 UTC
Pushed to autobuild-v4-8-test.
Comment 9 Karolin Seeger 2018-08-23 07:48:17 UTC
(In reply to Karolin Seeger from comment #8)
Autobuild is failing with the same error again.
Re-trying without this patchset.
Comment 10 Andreas Schneider 2018-08-23 08:11:02 UTC
Created attachment 14444 [details]
patch without test for v4.8

This means that $ENVNAME is not set on autobuild and it selects the wrong return code checks.

This works totally fine if I run it locally in v4-8-test:

[1(0)/1 at 0s] samba3.wbinfo_user_info(ad_member:local)
ALL OK (13 tests in 1 testsuites)

If the test doesn't work on 4.8 (it works on 4.9 and master), can you please just add the fix without the test?

I've attached the fix without the tests.
Comment 11 Karolin Seeger 2018-08-23 08:25:47 UTC
(In reply to Andreas Schneider from comment #10)
Pushed the patch without test.
Comment 12 Karolin Seeger 2018-08-24 09:49:56 UTC
Pushed to v4-8-test.
Closing out bug report.

Comment 13 Karolin Seeger 2018-08-24 09:52:41 UTC
Pushed to v4-8-test.
Closing out bug report.