Bug 15921 - CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set
Summary: CTDB_SOCKET can be used even when CTDB_TEST_MODE is not set
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: CTDB (show other bugs)
Version: 4.11.0
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Jule Anger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-09-25 05:45 UTC by Martin Schwenke
Modified: 2025-11-11 12:31 UTC (History)
1 user (show)

See Also:

Attachments
Patch for all stable versions (8.71 KB, patch)
2025-09-26 00:03 UTC, Martin Schwenke 		vl: review+
Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Schwenke 2025-09-25 05:45:41 UTC 
A foolish user could find references to CTDB_SOCKET in the source and then use it in a production environment.  If an attacker can control the value of CTDB_SOCKET then the chown() of the socket in ctdbd could then allow a symlink race or similar to be used.  The chances of this are tiny so not treating this as a CVE-worthy security issue.

We will just fix it and backport it to stable versions.
Comment 1 Samba QA Contact 2025-09-25 09:03:03 UTC 
This bug was referenced in samba master:

c4794e40529c63c696ecc3f8f27c810c22dd63a5
4c12a36eb5b44fb08d0461e6fa77fcdb4a128433
7e2358fcf7be177d6e5de6e26f9d7c5af4acbb0c
Comment 2 Martin Schwenke 2025-09-26 00:03:15 UTC 
Created attachment 18735 [details]
Patch for all stable versions

Cherry-picks cleanly from master.  Same patch applies cleanly to all current stable branches (v4-23-test, v4-22-test, v4-21-test).  It appears that we are going to do another bug fix release for 4.21, so we might as well include this.

Tested on each stable branch as follows:

$ git am BZ15921.patch
$ CFLAGS=-O3 ./configure --enable-developer --abi-check-disable --enable-selftest --with-cluster-support && make -j 8 && make test TESTS=clusteredmember

LGTM.
Comment 3 Jule Anger 2025-09-26 13:17:59 UTC 
Pushed to autobuild-v4-{23,22,21}-test.
Comment 4 Samba QA Contact 2025-09-26 13:33:03 UTC 
This bug was referenced in samba v4-23-test:

95b2c73d46ff1672bad324a8d5a4a2a8ee89fc27
d20797de97f6c4e5abca174e4a1429dc3e848d14
35e59dcfd2790a5ca1237a5ab2574270c2482195
Comment 5 Samba QA Contact 2025-09-26 13:52:33 UTC 
This bug was referenced in samba v4-23-stable (Release samba-4.23.1):

95b2c73d46ff1672bad324a8d5a4a2a8ee89fc27
d20797de97f6c4e5abca174e4a1429dc3e848d14
35e59dcfd2790a5ca1237a5ab2574270c2482195
Comment 6 Samba QA Contact 2025-09-26 15:11:03 UTC 
This bug was referenced in samba v4-22-test:

6bdd14199d0fbcc9a9e6f966d8dff81d5a87540d
e4445e74b0bd92f1a1b37c674b00e507292a1c33
ad38c9849503fd5acff83e80b9cb46bd719e31c4
Comment 7 Samba QA Contact 2025-10-15 13:21:30 UTC 
This bug was referenced in samba v4-21-test:

086f6393ab300f37962428b9a1cd318624b95130
467557d63a0ffebb15b88e5f5bee1ca9dbddcb2b
825d6197effca4d252ca5172ac9e15abe257b91e
Comment 8 Jule Anger 2025-10-15 16:35:37 UTC 
Closing out bug report.

Thanks!
Comment 9 Samba QA Contact 2025-10-16 14:37:49 UTC 
This bug was referenced in samba v4-22-stable (Release samba-4.22.6):

6bdd14199d0fbcc9a9e6f966d8dff81d5a87540d
e4445e74b0bd92f1a1b37c674b00e507292a1c33
ad38c9849503fd5acff83e80b9cb46bd719e31c4
Comment 10 Samba QA Contact 2025-11-11 12:31:10 UTC 
This bug was referenced in samba v4-21-stable (Release samba-4.21.10):

086f6393ab300f37962428b9a1cd318624b95130
467557d63a0ffebb15b88e5f5bee1ca9dbddcb2b
825d6197effca4d252ca5172ac9e15abe257b91e