From patchwork Tue Apr 28 12:11:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9750 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4g4fRm6f5mz3xN2 for ; Tue, 28 Apr 2026 12:11:32 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4g4fRm3vNJz7GV for ; Tue, 28 Apr 2026 12:11:32 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4g4fRd41Ysz34Vl for ; Tue, 28 Apr 2026 12:11:25 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4g4fRY4Fvgz33yl for ; Tue, 28 Apr 2026 12:11:21 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4g4fRX4nXNz1FG; Tue, 28 Apr 2026 12:11:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1777378280; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=XZ9RL9LeYKWyJdu1ebhCXUQ4ff6lqO7Yk+FQkqaSSuc=; b=WTZIufSVyy+iEmmZWtbkBOBHP4wBtDyUuzBDvSJ8/jZ/z4HJlLUV5pQP7JRkjRG/RybXUJ 01y9zmCjEwEqMg5il7w1xAjd4KXPyPQxDiTWpAb0WL5xFbUylzV2Qitny+MCpS7hrgvUCh IuAyzfSg9GvWKqzMNTauX8CH4AXQcjgBKN4Ixq7FlV6JdHqjCiBdcgUYaVLyKGB7INpxyg u2sbx+XRqXgbv1IMMJYMUdm3SnSv1VXnnj2AXABe4o+KNOO42bEiICMrmdfqUdaUjmuWSy LtrzPTc7Vsz+LjwxEn0sleGYuPEKoy9RKnfuSYV8ct8eDHEQh86SQQUmYcH+TQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1777378280; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=XZ9RL9LeYKWyJdu1ebhCXUQ4ff6lqO7Yk+FQkqaSSuc=; b=PwRCEbY0DWD30fR7zd1exnIIRy/HXykATfYm31s4o9WJLSFCvOeNmZO+Mf/tktT1JY1lCn MMqXMedMkwB2X0AA== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] samba: Update to version 4.24.1 Date: Tue, 28 Apr 2026 14:11:11 +0200 Message-ID: <20260428121111.1146161-11-adolf.belka@ipfire.org> In-Reply-To: <20260428121111.1146161-1-adolf.belka@ipfire.org> References: <20260428121111.1146161-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 4.23.6 to 4.24.1 - Update of rootfiles for all three architectures - Changelog 4.24.1 * BUG 16057: autobuild fails if /proc/version contains trailing space * BUG 16035: use after free in streams_xattr_connect() * BUG 16042: rpc workers with long living clients grow server memory keytab * BUG 16058: vfs_snapper failing to access or enumerate files in subfolders * BUG 16040: Samba is not build with FORTIFY_SOURCE * BUG 16055: Fix tests with MIT Kerberos 1.22.x 4.24.0 NEW FEATURES/CHANGES Authentication information audit support There are some Active Directory attributes that are not secret, but are relied on in some forms of authentication. Changes to these attributes could indicate surreptitious activity. The "dsdb_password_audit" and "dsdb_password_json_audit" debug classes now log changes to the following attributes: * altSecurityIdentities * dNSHostName * msDS-AdditionalDnsHostName * msDS-KeyCredentialLink * servicePrincipalName For the JSON logs, changes to these will be logged with the "action" field set to "Auth info change". vfs_streams_xattr can hold larger streams On Linux the size of a single extended attribute is limited to 65536 bytes of size. For some file systems, this is also the overall limit of space for xattrs, but for example xfs can hold more than that 64k of extended xattrs, although the individual xattr is still limited to 64k. Setting streams_xattr:max xattrs per stream = 1 to a higher value than 1 will allow Samba to shard the stream to more than one xattr. It has an artificial limit of 16 for a maximum stream length of 1MB. Support for remote password management (Entra ID SSPR, Keycloak) When a system such as Entra ID or Keycloak wants to change a user's password in its own database as well as in AD, it will use a password reset, meaning it does not transmit the old password to the domain controller. Normally a password reset avoids password history and age checks, which would allow a cloud password change to bypass on-premises password policies. To address this, a password reset using the "policy hints" control should respect password policies, as if it were an ordinary password change. Both Entra ID and Keycloak use this, but until now Samba did not understand this control, and would reject these reset requests. Now Samba AD will recognise the policy hints control and enforce local policy. This allows Microsoft Entra self-service password reset (SSPR) to work, and for Keycloak to work with the "password policy hints enabled" option. Kerberos PKINIT KeyTrust logon support Samba servers configured with the embedded heimdal KDC and running as an ADDC, now support "Windows Hello for Business Key-Trust logons". This allows the PKINIT authentication mechanism to be used with self-signed keys. The samba-tool computer and user commands have a new "keytrust" sub-command which allows for the setting and viewing of the public key details for computer and user accounts. This stores the public key details in msDS-KeyCredentialLink attribute of the account. msDS-KeyCredentialLink validation Updates to the msDS-KeyCredentialLink attribute are validated against the rules specified by MS-ADTS 3.1.1.5.3.1.1.6. Kerberos PKINIT strong/flexible key mappings Samba servers configured with the embedded heimdal KDC and running as an ADDC now support "Windows Strong and Flexible key mappings" as outlined in Microsoft KB5014754: Certificate-based authentication changes on Windows domain controllers. The default enforcement mode ("full") allows only strong certificate mappings. The smb.conf option strong certificate binding enforcement = compatibility will allow weak mappings where the certificate is newer than the user account. The option "none" will allow any mappings. The mappings for an account should be placed in the altSecurityIdentities attribute and follow the syntax documented in KB5014754. Kerberos PKINIT SID extension PKINIT authentication now supports certificates containing an Object SID extension (extension 1.3.6.1.4.1.311.25.2), this is considered to be a STRONG mapping for KB5014754. The computer and user samba-tool commands have a new sub-command "generate-csr" to generate certificate signing requests. KDC includes PAC by default Samba will ignore the value provided by the client in "PA-PAC-REQUEST" and always include a PAC in responses, unless "kdc always generate pac" is set to "no". KDC can insist clients request canonicalization Canonicalization of principal client names is not mandatory in Kerberos (per RFC4120), but must be requested by the client. In some circumstances allows a client to deceive Active Directory member servers (known as the "dollar ticket" attack). The new configuration option "kdc require canonicalization" can be used to require that clients request canonicalization; if they do not, their AS_REQ requests will be rejected as if the account was unknown. The default value is "no", for backward compatibility. Windows clients will ask for canonicalization by default, so in Windows-heavy environments it is safe and recommended to set this to "yes". KDC can avoid potentially confusing canonicalization Currently when the client does not request canonicalization, when the KDC looks up a name and there is no match it will append a "$" to the name and try again. An attacker who can create arbitrary machine accounts can sometimes get tickets for Unix users by mimicking their names (the "dollar ticket" attack). The configuration option kdc name match implicit dollar without canonicalization = no can be used to disable this behaviour for clients that do not request canonicalization. Probably this only affects traditional Unix clients, as Windows clients use canonicalization. If affected clients want a ticket for a machine account, they will have to use the full name including the dollar (e.g. "server$", not "server"). If the "kdc require canonicalization" option cannot be set to "yes" (because some clients do not request canonicalization) setting this option to "no" is a good alternative. KDC provides Kerberos acceptors with canonical client names By default the KDC will now send Kerberos services the canonicalized name (the sAMAccountName from the PAC) rather than trusting the cname. To return to the old behaviour, use krb5 acceptor report canonical client name = no in the smb.conf. This currently affects Heimdal KDC only, not MIT. KDC recommended configuration: strong certificate binding enforcement full kdc always include pac yes kdc require canonicalization yes If unable to use "kdc require canonicalization" = "yes", then "kdc name match implicit dollar without implicit canonicalization" should be set to "no" if possible. samba tool Two new sub-commands have been added to the user and computer commands: user|computer generate-csr Generate a Certificate signing request for an account containing the Object SID extension (extension 1.3.6.1.4.1.311.25.2) user|computer keytrust Add the public key details of a self signed certificate to an account. The command supports PEM and DER encoded public keys. New AIO rate-limiting VFS module A new VFS stackable module has been introduced to implement rate-limiting for asynchronous I/O operations. Administrators can now enforce throughput ceilings by defining limits in either operations per second or bytes per second. The module utilizes a token-based algorithm to calculate real-time I/O load; when limits are exceeded, it dynamically injects millisecond delays into async operations to maintain the defined threshold. CephFS FSCrypt support for the VFS ceph_new module The ceph_new VFS module can now make use of the FSCrypt feature recently added to CephFS. This enhancement enables data and file name encryption on a per share basis. A single CephFS file system may host a mix of encrypted and unencrypted directories. To obtain the encryption keys needed for FSCrypt the ceph_new module includes support for the Keybridge protocol. Keybridge is an RPC protocol based on Varlink that can retrieve keys from a local service via a UNIX socket. Users can choose to develop a custom Keybridge implementation or use the existing KMIP-compatible Keybridge server available as part of the sambacc project (https://github.com/samba-in-kubernetes/sambacc). Domain encryption types changed to AES by default The default value of the smb.conf option ‘kdc default domain supported enctypes’ now corresponds to ‘aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96’ (both AES encryption types) if the domain functional level is 2008 or higher. This addresses CVE-2026-20833. smb.conf changes Parameter Name Description Default strong certificate binding enforcement New full certificate backdating compensation New 0 kdc always include pac New yes kdc require canonicalization New no kdc name match implicit dollar without canonicalization New yes kdc default domain supported enctypes New default AES encryption types (if supported by domain) bugfixes * BUG 16019: incorrect behavior on rpcclient enumport with rpcd_spoolss * BUG 16001: altSecurityIdentities X509 issuer DN order is reversed * BUG 16000: vfs_aio_ratelimit: introduce burst-aware and persistent state model 4.24.0rc3 * BUG 15990: No function _python_sysroot defined * BUG 15978: leases torture test flappy * BUG 15984: smbd: in contend_dirleases() don't bother checking when not enabled * BUG 15993: 'net ads kerberos kinit' should use also default ccache name from krb5.conf * BUG 15789: "use-kerberos=desired" broken * BUG 15975: source3/libads/kerberos.c sets wrong failure for negative connection cache * BUG 15938: CTDB's statd_callout fails on sm-notify * BUG 15939: CTDB statd_callout_notify notifies unnecessary clients and loses their state * BUG 15939: CTDB statd_callout_notify notifies unnecessary clients and loses their state * BUG 15998: Backport domain default AES encryption types to 4.24 4.24.0rc2 * BUG 15979: possible memory leak on rpc_spoolss * BUG 15972: Winbind group resolution failure * BUG 15979: possible memory leak on rpc_spoolss * BUG 15977: ctdbd socket documentation is wrong * BUG 15976: time_t related build failure on 32bit arch in 4.24.0rc1 Signed-off-by: Adolf Belka --- config/rootfiles/packages/aarch64/samba | 17 +++++++++++++++++ config/rootfiles/packages/riscv64/samba | 17 +++++++++++++++++ config/rootfiles/packages/x86_64/samba | 17 +++++++++++++++++ lfs/samba | 6 +++--- 4 files changed, 54 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/packages/aarch64/samba b/config/rootfiles/packages/aarch64/samba index d1e56440a..f1b997a87 100644 --- a/config/rootfiles/packages/aarch64/samba +++ b/config/rootfiles/packages/aarch64/samba @@ -124,6 +124,7 @@ usr/bin/wspsearch #usr/include/samba-4.0/util/idtree_random.h #usr/include/samba-4.0/util/signal.h #usr/include/samba-4.0/util/substitute.h +#usr/include/samba-4.0/util/talloc_keep_secret.h #usr/include/samba-4.0/util/tfork.h #usr/include/samba-4.0/util/time.h #usr/include/samba-4.0/util_ldb.h @@ -188,6 +189,7 @@ usr/lib/python3.10/site-packages/ldb.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/__init__.py usr/lib/python3.10/site-packages/samba/_glue.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/_ldb.cpython-310-aarch64-linux-gnu.so +usr/lib/python3.10/site-packages/samba/asn1.py usr/lib/python3.10/site-packages/samba/auth.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/auth_util.py usr/lib/python3.10/site-packages/samba/colour.py @@ -287,6 +289,7 @@ usr/lib/python3.10/site-packages/samba/emulate/traffic.py usr/lib/python3.10/site-packages/samba/emulate/traffic_packets.py usr/lib/python3.10/site-packages/samba/forest_update.py usr/lib/python3.10/site-packages/samba/functional_level.py +usr/lib/python3.10/site-packages/samba/generate_csr.py usr/lib/python3.10/site-packages/samba/gensec.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/getopt.py usr/lib/python3.10/site-packages/samba/gkdi.py @@ -337,6 +340,7 @@ usr/lib/python3.10/site-packages/samba/kcc/graph.py usr/lib/python3.10/site-packages/samba/kcc/graph_utils.py usr/lib/python3.10/site-packages/samba/kcc/kcc_utils.py usr/lib/python3.10/site-packages/samba/kcc/ldif_import_export.py +usr/lib/python3.10/site-packages/samba/key_credential_link.py usr/lib/python3.10/site-packages/samba/logger.py usr/lib/python3.10/site-packages/samba/lsa_utils.py usr/lib/python3.10/site-packages/samba/mdb_util.py @@ -353,6 +357,8 @@ usr/lib/python3.10/site-packages/samba/netbios.cpython-310-aarch64-linux-gnu.so usr/lib/python3.10/site-packages/samba/netcmd/__init__.py usr/lib/python3.10/site-packages/samba/netcmd/common.py usr/lib/python3.10/site-packages/samba/netcmd/computer.py +usr/lib/python3.10/site-packages/samba/netcmd/computer_generate_csr.py +usr/lib/python3.10/site-packages/samba/netcmd/computer_keytrust.py usr/lib/python3.10/site-packages/samba/netcmd/contact.py usr/lib/python3.10/site-packages/samba/netcmd/dbcheck.py usr/lib/python3.10/site-packages/samba/netcmd/delegation.py @@ -434,7 +440,9 @@ usr/lib/python3.10/site-packages/samba/netcmd/user/delete.py usr/lib/python3.10/site-packages/samba/netcmd/user/disable.py usr/lib/python3.10/site-packages/samba/netcmd/user/edit.py usr/lib/python3.10/site-packages/samba/netcmd/user/enable.py +usr/lib/python3.10/site-packages/samba/netcmd/user/generate_csr.py usr/lib/python3.10/site-packages/samba/netcmd/user/getgroups.py +usr/lib/python3.10/site-packages/samba/netcmd/user/keytrust.py usr/lib/python3.10/site-packages/samba/netcmd/user/list.py usr/lib/python3.10/site-packages/samba/netcmd/user/move.py usr/lib/python3.10/site-packages/samba/netcmd/user/password.py @@ -580,6 +588,7 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/domain_backup_offline.py #usr/lib/python3.10/site-packages/samba/tests/dsdb.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_api.py +#usr/lib/python3.10/site-packages/samba/tests/dsdb_dn.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_dns.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_lock.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_quiet_env_tests.py @@ -609,6 +618,7 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/kcc/kcc_utils.py #usr/lib/python3.10/site-packages/samba/tests/kcc/ldif_import_export.py #usr/lib/python3.10/site-packages/samba/tests/key_credential_link.py +#usr/lib/python3.10/site-packages/samba/tests/key_credential_link_samdb.py #usr/lib/python3.10/site-packages/samba/tests/krb5 #usr/lib/python3.10/site-packages/samba/tests/krb5/alias_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/as_canonicalization_tests.py @@ -629,12 +639,14 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kdc_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kdc_tgs_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kdc_tgt_tests.py +#usr/lib/python3.10/site-packages/samba/tests/krb5/key_trust_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kpasswd_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/lockout_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/netlogon.py #usr/lib/python3.10/site-packages/samba/tests/krb5/nt_hash_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/pac_align_tests.py +#usr/lib/python3.10/site-packages/samba/tests/krb5/pkinit_certificate_mapping_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/pkinit_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/protected_users_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/raw_testcase.py @@ -756,8 +768,10 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_auth_policy.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_auth_silo.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_check_password_script.py +#usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_generate_csr.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_get_kerberos_ticket.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_getpassword_gmsa.py +#usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_keytrust.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_virtualCryptSHA.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_virtualCryptSHA_base.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py @@ -975,6 +989,7 @@ usr/lib/samba/vfs/acl_tdb.so usr/lib/samba/vfs/acl_xattr.so usr/lib/samba/vfs/aio_fork.so usr/lib/samba/vfs/aio_pthread.so +usr/lib/samba/vfs/aio_ratelimit.so usr/lib/samba/vfs/audit.so usr/lib/samba/vfs/btrfs.so usr/lib/samba/vfs/cap.so @@ -1039,6 +1054,8 @@ usr/sbin/winbindd #usr/share/locale/hu/LC_MESSAGES/pam_winbind.mo #usr/share/locale/it/LC_MESSAGES/pam_winbind.mo #usr/share/locale/ja/LC_MESSAGES/pam_winbind.mo +#usr/share/locale/ka/LC_MESSAGES/net.mo +#usr/share/locale/ka/LC_MESSAGES/pam_winbind.mo #usr/share/locale/ko/LC_MESSAGES/pam_winbind.mo #usr/share/locale/nb/LC_MESSAGES/pam_winbind.mo #usr/share/locale/nl/LC_MESSAGES/pam_winbind.mo diff --git a/config/rootfiles/packages/riscv64/samba b/config/rootfiles/packages/riscv64/samba index 2cff83ea1..17d234343 100644 --- a/config/rootfiles/packages/riscv64/samba +++ b/config/rootfiles/packages/riscv64/samba @@ -124,6 +124,7 @@ usr/bin/wspsearch #usr/include/samba-4.0/util/idtree_random.h #usr/include/samba-4.0/util/signal.h #usr/include/samba-4.0/util/substitute.h +#usr/include/samba-4.0/util/talloc_keep_secret.h #usr/include/samba-4.0/util/tfork.h #usr/include/samba-4.0/util/time.h #usr/include/samba-4.0/util_ldb.h @@ -188,6 +189,7 @@ usr/lib/python3.10/site-packages/ldb.cpython-310-riscv64-linux-gnu.so usr/lib/python3.10/site-packages/samba/__init__.py usr/lib/python3.10/site-packages/samba/_glue.cpython-310-riscv64-linux-gnu.so usr/lib/python3.10/site-packages/samba/_ldb.cpython-310-riscv64-linux-gnu.so +usr/lib/python3.10/site-packages/samba/asn1.py usr/lib/python3.10/site-packages/samba/auth.cpython-310-riscv64-linux-gnu.so usr/lib/python3.10/site-packages/samba/auth_util.py usr/lib/python3.10/site-packages/samba/colour.py @@ -287,6 +289,7 @@ usr/lib/python3.10/site-packages/samba/emulate/traffic.py usr/lib/python3.10/site-packages/samba/emulate/traffic_packets.py usr/lib/python3.10/site-packages/samba/forest_update.py usr/lib/python3.10/site-packages/samba/functional_level.py +usr/lib/python3.10/site-packages/samba/generate_csr.py usr/lib/python3.10/site-packages/samba/gensec.cpython-310-riscv64-linux-gnu.so usr/lib/python3.10/site-packages/samba/getopt.py usr/lib/python3.10/site-packages/samba/gkdi.py @@ -337,6 +340,7 @@ usr/lib/python3.10/site-packages/samba/kcc/graph.py usr/lib/python3.10/site-packages/samba/kcc/graph_utils.py usr/lib/python3.10/site-packages/samba/kcc/kcc_utils.py usr/lib/python3.10/site-packages/samba/kcc/ldif_import_export.py +usr/lib/python3.10/site-packages/samba/key_credential_link.py usr/lib/python3.10/site-packages/samba/logger.py usr/lib/python3.10/site-packages/samba/lsa_utils.py usr/lib/python3.10/site-packages/samba/mdb_util.py @@ -353,6 +357,8 @@ usr/lib/python3.10/site-packages/samba/netbios.cpython-310-riscv64-linux-gnu.so usr/lib/python3.10/site-packages/samba/netcmd/__init__.py usr/lib/python3.10/site-packages/samba/netcmd/common.py usr/lib/python3.10/site-packages/samba/netcmd/computer.py +usr/lib/python3.10/site-packages/samba/netcmd/computer_generate_csr.py +usr/lib/python3.10/site-packages/samba/netcmd/computer_keytrust.py usr/lib/python3.10/site-packages/samba/netcmd/contact.py usr/lib/python3.10/site-packages/samba/netcmd/dbcheck.py usr/lib/python3.10/site-packages/samba/netcmd/delegation.py @@ -434,7 +440,9 @@ usr/lib/python3.10/site-packages/samba/netcmd/user/delete.py usr/lib/python3.10/site-packages/samba/netcmd/user/disable.py usr/lib/python3.10/site-packages/samba/netcmd/user/edit.py usr/lib/python3.10/site-packages/samba/netcmd/user/enable.py +usr/lib/python3.10/site-packages/samba/netcmd/user/generate_csr.py usr/lib/python3.10/site-packages/samba/netcmd/user/getgroups.py +usr/lib/python3.10/site-packages/samba/netcmd/user/keytrust.py usr/lib/python3.10/site-packages/samba/netcmd/user/list.py usr/lib/python3.10/site-packages/samba/netcmd/user/move.py usr/lib/python3.10/site-packages/samba/netcmd/user/password.py @@ -580,6 +588,7 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/domain_backup_offline.py #usr/lib/python3.10/site-packages/samba/tests/dsdb.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_api.py +#usr/lib/python3.10/site-packages/samba/tests/dsdb_dn.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_dns.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_lock.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_quiet_env_tests.py @@ -609,6 +618,7 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/kcc/kcc_utils.py #usr/lib/python3.10/site-packages/samba/tests/kcc/ldif_import_export.py #usr/lib/python3.10/site-packages/samba/tests/key_credential_link.py +#usr/lib/python3.10/site-packages/samba/tests/key_credential_link_samdb.py #usr/lib/python3.10/site-packages/samba/tests/krb5 #usr/lib/python3.10/site-packages/samba/tests/krb5/alias_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/as_canonicalization_tests.py @@ -629,12 +639,14 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kdc_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kdc_tgs_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kdc_tgt_tests.py +#usr/lib/python3.10/site-packages/samba/tests/krb5/key_trust_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kpasswd_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/lockout_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/netlogon.py #usr/lib/python3.10/site-packages/samba/tests/krb5/nt_hash_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/pac_align_tests.py +#usr/lib/python3.10/site-packages/samba/tests/krb5/pkinit_certificate_mapping_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/pkinit_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/protected_users_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/raw_testcase.py @@ -756,8 +768,10 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_auth_policy.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_auth_silo.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_check_password_script.py +#usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_generate_csr.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_get_kerberos_ticket.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_getpassword_gmsa.py +#usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_keytrust.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_virtualCryptSHA.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_virtualCryptSHA_base.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py @@ -975,6 +989,7 @@ usr/lib/samba/vfs/acl_tdb.so usr/lib/samba/vfs/acl_xattr.so usr/lib/samba/vfs/aio_fork.so usr/lib/samba/vfs/aio_pthread.so +usr/lib/samba/vfs/aio_ratelimit.so usr/lib/samba/vfs/audit.so usr/lib/samba/vfs/btrfs.so usr/lib/samba/vfs/cap.so @@ -1039,6 +1054,8 @@ usr/sbin/winbindd #usr/share/locale/hu/LC_MESSAGES/pam_winbind.mo #usr/share/locale/it/LC_MESSAGES/pam_winbind.mo #usr/share/locale/ja/LC_MESSAGES/pam_winbind.mo +#usr/share/locale/ka/LC_MESSAGES/net.mo +#usr/share/locale/ka/LC_MESSAGES/pam_winbind.mo #usr/share/locale/ko/LC_MESSAGES/pam_winbind.mo #usr/share/locale/nb/LC_MESSAGES/pam_winbind.mo #usr/share/locale/nl/LC_MESSAGES/pam_winbind.mo diff --git a/config/rootfiles/packages/x86_64/samba b/config/rootfiles/packages/x86_64/samba index d800fca99..582ed8ebe 100644 --- a/config/rootfiles/packages/x86_64/samba +++ b/config/rootfiles/packages/x86_64/samba @@ -124,6 +124,7 @@ usr/bin/wspsearch #usr/include/samba-4.0/util/idtree_random.h #usr/include/samba-4.0/util/signal.h #usr/include/samba-4.0/util/substitute.h +#usr/include/samba-4.0/util/talloc_keep_secret.h #usr/include/samba-4.0/util/tfork.h #usr/include/samba-4.0/util/time.h #usr/include/samba-4.0/util_ldb.h @@ -188,6 +189,7 @@ usr/lib/python3.10/site-packages/ldb.cpython-310-x86_64-linux-gnu.so usr/lib/python3.10/site-packages/samba/__init__.py usr/lib/python3.10/site-packages/samba/_glue.cpython-310-x86_64-linux-gnu.so usr/lib/python3.10/site-packages/samba/_ldb.cpython-310-x86_64-linux-gnu.so +usr/lib/python3.10/site-packages/samba/asn1.py usr/lib/python3.10/site-packages/samba/auth.cpython-310-x86_64-linux-gnu.so usr/lib/python3.10/site-packages/samba/auth_util.py usr/lib/python3.10/site-packages/samba/colour.py @@ -287,6 +289,7 @@ usr/lib/python3.10/site-packages/samba/emulate/traffic.py usr/lib/python3.10/site-packages/samba/emulate/traffic_packets.py usr/lib/python3.10/site-packages/samba/forest_update.py usr/lib/python3.10/site-packages/samba/functional_level.py +usr/lib/python3.10/site-packages/samba/generate_csr.py usr/lib/python3.10/site-packages/samba/gensec.cpython-310-x86_64-linux-gnu.so usr/lib/python3.10/site-packages/samba/getopt.py usr/lib/python3.10/site-packages/samba/gkdi.py @@ -337,6 +340,7 @@ usr/lib/python3.10/site-packages/samba/kcc/graph.py usr/lib/python3.10/site-packages/samba/kcc/graph_utils.py usr/lib/python3.10/site-packages/samba/kcc/kcc_utils.py usr/lib/python3.10/site-packages/samba/kcc/ldif_import_export.py +usr/lib/python3.10/site-packages/samba/key_credential_link.py usr/lib/python3.10/site-packages/samba/logger.py usr/lib/python3.10/site-packages/samba/lsa_utils.py usr/lib/python3.10/site-packages/samba/mdb_util.py @@ -353,6 +357,8 @@ usr/lib/python3.10/site-packages/samba/netbios.cpython-310-x86_64-linux-gnu.so usr/lib/python3.10/site-packages/samba/netcmd/__init__.py usr/lib/python3.10/site-packages/samba/netcmd/common.py usr/lib/python3.10/site-packages/samba/netcmd/computer.py +usr/lib/python3.10/site-packages/samba/netcmd/computer_generate_csr.py +usr/lib/python3.10/site-packages/samba/netcmd/computer_keytrust.py usr/lib/python3.10/site-packages/samba/netcmd/contact.py usr/lib/python3.10/site-packages/samba/netcmd/dbcheck.py usr/lib/python3.10/site-packages/samba/netcmd/delegation.py @@ -434,7 +440,9 @@ usr/lib/python3.10/site-packages/samba/netcmd/user/delete.py usr/lib/python3.10/site-packages/samba/netcmd/user/disable.py usr/lib/python3.10/site-packages/samba/netcmd/user/edit.py usr/lib/python3.10/site-packages/samba/netcmd/user/enable.py +usr/lib/python3.10/site-packages/samba/netcmd/user/generate_csr.py usr/lib/python3.10/site-packages/samba/netcmd/user/getgroups.py +usr/lib/python3.10/site-packages/samba/netcmd/user/keytrust.py usr/lib/python3.10/site-packages/samba/netcmd/user/list.py usr/lib/python3.10/site-packages/samba/netcmd/user/move.py usr/lib/python3.10/site-packages/samba/netcmd/user/password.py @@ -580,6 +588,7 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/domain_backup_offline.py #usr/lib/python3.10/site-packages/samba/tests/dsdb.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_api.py +#usr/lib/python3.10/site-packages/samba/tests/dsdb_dn.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_dns.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_lock.py #usr/lib/python3.10/site-packages/samba/tests/dsdb_quiet_env_tests.py @@ -609,6 +618,7 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/kcc/kcc_utils.py #usr/lib/python3.10/site-packages/samba/tests/kcc/ldif_import_export.py #usr/lib/python3.10/site-packages/samba/tests/key_credential_link.py +#usr/lib/python3.10/site-packages/samba/tests/key_credential_link_samdb.py #usr/lib/python3.10/site-packages/samba/tests/krb5 #usr/lib/python3.10/site-packages/samba/tests/krb5/alias_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/as_canonicalization_tests.py @@ -629,12 +639,14 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kdc_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kdc_tgs_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kdc_tgt_tests.py +#usr/lib/python3.10/site-packages/samba/tests/krb5/key_trust_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/kpasswd_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/lockout_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/ms_kile_client_principal_lookup_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/netlogon.py #usr/lib/python3.10/site-packages/samba/tests/krb5/nt_hash_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/pac_align_tests.py +#usr/lib/python3.10/site-packages/samba/tests/krb5/pkinit_certificate_mapping_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/pkinit_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/protected_users_tests.py #usr/lib/python3.10/site-packages/samba/tests/krb5/raw_testcase.py @@ -756,8 +768,10 @@ usr/lib/python3.10/site-packages/samba/tdb_util.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_auth_policy.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_auth_silo.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_check_password_script.py +#usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_generate_csr.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_get_kerberos_ticket.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_getpassword_gmsa.py +#usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_keytrust.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_virtualCryptSHA.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_virtualCryptSHA_base.py #usr/lib/python3.10/site-packages/samba/tests/samba_tool/user_virtualCryptSHA_gpg.py @@ -975,6 +989,7 @@ usr/lib/samba/vfs/acl_tdb.so usr/lib/samba/vfs/acl_xattr.so usr/lib/samba/vfs/aio_fork.so usr/lib/samba/vfs/aio_pthread.so +usr/lib/samba/vfs/aio_ratelimit.so usr/lib/samba/vfs/audit.so usr/lib/samba/vfs/btrfs.so usr/lib/samba/vfs/cap.so @@ -1039,6 +1054,8 @@ usr/sbin/winbindd #usr/share/locale/hu/LC_MESSAGES/pam_winbind.mo #usr/share/locale/it/LC_MESSAGES/pam_winbind.mo #usr/share/locale/ja/LC_MESSAGES/pam_winbind.mo +#usr/share/locale/ka/LC_MESSAGES/net.mo +#usr/share/locale/ka/LC_MESSAGES/pam_winbind.mo #usr/share/locale/ko/LC_MESSAGES/pam_winbind.mo #usr/share/locale/nb/LC_MESSAGES/pam_winbind.mo #usr/share/locale/nl/LC_MESSAGES/pam_winbind.mo diff --git a/lfs/samba b/lfs/samba index 7b38018cc..a4a24a3f3 100644 --- a/lfs/samba +++ b/lfs/samba @@ -24,7 +24,7 @@ include Config -VER = 4.23.6 +VER = 4.24.1 SUMMARY = A SMB/CIFS File, Print, and Authentication Server THISAPP = samba-$(VER) @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = samba -PAK_VER = 120 +PAK_VER = 121 DEPS = avahi libtalloc perl-Parse-Yapp wsdd @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = c5c567bfc4734429790ec7362150eda231ce7e3e7dbdfaa2ca2dc81bd178c9c15cc9360b21f4c5dd1f1423d46337bc5a7b581efcff8ed647adb69a9b47922320 +$(DL_FILE)_BLAKE2 = 51459d4db739e47bc05692046ce0a8b3044de923b3d1e7a51589bb838a7ef9865b6d6034656ade87e099374157a92dac0cba70a5f293a4d1e2b623341b3e75ca install : $(TARGET)