From 8a9f2aa2c1cdfa72ad50d7c4f879220fe37654cd Mon Sep 17 00:00:00 2001 From: Joseph Sutton Date: Fri, 12 Nov 2021 14:20:45 +1300 Subject: [PATCH] CVE-2020-25717: selftest: turn ad_member_no_nss_wb into ad_member_idmap_nss In reality environments without 'nss_winbind' make use of 'idmap_nss'. For testing, DOMAIN/bob is mapped to the local 'bob', while DOMAIN/jane gets the uid based on the local 'jane' vis idmap_nss. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14901 Pair-Programmed-With: Stefan Metzmacher Signed-off-by: Joseph Sutton Signed-off-by: Stefan Metzmacher [metze@samba.org avoid to create a new ad_member_idmap_nss environment and merge it with ad_member_no_nss_wb instead] Reviewed-by: Ralph Boehme --- selftest/target/Samba.pm | 2 +- selftest/target/Samba3.pm | 24 ++++++++++++++++++++---- source4/selftest/tests.py | 2 +- 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/selftest/target/Samba.pm b/selftest/target/Samba.pm index 69e6dcee591..c4f8eb5d4f9 100644 --- a/selftest/target/Samba.pm +++ b/selftest/target/Samba.pm @@ -610,7 +610,7 @@ sub get_interface($) fipsadmember => 57, offlineadmem => 58, s2kmember => 59, - admemnonsswb => 60, + admemidmapnss => 60, rootdnsforwarder => 64, diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm index c0ed379bf3f..d1ac5c16c26 100755 --- a/selftest/target/Samba3.pm +++ b/selftest/target/Samba3.pm @@ -240,7 +240,7 @@ sub check_env($$) ad_member_fips => ["ad_dc_fips"], ad_member_offlogon => ["ad_dc"], ad_member_oneway => ["fl2000dc"], - ad_member_no_nss_wb => ["ad_dc"], + ad_member_idmap_nss => ["ad_dc"], clusteredmember => ["nt4_dc"], ); @@ -1448,7 +1448,7 @@ sub setup_ad_member_offlogon 1); } -sub setup_ad_member_no_nss_wb +sub setup_ad_member_idmap_nss { my ($self, $prefix, @@ -1461,14 +1461,23 @@ sub setup_ad_member_no_nss_wb return "UNKNOWN"; } - print "PROVISIONING AD MEMBER WITHOUT NSS WINBIND..."; + print "PROVISIONING AD MEMBER WITHOUT NSS WINBIND WITH idmap_nss config..."; my $extra_member_options = " + # bob:x:65521:65531:localbob gecos:/:/bin/false + # jane:x:65520:65531:localjane gecos:/:/bin/false + idmap config $dcvars->{DOMAIN} : backend = nss + idmap config $dcvars->{DOMAIN} : range = 65520-65521 + + # Support SMB1 so that we can use posix_whoami(). + client min protocol = CORE + server min protocol = LANMAN1 + username map = $prefix/lib/username.map "; my $ret = $self->provision_ad_member($prefix, - "ADMEMNONSSWB", + "ADMEMIDMAPNSS", $dcvars, $trustvars_f, $trustvars_e, @@ -1480,6 +1489,7 @@ sub setup_ad_member_no_nss_wb open(USERMAP, ">$prefix/lib/username.map") or die("Unable to open $prefix/lib/username.map"); print USERMAP " root = $dcvars->{DOMAIN}/root +bob = $dcvars->{DOMAIN}/bob "; close(USERMAP); @@ -2528,6 +2538,8 @@ sub provision($$) my ($uid_gooduser); my ($uid_eviluser); my ($uid_slashuser); + my ($uid_localbob); + my ($uid_localjane); if ($unix_uid < 0xffff - 13) { $max_uid = 0xffff; @@ -2548,6 +2560,8 @@ sub provision($$) $uid_gooduser = $max_uid - 11; $uid_eviluser = $max_uid - 12; $uid_slashuser = $max_uid - 13; + $uid_localbob = $max_uid - 14; + $uid_localjane = $max_uid - 15; if ($unix_gids[0] < 0xffff - 8) { $max_gid = 0xffff; @@ -3289,6 +3303,8 @@ user2:x:$uid_user2:$gid_nogroup:user2 gecos:$prefix_abs:/bin/false gooduser:x:$uid_gooduser:$gid_domusers:gooduser gecos:$prefix_abs:/bin/false eviluser:x:$uid_eviluser:$gid_domusers:eviluser gecos::/bin/false slashuser:x:$uid_slashuser:$gid_domusers:slashuser gecos:/:/bin/false +bob:x:$uid_localbob:$gid_domusers:localbob gecos:/:/bin/false +jane:x:$uid_localjane:$gid_domusers:localjane gecos:/:/bin/false "; if ($unix_uid != 0) { print PASSWD "root:x:$uid_root:$gid_root:root gecos:$prefix_abs:/bin/false diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py index 276c05acb32..9b78296828b 100755 --- a/source4/selftest/tests.py +++ b/source4/selftest/tests.py @@ -981,7 +981,7 @@ planoldpythontestsuite("ad_dc_smb1", "samba.tests.krb5.test_smb", 'TKT_SIG_SUPPORT': tkt_sig_support, 'EXPECT_PAC': expect_pac }) -planoldpythontestsuite("ad_member_no_nss_wb:local", +planoldpythontestsuite("ad_member_idmap_nss:local", "samba.tests.krb5.test_min_domain_uid", environ={ 'ADMIN_USERNAME': '$DC_USERNAME', -- 2.34.1