[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
This bug was fixed in the package samba - 2:4.7.6+dfsg~ubuntu-0ubuntu2.24 --- samba (2:4.7.6+dfsg~ubuntu-0ubuntu2.24) bionic; urgency=medium * samba.postinst: do not populate sambashare from the Ubuntu admin group (LP: #1942195) -- Paride Legovini Wed, 10 Nov 2021 15:29:48 +0100 ** Changed in: samba (Ubuntu Bionic) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
This bug was fixed in the package samba - 2:4.13.14+dfsg-0ubuntu0.20.04.2 --- samba (2:4.13.14+dfsg-0ubuntu0.20.04.2) focal; urgency=medium * samba.postinst: do not populate sambashare from the Ubuntu admin group (LP: #1942195) -- Paride Legovini Fri, 12 Nov 2021 14:42:02 +0100 ** Changed in: samba (Ubuntu Focal) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
This bug was fixed in the package samba - 2:4.13.14+dfsg-0ubuntu0.21.04.2 --- samba (2:4.13.14+dfsg-0ubuntu0.21.04.2) hirsute; urgency=medium * samba.postinst: do not populate sambashare from the Ubuntu admin group (LP: #1942195) -- Paride Legovini Fri, 12 Nov 2021 14:44:50 +0100 ** Changed in: samba (Ubuntu Hirsute) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
This bug was fixed in the package samba - 2:4.13.14+dfsg-0ubuntu0.21.10.2 --- samba (2:4.13.14+dfsg-0ubuntu0.21.10.2) impish; urgency=medium * samba.postinst: do not populate sambashare from the Ubuntu admin group (LP: #1942195) -- Paride Legovini Fri, 12 Nov 2021 11:17:14 +0100 ** Changed in: samba (Ubuntu Impish) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Oh, and for the future: please always state which exact versions of packages for each series have been tested when performing verification, as other wise - in some cases - the verification can be rejected because of that. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
It indeed looks to be a bit unreliable, the failure that is. As it has been discussed with adsys upstream, let me hint it before releasing. Thanks! -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Per team discussion we leave the decision whether adding a hint or triggering a migration-reference/0 autopkgtest run to the SRU team. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Verification done per [Test Case]. Note: the adsys autopkgtest failure on impish/arm64 is unrelated to the samba upload: 1. The part of the test that exercises samba passes. The failure is in an unrelated test. 2. The autopkgtest run fails even with adsys from impish-release; the test failure is not a regression caused by the samba upload. 3. The issue was discussed with didrocks (adsys "upstream"), and he agrees there isn't anything pointing at samba in the test failure. Discussion happened in #ubuntu-devel on 2021-11-19 [1]. [1] https://irclogs.ubuntu.com/2021/11/19/%23ubuntu-devel.html -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Tags removed: verification-needed verification-needed-bionic verification-needed-focal verification-needed-hirsute verification-needed-impish ** Tags added: verification-done verification-done-bionic verification-done-focal verification-done-hirsute verification-done-impish -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
It failed again (total 3 times) in the same way: https://autopkgtest.ubuntu.com/results/autopkgtest- impish/impish/arm64/a/adsys/2028_112720_82d83@/log.gz -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
The failed adsys/0.7.1 autopkgtest is due to a timeout: *** Test killed with quit: ran too long (11m0s). FAILgithub.com/ubuntu/adsys/internal/policies/ad660.011s I'm trying with a simple retrigger for now. I'll do the verification once all the tests pass. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Hello Richard, or anyone else affected, Accepted samba into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/samba/2:4.7.6+dfsg~ubuntu-0ubuntu2.24 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed- bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification- failed-bionic. In either case, without details of your testing we will not be able to proceed. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping! N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days. ** Changed in: samba (Ubuntu Bionic) Status: In Progress => Fix Committed ** Tags added: verification-needed-bionic -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Hello Richard, or anyone else affected, Accepted samba into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/samba/2:4.13.14+dfsg-0ubuntu0.20.04.2 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed- focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification- failed-focal. In either case, without details of your testing we will not be able to proceed. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping! N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days. ** Changed in: samba (Ubuntu Focal) Status: In Progress => Fix Committed ** Tags added: verification-needed-focal -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Hello Richard, or anyone else affected, Accepted samba into hirsute-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/samba/2:4.13.14+dfsg-0ubuntu0.21.04.2 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed- hirsute to verification-done-hirsute. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-hirsute. In either case, without details of your testing we will not be able to proceed. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping! N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days. ** Changed in: samba (Ubuntu Hirsute) Status: In Progress => Fix Committed ** Tags added: verification-needed-hirsute -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Hello Richard, or anyone else affected, Accepted samba into impish-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/samba/2:4.13.14+dfsg-0ubuntu0.21.10.2 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed- impish to verification-done-impish. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification- failed-impish. In either case, without details of your testing we will not be able to proceed. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping! N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days. ** Changed in: samba (Ubuntu Impish) Status: In Progress => Fix Committed ** Tags added: verification-needed verification-needed-impish -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
SRUs to fix this got uploaded to all the supported releases (thanks Sergio!): bionic focal hirsute impish Now it's up to the SRU team to review the change. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Hi Richard, very interesting, you are right. The Bionic lxd.preinst script has: # Add each admin user to the lxd group - for systems installed # before precise for u in $(getent group admin | sed -e "s/^.*://" -e "s/,/ /g"); do adduser "$u" lxd >/dev/null || true done I tried to install Bionic from the ISO image and I can confirm the admin group doesn't get automatically created at install time. This only affects Bionic as in >= Focal lxd is a snap, and I'm pretty sure the snap doesn't touch the groups. I filed this bug against the lxd package for the lxd maintainers to have a look: https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/1950635 Thanks again for raising the issue! -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Paride, firstly thanks for picking this up. Looking at another machine I have I notice that the lxd group may have a similar issue. This suggests the problem may affect other packages as well. Is there a way to trigger an audit for other packages that might be affected? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Merge proposal linked: https://code.launchpad.net/~paride/ubuntu/+source/samba/+git/samba/+merge/411694 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Merge proposal linked: https://code.launchpad.net/~paride/ubuntu/+source/samba/+git/samba/+merge/411691 ** Merge proposal linked: https://code.launchpad.net/~paride/ubuntu/+source/samba/+git/samba/+merge/411692 ** Merge proposal linked: https://code.launchpad.net/~paride/ubuntu/+source/samba/+git/samba/+merge/411693 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Changed in: samba (Ubuntu Bionic) Status: Triaged => In Progress ** Changed in: samba (Ubuntu Focal) Status: Triaged => In Progress ** Changed in: samba (Ubuntu Hirsute) Status: Triaged => In Progress ** Changed in: samba (Ubuntu Impish) Status: Triaged => In Progress -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Description changed: [Impact] Up until Ubuntu 11.10, administrator access using the sudo tool was granted via the "admin" Unix group. The samba postinst script has some logic that automatically adds users in the "admin" group to the sambashare group. In Ubuntu >= 12.04, administrator access is granted via the "sudo" group [1], and the "admin" group is not automatically created anymore. However the samba postinst functionality that auto-populates sambashare from "admin" has not been removed. This means that users an "admin" group, which now has no special meaning in Ubuntu, are automatically added to the sambashare group. This is wrong, and can have security implications given that the "admin" group can be a remote group (this is how this bug was first discovered, see the Original Description below). [1] https://wiki.ubuntu.com/PrecisePangolin/ReleaseNotes/UbuntuDesktop#PrecisePangolin.2FReleaseNotes.2FCommonInfrastructure.Common_Infrastructure [Test Case] Reproducer: 1. Start with a clean Ubuntu system 2. Created the "admin" group and add some users to it 3. Install samba 4. Verify that such users are added to sambashare Fix verification: 4. Verify that such users are NOT added to sambashare. + + Test PPA: https://launchpad.net/~paride/+archive/ubuntu/samba-lp1942195 [Where problems could occur] Problems may occur if new systems are deployed with the expectation that users in the "admin" group get auto-added to sambashare. This can only happen is the admin group is manually created before installing samba. [Development Fix] The admin -> sambashare auto-add function has been removed from the postinst script. This change was made in Debian. [Stable Fix] Same as the Development Fix. [Original Description] I'm running Ubuntu 20.04 in an enterprise environment. I recently installed the samba package on my machine which is configured to get most account details from a central ldap server. I was very surprised, therefore, to see the install script adding a large number of remote users who have no local account to the samabashare group in my local groups file. It turns out that this is because the postinstall script creates an initial sambashare group and then tries to populate it from the 'admin' group. However, since that is a group that is defined in the ldap database it ends up copying a large number of remote userids into the local group file. This is a bad idea in a centrally managed environment as the contents of that centrally managed group could change at any time. Surely the script should only try to do this if the admin group is local to the machine? Perhaps at the very least it should seek confirmation before performing such a change. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Description changed: + [Impact] + + Up until Ubuntu 11.10, administrator access using the sudo tool was + granted via the "admin" Unix group. The samba postinst script has some + logic that automatically adds users in the "admin" group to the + sambashare group. + + In Ubuntu >= 12.04, administrator access is granted via the "sudo" group + [1], and the "admin" group is not automatically created anymore. However + the samba postinst functionality that auto-populates sambashare from + "admin" has not been removed. This means that users an "admin" group, + which now has no special meaning in Ubuntu, are automatically added to + the sambashare group. This is wrong, and can have security implications + given that the "admin" group can be a remote group (this is how this bug + was first discovered, see the Original Description below). + + [1] + https://wiki.ubuntu.com/PrecisePangolin/ReleaseNotes/UbuntuDesktop#PrecisePangolin.2FReleaseNotes.2FCommonInfrastructure.Common_Infrastructure + + [Test Case] + + Reproducer: + + 1. Start with a clean Ubuntu system + 2. Created the "admin" group and add some users to it + 3. Install samba + 4. Verify that such users are added to sambashare + + Fix verification: + + 4. Verify that such users are NOT added to sambashare. + + [Where problems could occur] + + Problems may occur if new systems are deployed with the expectation that + users in the "admin" group get auto-added to sambashare. This can only + happen is the admin group is manually created before installing samba. + + [Development Fix] + + The admin -> sambashare auto-add function has been removed from the + postinst script. This change was made in Debian. + + [Stable Fix] + + Same as the Development Fix. + + [Original Description] + I'm running Ubuntu 20.04 in an enterprise environment. I recently installed the samba package on my machine which is configured to get most account details from a central ldap server. I was very surprised, therefore, to see the install script adding a large number of remote users who have no local account to the samabashare group in my local groups file. It turns out that this is because the postinstall script creates an initial sambashare group and then tries to populate it from the 'admin' group. However, since that is a group that is defined in the ldap database it ends up copying a large number of remote userids into the local group file. This is a bad idea in a centrally managed environment as the contents of that centrally managed group could change at any time. Surely the script should only try to do this if the admin group is local to the machine? Perhaps at the very least it should seek confirmation before performing such a change. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Changed in: samba (Ubuntu Impish) Assignee: (unassigned) => Paride Legovini (paride) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Changed in: samba (Ubuntu Impish) Status: New => Triaged -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
The upload to the devel release targeted impish, but actually landed in jammy. Added an Impish task for the SRU. ** Also affects: samba (Ubuntu Impish) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
This bug was fixed in the package samba - 2:4.13.5+dfsg-2ubuntu3 --- samba (2:4.13.5+dfsg-2ubuntu3) impish; urgency=medium * d/samba.postinst: do not populate sambashare from the admin group (Debian packaging cherry-pick. LP: #1942195) -- Paride Legovini Wed, 06 Oct 2021 10:31:14 +0200 ** Changed in: samba (Ubuntu) Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Changed in: samba (Ubuntu) Status: Confirmed => In Progress ** Also affects: samba (Ubuntu Hirsute) Importance: Undecided Status: New ** Also affects: samba (Ubuntu Bionic) Importance: Undecided Status: New ** Also affects: samba (Ubuntu Focal) Importance: Undecided Status: New ** Changed in: samba (Ubuntu Bionic) Status: New => Triaged ** Changed in: samba (Ubuntu Focal) Status: New => Triaged ** Changed in: samba (Ubuntu Hirsute) Status: New => Triaged ** Changed in: samba (Ubuntu Bionic) Assignee: (unassigned) => Paride Legovini (paride) ** Changed in: samba (Ubuntu Focal) Assignee: (unassigned) => Paride Legovini (paride) ** Changed in: samba (Ubuntu Hirsute) Assignee: (unassigned) => Paride Legovini (paride) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Merge proposal linked: https://code.launchpad.net/~paride/ubuntu/+source/samba/+git/samba/+merge/409731 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Here it is: https://salsa.debian.org/samba- team/samba/-/merge_requests/54 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Thanks for reviewing Sergio. I did the same archeology and indeed the first line of that commit message is "This reverts commit fe5cef50." :-) I don't foresee any problem with the approach that commit implements: it just feels strange to fix a bug by dropping functionality, even if broken and apparently not missed by anyone. However as we agree on it I'll go ahead and open a MR on salsa. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Thanks for the commit, Paride. I left a comment there, but I'm also going to copy it over here: First of all, thank you for taking the time to investigate and write an insightful commit message explaining the situation. My first thought when reviewing this was: "where did this excerpt of code came from?" I did some archaeology (`git blame` FTW) and found that this was added by commit fe5cef5014db5b5d6cf55e036583f8f84962e9b2. Unfortunately, there doesn't seem to be much context around the decision to add this code to the postinst script; I couldn't find a related Ubuntu bug, nor a mailing list thread that could provide some explanation here. Either way, after thinking a little bit, and especially after considering the arguments you raised in the commit message, I find myself aligned with your rationale. While I can understand why one would want to use the members of the `admin` group as the initial members of the `sambashare` group, I also tend to think that this is perhaps "too invasive" without much benefit. The user should be the one deciding who is part of `sambashare` and who isn't, just like it is with the Debian samba package. Given that this is an Ubuntu-related topic, I will copy this comment to the Launchpad bug and we can continue the discussion there if you want. I'm particularly interested in knowing whether you foresee any problems with this approach (I don't). Thanks! -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Tags removed: server-triage-discuss -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
This is what I propose, see the commit message for the rationale: https://salsa.debian.org/paride/samba/-/commit/4385c3920afa81e2c30a74d80f2ee0eb04753bb9 I didn't open a MR yet, let's agree on the approach first. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Changed in: samba (Ubuntu) Assignee: (unassigned) => Paride Legovini (paride) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Tags added: server-triage-discuss -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Hello Richard and thanks for this bug report. You are right: the samba.postinst script adds all the users in the 'admin' group to the 'sambashare' group: for USER in `getent group admin | cut -f4 -d:`; do adduser "$USER" sambashare \ || ! getent passwd "$USER" >/dev/null done The interesting thing is that I had a look in some Ubuntu systems I have access to and there's no 'admin' group at all. I think the 'admin' group is a legacy thing: the Ubuntu 12.04 release notes [1] report that: Up until Ubuntu 11.10, administrator access using the sudo tool was granted via the "admin" Unix group. In Ubuntu 12.04, administrator access will be granted via the "sudo" group. So in the older Ubuntu releases the 'admin' did always exist as a local group. The obvious fix here is to have the postinst script add users from the 'sudo' group instead, however I'm not sure I really like this idea. We'll again hardcode a group name in the postinst, and as apparently nobody noticed that the "auto-add admin/sudo users to sambashare" mechanism was broken in all these years, maybe it's not really worth having it in the first place. Not having it will also make Ubuntu's samba behave like Debian in this respect. This is worth some more discussion. [1] https://wiki.ubuntu.com/PrecisePangolin/ReleaseNotes/UbuntuDesktop#PrecisePangolin.2FReleaseNotes.2FCommonInfrastructure.Common_Infrastructure -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
Status changed to 'Confirmed' because the bug affects multiple users. ** Changed in: samba (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1942195] Re: Installing Samba unexpectedly adds many unknown local users to sambashare group
** Description changed: I'm running Ubuntu 20.04 in an enterprise environment. I recently - installed the samba package on my my machine which is configured to get + installed the samba package on my machine which is configured to get most account details from a central ldap server. I was very surprised, therefore, to see the install script adding a large number of remote users who have no local account to the samabashare group in my local groups file. It turns out that this is because the postinstall script creates an initial sambashare group and then tries to populate it from the 'admin' group. However, since that is a group that is defined in the ldap database it ends up copying a large number of remote userids into the local group file. This is a bad idea in a centrally managed environment as the contents of that centrally managed group could change at any time. Surely the script should only try to do this if the admin group is local to the machine? Perhaps at the very least it should seek confirmation before performing such a change. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1942195 Title: Installing Samba unexpectedly adds many unknown local users to sambashare group To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1942195/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
