Bug 1831986
| Summary: | unprivileged user should be able to read-only to gencache.tdb instead of permission denied | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Ding-Yi Chen <dchen> | |
| Component: | samba | Assignee: | Andreas Schneider <asn> | |
| Status: | CLOSED ERRATA | QA Contact: | sssd-qe <sssd-qe> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 7.8 | CC: | adzilsky, asn, dkarpele, gdeschner, iboukris, jarrpa, wrydberg | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | samba-4.10.15-5.el7 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1859277 1962350 (view as bug list) | Environment: | ||
| Last Closed: | 2020-09-29 20:19:10 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1859277 | |||
What is the exact issue you're having that you need access to gencache.tdb as a user? Hey Andreas, On samba-client-4.9.1 ( RHEL 7.7 ) net commands like net ads status, net ads search etc works fine as an normal user However on samba-client-4.10.4 ( RHEL 7.8 ) net commands has issues opening "gencache.tdb" as normal users _________________________________________________________________ tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied Opening /var/lib/samba/lock/gencache.tdb failed: Permission denied Opening cache file at /var/lib/samba/lock/gencache.tdb tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied Opening /var/lib/samba/lock/gencache.tdb failed: Permission denied Opening cache file at /var/lib/samba/lock/gencache.tdb tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied Opening /var/lib/samba/lock/gencache.tdb failed: Permission denied Opening cache file at /var/lib/samba/lock/gencache.tdb tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied Opening /var/lib/samba/lock/gencache.tdb failed: Permission denied _________________________________________________________________ "With the previous Samba version I believe it was able to lookup the AD sitename from gencache.tdb so that it knows to send the query to the servers that are appropriate for the site. With the latest version it fails getting the site name so it wastes a large amount of time querying DC's all over the world, many of which are unreachable or unresolvable." Regards, Billy Red Hat, Inc. From CU: _________________________________________________________________ Ok, for the time being we can work around by adding the "password server" option to smb.conf and keep it maintained with a cron job. We have to omit the "*" from the line though, because that causes the net command to lookup all DC's in the company. But with just the DC's from the local site listed the net command returns output like normal: [rigs@hbl1099 ~]# time net ads search samaccountname=worksys cn Got 1 replies cn: worksys real 0m0.102s user 0m0.047s sys 0m0.015s _________________________________________________________________ I've found a solution for the issue which is currently reviewed upstream. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: samba security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:3981 |
Description of problem: In samba-4.9, a regular user can still read gencache.tdb as read-only as fallback after tried to open as read-write. However, in samba-4.10, the fallback code is gone. Version-Release number of selected component (if applicable): samba-4.10.4-10.el7.x86_64 How reproducible: Always Steps to Reproduce: 1. Login as a non-root user 2. LANG=C net ads -d 5 status |& grep gencache.tdb Actual results: Consecutively tried to open gencache.tdb with mode RW but keep failing because of "Permission denied". Opening cache file at /var/lib/samba/lock/gencache.tdb tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied Opening /var/lib/samba/lock/gencache.tdb failed: Permission denied Opening cache file at /var/lib/samba/lock/gencache.tdb ... Expected results: Fallback with Read-Only mode. Opening cache file at /var/lib/samba/gencache.tdb tdb(/var/lib/samba/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/gencache.tdb: Permission denied gencache_init: Opening cache file /var/lib/samba/gencache.tdb read-only. tdb(/var/lib/samba/gencache.tdb): tdb_transaction_start: cannot start a transaction on a read-only or internal db Additional info: Impact: As unprivileged users are unable to read cache, this slows down their operations dramatically. Following lines are seen in gencache_init, gencache.c, samba-4.9. samba-4.10, however, does not contain those. if (!cache && (errno == EACCES)) { open_flags = O_RDONLY; cache = tdb_wrap_open(NULL, cache_fname, hash_size, TDB_DEFAULT|TDB_INCOMPATIBLE_HASH, open_flags, 0644); if (cache) { DEBUG(5, ("gencache_init: Opening cache file %s read-only.\n", cache_fname)); } }