1831986 – unprivileged user should be able to read-only to gencache.tdb instead of permission denied

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1831986 - unprivileged user should be able to read-only to gencache.tdb instead of permission denied

Summary: unprivileged user should be able to read-only to gencache.tdb instead of perm...

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	samba
Sub Component:
Version:	7.8
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	medium
Target Milestone:	rc
Target Release:	---
Assignee:	Andreas Schneider
QA Contact:	sssd-qe
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	1859277
TreeView+	depends on / blocked

Reported:	2020-05-06 04:30 UTC by Ding-Yi Chen
Modified:	2023-12-15 17:49 UTC (History)
CC List:	7 users (show)
Fixed In Version:	samba-4.10.15-5.el7
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Clones:	1859277 1962350 (view as bug list)
Environment:
Last Closed:	2020-09-29 20:19:10 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2020:3981	0	None	None	None	2020-09-29 20:19:25 UTC
Samba Project	14370	0	None	None	None	2020-05-06 15:38:20 UTC

Description Ding-Yi Chen 2020-05-06 04:30:56 UTC

Description of problem:

In samba-4.9, a regular user can still read gencache.tdb as read-only as fallback after tried to open as read-write.

However, in samba-4.10, the fallback code is gone.



Version-Release number of selected component (if applicable):
samba-4.10.4-10.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Login as a non-root user
2. LANG=C net ads -d 5 status  |& grep gencache.tdb
 

Actual results:

Consecutively tried to open gencache.tdb with mode RW but keep failing because of  "Permission denied".

Opening cache file at /var/lib/samba/lock/gencache.tdb
tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied
Opening /var/lib/samba/lock/gencache.tdb failed: Permission denied
Opening cache file at /var/lib/samba/lock/gencache.tdb
...

Expected results:

Fallback with Read-Only mode.

Opening cache file at /var/lib/samba/gencache.tdb
tdb(/var/lib/samba/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/gencache.tdb: Permission denied
gencache_init: Opening cache file /var/lib/samba/gencache.tdb read-only.
tdb(/var/lib/samba/gencache.tdb): tdb_transaction_start: cannot start a transaction on a read-only or internal db


Additional info:

Impact: As unprivileged users are unable to read cache, this slows down their operations dramatically.

Following lines are seen in gencache_init, gencache.c, samba-4.9. 
samba-4.10, however, does not contain those.


	if (!cache && (errno == EACCES)) {
		open_flags = O_RDONLY;
		cache = tdb_wrap_open(NULL, cache_fname, hash_size,
				      TDB_DEFAULT|TDB_INCOMPATIBLE_HASH,
				      open_flags, 0644);
		if (cache) {
			DEBUG(5, ("gencache_init: Opening cache file %s read-only.\n", cache_fname));
		}
	}

Comment 2 Andreas Schneider 2020-05-06 14:58:12 UTC

What is the exact issue you're having that you need access to gencache.tdb as a user?

Comment 3 toasty 2020-05-06 16:45:38 UTC

Hey Andreas,

On samba-client-4.9.1 ( RHEL 7.7 ) net commands like net ads status, net ads search etc works fine as an normal user

However on samba-client-4.10.4 ( RHEL 7.8 ) net commands has issues opening "gencache.tdb" as normal users
_________________________________________________________________ 

tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied
Opening /var/lib/samba/lock/gencache.tdb failed: Permission denied
Opening cache file at /var/lib/samba/lock/gencache.tdb
tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied
Opening /var/lib/samba/lock/gencache.tdb failed: Permission denied
Opening cache file at /var/lib/samba/lock/gencache.tdb
tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied
Opening /var/lib/samba/lock/gencache.tdb failed: Permission denied
Opening cache file at /var/lib/samba/lock/gencache.tdb
tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied
Opening /var/lib/samba/lock/gencache.tdb failed: Permission denied
_________________________________________________________________ 

"With the previous Samba version I believe it was able to lookup the AD sitename from gencache.tdb so that it knows to send the query to the servers that are appropriate for the site.  With the latest version it fails getting the site name so it wastes a large amount of time querying DC's all over the world, many of which are unreachable or unresolvable."

Regards,

Billy

Red Hat, Inc.

Comment 4 toasty 2020-05-08 16:20:06 UTC

From CU:
_________________________________________________________________ 

Ok, for the time being we can work around by adding the "password server" option to smb.conf and keep it maintained with a cron job.  We have to omit the "*" from the line though, because that causes the net command to lookup all DC's in the company.  But with just the DC's from the local site listed the net command returns output like normal:

[rigs@hbl1099 ~]# time net ads search samaccountname=worksys cn
Got 1 replies

cn: worksys


real    0m0.102s
user    0m0.047s
sys     0m0.015s
_________________________________________________________________

Comment 5 Andreas Schneider 2020-05-11 15:01:30 UTC

I've found a solution for the issue which is currently reviewed upstream.

Comment 9 errata-xmlrpc 2020-09-29 20:19:10 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: samba security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:3981

Note You need to log in before you can comment on or make changes to this bug.