Ubuntu
samba package

Can't print after update to 4.13

Bug #1951490 reported by Florian Lentz on 2021-11-19

This bug affects 2 people

	Status	Importance	Assigned to
samba	Unknown	Unknown	samba-bugs #14867
samba (Ubuntu)	Fix Released	High	Andreas Hasenack
Focal	Fix Released	High	Andreas Hasenack
Impish	Won't Fix	High	Andreas Hasenack
Jammy	Fix Released	High	Andreas Hasenack

Bug Description

[Impact]
After installing the 2021-10 Monthly Rollup patch (KB5006743), printing no longer works.

[Test Plan]
Bringing up a test environment for this issue is complex, as it involves:
- setting up a samba AD controller (perhaps a plain NT controller is sufficient)
- setting up printing on said controller
- joining windows 7 to the directory
- applying (or not) the KB5006743 update for testing before and after

We thus will rely on community members to test this fix.

The test is: print from an unprivileged normal user account.

[Where problems could occur]
Samba is a complex piece of software, specially when used in the Active Directory Domain Controller role. Printing doesn't make it simpler.

The configuration file smb.conf is reloaded periodically in the background if there were changes, so I don't think a service restart would uncover previously undetected invalid configuration.

Calls to switch privileges for a specific function must come in pairs, and that is the case with this fix with regard to become/unbecome_root. I grepped the code and this pair is used in many places, but always with a warning that the calls must be paired, and the function must not return without the unbecome_root call. This means mistakes could be made, but this patch seems to have paid attention to this important detail.

There is no verification whether unbecome_root succeeded in this patch, but that seems to be the pattern everywhere else. Maybe the function panics() if it fails, I couldn't verify that.

[Other Info]
Not at this time.

[Original Description]

After updating my AD-DC to samba 4.13 I am unable to print from normal user accounts (Windows is logging "Win32 error code returned by the print processor: 50. The request is not supported."). Also the Log is full with entries like this:

[2021/11/19 01:48:37.496949, 0] ../../source3/rpc_server/rpc_server.c:1086(dcesrv_auth_gensec_prepare)
dcesrv_auth_gensec_prepare: Failed to prepare gensec: NT_STATUS_INVALID_SERVER_STATE

Enabling debug logs show that this is caused by the ownership of a directory which samba complains is not matching:

[2021/11/19 01:48:37.482365, 4, effective(30000XX, 100), real(30000XX, 0)] ../../source3/rpc_server/rpc_ncacn_np.c:110(make_internal_rpc_pipe_socketpair)
  Create of internal pipe \pipe\spoolss requested
[2021/11/19 01:48:37.485785, 3, effective(30000XX, 100), real(30000XX, 0)] ../../lib/util/util.c:483(directory_create_or_exist_strict)
  directory_create_or_exist_strict: invalid ownership on directory /var/lib/samba/private/msg.sock
[2021/11/19 01:48:37.485807, 1, effective(30000XX, 100), real(30000XX, 0)] ../../source3/auth/auth_samba4.c:248(prepare_gensec)
  imessaging_init failed

That is, because /var/lib/samba/private/msg.sock is owned by root:root in my case (and it gets created with those permissions aswell if I delete it), but https://github.com/samba-team/samba/blob/db11778b57610e24324aa4342f89918f66157d71/source4/lib/messaging/messaging.c#L507 uses geteuid() which is sometimes the user ID of the connecting user (as can be seen above, XX is the number that represents the uid of the windows user connecting).

I am not sure if this is also the cause for the printing issue, but this spam in the log is super annoying aswell and should be fixed.

Futher information about the system:
Description: Ubuntu 20.04.3 LTS
Release: 20.04
Arch: amd64
Samba-Version: 2:4.13.14+dfsg-0ubuntu0.20.04.1

See original description

Tags:

Related branches

~ahasenack/ubuntu/+source/samba:kinetic-samba-416-merge

Merged into ubuntu/+source/samba:debian/sid at revision 93d47629c882a9e02d9748e2839ee56297d90a93

Sergio Durigan Junior (community): Approve on 2022-06-07

Canonical Server: Pending requested 2022-06-06

~ahasenack/ubuntu/+source/samba:kinetic-samba-416-merge

Merged into ubuntu/+source/samba:ubuntu/devel at revision 93d47629c882a9e02d9748e2839ee56297d90a93

Robie Basak: Pending requested 2022-06-06

~ahasenack/ubuntu/+source/samba:fix-printing-1951490-focal

Merged into ubuntu/+source/samba:ubuntu/focal-devel at revision 8fe518fd7a57c342fea97622d5a63859c5d0536c

Sergio Durigan Junior (community): Approve on 2022-03-10

Canonical Server: Pending requested 2022-03-10

~ahasenack/ubuntu/+source/samba:fix-printing-1951490-impish

Merged into ubuntu/+source/samba:ubuntu/impish-devel at revision c6266671f8feabfa45dc1d8adc4fd2006886d867

Sergio Durigan Junior (community): Approve on 2022-03-10

Canonical Server: Pending requested 2022-03-10

~ahasenack/ubuntu/+source/samba:fix-printing-1951490-jammy

Merged into ubuntu/+source/samba:ubuntu/devel at revision 1e9cf65c8c9c9f440f365914a757ad562acbe6fd

Sergio Durigan Junior (community): Approve on 2022-03-10

Canonical Server: Pending requested 2022-03-10

Revision history for this message

Launchpad Janitor (janitor) wrote on 2021-11-22:

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in samba (Ubuntu):
status:	New → Confirmed

Revision history for this message

Lucas Kanashiro (lucaskanashiro) wrote on 2021-11-23:

Thanks for taking the time to report this bug and trying to make Ubuntu better.

In the upstream bug there is no reply yet from the maintainers but it might be a valid bug. This will need some investigation, I'll be subscribing ubuntu-server and adding the server-todo tag to see if the Ubuntu Server team can find some time to work on it.

tags:

added: server-todo

Revision history for this message

Florian Lentz (flole998) wrote on 2022-01-26:

There have been patches provided for testing and the latest master already has the changes in there.

For some reason the remote bug watcher for samba seems to be broken aswell, I'm seeing "Launchpad couldn't connect to Samba Bugzilla." above.

Revision history for this message

Paride Legovini (paride) wrote on 2022-01-27:

Thanks Florian for checking, there are indeed patches for samba 4.14, 4.15, 4.16. No patches for samba 4.13, but maybe that's because upstream only ships security fixes for it at the moment [1].

A bit confusingly the upstream patches mention that:

  Note this is only really needed for 4.15 and older, as
  we no longer run the rpc_server embedded in smbd,
  but we better be consistent for now.

but a patch *does* exist for samba 4.16. We should verify if those patches apply to what we have in >= Focal and if they actually fix the bug.

[1] https://wiki.samba.org/index.php/Samba_Release_Planning

tags:

added: regression-update server-next
removed: server-todo

Paride Legovini (paride) on 2022-01-27

Changed in samba (Ubuntu):
importance:	Undecided → High

Paride Legovini (paride) on 2022-02-02

Changed in samba (Ubuntu):
assignee:	nobody → Ubuntu Security Team (ubuntu-security)

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2022-02-03:

I've uploaded a test package for focal into the security team ppa here:

https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages

Could you please test it and see if it fixes your printing problem?

Thanks!

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2022-02-15:

We are still waiting for the bug reporter to test the packages, thanks!

Revision history for this message

Sebastian Chrostek (sezastian) wrote on 2022-02-17:

The test packages solve the problem for us.
thanks!

Christian Ehrhardt  (paelzer) on 2022-02-23

tags:

added: server-todo
removed: server-next

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2022-02-24:

bug-fix by mdeslaur as tested by Sebastian Edit (9.2 KiB, text/plain)

After talking with Marc and reading into the case a bit more this is a coincidence that it fails with the 4.17 update [1] in Nov 2021. Instead it seems it is caused by the "Windows 7 with 2021-10 monthly rollup patch (KB5006743)" and similar in the same time-frame.

Nevertheless worth to be fixed, just it will have to be a normal SRU.
Taking back the security assignment and the Server Team will try to drive a normal SRU for this.

Since the upload by mdeslaur to the security PPA is now partially in Focal already (the 2:4.13.17~dfsg-0ubuntu0.21.04.1 part of it) the LP debdiff is odd. I'm hereby attaching just the added delta on top that worked. IMHO that is almost ready, just some deb3-headers and creating a good SRU template here in the bug.

@Sebastian - thanks for testing, when this is going to be released we might need you again for this. To be clear, is this just "print from normal windows user to a samba printer" or is there anything more complex to this?

[1]: https://launchpad.net/ubuntu/+source/samba/2:4.13.14+dfsg-0ubuntu0.20.04.1

Changed in samba (Ubuntu):
assignee:	Ubuntu Security Team (ubuntu-security) → Christian Ehrhardt  (paelzer)
tags:	added: server-next removed: server-todo

Revision history for this message

Sebastian Chrostek (sezastian) wrote on 2022-02-24:

"print from normal windows user to a samba printer"
-> yes, for us it was only this bug which was solved by the patch
i can test again if you release this

Revision history for this message

Christian Ehrhardt  (paelzer) wrote on 2022-02-24:

#10

BTW one thing to be careful to not mix is here is minor and sub-minor version.
The patch mentions to only be for 4.15 and earlier.
This matches [1] saying "rpc_server Removed".
But while the .17 might be misleading at first it is 4.13.17 that it in focal and impish - so the .13 matters here. And those need a fix. You can also see that in the man-page which for all these (pre 4.16) will mention "Default: rpc_server:SERVER = embedded".

We can see that Upstream prepares those for the next stable releases, but not 4.13 AFAICS:

$ git log --all --grep="dcesrv_core: wrap gensec_" --oneline
# plus adding which branch they are on:
v4-16-stable 20f84f11651 dcesrv_core: wrap gensec_*() calls in [un]become_root() calls
v4-15-test e26270cbe58 dcesrv_core: wrap gensec_*() calls in [un]become_root() calls
v4-14-test 9e3c363030d dcesrv_core: wrap gensec_*() calls in [un]become_root() calls
master 0651fa474cd dcesrv_core: wrap gensec_*() calls in [un]become_root() calls
dev-branch ed345c6bc34 dcesrv_core: wrap gensec_*() calls in [un]become_root() calls

So for 4.15 (jammy) we could just wait to 4.15.6 - but then the SRU requires it to be fixed there first and we do not know when this will be released.

So the approach from here should IMHO be to prep:
9e3c363030d -> 4.13.17 -> Focal
9e3c363030d -> 4.13.17 -> Impish
e26270cbe58 -> 4.15.5 -> Jammy

Based on the backport by Marc I have prepared how I'd think a Focal upload could look like.
=> https://code.launchpad.net/~paelzer/ubuntu/+source/samba/+git/samba/+ref/fix-printing-1951490-focal

TODO:
- check and adopt my branch
- map the same for Impish and Jammy
- upload for Jammy
- Prepare SRU template
- upload to -unapproved

[1]: https://wiki.samba.org/index.php/Samba_4.16_Features_added/changed

Changed in samba (Ubuntu):
assignee:	Christian Ehrhardt  (paelzer) → nobody

Ubuntu Foundations Team Bug Bot (crichton) on 2022-02-24

tags:

added: patch

Christian Ehrhardt  (paelzer) on 2022-03-07

tags:

added: server-todo
removed: server-next

Christian Ehrhardt  (paelzer) on 2022-03-09

Changed in samba (Ubuntu):
assignee:	nobody → Andreas Hasenack (ahasenack)

Andreas Hasenack (ahasenack) on 2022-03-09

Changed in samba (Ubuntu Jammy):
status:	Confirmed → In Progress

Andreas Hasenack (ahasenack) on 2022-03-09

Changed in samba (Ubuntu Focal):
assignee:	nobody → Andreas Hasenack (ahasenack)
Changed in samba (Ubuntu Impish):
assignee:	nobody → Andreas Hasenack (ahasenack)
status:	New → In Progress
Changed in samba (Ubuntu Focal):
status:	New → In Progress

Andreas Hasenack (ahasenack) on 2022-03-10

description:	updated
Changed in samba (Ubuntu Impish):
importance:	Undecided → High
Changed in samba (Ubuntu Focal):
importance:	Undecided → High
description:	updated

Andreas Hasenack (ahasenack) on 2022-03-10

description:

updated

Revision history for this message

Launchpad Janitor (janitor) wrote on 2022-03-11:

#11

This bug was fixed in the package samba - 2:4.15.5~dfsg-0ubuntu2

---------------
samba (2:4.15.5~dfsg-0ubuntu2) jammy; urgency=medium

* d/p/lp-1951490-fix-printing-KB5006743.patch: Fix printing after
Windows 2021-10 Monthly Rollup patch (LP: #1951490)

-- Andreas Hasenack <email address hidden> Thu, 10 Mar 2022 10:32:59 -0300

Changed in samba (Ubuntu Jammy):
status:	In Progress → Fix Released

Revision history for this message

Łukasz Zemczak (sil2100) wrote on 2022-03-17:

#12

This one looks okay. Since the fix involves some privilege bumping in various parts of the code, I'm happy this change has been prepared in cooperation with the security team - this would be my main point of concern (requiring a security review). So I will be accepting this to -proposed.

I assume it's intended only for -updates, right? Or do we want to fix this regression in the -security pocket as well? It would require a rebuild then though.

Changed in samba (Ubuntu Impish):
status:	In Progress → Fix Committed
tags:	added: verification-needed verification-needed-impish

Revision history for this message

Łukasz Zemczak (sil2100) wrote on 2022-03-17: Please test proposed package

#13

Hello Florian, or anyone else affected,

Accepted samba into impish-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/samba/2:4.13.17~dfsg-0ubuntu0.21.10.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-impish to verification-done-impish. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-impish. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in samba (Ubuntu Focal):
status:	In Progress → Fix Committed
tags:	added: verification-needed-focal

Revision history for this message

Łukasz Zemczak (sil2100) wrote on 2022-03-17:

#14

Hello Florian, or anyone else affected,

Accepted samba into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/samba/2:4.13.17~dfsg-0ubuntu0.21.04.2 in a few hours, and then in the -proposed repository.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message

Sebastian Chrostek (sezastian) wrote on 2022-03-17:

#15

the packages in focal-proposed (2:4.13.17~dfsg-0ubuntu0.21.04.2) work for me
thanks

Revision history for this message

Ubuntu SRU Bot (ubuntu-sru-bot) wrote on 2022-03-18: Autopkgtest regression report (samba/2:4.13.17~dfsg-0ubuntu0.21.04.2)

#16

All autopkgtests for the newly accepted samba (2:4.13.17~dfsg-0ubuntu0.21.04.2) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

gvfs/1.44.1-1ubuntu1 (arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#samba

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

Revision history for this message

Andreas Hasenack (ahasenack) wrote on 2022-03-24:

#17

The failed test from comment #16 was retried and resolved. Everything is green for this update in focal.

Revision history for this message

Andreas Hasenack (ahasenack) wrote on 2022-03-30:

#18

Hello dear community,

just a reminder that we are relying on you to perform the SRU verification for ubuntu impish and focal, because the environment where the bug happens is rather complex to setup from scratch.

Revision history for this message

Andreas Hasenack (ahasenack) wrote on 2022-03-30:

#19

> the packages in focal-proposed (2:4.13.17~dfsg-0ubuntu0.21.04.2) work for me
> thanks

Hello Sebastian,

can you please adjust the bug tags according to the instructions in comment #14, and elaborate a bit on the testing you did?

Sebastian Chrostek (sezastian) on 2022-03-30

tags:

added: verification-done-focal
removed: verification-needed-focal

Revision history for this message

Łukasz Zemczak (sil2100) wrote on 2022-04-04:

#20

Okay, I also think we aged this long enough now in -proposed. Let's proceed.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2022-04-04:

#21

This bug was fixed in the package samba - 2:4.13.17~dfsg-0ubuntu0.21.04.2

---------------
samba (2:4.13.17~dfsg-0ubuntu0.21.04.2) focal; urgency=medium

* d/p/lp-1951490-fix-printing-KB5006743.patch: Fix printing after
Windows 2021-10 Monthly Rollup patch (LP: #1951490)

-- Andreas Hasenack <email address hidden> Thu, 10 Mar 2022 10:48:01 -0300

Changed in samba (Ubuntu Focal):
status:	Fix Committed → Fix Released

Revision history for this message

Łukasz Zemczak (sil2100) wrote on 2022-04-04: Update Released

#22

The verification of the Stable Release Update for samba has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message

Andreas Hasenack (ahasenack) wrote on 2022-04-04:

#23

We still need an Ubuntu Impish verification, any volunteers?

Christian Ehrhardt  (paelzer) on 2022-05-18

tags:

removed: server-todo

Revision history for this message

Brian Murray (brian-murray) wrote on 2022-07-18:

#24

Ubuntu 21.10 (Impish Indri) has reached end of life, so this bug will not be fixed for that specific release.

Changed in samba (Ubuntu Impish):
status:	Fix Committed → Won't Fix

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Patches

bug-fix by mdeslaur as tested by Sebastian Edit

Add patch

Remote bug watches

samba-bugs #14867 Edit

Bug watches keep track of this bug in other bug trackers.

Ubuntusamba package

Can't print after update to 4.13

Bug Description

Related branches

Other bug subscribers

Patches

Remote bug watches

Ubuntu
samba package