diff mbox series

[meta-networking,scarthgap,4/4] samba: upgrade to 4.22.10

Message ID 20260619041500.2635711-1-hjadon@cisco.com
State New
Headers show
Series samba: upgrade to 4.22.10 | expand

Commit Message

From: Himanshu Jadon <hjadon@cisco.com>

Upgrade Samba to the fixed 4.22.10 security release for
Scarthgap.

Samba 4.22.10 addresses the following security CVEs:
CVE-2026-1933, CVE-2026-2340, CVE-2026-3012,
CVE-2026-3238, CVE-2026-4408, and CVE-2026-4480.

Release notes:
https://www.samba.org/samba/history/samba-4.22.10.html

The base 4.19.9 version is directly affected by CVE-2026-3012,
CVE-2026-3238, CVE-2026-4408, and CVE-2026-4480. Samba lists
CVE-2026-1933 as affecting versions since 4.21 and CVE-2026-2340
as affecting versions since 4.20, so those two are fixed by
4.22.10 but are not applicable to the base 4.19.9 version.

The upgrade requires newer talloc, tdb, and tevent from the
preceding commits. Drop the system libldb dependency and pyldb
runtime dependency because newer Samba builds its own LDB/PyLDB
copy, matching the upstream meta-openembedded upgrade path.

Refresh the existing recipe patches for the 4.22.10 source
layout. Add bison-native for the generated parser build and
add docbook-xml-dtd4-native so Samba manpage generation can
resolve the native DocBook XML catalog directly.

Raise the xsltproc maxdepth used for Samba manpage generation.
The generated smb.conf.5 DocBook input is large enough to hit
libxslt's default recursion limit with the DocBook stylesheet.

Package samba-bgqd.service with samba-base because Samba 4.22.10
installs the unit when systemd support is enabled.

Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
---
 .../samba/0001-Don-t-check-xsltproc-manpages.patch | 20 ++--------
 .../0003-Add-config-option-without-valgrind.patch  |  9 ++---
 ...dd-options-to-configure-the-use-of-libbsd.patch | 45 +++++++++++++++-------
 ...raise-xsltproc-maxdepth-for-manpage-build.patch | 36 +++++++++++++++++
 .../samba/{samba_4.19.9.bb => samba_4.22.10.bb}    | 45 ++++++++++++++++++----
 5 files changed, 113 insertions(+), 42 deletions(-)
 create mode 100644 meta-networking/recipes-connectivity/samba/samba/0008-build-raise-xsltproc-maxdepth-for-manpage-build.patch
 rename meta-networking/recipes-connectivity/samba/{samba_4.19.9.bb => samba_4.22.10.bb} (87%)
diff mbox series

Patch

diff --git a/meta-networking/recipes-connectivity/samba/samba/0001-Don-t-check-xsltproc-manpages.patch b/meta-networking/recipes-connectivity/samba/samba/0001-Don-t-check-xsltproc-manpages.patch
index a498348c20..dea0bab99e 100644
--- a/meta-networking/recipes-connectivity/samba/samba/0001-Don-t-check-xsltproc-manpages.patch
+++ b/meta-networking/recipes-connectivity/samba/samba/0001-Don-t-check-xsltproc-manpages.patch
@@ -9,25 +9,14 @@  Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
 
 Rebase to 4.14.4
 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+
+Rebase to 4.23.5
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 ---
- lib/ldb/wscript    | 2 +-
  lib/talloc/wscript | 2 +-
  lib/tdb/wscript    | 2 +-
- 3 files changed, 3 insertions(+), 3 deletions(-)
+ 2 files changed, 2 insertions(+), 2 deletions(-)
 
-diff --git a/lib/ldb/wscript b/lib/ldb/wscript
-index ed5d45f..de3c648 100644
---- a/lib/ldb/wscript
-+++ b/lib/ldb/wscript
-@@ -144,7 +144,7 @@ def configure(conf):
-         conf.DEFINE('EXPECTED_SYSTEM_LDB_VERSION_RELEASE', int(v[2]))
- 
-     if conf.env.standalone_ldb:
--        conf.CHECK_XSLTPROC_MANPAGES()
-+        #conf.CHECK_XSLTPROC_MANPAGES()
- 
-         # we need this for the ldap backend
-         if conf.CHECK_FUNCS_IN('ber_flush ldap_open ldap_initialize', 'lber ldap', headers='lber.h ldap.h'):
 diff --git a/lib/talloc/wscript b/lib/talloc/wscript
 index 075f1ec..9bd9f73 100644
 --- a/lib/talloc/wscript
@@ -56,4 +45,3 @@  index 5e6a928..f13cf2a 100644
      conf.SAMBA_CHECK_PYTHON_HEADERS()
 -- 
 2.25.1
-
diff --git a/meta-networking/recipes-connectivity/samba/samba/0003-Add-config-option-without-valgrind.patch b/meta-networking/recipes-connectivity/samba/samba/0003-Add-config-option-without-valgrind.patch
index 2c9d29c9fe..aa25966d31 100644
--- a/meta-networking/recipes-connectivity/samba/samba/0003-Add-config-option-without-valgrind.patch
+++ b/meta-networking/recipes-connectivity/samba/samba/0003-Add-config-option-without-valgrind.patch
@@ -37,7 +37,7 @@  diff --git a/wscript b/wscript
 index 95ddd9e..6d9577a 100644
 --- a/wscript
 +++ b/wscript
-@@ -123,6 +123,13 @@ def options(opt):
+@@ -131,6 +131,13 @@
                    help=('Disable kernely keyring support for credential storage'),
                    action='store_false', dest='enable_keyring')
  
@@ -48,9 +48,6 @@  index 95ddd9e..6d9577a 100644
 +                   help=("Disable use of valgrind"),
 +                   action="store_false", dest='enable_valgrind', default=False)
 +
-     gr = opt.option_group('developer options')
+     opt.samba_add_onoff_option('ldap')
  
-     opt.load('python') # options for disabling pyc or pyo compilation
--- 
-2.25.1
-
+     opt.option_group('developer options')
diff --git a/meta-networking/recipes-connectivity/samba/samba/0004-Add-options-to-configure-the-use-of-libbsd.patch b/meta-networking/recipes-connectivity/samba/samba/0004-Add-options-to-configure-the-use-of-libbsd.patch
index c72bd133ee..ac4c85eeb5 100644
--- a/meta-networking/recipes-connectivity/samba/samba/0004-Add-options-to-configure-the-use-of-libbsd.patch
+++ b/meta-networking/recipes-connectivity/samba/samba/0004-Add-options-to-configure-the-use-of-libbsd.patch
@@ -19,7 +19,7 @@  diff --git a/buildtools/wafsamba/wscript b/buildtools/wafsamba/wscript
 index 30cb366..d167551 100644
 --- a/buildtools/wafsamba/wscript
 +++ b/buildtools/wafsamba/wscript
-@@ -145,6 +145,13 @@ Currently the only tested value is 'smbtorture,smbd/smbd' for Samba'''),
+@@ -155,6 +155,13 @@ Currently the only tested value is 'smbtorture,smbd/smbd' for Samba'''),
                     help=("Disable use of gettext"),
                     action="store_true", dest='disable_gettext', default=False)
  
@@ -37,7 +37,7 @@  diff --git a/lib/replace/wscript b/lib/replace/wscript
 index 9dd9b48..a22ae59 100644
 --- a/lib/replace/wscript
 +++ b/lib/replace/wscript
-@@ -444,20 +444,21 @@ def configure(conf):
+@@ -444,31 +444,32 @@
  
      strlcpy_in_bsd = False
  
@@ -46,28 +46,48 @@  index 9dd9b48..a22ae59 100644
 -        if conf.CHECK_FUNCS_IN('strlcpy strlcat', 'bsd', headers='bsd/string.h',
 -                               checklibc=True):
 -            strlcpy_in_bsd = True
--    if not conf.CHECK_FUNCS('getpeereid'):
--        conf.CHECK_FUNCS_IN('getpeereid', 'bsd', headers='sys/types.h bsd/unistd.h')
--    if not conf.CHECK_FUNCS_IN('setproctitle', 'setproctitle', headers='setproctitle.h'):
--        conf.CHECK_FUNCS_IN('setproctitle', 'bsd', headers='sys/types.h bsd/unistd.h')
--    if not conf.CHECK_FUNCS('setproctitle_init'):
--        conf.CHECK_FUNCS_IN('setproctitle_init', 'bsd', headers='sys/types.h bsd/unistd.h')
--
--    if not conf.CHECK_FUNCS('closefrom'):
--        conf.CHECK_FUNCS_IN('closefrom', 'bsd', headers='bsd/unistd.h')
+-    elif conf.env.enable_fuzzing:
+-        # Just to complicate it more, some versions of Honggfuzz have
+-        # got strlcpy and strlcat in libc, but not in <string.h>
+-        # (unless it is there coincidentally, on a BSD). Therefore we
+-        # can't use CHECK_FUNCS alone to decide whether to add the
+-        # headers to replace.h.
+-        #
+-        # As this is only known to happen on a fuzzing compiler, we'll
+-        # skip the check when not in fuzzing mode.
+-        conf.CHECK_HEADERS('bsd/string.h')
 +    if Options.options.enable_libbsd:
 +        # libbsd on some platforms provides strlcpy and strlcat
 +        if not conf.CHECK_FUNCS('strlcpy strlcat'):
 +            if conf.CHECK_FUNCS_IN('strlcpy strlcat', 'bsd', headers='bsd/string.h',
 +                                   checklibc=True):
 +                strlcpy_in_bsd = True
++        elif conf.env.enable_fuzzing:
++            # Just to complicate it more, some versions of Honggfuzz have
++            # got strlcpy and strlcat in libc, but not in <string.h>
++            # (unless it is there coincidentally, on a BSD). Therefore we
++            # can't use CHECK_FUNCS alone to decide whether to add the
++            # headers to replace.h.
++            #
++            # As this is only known to happen on a fuzzing compiler, we'll
++            # skip the check when not in fuzzing mode.
++            conf.CHECK_HEADERS('bsd/string.h')
+ 
+-    if not conf.CHECK_FUNCS('getpeereid'):
+-        conf.CHECK_FUNCS_IN('getpeereid', 'bsd', headers='sys/types.h bsd/unistd.h')
+-    if not conf.CHECK_FUNCS_IN('setproctitle', 'setproctitle', headers='setproctitle.h'):
+-        conf.CHECK_FUNCS_IN('setproctitle', 'bsd', headers='sys/types.h bsd/unistd.h')
+-    if not conf.CHECK_FUNCS('setproctitle_init'):
+-        conf.CHECK_FUNCS_IN('setproctitle_init', 'bsd', headers='sys/types.h bsd/unistd.h')
 +        if not conf.CHECK_FUNCS('getpeereid'):
 +            conf.CHECK_FUNCS_IN('getpeereid', 'bsd', headers='sys/types.h bsd/unistd.h')
 +        if not conf.CHECK_FUNCS_IN('setproctitle', 'setproctitle', headers='setproctitle.h'):
 +            conf.CHECK_FUNCS_IN('setproctitle', 'bsd', headers='sys/types.h bsd/unistd.h')
 +        if not conf.CHECK_FUNCS('setproctitle_init'):
 +            conf.CHECK_FUNCS_IN('setproctitle_init', 'bsd', headers='sys/types.h bsd/unistd.h')
-+
+ 
+-    if not conf.CHECK_FUNCS('closefrom'):
+-        conf.CHECK_FUNCS_IN('closefrom', 'bsd', headers='bsd/unistd.h')
 +        if not conf.CHECK_FUNCS('closefrom'):
 +            conf.CHECK_FUNCS_IN('closefrom', 'bsd', headers='bsd/unistd.h')
  
@@ -94,4 +114,3 @@  index 44f92a8..79e8d09 100644
      bld.SAMBA_BINARY('texpect',
 -- 
 2.25.1
-
diff --git a/meta-networking/recipes-connectivity/samba/samba/0008-build-raise-xsltproc-maxdepth-for-manpage-build.patch b/meta-networking/recipes-connectivity/samba/samba/0008-build-raise-xsltproc-maxdepth-for-manpage-build.patch
new file mode 100644
index 0000000000..d2ba9e0e67
--- /dev/null
+++ b/meta-networking/recipes-connectivity/samba/samba/0008-build-raise-xsltproc-maxdepth-for-manpage-build.patch
@@ -0,0 +1,36 @@ 
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Himanshu Jadon <hjadon@cisco.com>
+Date: Thu, 11 Jun 2026 06:00:00 -0700
+Subject: [PATCH] build: raise xsltproc maxdepth for manpage build
+
+The generated smb.conf.5 DocBook input in Samba 4.22.10 is large enough
+to hit libxslt's default recursion limit while the DocBook manpage
+stylesheet runs string.subst. Raise the xsltproc maxdepth for the final
+Samba manpage transform to avoid failing with:
+
+  xsltApplySequenceConstructor: A potential infinite template recursion
+  was detected.
+
+This changes only the documentation generation command and does not
+alter the generated Samba binaries.
+
+Upstream-Status: Pending
+
+Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
+---
+ buildtools/wafsamba/wafsamba.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/buildtools/wafsamba/wafsamba.py b/buildtools/wafsamba/wafsamba.py
+index 8edcc74..5f9b4ac 100644
+--- a/buildtools/wafsamba/wafsamba.py
++++ b/buildtools/wafsamba/wafsamba.py
+@@ -1217,7 +1217,7 @@ def SAMBAMANPAGES(bld, manpages, extra_source=None):
+                             rule='''XML_CATALOG_FILES="${SAMBA_CATALOGS}"
+                                     export XML_CATALOG_FILES
+                                     ${XSLTPROC} --xinclude --stringparam noreference 0 -o ${TGT}.xml --nonet ${SAMBA_EXPAND_XSL} ${SRC[0].abspath(env)}
+-                                    ${XSLTPROC} --nonet -o ${TGT} ${SAMBA_MAN_XSL} ${TGT}.xml'''
++                                    ${XSLTPROC} --maxdepth 10000 --nonet -o ${TGT} ${SAMBA_MAN_XSL} ${TGT}.xml'''
+                             )
+         bld.INSTALL_FILES('${MANDIR}/man%s' % m[-1], m, flat=True)
+ Build.BuildContext.SAMBAMANPAGES = SAMBAMANPAGES
diff --git a/meta-networking/recipes-connectivity/samba/samba_4.19.9.bb b/meta-networking/recipes-connectivity/samba/samba_4.22.10.bb
similarity index 87%
rename from meta-networking/recipes-connectivity/samba/samba_4.19.9.bb
rename to meta-networking/recipes-connectivity/samba/samba_4.22.10.bb
index d50d9f5155..654351c15f 100644
--- a/meta-networking/recipes-connectivity/samba/samba_4.19.9.bb
+++ b/meta-networking/recipes-connectivity/samba/samba_4.22.10.bb
@@ -12,7 +12,11 @@  ${SAMBA_MIRROR}    http://mirror.internode.on.net/pub/samba \n \
 ${SAMBA_MIRROR}    http://www.mirrorservice.org/sites/ftp.samba.org \n \
 "
 
-export PYTHONHASHSEED="1"
+export PYTHONHASHSEED = "1"
+
+# If XML_CATALOG_FILES env var is not defined, waf defaults
+# to build host folders looking for catalogs.
+export XML_CATALOG_FILES = ""
 
 SRC_URI = "${SAMBA_MIRROR}/stable/samba-${PV}.tar.gz \
            file://smb.conf \
@@ -24,6 +28,7 @@  SRC_URI = "${SAMBA_MIRROR}/stable/samba-${PV}.tar.gz \
            file://0005-Fix-pyext_PATTERN-for-cross-compilation.patch \
            file://0006-smbtorture-skip-test-case-tfork_cmd_send.patch \
            file://0007-Deleted-settiong-of-python-to-fix-the-install-confli.patch \
+           file://0008-build-raise-xsltproc-maxdepth-for-manpage-build.patch \
            "
 
 SRC_URI:append:libc-musl = " \
@@ -31,9 +36,9 @@  SRC_URI:append:libc-musl = " \
            file://samba-4.3.9-remove-getpwent_r.patch \
            "
 
-SRC_URI[sha256sum] = "71ed406444714c90bb9d36c576d807b67af15449f297e91106d42b3ca2fa5549"
+SRC_URI[sha256sum] = "e601437cde4845a42e7818379cd0ad5fc4fa518a7cf5284cc0a2657e79b30c34"
 
-UPSTREAM_CHECK_REGEX = "samba\-(?P<pver>4\.19(\.\d+)+).tar.gz"
+UPSTREAM_CHECK_REGEX = "samba\-(?P<pver>4\.22(\.\d+)+).tar.gz"
 
 inherit systemd waf-samba cpan-base perlnative update-rc.d perl-version pkgconfig
 
@@ -42,7 +47,7 @@  CVE_STATUS[CVE-2011-2411] = "not-applicable-platform: vulnerable only on HP NonS
 # remove default added RDEPENDS on perl
 RDEPENDS:${PN}:remove = "perl"
 
-DEPENDS += "readline virtual/libiconv zlib popt libtalloc libtdb libtevent libldb libaio libpam libtasn1 libtasn1-native jansson libparse-yapp-perl-native gnutls cmocka"
+DEPENDS += "readline virtual/libiconv zlib popt libtalloc libtdb libtevent libaio libpam libtasn1 libtasn1-native jansson libparse-yapp-perl-native gnutls cmocka docbook-xml-dtd4-native bison-native"
 
 inherit features_check
 REQUIRED_DISTRO_FEATURES = "pam"
@@ -57,7 +62,7 @@  INITSCRIPT_NAME = "samba"
 INITSCRIPT_PARAMS = "start 20 3 5 . stop 20 0 1 6 ."
 
 SYSTEMD_PACKAGES = "${PN}-base ${PN}-ad-dc winbind ctdb"
-SYSTEMD_SERVICE:${PN}-base = "nmb.service smb.service"
+SYSTEMD_SERVICE:${PN}-base = "nmb.service smb.service samba-bgqd.service"
 SYSTEMD_SERVICE:${PN}-ad-dc = "${@bb.utils.contains('PACKAGECONFIG', 'ad-dc', 'samba.service', '', d)}"
 SYSTEMD_SERVICE:winbind = "winbind.service"
 SYSTEMD_SERVICE:ctdb = "ctdb.service"
@@ -127,6 +132,19 @@  EXTRA_OECONF += "--enable-fhs \
 
 LDFLAGS += "-Wl,-z,relro,-z,now ${@bb.utils.contains('DISTRO_FEATURES', 'ld-is-gold', ' -fuse-ld=bfd ', '', d)}"
 
+do_configure:prepend() {
+    # The xsltproc tool is actually a wrapper script in OE, which exports its own XML_CATALOG_FILES env var
+    # However samba does that too. So here I'm trying to concatenate the variables.
+    # The original looks like this in the wrapper:
+    # export XML_CATALOG_FILES=oe-core-specific-thing
+    # and this sed prepends the value with $XML_CATALOG_FILES, and encloses it in quotes. So the end value is
+    # export XML_CATALOG_FILES="$XML_CATALOG FILES oe-core-specific-thing"
+    # The first grep just checks if it was already done, so it is not prepended multiple times.
+
+    grep \$XML_CATALOG_FILES ${STAGING_BINDIR_NATIVE}/xsltproc || \
+        sed -i 's,\(XML_CATALOG_FILES\)=\(.*\),\1="\$XML_CATALOG_FILES \2",' ${STAGING_BINDIR_NATIVE}/xsltproc
+}
+
 do_configure:append() {
     cd ${S}/pidl/
     perl Makefile.PL PREFIX=${prefix}
@@ -208,6 +226,18 @@  do_install:append() {
     find ${D}${libdir}/perl5/ -type f -name "perllocal.pod" -delete
     find ${D}${libdir}/perl5/ -type f -name ".packlist" -delete
     sed -i -e '1s,#!.*perl,#!${bindir}/env perl,' ${D}${bindir}/pidl
+
+    sed -i 's,${WORKDIR},,g' ${S}/bin/default/libcli/wsp/wsp_aqs_lexer.c
+    sed -i 's,${WORKDIR},,g' ${S}/bin/default/libcli/wsp/wsp_aqs_lexer.h
+
+    # Phoenix installs standalone libldb with Samba; keep libldb as the
+    # provider of the common ldb command-line tools to avoid rootfs clashes.
+    rm -f ${D}${bindir}/ldbadd \
+          ${D}${bindir}/ldbdel \
+          ${D}${bindir}/ldbedit \
+          ${D}${bindir}/ldbmodify \
+          ${D}${bindir}/ldbrename \
+          ${D}${bindir}/ldbsearch
 }
 
 PACKAGES =+ "${PN}-python3 ${PN}-pidl \
@@ -240,13 +270,14 @@  PACKAGESPLITFUNCS:prepend = "samba_populate_packages "
 PACKAGES_DYNAMIC = "samba-auth-.* samba-pdb-.*"
 
 RDEPENDS:${PN} += "${PN}-base ${PN}-python3 ${PN}-dsdb-modules python3"
-RDEPENDS:${PN}-python3 += "pytalloc python3-tdb pyldb"
+RDEPENDS:${PN}-python3 += "pytalloc python3-tdb"
 
 FILES:${PN}-base = "${sbindir}/nmbd \
                     ${sbindir}/smbd \
                     ${sysconfdir}/init.d \
                     ${systemd_system_unitdir}/nmb.service \
-                    ${systemd_system_unitdir}/smb.service"
+                    ${systemd_system_unitdir}/smb.service \
+                    ${systemd_system_unitdir}/samba-bgqd.service"
 
 FILES:${PN}-ad-dc = "${sbindir}/samba \
                      ${systemd_system_unitdir}/samba.service \