illumos

2021-02-09

07:53 PM illumos gate Bug #13508 (New): door_layout() should align the stack to 16 bytes for i386 processes

We recently came across an issue where a door server was crashing with a GP fault when attempting to perform an SSE i... Matt Barden

2021-02-05

10:05 PM illumos gate Bug #13501 (New): smbutil view crashes in ndr_clnt_get_frags()

In testing 13169 (and re-tested against illumos-gate without that change), I discovered that, when the NDR client att... Matt Barden

2021-01-30

12:37 AM illumos gate Bug #13169: CVE-2020-1472 (ZeroLogon) and SMB authentication

Testing Notes:
Install, configure, and run the included libmlrpc-tests.
Connect to a domain-joined server, with bot... Matt Barden

12:32 AM illumos gate Bug #13442: SMB server should try harder to protect SACLs

Apply the attached patch to samba, build smbtorture, and run "smbtorture -U user%pass //server/share smb2.acls.SACL".... Matt Barden

12:25 AM illumos gate Bug #13441: SMB: Creating named streams on existing files is not quite right

Testing Notes:
Run streams-setup.sh in a directory on a share on the server under test.
Mount the share from an i... Matt Barden

2021-01-08

09:39 PM illumos gate Bug #13442 (Closed): SMB server should try harder to protect SACLs

In SMB, the System ACL (SACL) is protected by SeSecurityPrivilege: ACCESS_SYSTEM_SECURITY permission is required to m... Matt Barden

09:26 PM illumos gate Bug #13441 (Closed): SMB: Creating named streams on existing files is not quite right

In MS-FSA, 'file lookup' effectively has the following branches:
1. If the file doesn't exist, create the file and... Matt Barden

2020-08-14

07:43 PM illumos gate Bug #13047 (Closed): SMB server is too strict about security descriptors

SMB allows a user to 'remove' an ACL by specifying that it wants the acl to change (SMB_DACL/SACL_SECINFO), but marki... Matt Barden

07:11 PM illumos gate Bug #13045 (Closed): Idmap's KDC lookup override doesn't work

Our kerberos library provides a mechanism for 'overriding' the normal lookup routine, by specifying a "_krb5_override... Matt Barden

2020-08-07

08:13 PM illumos gate Bug #13026 (Closed): SMB and NFS use the global zone's IDMAP when they shouldn't

SMB and NFS use crget() as a base for their credentials.
This copies the global kcred, and so sets cr->cr_zone to th... Matt Barden