samba.git/python/samba/netcmd/domain_backup.py, branch talloc-2.3.3

netcmd: Avoid conflicting SIDs when creating an offline backup

2021-06-11T07:41:38+00:00

To allow the new DC object to be created in a restored domain while
avoiding conflicts with existing SIDS, we fetch a SID that is available
at the time of backing up and store it in the backed-up database.
However, if a new security principal is created on this DC during the
backup process, the stored SID may be reused for that object, resulting
in an error on restoration.

By getting the SID for restore only after all the database files have
been backed up, we ensure that the chosen SID does not conflict with any
objects in the backed-up database.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall

netcmd: Use next_free_rid() function to calculate a SID for restoring a backup

2021-06-11T07:41:38+00:00

This means we won't get errors if the DC doesn't have a rIDNextRID
attribute, but we will still error if there is no RID Set or if all its
pools are exhausted.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14669

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall

netcmd: Refactor seizing DNS roles while restoring from a backup

2021-06-11T07:41:38+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall

netcmd: Use correct path for state directory during offline backup

2021-06-11T07:41:38+00:00

During the restore process, we use make_smbconf() to create a new
smb.conf file with the default paths. The default location for 'state
directory' is 'state', but we currently rename this directory to
'statedir' on backing up, so it will end up pointing to a non-existent
directory. This commit ensures the names are consistent.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall

netcmd: Fix error-checking condition

2021-06-11T07:41:38+00:00

This condition probably meant to check the argument of the most recently
thrown exception, rather than the previous one again.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14669

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall

netcmd: Fix opening SamDB database for offline backup

2021-03-24T02:08:54+00:00

When opening the backed-up SamDB database, open the top-level database
without loading any modules so the backend database files aren't
unnecessarily opened. The domain SID is now fetched from the original
database rather than from the backup.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14676

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Samuel Cabrero

netcmd: Workaround issue backing up offline domain with lmdb >= 0.9.26

2021-03-24T02:08:54+00:00

The LMDB change "ITS#9278 fix robust mutex cleanup for FreeBSD" released
in version 0.9.26 makes samba-tool domain backup offline to fail with
the following error:

Failed to connect to 'mdb:///tmp/foo/private/sam.ldb.d/CN=CONFIGURATION,DC=FOO,DC=EXAMPLE,DC=COM.ldb' with backend 'mdb': Unable to load ltdb cache records for backend 'ldb_mdb backend'
module samba_dsdb initialization failed : Operations error
Unable to load modules for /tmp/foo/private/sam.ldb.bak-offline: Unable to load ltdb cache records for backend 'ldb_mdb backend'
ERROR(ldb): uncaught exception - Unable to load ltdb cache records for backend 'ldb_mdb backend'
  File "/usr/local/samba/lib64/python3.6/site-packages/samba/netcmd/__init__.py", line 186, in _run
    return self.run(*args, **kwargs)
  File "/usr/local/samba/lib64/python3.6/site-packages/samba/netcmd/domain_backup.py", line 1147, in run
    session_info=system_session(), lp=lp)
  File "/usr/local/samba/lib64/python3.6/site-packages/samba/samdb.py", line 72, in __init__
    options=options)
  File "/usr/local/samba/lib64/python3.6/site-packages/samba/__init__.py", line 114, in __init__
    self.connect(url, flags, options)
  File "/usr/local/samba/lib64/python3.6/site-packages/samba/samdb.py", line 87, in connect
    options=options)

The error occurs opening the backed ldb to write the backup date and the
next SID, a call to pthread_mutex_lock in mdb_txn_renew0 (frame 8) returns
EINVAL:

  #0  0x00007ff63c2f1bea in wait4 () from /lib64/libc.so.6
  #1  0x00007ff63c26f3a3 in do_system () from /lib64/libc.so.6
  #2  0x00007ff63bc71e94 in smb_panic_default (why=0x7ffed481b7d0 "Signal 6: Aborted") at ../../lib/util/fault.c:153
  #3  0x00007ff63bc72168 in smb_panic (why=0x7ffed481b7d0 "Signal 6: Aborted") at ../../lib/util/fault.c:200
  #4  0x00007ff63bc71c82 in fault_report (sig=6) at ../../lib/util/fault.c:81
  #5  0x00007ff63bc71c97 in sig_fault (sig=6) at ../../lib/util/fault.c:92
  #6  
  #7  0x00007ff63c2178b5 in raise () from /lib64/libpthread.so.0
  #8  0x00007ff637602e65 in mdb_txn_renew0 (txn=txn@entry=0x55d6f97fb800) at mdb.c:2710
  #9  0x00007ff637603ae8 in mdb_txn_begin (env=0x55d6f85dfa80, parent=0x0, flags=131072, ret=0x55d6f89c0928)
      at mdb.c:2912
  #10 0x00007ff6376236cc in lmdb_lock_read (module=0x55d6f8c5f4b0) at ../../lib/ldb/ldb_mdb/ldb_mdb.c:585
  #11 0x00007ff637641de6 in ldb_kv_cache_load (module=0x55d6f8c5f4b0) at ../../lib/ldb/ldb_key_value/ldb_kv_cache.c:450
  #12 0x00007ff637638792 in ldb_kv_init_store (ldb_kv=0x55d6f8af2a80, name=0x7ff637625675 "ldb_mdb backend",
      ldb=0x55d6f8cd22b0, options=0x0, _module=0x7ffed481c248) at ../../lib/ldb/ldb_key_value/ldb_kv.c:2166
  #13 0x00007ff6376247ba in lmdb_connect (ldb=0x55d6f8cd22b0,
      url=0x55d6f85d41f0 "mdb:///tmp/foo/private/sam.ldb.d/CN=CONFIGURATION,DC=FOO,DC=EXAMPLE,DC=COM.ldb", flags=64,
      options=0x0, _module=0x7ffed481c248) at ../../lib/ldb/ldb_mdb/ldb_mdb.c:1143
  #14 0x00007ff63bd94d2f in ldb_module_connect_backend (ldb=0x55d6f8cd22b0,
      url=0x55d6f85d41f0 "mdb:///tmp/foo/private/sam.ldb.d/CN=CONFIGURATION,DC=FOO,DC=EXAMPLE,DC=COM.ldb",
      options=0x0, backend_module=0x7ffed481c248) at ../../lib/ldb/common/ldb_modules.c:221
  #15 0x00007ff6375a4baf in new_partition_from_dn (ldb=0x55d6f8cd22b0, data=0x55d6f858bed0, mem_ctx=0x55d6f8a03cd0,
      dn=0x55d6f9865450, filename=0x55d6f860b6da "sam.ldb.d/CN=CONFIGURATION,DC=FOO,DC=EXAMPLE,DC=COM.ldb",
      backend_db_store=0x55d6f9d378e0 "mdb", partition=0x7ffed481c308)
      at ../../source4/dsdb/samdb/ldb_modules/partition_init.c:257
  #16 0x00007ff6375a57b9 in partition_reload_if_required (module=0x55d6f8972d10, data=0x55d6f858bed0, parent=0x0)
      at ../../source4/dsdb/samdb/ldb_modules/partition_init.c:513
  #17 0x00007ff6375a3b04 in partition_read_lock (module=0x55d6f8972d10)
      at ../../source4/dsdb/samdb/ldb_modules/partition.c:1492
  #18 0x00007ff63bd9631e in ldb_next_read_lock (module=0x55d6f8972d10) at ../../lib/ldb/common/ldb_modules.c:662
  #19 0x00007ff637484857 in schema_read_lock (module=0x55d6f9377e40)
      at ../../source4/dsdb/samdb/ldb_modules/schema_load.c:614
  #20 0x00007ff63bd9631e in ldb_next_read_lock (module=0x55d6f9377e40) at ../../lib/ldb/common/ldb_modules.c:662
  #21 0x00007ff6374b5402 in samba_dsdb_init (module=0x55d6f91c3cd0)
      at ../../source4/dsdb/samdb/ldb_modules/samba_dsdb.c:483
  #22 0x00007ff63bd95283 in ldb_module_init_chain (ldb=0x55d6f8cd22b0, module=0x55d6f91c3cd0)
      at ../../lib/ldb/common/ldb_modules.c:363
  #23 0x00007ff63bd95645 in ldb_load_modules (ldb=0x55d6f8cd22b0, options=0x0)
      at ../../lib/ldb/common/ldb_modules.c:445
  #24 0x00007ff63bd90663 in ldb_connect (ldb=0x55d6f8cd22b0,
      url=0x7ff6377d98f8 "/tmp/foo/private/sam.ldb.bak-offline", flags=64, options=0x0)
      at ../../lib/ldb/common/ldb.c:274
  #25 0x00007ff63bddb32f in py_ldb_connect (self=0x7ff63778afc0, args=(), Python Exception  There is no member named ma_keys.:
  kwargs=) at ../../lib/ldb/pyldb.c:1235

Deleting the previous samdb instance by setting it to None before opening the
backed ldb workaround the problem until we find the real problem here.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14676

Signed-off-by: Samuel Cabrero 
Reviewed-by: Andrew Bartlett

netcmd: Avoid database corruption by opting not to create database files during an offline domain backup

2021-03-23T23:38:38+00:00

If backup dirs contain hardlinks, the backup process could previously
attempt to open an LMDB database already opened during the backup,
causing it to be recreated as a new TDB database. This commit ensures
that new database files are not created during this operation, and that
the main SamDB database is not modified.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14027

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall

netcmd: Determine which files are to be copied for an offline domain backup

2021-03-23T23:38:38+00:00

The old behaviour attempted to check for and remove files with duplicate
names, but did not do so due to a bug, and would have left undetermined
which files were given priority when duplicate filenames were present.
Now when hardlinks are present, only one instance of each file is
chosen, with files in the private directory having priority. If one
backup dir is nested inside another, the files contained in the nested
directory are only added once. Additionally, the BIND DNS database is
omitted from the backup.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14027

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall

samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID

2020-11-26T21:15:40+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14575

Signed-off-by: Andrew Bartlett 
Reviewed-by: Gary Lockyer 

Autobuild-User(master): Gary Lockyer 
Autobuild-Date(master): Thu Nov 26 21:15:40 UTC 2020 on sn-devel-184