7.4 update: security hardening, #44/#61/#93, Ubuntu 26.04 compat

debian/changelog

@@ -1,3 +1,19 @@
+linuxmuster-linuxclient7 (7.4.0) lmn74; urgency=high
+
+ * Security: validate the path and share name passed to the sudoTools mount-share
+ helper to prevent path traversal / arbitrary CIFS mounts as root
+ * Security: restrict install-printer to safe device-uri schemes and validate the
+ printer name (sudoTools is callable NOPASSWD by any domain user)
+ * Security: escape all values interpolated into LDAP search filters to prevent
+ LDAP filter injection
+ * Feat: create user homedirs with umask=077 so users cannot read each other's data (#44)
+ * Fix: printers are not uninstalled on logout because lpadmin is not in PATH (#93)
+ * Fix: onBoot hook could block the boot process when the DC/sysvol is unreachable (#61)
+ * Compat: support Ubuntu 26.04 / Samba 4.2x (drop deprecated "client use spnego",
+ robust SSSD version parsing, timeout on mount.cifs)
+
+ -- Lukas Lukic-Spitznagel <lukas.spitznagel@netzint.de> Thu, 23 Jul 2026 12:00:00 +0200
+
 linuxmuster-linuxclient7 (1.1.4) lmn73; urgency=medium
 
  * Fix: regressions in setup and prepareImage (#91)

usr/lib/python3/dist-packages/linuxmusterLinuxclient7/computer.py

@@ -26,7 +26,7 @@ def readAttributes():
  :return: Tuple (success, dict of attributes)
  :rtype: tuple
  """
- return ldapHelper.searchOne(f"(sAMAccountName={hostname()}$)")
+ return ldapHelper.searchOne(f"(sAMAccountName={ldapHelper.escape(hostname())}$)")
 
 def isInGroup(groupName):
  """

usr/lib/python3/dist-packages/linuxmusterLinuxclient7/constants.py

@@ -9,6 +9,9 @@
 
 shareMountBasepath = "/home/{}/media"
 hiddenShareMountBasepath = "/srv/samba/{}"
+# Timeout (in seconds) for the mount.cifs call, so an unreachable server
+# cannot block boot / login indefinitely (see issue #61).
+mountTimeoutSeconds = 10
 machineAccountSysvolMountPath = "/var/lib/samba/sysvol"
 defaultShareLetterTemplate = " ({letter}:)"
 

usr/lib/python3/dist-packages/linuxmusterLinuxclient7/gpo.py

@@ -80,7 +80,7 @@ def _findApplicablePolicies():
  policyName = f"sophomorix:school:{schoolName}"
 
  # find policy
- rc, policyAdObject = ldapHelper.searchOne(f"(displayName={policyName})")
+ rc, policyAdObject = ldapHelper.searchOne(f"(displayName={ldapHelper.escape(policyName)})")
  if not rc:
  return False, None
 
@@ -99,7 +99,7 @@ def _parsePolicy(policyDn):
  """
 
  # Find policy in AD
- rc, policyAdObject = ldapHelper.searchOne(f"(distinguishedName={policyDn[0]})")
+ rc, policyAdObject = ldapHelper.searchOne(f"(distinguishedName={ldapHelper.escape(policyDn[0])})")
  if not rc:
  logging.error("===> Could not find poilcy in AD! ===")
  return False

usr/lib/python3/dist-packages/linuxmusterLinuxclient7/ldapHelper.py

@@ -1,8 +1,20 @@
-import ldap, ldap.sasl, sys, getpass, subprocess
+import ldap, ldap.sasl, ldap.filter, sys, getpass, subprocess
 from linuxmusterLinuxclient7 import logging, constants, config, user, computer
 
 _currentLdapConnection = None
 
+def escape(value):
+ """
+ Escapes a value so it can be safely embedded into an LDAP search filter.
+ This prevents LDAP filter injection (e.g. via crafted usernames or hostnames).
+
+ :param value: The value to escape
+ :type value: str
+ :return: The escaped value
+ :rtype: str
+ """
+ return ldap.filter.escape_filter_chars(str(value))
+
 def serverUrl():
  """
  Returns the server URL
@@ -109,7 +121,7 @@ def isObjectInGroup(objectDn, groupName):
  :rtype: bool
  """
  logging.debug(f"= Testing if object {objectDn} is a member of group {groupName} =")
- rc, groupAdObject = searchOne(f"(&(member:1.2.840.113556.1.4.1941:={objectDn})(sAMAccountName={groupName}))")
+ rc, groupAdObject = searchOne(f"(&(member:1.2.840.113556.1.4.1941:={escape(objectDn)})(sAMAccountName={escape(groupName)}))")
  logging.debug(f"=> Result: {rc} =")
  return rc
 

usr/lib/python3/dist-packages/linuxmusterLinuxclient7/printers.py

@@ -1,6 +1,17 @@
-import os, subprocess, re
+import os, subprocess, re, shutil
 from linuxmusterLinuxclient7 import logging, user
 
+# Resolve absolute paths at import time. When called from the logout PAM hook the
+# PATH is reduced to /bin:/usr/bin, so lpadmin (/usr/sbin) is not found otherwise.
+# See issue #93.
+_lpadminPath = shutil.which("lpadmin") or "/usr/sbin/lpadmin"
+_lpstatPath = shutil.which("lpstat") or "/usr/bin/lpstat"
+
+# CUPS device-uri schemes we allow to be installed via the (root) sudoTools helper.
+# Notably excludes "file://", which would let an unprivileged domain user write to
+# an arbitrary file as root. See security audit.
+_allowedPrinterUriSchemes = ("ipp", "ipps", "http", "https", "smb", "lpd", "socket", "dnssd")
+
 def installPrinter(networkPath, name=None, username=None):
  """
  Installs a networked printer for a user
@@ -70,8 +81,16 @@ def translateSambaToIpp(networkPath):
 # --------------------
 
 def _installPrinter(username, networkPath, name):
+ if not _printerNetworkPathIsValid(networkPath):
+ logging.error(f"Refusing to install printer: invalid network path '{networkPath}'")
+ return False
+
+ if not _printerNameIsValid(name):
+ logging.error(f"Refusing to install printer: invalid printer name '{name}'")
+ return False
+
  logging.info(f"Install Printer {name} on {networkPath}")
- installCommand = ["timeout", "10", "lpadmin", "-p", name, "-E", "-v", networkPath, "-m", "everywhere", "-u", f"allow:{username}"]
+ installCommand = ["timeout", "10", _lpadminPath, "-p", name, "-E", "-v", networkPath, "-m", "everywhere", "-u", f"allow:{username}"]
  logging.debug(f"* running '{' '.join(installCommand)}'")
  p = subprocess.call(installCommand, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
  if p == 0:
@@ -88,7 +107,7 @@ def _installPrinterWithoutRoot(networkPath, name):
 
 def _getInstalledPrintersOfUser(username):
  logging.info(f"Getting installed printers of {username}")
- command = ["lpstat", "-U", username, "-p"]
+ command = [_lpstatPath, "-U", username, "-p"]
  #logging.debug(f"running '{command}'")
 
  result = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True)
@@ -113,7 +132,7 @@ def _getInstalledPrintersOfUser(username):
 
 def _uninstallPrinter(name):
  logging.info(f"Uninstall Printer {name}")
- uninstallCommand = ["timeout", "10", "lpadmin", "-x", name]
+ uninstallCommand = ["timeout", "10", _lpadminPath, "-x", name]
  logging.debug(f"* running '{' '.join(uninstallCommand)}'")
  p = subprocess.call(uninstallCommand, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
  if p == 0:
@@ -124,3 +143,16 @@ def _uninstallPrinter(name):
  else:
  logging.fatal(f"* Error Uninstalling Printer {name}!")
  return False
+
+def _printerNetworkPathIsValid(networkPath):
+ if not networkPath or "\x00" in networkPath or "\n" in networkPath:
+ return False
+ match = re.match(r"^([a-zA-Z][a-zA-Z0-9+.-]*)://", networkPath)
+ if not match:
+ return False
+ return match.group(1).lower() in _allowedPrinterUriSchemes
+
+def _printerNameIsValid(name):
+ if not name:
+ return False
+ return re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]*", name) is not None

usr/lib/python3/dist-packages/linuxmusterLinuxclient7/realm.py

@@ -69,14 +69,20 @@ def isJoined():
  else:
  return len(joinedDomains) > 0
 
-def pullKerberosTicketForComputerAccount():
+def pullKerberosTicketForComputerAccount(timeoutSeconds=None):
  """
  Pulls a kerberos ticket using the computer account from `/etc/krb5.keytab`
 
+ :param timeoutSeconds: If set, abort the kinit after this many seconds so an
+ unreachable domain controller cannot block the caller (e.g. boot). See issue #61.
+ :type timeoutSeconds: int, optional
  :return: True on success, False otherwise
  :rtype: bool
  """
- return subprocess.call(["kinit", "-k", computer.krbHostName()]) == 0
+ command = ["kinit", "-k", computer.krbHostName()]
+ if timeoutSeconds is not None:
+ command = ["timeout", str(timeoutSeconds)] + command
+ return subprocess.call(command) == 0
 
 def verifyDomainJoin():
  """

usr/lib/python3/dist-packages/linuxmusterLinuxclient7/setup.py

@@ -374,7 +374,12 @@ def _deleteObsoleteFiles():
  return True
 
 def _parseVersion(versionString):
- return tuple(int(p) for p in versionString.split("."))
+ # Only look at the leading dotted-number part so packaging suffixes emitted by
+ # newer distributions (e.g. "2.10.0-1ubuntu1" on Ubuntu 26.04) do not break parsing.
+ match = re.match(r"\d+(?:\.\d+)*", versionString.strip())
+ if not match:
+ raise ValueError(f"Could not parse version string: {versionString!r}")
+ return tuple(int(p) for p in match.group(0).split("."))
 
 def _getSssdVersion():
  try:

usr/lib/python3/dist-packages/linuxmusterLinuxclient7/shares.py

@@ -138,8 +138,28 @@ def getLocalSysvolPath():
 # This parameter influences the `cruid` mount option.
 def _mountShare(username, networkPath, shareName, hiddenShare, useCruidOfExecutingUser=False):
 
+ # Normalize and validate the untrusted inputs before doing anything as root.
+ # _mountShare() is reachable by any domain user via the sudoTools helper, so
+ # unvalidated values would allow mounting an arbitrary CIFS server to an
+ # arbitrary location (path traversal via shareName). See security audit.
+ networkPath = networkPath.replace("\\", "/")
+
+ if not _networkPathIsValid(networkPath):
+ logging.error(f"Refusing to mount: invalid network path '{networkPath}'")
+ return False, None
+
+ if not _shareNameIsValid(shareName):
+ logging.error(f"Refusing to mount: invalid share name '{shareName}'")
+ return False, None
+
  mountpoint = _getShareMountpoint(networkPath, username, hiddenShare, shareName)
 
+ # Defense in depth: make sure the resolved mountpoint really stays inside the
+ # per-user base directory and did not escape it through traversal.
+ if not _mountpointIsWithinBase(mountpoint, username, hiddenShare):
+ logging.error(f"Refusing to mount: mountpoint '{mountpoint}' escapes the allowed base directory")
+ return False, None
+
  mountCommandOptions = f"file_mode=0700,dir_mode=0700,sec=krb5,nodev,nosuid,mfsymlinks,nobrl,vers=3.0,user={username}"
  rc, networkConfig = config.network()
  domain = None
@@ -162,7 +182,10 @@ def _mountShare(username, networkPath, shareName, hiddenShare, useCruidOfExecuti
  gid = -1
  logging.warning("Uid could not be found! Continuing anyway!")
 
- mountCommand = [shutil.which("mount.cifs"), "-o", mountCommandOptions, networkPath, mountpoint]
+ mountBinary = shutil.which("mount.cifs") or "/usr/sbin/mount.cifs"
+ # Wrap the mount in `timeout` so an unreachable server cannot block
+ # boot / login indefinitely (issue #61).
+ mountCommand = ["timeout", str(constants.mountTimeoutSeconds), mountBinary, "-o", mountCommandOptions, networkPath, mountpoint]
 
  logging.debug(f"Trying to mount '{networkPath}' to '{mountpoint}'")
  logging.debug("* Creating directory...")
@@ -259,3 +282,36 @@ def _getShareMountpoint(networkPath, username, hidden, shareName = None):
 
 def _directoryIsMountpoint(dir):
  return subprocess.call(["mountpoint", "-q", dir]) == 0
+
+def _networkPathIsValid(networkPath):
+ """
+ Validates a CIFS network path of the form `//server/share[/subdir...]`.
+ Rejects empty paths, path traversal and control characters.
+ """
+ if not networkPath or "\x00" in networkPath or "\n" in networkPath:
+ return False
+ if ".." in networkPath.split("/"):
+ return False
+ return re.fullmatch(r"//[^/\x00]+/[^\x00]+", networkPath) is not None
+
+def _shareNameIsValid(shareName):
+ """
+ Validates the share name, which becomes a single directory below the user's
+ mount base. It must therefore be a single path component without any slashes
+ or traversal.
+ """
+ if not shareName or shareName in (".", ".."):
+ return False
+ if "/" in shareName or "\\" in shareName or "\x00" in shareName:
+ return False
+ return True
+
+def _mountpointIsWithinBase(mountpoint, username, hidden):
+ if hidden:
+ base = constants.hiddenShareMountBasepath.format(username)
+ else:
+ base = constants.shareMountBasepath.format(username)
+
+ base = os.path.normpath(base)
+ normalized = os.path.normpath(mountpoint)
+ return normalized == base or normalized.startswith(base + "/")

usr/lib/python3/dist-packages/linuxmusterLinuxclient7/tests/test_ldapHelper.py

@@ -0,0 +1,23 @@
+from unittest import mock
+from .. import ldapHelper
+
+
+def test_escape():
+ # Plain values are unchanged
+ assert ldapHelper.escape("user1") == "user1"
+ # LDAP filter metacharacters are escaped so they cannot alter the filter
+ assert ldapHelper.escape("*") == r"\2a"
+ assert ldapHelper.escape("a)(b") == r"a\29\28b"
+ assert ldapHelper.escape("a\\b") == r"a\5cb"
+ # Non-str input is handled
+ assert ldapHelper.escape(123) == "123"
+
+
+@mock.patch("linuxmusterLinuxclient7.ldapHelper.searchOne")
+def test_isObjectInGroupEscapesFilter(mockSearchOne):
+ mockSearchOne.return_value = (True, {})
+ # A crafted group name with filter metacharacters must be escaped, not injected.
+ assert ldapHelper.isObjectInGroup("cn=user,dc=x", "domain users)(cn=*")
+ usedFilter = mockSearchOne.call_args.args[0]
+ assert "*" not in usedFilter
+ assert r"\2a" in usedFilter

usr/lib/python3/dist-packages/linuxmusterLinuxclient7/tests/test_printers.py

@@ -2,6 +2,41 @@
 from unittest import mock
 from .. import printers
 
+def test_printerNetworkPathIsValid():
+ assert printers._printerNetworkPathIsValid("ipp://server/printers/P1")
+ assert printers._printerNetworkPathIsValid("smb://server/P1")
+ assert printers._printerNetworkPathIsValid("https://server/printers/P1")
+ # dangerous / invalid schemes must be rejected
+ assert not printers._printerNetworkPathIsValid("file:///etc/passwd")
+ assert not printers._printerNetworkPathIsValid("/etc/passwd")
+ assert not printers._printerNetworkPathIsValid("")
+ assert not printers._printerNetworkPathIsValid("ipp://server/\nP1")
+
+
+def test_printerNameIsValid():
+ assert printers._printerNameIsValid("EW-farblaser")
+ assert printers._printerNameIsValid("printer1")
+ assert not printers._printerNameIsValid("")
+ assert not printers._printerNameIsValid("-flag")
+ assert not printers._printerNameIsValid("a/b")
+ assert not printers._printerNameIsValid("a b")
+
+
+@mock.patch("subprocess.call")
+@mock.patch("linuxmusterLinuxclient7.hooks.user.isRoot")
+@mock.patch("linuxmusterLinuxclient7.hooks.user.username")
+def test_installPrinterRejectsUnsafeInput(mockUserUsername, mockUserIsRoot, mockSubprocessCall):
+ mockUserIsRoot.return_value = True
+ mockUserUsername.return_value = "user1"
+
+ # Unsafe device-uri scheme (file://) must be rejected without running lpadmin.
+ assert not printers.installPrinter("file:///etc/passwd", "printer1")
+ # Unsafe printer name must be rejected too.
+ assert not printers.installPrinter("ipp://server/printers/P1", "../evil")
+ # The privileged lpadmin command (wrapped in `timeout`) must never have run.
+ assert _getCallsTo(mockSubprocessCall, "timeout") == []
+
+
 def test_translateSambaToIpp():
  assert printers.translateSambaToIpp("\\\\linuxmuster.lan\\printer1") == (True, "ipp://linuxmuster.lan/printers/printer1")
  assert printers.translateSambaToIpp("\\\\linuxmuster.lan\\") == (False, None)
@@ -18,13 +53,13 @@ def test_installPrinter(mockUserUsername, mockUserIsRoot, mockSubprocessCall):
  mockUserUsername.return_value = "user1"
 
  assert printers.installPrinter("ipp://linuxmuster.lan/printers/printer1")
- assert _getCallsTo(mockSubprocessCall, "timeout")[-1] == ["timeout", "10", "lpadmin", "-p", "printer1", "-E", "-v", "ipp://linuxmuster.lan/printers/printer1", "-m", "everywhere", "-u", "allow:user1"]
+ assert _getCallsTo(mockSubprocessCall, "timeout")[-1] == ["timeout", "10", printers._lpadminPath, "-p", "printer1", "-E", "-v", "ipp://linuxmuster.lan/printers/printer1", "-m", "everywhere", "-u", "allow:user1"]
 
  assert printers.installPrinter("ipp://linuxmuster.lan/printers/printer1", "printer2")
- assert _getCallsTo(mockSubprocessCall, "timeout")[-1] == ["timeout", "10", "lpadmin", "-p", "printer2", "-E", "-v", "ipp://linuxmuster.lan/printers/printer1", "-m", "everywhere", "-u", "allow:user1"]
-
+ assert _getCallsTo(mockSubprocessCall, "timeout")[-1] == ["timeout", "10", printers._lpadminPath, "-p", "printer2", "-E", "-v", "ipp://linuxmuster.lan/printers/printer1", "-m", "everywhere", "-u", "allow:user1"]
+
  assert printers.installPrinter("ipp://linuxmuster.lan/printers/printer1", "printer2", "user2")
- assert _getCallsTo(mockSubprocessCall, "timeout")[-1] == ["timeout", "10", "lpadmin", "-p", "printer2", "-E", "-v", "ipp://linuxmuster.lan/printers/printer1", "-m", "everywhere", "-u", "allow:user2"]
+ assert _getCallsTo(mockSubprocessCall, "timeout")[-1] == ["timeout", "10", printers._lpadminPath, "-p", "printer2", "-E", "-v", "ipp://linuxmuster.lan/printers/printer1", "-m", "everywhere", "-u", "allow:user2"]
 
  mockUserIsRoot.return_value = False
  assert printers.installPrinter("ipp://linuxmuster.lan/printers/printer1")
@@ -57,8 +92,8 @@ def test_uninstallAllPrintersOfUser(mockSubprocessRun, mockSubprocessCall):
  mockSubprocessRun.return_value = CompletedProcess(args=["lpstat", "-U", "user1", "-p"], returncode=0, stdout=lpstatStdout)
 
  assert printers.uninstallAllPrintersOfUser("user1")
- assert _getCallsTo(mockSubprocessRun, "lpstat")[-1] == ['lpstat', '-U', 'user1', '-p']
- assert _getCallsTo(mockSubprocessCall, "timeout") == [["timeout", "10", "lpadmin", "-x", "printer1"], ["timeout", "10", "lpadmin", "-x", "printer2"]]
+ assert _getCallsTo(mockSubprocessRun, printers._lpstatPath)[-1] == [printers._lpstatPath, '-U', 'user1', '-p']
+ assert _getCallsTo(mockSubprocessCall, "timeout") == [["timeout", "10", printers._lpadminPath, "-x", "printer1"], ["timeout", "10", printers._lpadminPath, "-x", "printer2"]]
 
  mockSubprocessRun.return_value = CompletedProcess(args=["lpstat", "-U", "user1", "-p"], returncode=1)
  assert printers.uninstallAllPrintersOfUser("user1")

usr/lib/python3/dist-packages/linuxmusterLinuxclient7/tests/test_realm.py

@@ -80,6 +80,14 @@ def test_pullKerberosTicketForComputerAccount(mockSubprocessCall):
  mockSubprocessCall.return_value = 1
  assert not realm.pullKerberosTicketForComputerAccount()
 
+@mock.patch("subprocess.call")
+@mock.patch("linuxmusterLinuxclient7.computer.krbHostName", lambda : "linuxmuster.lan")
+def test_pullKerberosTicketForComputerAccountWithTimeout(mockSubprocessCall):
+ mockSubprocessCall.return_value = 0
+ assert realm.pullKerberosTicketForComputerAccount(timeoutSeconds=5)
+ calls = _getCallsTo(mockSubprocessCall, "timeout")
+ assert ["timeout", "5", "kinit", "-k", "linuxmuster.lan"] in calls
+
 @mock.patch("subprocess.call")
 @mock.patch("linuxmusterLinuxclient7.realm.isJoined")
 @mock.patch("linuxmusterLinuxclient7.realm.pullKerberosTicketForComputerAccount")