7.4 update: security hardening, #44/#61/#93, Ubuntu 26.04 compat

[hermanntoast]

Overview

Collected 7.4 (lmn74) update bundling a security audit follow-up, two open bug fixes, one open PR, and Ubuntu 26.04 / Samba 4.2x compatibility. Version bumped to 7.4.0 lmn74.

Security fixes

The sudoTools helper is callable NOPASSWD by every member of domain users (see etc/sudoers.d/99-linuxmuster-linuxclient7), so its arguments are an unprivileged→root trust boundary.

1. Path traversal / arbitrary CIFS mount as root (critical). mount-share --name flowed unvalidated into the mountpoint (/home/{user}/media/{name}), so --name ../../../.. escaped the per-user base and let any domain user mkdir as root and mount an attacker-controlled SMB server at an arbitrary path. shares._mountShare() now validates the network path and share name and confirms the resolved mountpoint stays inside the user's base dir. Also fixes the mount-share success check (the old if tuple: was always truthy).
2. install-printer argument injection. Restricted device-uri schemes to a safe allow-list (notably rejecting file://, which would let a domain user write to any file as root) and validated the printer name.
3. LDAP filter injection. Usernames, hostnames and policy names were interpolated into LDAP filters via f-strings without escaping. All values now go through ldap.filter.escape_filter_chars().

Bug fixes

• Printers are not uninstalled when a user logs out #93 – Printers were not uninstalled on logout because the logout PAM environment only has PATH=/bin:/usr/bin and lpadmin lives in /usr/sbin. lpadmin/lpstat are now resolved to absolute paths.
• onBoot hook blocks boot process in some cases #61 – The onBoot hook could block boot when the DC/sysvol was unreachable. Kerberos ticket retrieval now uses a 5 s timeout and mount.cifs is wrapped in timeout.

Incorporated PR

• Feat: Change umask of homedir to 077 #44 (by @dorianim) – create user homedirs with umask=077 so users cannot read each other's data.

Ubuntu 26.04 / Samba 4.2x compatibility

• Dropped the deprecated client use spnego smb.conf option (SPNEGO is always used in modern Samba; the option triggers warnings).
• Made SSSD version parsing tolerant of packaging suffixes (e.g. 2.10.0-1ubuntu1) so the krb5_child capability check keeps working.
• The mount.cifs timeout above also hardens boot on new stacks.

⚠️ The Ubuntu 26.04 changes are based on the current Samba deprecation state and were not validated on a live 26.04 client. Please smoke-test a real domain join + login on 26.04 before release.

Tests

make tests — 110 passed (99 previously + 11 new covering the validation, LDAP escaping, timeout and version-parsing paths).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.09%. Comparing base (5181369) to head (5cf4b86).

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #94      +/-   ##
==========================================
+ Coverage   61.82%   65.09%   +3.26%     
==========================================
  Files          18       18              
  Lines        1548     1607      +59     
==========================================
+ Hits          957     1046      +89     
+ Misses        591      561      -30     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[hermanntoast]

🧪 Live test on real hardware — Ubuntu 26.04 LTS against linuxmuster.net 7.4

This branch was built into a 7.4.0 package, installed on a real client, and fully tested end-to-end against a linuxmuster.net 7.4 server.

Test environment

• linuxmuster.net 7.4 server (domain join against the real AD)
• Ubuntu 26.04 LTS client (Kernel 7.0), Python 3.14.4
• Samba 4.23.6, SSSD 2.12.0

Installation & compatibility

Test	Result
Package 7.4.0 installed incl. all dependencies	✅
All Python core modules import under Python 3.14	✅ no breakage
setup — domain join against Samba 4.23	✅ successful
sysvol mount (timeout … mount.cifs … vers=3.0)	✅ "Success"
status → "fully setup and working"	✅
Live /etc/samba/smb.conf: no active client use spnego	✅ Samba 4.x compatible

AD login (one fresh user per role)

Test	Student	Teacher	Staff
Login / Kerberos auth	✅	✅	✅
Home freshly created with 0700 (umask=077, #44)	✅	✅	✅
Role-based share mounts (sec=krb5)	✅	✅ (incl. students' homes)	✅
Login hooks incl. remote logon.sh	✅	✅	✅
Access to sudoTools via %domain users	✅	✅	✅

Side note: the new staff role (linuxmuster 7.4) is a member of domain users and can use sudoTools without a dedicated sudoers entry — a %role-staff line is not required.

Printer logout (#93)

Test	Result
Uninstall on logout under reduced PATH=/bin:/usr/bin	✅ via absolute /usr/sbin/lpadmin

Security fixes (verified on the real machine)

Attack	Result
Path traversal via --name (root mkdir/mount at arbitrary location)	✅ rejected, no directory created
Traversal network path	✅ rejected
install-printer file:// (write to arbitrary file as root)	✅ rejected
Malicious printer name	✅ rejected
LDAP escaping via python-ldap (* → \2a)	✅
sudoers valid (visudo -cf = parsed OK)	✅

Conclusion: On Ubuntu 26.04 with Samba 4.23, the 7.4.0 client works fully against a linuxmuster.net 7.4 server — domain join, AD login (student/teacher/staff), shares, hooks and printers all function, and every security fix holds up live.