+o Andrew Bartlett <abartlet@samba.org>
+ * BUG 9121: Provide and use setproctitle replacement function for samba4
+ processes on linux.
+ * BUG 9271: samba-tool: Rework ldap attribute fetch in classicupgrade for
+ missing attributes.
+ * BUG 9421: Fix several build issues.
+ * BUG 9448: Backport several crash bugs from master.
+
+
+o Sumit Bose <sbose@redhat.com>
+ * BUG 9367: Use work around for 'winbind use default domain' only if it
+ is set.
+
+
+o Kai Blin <kai@samba.org>
+ * BUG 9399 - 'samba-tool dns serverinfo localhost' returns 'Memory
+ allocation error'.
+ * BUG 9449: Remove unused samba-dig tool.
+
+
+o Günther Deschner <gd@samba.org>
+ * BUG 9426: rpc_client: lookup nametype 0x20 in rpc_pipe_open_tcp_port().
+ * BUG 9439: Fix ncacn_ip_tcp reconnection code for lsa lookups.
+ * BUG 9451: Allow to force DNS updates using net.
+
+
+o David Disseldorp <ddiss@samba.org>
+ * BUG 9433: spoolss: Fix segfault when "default devmode" is disabled.
+
+
+o Amitay Isaacs <amitay@gmail.com>
+ * BUG 9265: Bind dlz fails to start if there is a trustedanchors zone.
+ * BUG 9354: Fix format string vulnerability in an error message.
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 9422: Large read requests cause server to issue malformed reply.
+ * BUG 9440: Do not rely on dbwrap_record_get_value to return a talloc
+ object.
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 8620: Read ACL are not enabled by default on DS.
+ * BUG 8621: ACL are not recalculated if parent is changed and inherit is
+ enabled.
+ * BUG 9373: samba-tool: Report a CommandError if loading of the config file
+ fails.
+ * BUG 9385: Add missing newline in the output of ldb_ldif_write_trace().
+ * BUG 9390: Fix segfaults in "log level = 10" on Solaris.
+ * BUG 9402: lib/addns: Fix working with a bind9 server.
+ * BUG 9406: ACL fixes since 4.0 rc1.
+ * BUG 9447: Backport tests from master.
+ * BUG 9448: Backport several crash bugs from master.
+
+
+o Ricky Nance <ricky.nance@weaubleau.k12.mo.us>
+ * BUG 9449: Remove phpldapadmin inclusion.
+
+
+o Matthieu Patou <mat@matws.net>
+ * BUG 9418: Fix MD5 detection in the autoconf build.
+
+
+o Arvid Requate <requate@univention.de>
+ * BUG 9376: Fix typo in got_duplicate_group check.
+ * BUG 9392: Fix 'samba-tool fsmo --role=schema'.
+
+
+o Andreas Schneider <asn@samba.org>
+ * BUG 9386: Failover if netlogon pipe is not available.
+ * BUG 9436: Fix leaking sockets of SMB connections to a DC.
+
+
+o Karolin Seeger <kseeger@samba.org>
+ * BUG 9425: Do not build ntdb by default.
+ * BUG 9437: Warnings when building manpages with waf.
+ * BUG 9443: Manpages of the libraries are located in different
+ subdirectories.
+ * BUG 9444: Merge both samba.8 manpages.
+ * BUG 9445: Update man 7 samba.
+
+
+o Jelmer Vernooij <jelmer@samba.org>
+ * BUG 9339: Backport build fixes from master.
+
+
+CHANGES SINCE 4.0.0rc4
+======================
+
+With this release candidate the location of the socket samba accepts
+connections from NTPd has changed, as has the enforced permissions.
+
+This means the ntp.conf will need to change from (eg)
+
+ntpsigndsocket /usr/local/samba/var/run/ntp_signd/
+
+to
+
+ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/
+
+To use the socket with ntp on a system with an ntp user and group, you must
+run:
+
+chgrp ntp /usr/local/samba/var/lib/ntp_signd/
+
+o Michael Adam <obnox@samba.org>
+ * BUG 9321: winbindd:cache: Fix offline logons with cached credentials.
+ * BUG 9339: Build and quota fixes.
+ * BUG 9353: Fix the cluster(ctdb) build without system talloc installed.
+
+
+o Christian Ambach <ambi@samba.org>
+ * BUG 9208: Cannot migrate files with inheritance flags to share on top of
+ NFSv4 filesystem.
+ * BUG 9361: Quotas management doesn't work with SMB2/3.
+
+
+o Andrew Bartlett <abartlet@samba.org>
+ * BUG 9317: Cannot easily change to internal DNS server.
+ * BUG 9338: lib/replace: Return size of xattr if size argument is 0.
+ * BUG 9339: Build and quota fixes.
+ * BUG 9340: Do not use the wheel group for 'administrators'.
+ * BUG 9347: winbind: Extend wbcAuthenticateUserEx to provide PAC.
+ * BUG 9352: Fix samba crashes with certain RPC calls.
+ * BUG 9355: Set mask values to 0777 and use fileserver.conf.
+ * BUG 9357: Don't expose more symbols than specified by abi_match setting.
+ * BUG 9379: ntp_signd permissions are too broad.
+
+
+o Björn Baumbach <bb@sernet.de>
+ * BUG 9300: vfs_streams_depot: Add delete_lost option.
+ * BUG 9348: Fix the build against older ctdb versions.
+ * BUG 9345: fix use of <smbconfoption> tag.
+ * BUG 9349: Fix check for ctdb_private.h
+ * BUG 9351: Fail "configure --with-cluster-support" if ctdb support is not
+ available.
+
+
+o Ira Cooper <ira@samba.org>
+ * BUG 9339: Build and quota fixes.
+
+
+o Günther Deschner <gd@samba.org>
+ * BUG 9272: 'net ads join' does not provide AES keys in host keytab.
+
+
+o David Disseldorp <ddiss@samba.org>
+ * BUG 9125: Revert "s3-winbindd: make sure we obey the -n switch
+ also for samlogon cache access" and describe samlogon cache caveat for
+ 'winbindd -n'.
+
+
+o Björn Jacke <bj@sernet.de>
+ * BUG 7472: Check for dn_expand also in libinet.
+ * BUG 9339: Build and quota fixes.
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 9208: Cannot migrate files with inheritance flags to share on top of
+ NFSv4 filesystem.
+ * BUG 9352: dsdb: Simplify DsCrackNameOneFilter a bit.
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 8620: Read ACL are not enabled by default on DS.
+ * BUG 9175: Add smbXcli_session_set_disconnect_expired().
+ * BUG 9341: Fix SMBD_SMB2_NUM_IOV_PER_REQ check for sendfile().
+ * BUG 9359: Optimization needed for SMB2 performance sensitive workloads.
+ * BUG 9360: SMB1 tree connect time is wrong.
+
+
+o Ricky Nance <ricky.nance@weaubleau.k12.mo.us>
+ * BUG 9339: Build and quota fixes.
+
+
+o Rusty Russell <rusty@rustcorp.com.au>
+ * BUG 9339: Build and quota fixes.
+
+
+o Christof Schmitt <christof.schmitt@us.ibm.com>
+ * BUG 9347: winbind: Extend wbcAuthenticateUserEx to provide PAC.
+
+
+o Andreas Schneider <asn@samba.org>
+ * BUG 9326: Fix 'net ads join' message for the dns domain.
+ * BUG 9336: Add NetworkManager dispatcher script for Winbind.
+ * BUG 9339: Build and quota fixes.
+
+
+o Jelmer Vernooij <jelmer@samba.org>
+ * BUG 9357: Don't expose more symbols than specified by abi_match setting.
+
+
+CHANGES SINCE 4.0.0rc3
+======================
+
+o Michael Adam <obnox@samba.org>
+ * BUG 9304: Remove unused sessionid.tdb and connections.tdb related code.
+ * BUG 9319: validate stat(2) information before reconnect durable handles.
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 9190: Fix regression (change in behavior) of default acl masks.
+ Remove "security mask", "force security mode", "directory security mask"
+ "force directory" and "security mode" parameters.
+ * BUG 9329: Directory listing with SeBackup can crash smbd.
+
+
+o Andrew Bartlett <abartlet@samba.org>
+ * BUG 9295: Assert that auth_domain, auth_builtin, auth_sam, auth_winbind
+ are builtin.
+ * BUG 9322: Backport ldb version update.
+
+
+o Björn Baumbach <bb@sernet.de>
+ * BUG 9190: docs: Fix opening and ending tag mismatch: para.
+
+
+o Gregor Beck <gbeck@sernet.de>
+ * BUG 9304: Remove unused sessionid.tdb and connections.tdb related code.
+
+
+o David Disseldorp <ddiss@suse.de>
+ * BUG 8564: Fix segfault in pam_sm_authenticate().
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 9184: Fix loop in tdgram_bsd_recvfrom().
+ * BUG 9209: Fix unitialized padding in smb2_create_blob_push_one().
+ * BUG 9304: Remove unused sessionid.tdb and connections.tdb related code.
+ * BUG 9309: Avoid a level 0 DEBUG if tstream_npa_connect_recv fails.
+ * BUG 9318: Fix write time updates for durable handles.
+
+
+o Andreas Schneider <asn@samba.org>
+ * BUG 9295: Build standard auth modules as internal modules.
+ * BUG 9301: Move 'smbprint' to a common location.
+
+
+o Jelmer Vernooij <jelmer@samba.org>
+ * BUG 9274: Add documentation and selftest fixes.
+
+
+CHANGES SINCE 4.0.0rc2
+======================
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 8966: Fix 'net rpc share allowedusers' to work with 2008r2.
+ * BUG 9209: Parse of invalid SMB2 create blob can cause smbd crash.
+ * BUG 9214: Bad user supplied SMB2 credit value can cause smbd to call
+ smb_panic.
+ * BUG 9222: Document that signing cannot be disabled for SMB2 by design.
+
+
+o Andrew Bartlett <abartlet@samba.org>
+ * BUG 9235: Update Samba3-HOWTO Collection.
+ * BUG 9271: samba-tool: Skip chown in sysvolreset when it would fail on
+ a GID.
+ * BUG 9274: Update Samba3-HOWTO Collection.
+
+
+o Björn Baumbach <bb@sernet.de>
+ * BUG 9235: Fix opening and ending tag mismatch in Samba3-HOWTO.
+ * BUG 9271: Fix typos in samba_backup.
+ * BUG 9274: Add delete_lost option to vfs_streams_depot.8.
+
+
+o Kai Blin <kai@samba.org>
+ * BUG 9225: Fix return code for deleted DNS records.
+ * BUG 8878: Time out UDP requests after DNS_REQUEST_TIMEOUT seconds.
+
+
+o Günther Deschner <gd@samba.org>
+ * BUG 9177: pam_winbind: Match more return codes when wbcGetPwnam has
+ failed.
+
+
+o David Disseldorp <ddiss@samba.org>
+ * BUG 9269: Fix 64bit-portability-issue.
+
+
+o Björn Jacke <bj@sernet.de>
+ * BUG 5670: Apply some Solaris packaging fixes.
+ * BUG 8107: Fix poll replacement to become a msleep replacement.
+ * BUG 8344: Fix --with(out)-sendfile-support option handling.
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 9223: Fix uninitialized variable in the cldap server.
+ * BUG 9268: Make tdb robust against improper CLEAR_IF_FIRST restart.
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 9271: Several samba-tool fixes.
+ * BUG 9196: Don't take 'state->te' as indication for "was_deferred".
+
+
+o Matthieu Patou <mat@matws.net>
+ * BUG 9240: Remove unused variable in DNS server.
+ * BUG 9252: Preliminary tests for dcpromo in Windows 2012 fails with
+ Samba DC.
+ * BUG 9253: Crackname returns a dns domain name even if there is no cracked
+ SID.
+ * BUG 9255: Getncchanges with exop for repl_obj returns highest_usn.
+ * BUG 9256: Getncchanges with exop for repl_obj_with_secrets should always
+ be allowed for RWDC.
+ * BUG 9257: LDAP server has at least one un-initialized variable.
+ * BUG 9258: LDAP server ignore configuration values set in the database for
+ timeout.
+ * BUG 9259: rodc join fails complaining that it can't find a RWDC.
+ * BUG 9260: kccdrs_replica_get_info returns invalid level when non
+ supported should be returned.
+ * BUG 9261: ds_replica_sync fails when specifying a name and not a guid.
+ * BUG 9264: getncchanges returns invalid_parameters when it should return
+ bad_nc.
+ * BUG 9254: DsExecuteKCC returns wrong error code if taskid != 0.
+ * BUG 9265: Bind dlz fails to start if there is a trustedanchors zone.
+
+
+o Rusty Russell <rusty@rustcorp.com.au>
+ * BUG 9268: Make tdb robust against shrinking tdbs.
+
+
+o Andreas Schneider <asn@samba.org>
+ * BUG 8769: Fix RAW printing for normal users.
+ * BUG 9112: Increase debug level for info that the db is empty.
+ * BUG 9244: Build pam_smbpass module only if enabled.
+ * BUG 9245: Make sure the registry is set up before we init printing.
+ * BUG 9276: Add config for systemd-tmpfiles.
+ * BUG 9280: Add support for reloading systemd services.
+
+
+o Karolin Seeger <kseeger@samba.org>
+ * BUG 7826: Remove link to Using Samba.
+ * BUG 8802: Add basic manpages for 'samba' and 'samba-tool'.
+ * BUG 9165: Fix makerpms.sh on RHEL.
+ * BUG 9243: Remove duplicate synonym min protocol.
+ * BUG 9271: Several samba-tool fixes.
+
+
+o Jelmer Vernooij <jelmer@samba.org>
+ * BUG 9243: Add basic documentation for 'server min protocol'.
+ * BUG 9271: Several samba-tool fixes.
+ * BUG 9274: Add documentation for several parameters.
+
+
+o Matthias Dieter Wallnöfer <mdw@samba.org>
+ * BUG 9183: Introduce the wildcard binding feature to allow DNS to listen on
+ localhost.
+
+
+CHANGES SINCE 4.0.0rc1
+======================
+
+o Michael Adam <obnox@samba.org>
+ * BUG 9173: Make the SMB2 compound request create/delete_on_close/
+ close work as Windows.
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 9161: Re-add the vfs_Chdir() cache.
+ * BUG 9189: SMB2 Create doesn't return correct MAX ACCESS access mask in
+ blob.
+ * BUG 9213: Bad ASN.1 NegTokenInit packet can cause invalid free.
+
+
+o Christian Ambach <ambi@samba.org>
+ * BUG 9162: Fix the build of the GPFS VFS module.
+ * BUG 9197: Only do 'printing_subsystem_update' when printing is enabled.
+
+
+o Andrew Bartlett <abartlet@samba.org>
+ * BUG 9228: Fix build on systems without ldap development headers.
+
+
+o Alexander Bokovoy <ab@samba.org>
+ * BUG 9157: Cleanup idmap_ldap build dependencies.
+ * BUG 9228: Make smbldaphelper subsystem an internal library.
+ * BUG 9229: Fix build of winbindd- and krb5 locator-related manpages.
+
+
+o Sumit Bose <sbose@redhat.com>
+ * BUG 9185: Allow DNS resolution of trusted domains if DNS name is
+ available.
+
+
+o Ira Cooper <ira@samba.org>
+ * BUG 9162: Fix build on Illumos/Solaris using '--with-acl'.
+ * BUG 9173: Compound requests should continue processing.
+
+
+o Günther Deschner <gd@samba.org>
+ * BUG 9185: Winbind cannot resolve AD DC in a different subnet.
+
+
+o Björn Jacke <bj@sernet.de>
+ * BUG 9162: Fix the build of the ACL VFS modules.
+ * BUG 9172: Fix reporting of gfs2 quotas.
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 9217: CreateFile with FILE_DIRECTORY_FILE can create directories
+ on read-only shares.
+
+
+o Vladimir Marek <Vladimir.Marek@Oracle.COM>
+ * BUG 9192: Fix service control for non-internal services.
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 9173: Make the SMB2 compound request create/delete_on_close/
+ close work as Windows.
+ * BUG 9184: Fix receiving of UDP packets from 0 bytes.
+ * BUG 9191: Release the share mode lock before calling exit_server().
+ * BUG 9193: Fix usage of invalid memory in smb2_signing_check_pdu().
+ * BUG 9194: Disallow '--prefix=/usr' and '--prefix=/usr/local' without
+ '--enable-fhs'.
+ * BUG 9198: Fix RHEL-CTDB packaging.
+
+
+o Matthieu Patou <mat@matws.net>
+ * BUG 9199: Fix usage of "panic action".
+ * BUG 9233: Fix a non handled memory out of memory.
+
+
+o Andreas Schneider <asn@samba.org>
+ * BUG 8632: Fix builtin forms order to match Windows again.
+ * BUG 9159: Fix generating idmap manpages.
+ * BUG 9218: Don't segfault if user specified ports out for range.
+ * BUG 9231: Fix NT_STATUS_IO_TIMEOUT during slow import of printers into
+ registry.