23 files changed, 153 insertions, 75 deletions

diff --git a/debian/changelog b/debian/changelog
index 4f41007..300a3f7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,22 @@
+samba (2:4.20.2+dfsg-3) unstable; urgency=medium
+
+  * split out samba-vfs-glusterfs from samba-vfs-modules
+    (pick up and rework ubuntu changes)
+  * split out samba-vfs-ceph from samba-vfs-modules
+  * merge samba-vfs-modules (remaining) into main samba package
+  * the only remaining extra vfs module, snapper, does not need extra handling
+  * d/samba-ad-dc.lintian-overrides: add conflicts-with-version override
+    for /usr-move
+  * samba-common-bin: use trivial separate shell wrapper for the python script
+  * d/rules: use before-trixie build profile to control dh_movetousr run too
+  * d/*.service: provide empty value for referenced environment vars
+    (Closes: #1073969)
+  * d/dirs: remove leftover file
+  * d/samba-common-bin.dirs: stop creating /etc/samba/tls/
+  * d/samba.dirs: stop creating bin & sbin
+
+ -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 25 Jun 2024 07:58:16 +0300
+
 samba (2:4.20.2+dfsg-2~progress7.99u1) graograman-backports; urgency=medium
 
   * Uploading to graograman-backports, remaining changes:
diff --git a/debian/control b/debian/control
index c40492c..1cd9d1d 100644
--- a/debian/control
+++ b/debian/control
@@ -40,13 +40,13 @@ Build-Depends-Arch:
 	libblkid-dev,
 	libbsd-dev,
 	libcap-dev [linux-any],
-# the same [arch list] is in rules (with-ceph) and ctdb.install
+# the same [arch list] is in ctdb.install
 	libcephfs-dev [amd64 arm64 mips64el ppc64el riscv64 s390x],
 	librados-dev  [amd64 arm64 mips64el ppc64el riscv64 s390x],
 	libcmocka-dev,
 	libcups2-dev,
 	libdbus-1-dev,
-	libglusterfs-dev [amd64 arm64 ppc64el ppc64 riscv64 mips64el s390x ia64 sparc64],
+	libglusterfs-dev [amd64 arm64 loong64 mips64el ppc64 ppc64el riscv64 s390x sparc64],
 	libgnutls28-dev,
 	libgpgme11-dev,
 	libicu-dev,
@@ -97,12 +97,18 @@ Depends: passwd,
          ${python3:Depends},
          ${shlibs:Depends}
 Recommends: attr,
-            samba-vfs-modules,
             python3-samba,
 Suggests: ctdb,
           ufw,
-          winbind
-Breaks: samba-ad-provision (<< ${source:Upstream-Version})
+          winbind,
+          samba-vfs-ceph, samba-vfs-glusterfs,
+# move libdfs-server-ad-samba4.so.0 samba-libs=>samba-vfs-modules in 4.19.0~rc1
+# swallow samba-vfs-modules by samba in 4.20.2-dfsg-3
+Replaces: samba-libs (<< 2:4.19.0~),
+          samba-vfs-modules (<< 2:4.20.2+dfsg-3~),
+Breaks:   samba-ad-provision (<< ${source:Upstream-Version}),
+          samba-libs (<< 2:4.19.0~),
+          samba-vfs-modules (<< 2:4.20.2+dfsg-3~),
 Description: SMB/CIFS file, print, and login server for Unix
  Samba is an implementation of the SMB/CIFS protocol for Unix systems,
  providing support for cross-platform file and printer sharing with
@@ -192,7 +198,6 @@ Depends: samba (= ${binary:Version}),
 	 python3-samba (= ${binary:Version}),
 	 python3-dnspython,
 	 samba-dsdb-modules (= ${binary:Version}),
-	 samba-vfs-modules (= ${binary:Version}),
 	 winbind (= ${binary:Version}),
 	 krb5-kdc (>= 1.21.0~) <pkg.samba.mitkrb5>,
 	 ${python3:Depends},
@@ -357,31 +362,58 @@ Description: Samba Directory Services Database
  Directory features to the LDB library.
 
 Package: samba-vfs-modules
+# Remove this package for trixie+1
 Architecture: any
-Multi-Arch: same
-Depends: samba-libs (= ${binary:Version}), ${misc:Depends}, ${shlibs:Depends}
-Recommends: ${vfsmods:Depends}
-# move libdfs-server-ad-samba4.so.0 samba-libs=>samba-vfs-modules in 4.19.0~rc1
-Replaces: samba-libs (<< 2:4.19.0~)
-Breaks:   samba-libs (<< 2:4.19.0~)
+Section: oldlibs
+Depends: ${misc:Depends}
+Description: Samba Virtual FileSystem plugins (transitional package)
+ Samba is an implementation of the SMB/CIFS protocol for Unix systems,
+ providing support for cross-platform file sharing with Microsoft Windows, OS X,
+ and other Unix systems.  Samba can also function as a domain controller
+ or member server in Active Directory or NT4-style domains.
+ .
+ Virtual FileSystem modules are stacked shared libraries extending the
+ functionality of Samba.  This package used to provide VFS modules for
+ samba, but since version 4.20.2+dfsg-3, most of the modules were merged
+ into main samba package, or into their own separate packages -
+ samba-vfs-ceph and samba-vfs-glusterfs.
+ .
+ This package can safely be removed.
+
+Package: samba-vfs-ceph
+Architecture: amd64 arm64 mips64el ppc64el riscv64 s390x
+Depends: samba (= ${binary:Version}), ${misc:Depends}, ${shlibs:Depends}
+# ceph modules moved from samba-vfs-modules in 4.20.2+dfsg-3
+Replaces: samba-vfs-modules (<< 4.20.2+dfsg-3~)
+Breaks:   samba-vfs-modules (<< 4.20.2+dfsg-3~)
+Enhances: samba
+Description: Samba Virtual FileSystem ceph modules
+ Samba is an implementation of the SMB/CIFS protocol for Unix systems,
+ providing support for cross-platform file sharing with Microsoft Windows, OS X,
+ and other Unix systems.  Samba can also function as a domain controller
+ or member server in Active Directory or NT4-style domains.
+ .
+ Virtual FileSystem modules are stacked shared libraries extending the
+ functionality of Samba. This package provides vfs_ceph and vfs_ceph_snapshots
+ modules.
+
+Package: samba-vfs-glusterfs
+Architecture: amd64 arm64 loong64 mips64el ppc64 ppc64el riscv64 s390x sparc64
+Depends: samba (= ${binary:Version}), ${misc:Depends}, ${shlibs:Depends}
+# glusterfs modules moved from samba-vfs-modules in 4.20.2+dfsg-3 (4.19.4+dfsg-2ubuntu1)
+# in ubuntu, glusterfs was in samba-vfs-modules-extra temporarily
+Replaces: samba-vfs-modules (<< 4.20.2+dfsg-3~), samba-vfs-modules-extra (<< 4.20.2+dfsg-3~)
+Breaks:   samba-vfs-modules (<< 4.20.2+dfsg-3~), samba-vfs-modules-extra (<< 4.20.2+dfsg-3~)
 Enhances: samba
-Description: Samba Virtual FileSystem plugins
+Description: Samba Virtual FileSystem glusterfs modules
  Samba is an implementation of the SMB/CIFS protocol for Unix systems,
  providing support for cross-platform file sharing with Microsoft Windows, OS X,
  and other Unix systems.  Samba can also function as a domain controller
  or member server in Active Directory or NT4-style domains.
  .
  Virtual FileSystem modules are stacked shared libraries extending the
- functionality of Samba. Some examples are:
-  * vfs_acl_xattr: Save NTFS-ACLs in Extended Attributes
-  * vfs_audit: record selected Samba VFS operations in the system log
-  * vfs_readonly: Make a Samba share read only for a specified time period
-  * vfs_recycle: Give the same effect as the Recycle Bin on Windows computers
-  * vfs_shadow_copy2: Expose snapshots to Windows clients as shadow copies
-  * vfs_worm: Disallow writes for older file
- .
- Note: The runtime dependencies of vfs_ceph, vfs_glusterfs and vfs_snapper are
- moved to Recommends.
+ functionality of Samba. This package provides vfs_glusterfs and
+ vfs_glusterfs_fuse modules.
 
 Package: libsmbclient0
 Provides: ${t64:Provides}
@@ -541,8 +573,9 @@ Depends: iproute2 [linux-any],
          time,
          ${misc:Depends},
          ${shlibs:Depends}
-Recommends: ethtool [linux-any], python3:any, python3-etcd, ${rados:Depends}
-Suggests: lsof
+Recommends: ethtool [linux-any], python3:any, python3-etcd,
+Suggests: lsof,
+	${rados:Depends}, samba-vfs-ceph [amd64 arm64 mips64el ppc64el riscv64 s390x],
 Description: clustered database to store temporary data
  CTDB is a cluster implementation of the TDB database used by Samba and other
  projects to store temporary data. If an application is already using TDB for
diff --git a/debian/dirs b/debian/dirs
deleted file mode 100644
index acc9c2e..0000000
--- a/debian/dirs
+++ /dev/null
@@ -1,5 +0,0 @@
-etc/samba
-usr/bin
-usr/sbin
-usr/share/man/man1
-usr/share/man/man7
diff --git a/debian/rules b/debian/rules
index cbc2168..ddc885a 100755
--- a/debian/rules
+++ b/debian/rules
@@ -35,10 +35,9 @@ LDB_DEB_VERSION = ${LDB_EPOCH}${LDB_VERSION}+samba${DEB_VERSION_UPSTREAM_REVISIO
 LDB_DEPENDS = libldb2 (= ${LDB_DEB_VERSION})
 LDB_PACKAGES = libldb2 libldb-dev ldb-tools python3-ldb python3-ldb-dev
 
+before-trixie := $(filter pkg.samba.before-trixie, ${DEB_BUILD_PROFILES})
+
 omit-pkgs =
-with-glusterfs =
-with-ceph =
-with-snapper =
 
 config-args = \
 	--vendor-name=${DEB_VENDOR}-${DEB_VERSION_UPSTREAM_REVISION} \
@@ -79,9 +78,6 @@ config-args = \
 	--with-logdir=/var/log/ctdb \
 
 ifeq (${DEB_HOST_ARCH_OS}, linux) # extra linux-specific features
-with-glusterfs = $(if $(filter amd64 arm64 ppc64el ppc64 riscv64 mips64el s390x ia64 sparc64,${DEB_HOST_ARCH}),yes)
-with-ceph = $(if $(filter amd64 arm64 mips64el ppc64el riscv64 s390x, ${DEB_HOST_ARCH}),yes)
-with-snapper = yes
 
 config-args += \
 	--with-quota \
@@ -91,7 +87,7 @@ endif
 
 # Ubuntu i386 binary compatibility only effort: Disable some i386 packages and modules
 ifeq (${DEB_VENDOR}-${DEB_HOST_ARCH}, Ubuntu-i386)
-omit-pkgs += ctdb libpam-winbind samba samba-ad-dc samba-testsuite samba-vfs-modules
+omit-pkgs += ctdb libpam-winbind samba samba-ad-dc samba-testsuite samba-vfs-modules samba-vfs-ceph samba-vfs-glusterfs
 endif
 
 ifneq (,$(filter armel mipsel m68k powerpc sh4,${DEB_HOST_ARCH}))
@@ -119,16 +115,8 @@ endif
 # build is done in bin/default/ subdir
 CFLAGS += -ffile-prefix-map=../../=
 
-config-args += $(if ${with-ceph},\
-	  --enable-cephfs --enable-ceph-reclock,\
-	  --disable-cephfs)
-
 # we had t64 transition (libsmbclient => libsmbclient0) for trixie
-ifneq (,$(filter pkg.samba.before-trixie, ${DEB_BUILD_PROFILES}))
-libsmbclient := libsmbclient
-else
-libsmbclient := libsmbclient0
-endif
+libsmbclient := $(if ${before-trixie},libsmbclient,libsmbclient0)
 
 with_mitkrb5 = $(filter pkg.samba.mitkrb5, ${DEB_BUILD_PROFILES})
 ifneq (,${with_mitkrb5})
@@ -140,7 +128,8 @@ config-args += \
 mitkrb5-samba-ver = ${DEB_VERSION}mitkrb5
 mitkrb5-dep-pkgs = samba-libs samba-dev
 mitkrb5-dep-pkgs += samba samba-common-bin python3-samba
-mitkrb5-dep-pkgs += samba-dsdb-modules samba-vfs-modules
+mitkrb5-dep-pkgs += samba-vfs-ceph samba-vfs-glusterfs
+mitkrb5-dep-pkgs += samba-dsdb-modules
 mitkrb5-dep-pkgs += ${libsmbclient} smbclient
 mitkrb5-dep-pkgs += libnss-winbind libpam-winbind
 mitkrb5-dep-pkgs += winbind libwbclient0
@@ -156,6 +145,11 @@ endif
 # ${build-pkgs} will honour arch/indep and the above list in ${DH_OPTIONS}
 build-pkgs := $(shell dh_listpackages)
 
+with-ceph := $(filter samba-vfs-ceph,${build-pkgs})
+config-args += $(if ${with-ceph},\
+	  --enable-cephfs --enable-ceph-reclock,\
+	  --disable-cephfs)
+
 binary binary-arch binary-indep \
 install install-arch install-indep: %:
 	dh $*
@@ -271,6 +265,15 @@ endif
 	dh_link -plibldb2 /usr/lib/${DEB_HOST_MULTIARCH}/ldb/modules/ldb \
 	                  /usr/lib/${DEB_HOST_MULTIARCH}/samba/ldb/compat
 
+execute_after_dh_install:
+# some vfs modules are in separate packages.  Removing them here avoids having
+# explicit list of other modules in d/samba.install
+	rm -f \
+	    debian/samba/usr/lib/${DEB_HOST_MULTIARCH}/samba/vfs/glusterfs*.so \
+	    debian/samba/usr/share/man/man8/vfs_glusterfs*.8 \
+	    debian/samba/usr/lib/${DEB_HOST_MULTIARCH}/samba/vfs/ceph*.so \
+	    debian/samba/usr/share/man/man8/vfs_ceph*.8
+
 provision-dest := debian/samba-ad-provision/usr/share/samba/setup
 
 override_dh_auto_install-indep:
@@ -349,7 +352,7 @@ override_dh_shlibdeps:
 # for specific executables/modules, put dependencies in separate variables
 # to change Depends to Recommends for them in d/control
 	dh_shlibdeps -l/usr/lib/${DEB_HOST_MULTIARCH}/samba \
-	    -Xceph.so -Xglusterfs.so -Xsnapper.so -Xctdb_mutex_ceph_rados_helper
+	    -Xctdb_mutex_ceph_rados_helper
 ifneq (,$(filter ctdb, ${build-pkgs}))
 	echo "rados:Depends=" >> debian/ctdb.substvars
 ifneq (${with-ceph},)
@@ -357,15 +360,6 @@ ifneq (${with-ceph},)
 	    debian/ctdb/usr/libexec/ctdb/ctdb_mutex_ceph_rados_helper
 endif
 endif
-ifneq (,$(filter samba-vfs-modules,${build-pkgs}))
-	echo "vfsmods:Depends=" >> debian/samba-vfs-modules.substvars
-ifneq (${with-snapper}${with-ceph}${with-glusterfs},)
-	dpkg-shlibdeps -Tdebian/samba-vfs-modules.substvars -pvfsmods \
-	    $(if ${with-snapper}, debian/samba-vfs-modules/usr/lib/*/samba/vfs/snapper.so) \
-	    $(if ${with-ceph}, debian/samba-vfs-modules/usr/lib/*/samba/vfs/ceph.so) \
-	    $(if ${with-glusterfs}, debian/samba-vfs-modules/usr/lib/*/samba/vfs/glusterfs.so)
-endif
-endif
 # after shlibdeps run, check that we don't have wrong depdendencies
 	$(call depcheck, samba-libs, samba|winbind|smbclient|ctdb)
 	$(call depcheck, smbclient, samba|winbind|ctdb)
@@ -381,8 +375,10 @@ ifneq (,$(filter ${build-pkgs}, ${mitkrb5-dep-pkgs}))
 	dh_gencontrol $(addprefix -p, $(filter ${build-pkgs}, ${mitkrb5-dep-pkgs})) -- -v${mitkrb5-samba-ver} -Vldb:Depends="${LDB_DEPENDS}"
 endif
 	dh_gencontrol --remaining-packages -- -Vldb:Depends="${LDB_DEPENDS}"
-# move files from / to /usr if needed (#1059187):
-	if command -v dh_movetousr >/dev/null; then dh_movetousr -plibpam-winbind -plibnss-winbind; fi
+ifeq (,${before-trixie})
+# run dh_movetousr only on trixie and up, not before
+	dh_movetousr -plibpam-winbind -plibnss-winbind
+endif
 
 clean:
 	# see also debian/clean
diff --git a/debian/samba-ad-dc.lintian-overrides b/debian/samba-ad-dc.lintian-overrides
index f3c2287..fd2c7a7 100644
--- a/debian/samba-ad-dc.lintian-overrides
+++ b/debian/samba-ad-dc.lintian-overrides
@@ -1,3 +1,5 @@
 # begin-remove-after: trixie
 diversion-for-unknown-file lib/systemd/system/samba-ad-dc.service [preinst:*]
+# Breaks+Replaces upgraded to Conflicts for DEP17 + /usr-move
+conflicts-with-version samba (<< 2:4.20.1+dfsg-2~)
 # end-remove-after
diff --git a/debian/samba-ad-dc.service b/debian/samba-ad-dc.service
index fdee735..597a9ad 100644
--- a/debian/samba-ad-dc.service
+++ b/debian/samba-ad-dc.service
@@ -8,6 +8,7 @@ After=network.target network-online.target
 Type=notify
 PIDFile=/run/samba/samba.pid
 LimitNOFILE=16384
+Environment=SAMBAOPTIONS=
 EnvironmentFile=-/etc/default/samba
 ExecStart=/usr/sbin/samba --foreground --no-process-group $SAMBAOPTIONS
 ExecReload=/bin/kill -HUP $MAINPID
diff --git a/debian/samba-common-bin.dirs b/debian/samba-common-bin.dirs
index bbd723d..5e6ccf9 100644
--- a/debian/samba-common-bin.dirs
+++ b/debian/samba-common-bin.dirs
@@ -1,2 +1 @@
-etc/samba/tls
 var/cache/samba
diff --git a/debian/samba-common-bin.install b/debian/samba-common-bin.install
index 0a95d76..e8862e6 100644
--- a/debian/samba-common-bin.install
+++ b/debian/samba-common-bin.install
@@ -1,7 +1,8 @@
 usr/bin/dbwrap_tool
 usr/bin/net
 usr/bin/nmblookup
-usr/bin/samba-log-parser
+debian/samba-log-parser usr/bin
+usr/bin/samba-log-parser usr/libexec/samba
 usr/bin/samba-regedit
 usr/bin/smbcontrol
 usr/bin/smbpasswd
diff --git a/debian/samba-log-parser b/debian/samba-log-parser
new file mode 100755
index 0000000..09f6bcd
--- /dev/null
+++ b/debian/samba-log-parser
@@ -0,0 +1,5 @@
+#! /bin/sh
+me="${0##*/}"
+command -v python3 >/dev/null && exec /usr/libexec/samba/$me "$@"
+echo "$me: E: This program requires python3.  Please install python3 package to use it." >&2
+exit 42
diff --git a/debian/samba-vfs-ceph.install b/debian/samba-vfs-ceph.install
new file mode 100644
index 0000000..be619c1
--- /dev/null
+++ b/debian/samba-vfs-ceph.install
@@ -0,0 +1,4 @@
+usr/lib/${DEB_HOST_MULTIARCH}/samba/vfs/ceph.so
+usr/lib/${DEB_HOST_MULTIARCH}/samba/vfs/ceph_snapshots.so
+usr/share/man/man8/vfs_ceph.8
+usr/share/man/man8/vfs_ceph_snapshots.8
diff --git a/debian/samba-vfs-ceph.lintian-overrides b/debian/samba-vfs-ceph.lintian-overrides
new file mode 100644
index 0000000..26cc8ed
--- /dev/null
+++ b/debian/samba-vfs-ceph.lintian-overrides
@@ -0,0 +1 @@
+samba-vfs-ceph: spare-manual-page */man/man8/vfs_*
diff --git a/debian/samba-vfs-glusterfs.install b/debian/samba-vfs-glusterfs.install
new file mode 100644
index 0000000..c360548
--- /dev/null
+++ b/debian/samba-vfs-glusterfs.install
@@ -0,0 +1,4 @@
+usr/lib/${DEB_HOST_MULTIARCH}/samba/vfs/glusterfs.so
+usr/lib/${DEB_HOST_MULTIARCH}/samba/vfs/glusterfs_fuse.so
+usr/share/man/man8/vfs_glusterfs.8
+usr/share/man/man8/vfs_glusterfs_fuse.8
diff --git a/debian/samba-vfs-glusterfs.lintian-overrides b/debian/samba-vfs-glusterfs.lintian-overrides
new file mode 100644
index 0000000..c864cd4
--- /dev/null
+++ b/debian/samba-vfs-glusterfs.lintian-overrides
@@ -0,0 +1 @@
+samba-vfs-glusterfs: spare-manual-page */man/man8/vfs_*
diff --git a/debian/samba-vfs-modules.NEWS b/debian/samba-vfs-modules.NEWS
new file mode 100644
index 0000000..973e561
--- /dev/null
+++ b/debian/samba-vfs-modules.NEWS
@@ -0,0 +1,15 @@
+samba-vfs-modules (2:4.20.2+dfsg-3) unstable; urgency=medium
+
+  samba-vfs-modules package has been dropped in this release.
+  Instead, all common vfs modules are now part of regular samba
+  package, so are always installed (so there is not need to install
+  samba-vfs-modules for, say, wide links = yes to work, ad-dc always
+  works too and so on).
+
+  At the same time, glusterfs and ceph vfs modules are now shipped in
+  their own separate packages, samba-vfs-glusterfs and samba-vfs-ceph
+  (samba-vfs-glusterfs in universe in ubuntu).  If you need ceph or
+  glusterfs functionality, please install samba-vfs-ceph and/or
+  samba-vfs-glusterfs package(s) separately.
+
+ -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 24 Jun 2024 12:48:23 +0300
diff --git a/debian/samba-vfs-modules.install b/debian/samba-vfs-modules.install
deleted file mode 100644
index c82d897..0000000
--- a/debian/samba-vfs-modules.install
+++ /dev/null
@@ -1,3 +0,0 @@
-usr/lib/*/samba/vfs/*.so
-usr/share/man/man8/vfs_*.8
-usr/lib/*/samba/libdfs-server-ad-private-samba.so.0
diff --git a/debian/samba-vfs-modules.lintian-overrides b/debian/samba-vfs-modules.lintian-overrides
deleted file mode 100644
index 5e2bcbb..0000000
--- a/debian/samba-vfs-modules.lintian-overrides
+++ /dev/null
@@ -1,7 +0,0 @@
-# False positives, see #896012
-samba-vfs-modules: library-not-linked-against-libc *
-# manpages describing vfs modules:
-samba-vfs-modules: spare-manual-page */man/man8/vfs_*
-# intentional: was a typo in old config parser so we allow old config to work:
-samba-vfs-modules: hardening-no-fortify-functions */samba/vfs/expand_msdfs.so*
-samba-vfs-modules: hardening-no-fortify-functions */samba/vfs/fileid.so*
diff --git a/debian/samba.dirs b/debian/samba.dirs
index cd0dcc6..463322a 100644
--- a/debian/samba.dirs
+++ b/debian/samba.dirs
@@ -1,6 +1,4 @@
 etc/apparmor.d/samba
-usr/bin
-usr/sbin
 var/lib/samba/printers/COLOR
 var/lib/samba/printers/IA64
 var/lib/samba/printers/W32ALPHA
diff --git a/debian/samba.install b/debian/samba.install
index e58aecf..6273a23 100755
--- a/debian/samba.install
+++ b/debian/samba.install
@@ -32,3 +32,8 @@ usr/share/man/man8/smbd.8
 usr/share/samba/admx/
 usr/share/samba/mdssvc/elasticsearch_mappings.json
 usr/share/samba/update-apparmor-samba-profile
+
+# vfs modules
+usr/lib/*/samba/vfs/*.so
+usr/share/man/man8/vfs_*.8
+usr/lib/*/samba/libdfs-server-ad-private-samba.so.0
diff --git a/debian/samba.lintian-overrides b/debian/samba.lintian-overrides
index 128f6e8..54bcfe1 100644
--- a/debian/samba.lintian-overrides
+++ b/debian/samba.lintian-overrides
@@ -1 +1,7 @@
 samba: hardening-no-fortify-functions */samba/libmscat-private-samba.so.*
+# False positives, see #896012
+samba: library-not-linked-against-libc *
+# manpages describing vfs modules (they're named vfs_foo while the module is vfs/foo.so):
+samba: spare-manual-page */man/man8/vfs_*
+samba: hardening-no-fortify-functions */samba/vfs/expand_msdfs.so*
+samba: hardening-no-fortify-functions */samba/vfs/fileid.so*
diff --git a/debian/samba.nmbd.service b/debian/samba.nmbd.service
index 4f74f49..010c845 100644
--- a/debian/samba.nmbd.service
+++ b/debian/samba.nmbd.service
@@ -7,6 +7,7 @@ After=network.target network-online.target
 [Service]
 Type=notify
 PIDFile=/run/samba/nmbd.pid
+Environment=NMBDOPTIONS=
 EnvironmentFile=-/etc/default/samba
 ExecStart=/usr/sbin/nmbd --foreground --no-process-group $NMBDOPTIONS
 ExecReload=/bin/kill -HUP $MAINPID
diff --git a/debian/samba.smbd.service b/debian/samba.smbd.service
index a5b7929..5bff436 100644
--- a/debian/samba.smbd.service
+++ b/debian/samba.smbd.service
@@ -8,6 +8,7 @@ After=network.target network-online.target nmb.service winbind.service
 Type=notify
 PIDFile=/run/samba/smbd.pid
 LimitNOFILE=16384
+Environment=SMBDOPTIONS=
 EnvironmentFile=-/etc/default/samba
 ExecStartPre=/usr/share/samba/update-apparmor-samba-profile
 ExecStart=/usr/sbin/smbd --foreground --no-process-group $SMBDOPTIONS
diff --git a/debian/tests/control b/debian/tests/control
index d27e025..e51a37c 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -3,7 +3,7 @@ Depends: samba, coreutils, systemd, cifs-utils, passwd
 Restrictions: needs-root, allow-stderr, isolation-machine
 
 Tests: cifs-share-access-uring
-Depends: samba, samba-vfs-modules, coreutils, systemd, cifs-utils, passwd
+Depends: samba, coreutils, systemd, cifs-utils, passwd
 Restrictions: needs-root, allow-stderr, isolation-machine, skippable
 
 Tests: python-smoke
@@ -22,7 +22,7 @@ Depends: samba, smbclient, coreutils, systemd, passwd
 Restrictions: needs-root, allow-stderr, isolation-container
 
 Tests: smbclient-share-access-uring
-Depends: samba, samba-vfs-modules, smbclient, coreutils, systemd, passwd
+Depends: samba, smbclient, coreutils, systemd, passwd
 Restrictions: needs-root, allow-stderr, isolation-container, skippable
 
 Tests: reinstall-samba-common-bin
diff --git a/debian/winbind.service b/debian/winbind.service
index 5b009a4..1c21d28 100644
--- a/debian/winbind.service
+++ b/debian/winbind.service
@@ -7,6 +7,7 @@ Before=nss-user-lookup.target
 [Service]
 Type=notify
 PIDFile=/run/samba/winbindd.pid
+Environment=WINBINDOPTIONS=
 EnvironmentFile=-/etc/default/samba
 ExecStart=/usr/sbin/winbindd --foreground --no-process-group $WINBINDOPTIONS
 ExecReload=/bin/kill -HUP $MAINPID