First thing you need to know is that after release (like 17.10), Ubuntu DOES NOT update the code. No new releases of LibreOffice or Openshot or Samba during 17.10's life.
The security team (and the SRU developers) will do exactly what you did - patch the 4.6.7 code. Then they increment the `ubuntuX.Y` string at the end of the version string from 3 to 3.1.
Apt reads the changed version string, and treat it (properly) as an upgrade.
It's generally considered a bad idea to fix or game the version number system. It leads to all kinds of trouble.
You can simply tell apt to not upgrade samba anymore:
Code:
sudo apt-mark hold samba //today
sudo apt-mark unhold samba //someday, to remove the hold
See 'man apt-mark'
Bookmarks