python/samba/tests/posixacl.py

   1 # Unix SMB/CIFS implementation. Tests for NT and posix ACL manipulation
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
   3 # Copyright (C) Andrew Bartlett 2012
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 """Tests for the Samba3 NT -> posix ACL layer"""
  20
  21 from samba.ntacls import setntacl, getntacl, checkset_backend
  22 from samba.dcerpc import xattr, security, smb_acl, idmap
  23 from samba.param import LoadParm
  24 from samba.tests import TestCaseInTempDir
  25 from samba import provision
  26 import random
  27 import os
  28 from samba.samba3 import smbd, passdb
  29 from samba.samba3 import param as s3param
  30
  31 # To print a posix ACL use:
  32 #        for entry in posix_acl.acl:
  33 #            print "a_type: %d" % entry.a_type
  34 #            print "a_perm: %o" % entry.a_perm
  35 #            print "uid: %d" % entry.uid
  36 #            print "gid: %d" % entry.gid
  37
  38 class PosixAclMappingTests(TestCaseInTempDir):
  39
  40     def test_setntacl(self):
  41         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  42         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  43
  44     def test_setntacl_smbd_getntacl(self):
  45         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  46         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  47         facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  48         anysid = security.dom_sid(security.SID_NT_SELF)
  49         self.assertEquals(facl.as_sddl(anysid),acl)
  50
  51     def test_setntacl_smbd_setposixacl_getntacl(self):
  52         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  53         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  54
  55         # This will invalidate the ACL, as we have a hook!
  56         smbd.set_simple_acl(self.tempf, 0640)
  57
  58         # However, this only asks the xattr
  59         try:
  60             facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  61             self.assertTrue(False)
  62         except TypeError:
  63             pass
  64
  65     def test_setntacl_invalidate_getntacl(self):
  66         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  67         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  68
  69         # This should invalidate the ACL, as we include the posix ACL in the hash
  70         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
  71         backend_obj.wrap_setxattr(dbname,
  72                                   self.tempf, "system.fake_access_acl", "")
  73
  74         #however, as this is direct DB access, we do not notice it
  75         facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  76         anysid = security.dom_sid(security.SID_NT_SELF)
  77         self.assertEquals(acl, facl.as_sddl(anysid))
  78
  79     def test_setntacl_invalidate_getntacl_smbd(self):
  80         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  81         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  82
  83         # This should invalidate the ACL, as we include the posix ACL in the hash
  84         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
  85         backend_obj.wrap_setxattr(dbname,
  86                                   self.tempf, "system.fake_access_acl", "")
  87
  88         #the hash would break, and we return an ACL based only on the mode, except we set the ACL using the 'ntvfs' mode that doesn't include a hash
  89         facl = getntacl(self.lp, self.tempf)
  90         anysid = security.dom_sid(security.SID_NT_SELF)
  91         self.assertEquals(acl, facl.as_sddl(anysid))
  92
  93     def test_setntacl_smbd_invalidate_getntacl_smbd(self):
  94         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  95         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x001200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
  96         os.chmod(self.tempf, 0750)
  97         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  98
  99         # This should invalidate the ACL, as we include the posix ACL in the hash
 100         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
 101         backend_obj.wrap_setxattr(dbname,
 102                                   self.tempf, "system.fake_access_acl", "")
 103
 104         #the hash will break, and we return an ACL based only on the mode
 105         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 106         anysid = security.dom_sid(security.SID_NT_SELF)
 107         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 108
 109     def test_setntacl_smbd_dont_invalidate_getntacl_smbd(self):
 110         # set an ACL on a tempfile
 111         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 112         os.chmod(self.tempf, 0750)
 113         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 114
 115         # now influence the POSIX ACL->SD mapping it returns something else than
 116         # what was set previously
 117         # this should not invalidate the hash and the complete ACL should still
 118         # be returned
 119         self.lp.set("profile acls", "yes")
 120         # we should still get back the ACL (and not one mapped from POSIX ACL)
 121         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 122         self.lp.set("profile acls", "no")
 123         anysid = security.dom_sid(security.SID_NT_SELF)
 124         self.assertEquals(acl, facl.as_sddl(anysid))
 125
 126     def test_setntacl_getntacl_smbd(self):
 127         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 128         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
 129         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 130         anysid = security.dom_sid(security.SID_NT_SELF)
 131         self.assertEquals(facl.as_sddl(anysid),acl)
 132
 133     def test_setntacl_smbd_getntacl_smbd(self):
 134         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 135         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 136         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 137         anysid = security.dom_sid(security.SID_NT_SELF)
 138         self.assertEquals(facl.as_sddl(anysid),acl)
 139
 140     def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
 141         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 142         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 143         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 144         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 145         smbd.set_simple_acl(self.tempf, 0640)
 146         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 147         anysid = security.dom_sid(security.SID_NT_SELF)
 148         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 149
 150     def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
 151         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 152         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 153         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;BA)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 154         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 155         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 156         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 157         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 158         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 159
 160         # This should re-calculate an ACL based on the posix details
 161         facl = getntacl(self.lp,self.tempf, direct_db_access=False)
 162         anysid = security.dom_sid(security.SID_NT_SELF)
 163         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 164
 165     def test_setntacl_smbd_getntacl_smbd_gpo(self):
 166         acl = "O:DAG:DUD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 167         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 168         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 169         domsid = security.dom_sid("S-1-5-21-2212615479-2695158682-2101375467")
 170         self.assertEquals(facl.as_sddl(domsid),acl)
 171
 172     def test_setntacl_getposixacl(self):
 173         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 174         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 175         facl = getntacl(self.lp, self.tempf)
 176         anysid = security.dom_sid(security.SID_NT_SELF)
 177         self.assertEquals(facl.as_sddl(anysid),acl)
 178         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 179
 180     def test_setposixacl_getposixacl(self):
 181         smbd.set_simple_acl(self.tempf, 0640)
 182         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 183         self.assertEquals(posix_acl.count, 4)
 184
 185         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 186         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 187
 188         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 189         self.assertEquals(posix_acl.acl[1].a_perm, 4)
 190
 191         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 192         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 193
 194         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 195         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 196
 197     def test_setposixacl_getntacl(self):
 198         acl = ""
 199         smbd.set_simple_acl(self.tempf, 0750)
 200         try:
 201             facl = getntacl(self.lp, self.tempf)
 202             self.assertTrue(False)
 203         except TypeError:
 204             # We don't expect the xattr to be filled in in this case
 205             pass
 206
 207     def test_setposixacl_getntacl_smbd(self):
 208         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 209         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 210         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 211         smbd.set_simple_acl(self.tempf, 0640)
 212         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 213         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 214         anysid = security.dom_sid(security.SID_NT_SELF)
 215         self.assertEquals(acl, facl.as_sddl(anysid))
 216
 217     def test_setposixacl_dir_getntacl_smbd(self):
 218         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 219         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempdir).st_uid)
 220         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 221         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 222         (BA_id,BA_type) = s4_passdb.sid_to_id(BA_sid)
 223         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 224         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 225         (SO_id,SO_type) = s4_passdb.sid_to_id(SO_sid)
 226         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 227         smbd.chown(self.tempdir, BA_id, SO_id)
 228         smbd.set_simple_acl(self.tempdir, 0750)
 229         facl = getntacl(self.lp, self.tempdir, direct_db_access=False)
 230         acl = "O:BAG:SOD:(A;;0x001f01ff;;;BA)(A;;0x001200a9;;;SO)(A;;;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001200a9;;;CG)(A;OICIIO;0x001200a9;;;WD)"
 231
 232         anysid = security.dom_sid(security.SID_NT_SELF)
 233         self.assertEquals(acl, facl.as_sddl(anysid))
 234
 235     def test_setposixacl_group_getntacl_smbd(self):
 236         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 237         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 238         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 239         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 240         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 241         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 242         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 243         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 244         domsid = passdb.get_global_sam_sid()
 245         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 246         anysid = security.dom_sid(security.SID_NT_SELF)
 247         self.assertEquals(acl, facl.as_sddl(anysid))
 248
 249     def test_setposixacl_getposixacl(self):
 250         smbd.set_simple_acl(self.tempf, 0640)
 251         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 252         self.assertEquals(posix_acl.count, 4)
 253
 254         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 255         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 256
 257         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 258         self.assertEquals(posix_acl.acl[1].a_perm, 4)
 259
 260         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 261         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 262
 263         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 264         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 265
 266     def test_setposixacl_dir_getposixacl(self):
 267         smbd.set_simple_acl(self.tempdir, 0750)
 268         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 269         self.assertEquals(posix_acl.count, 4)
 270
 271         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 272         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 273
 274         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 275         self.assertEquals(posix_acl.acl[1].a_perm, 5)
 276
 277         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 278         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 279
 280         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 281         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 282
 283     def test_setposixacl_group_getposixacl(self):
 284         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 285         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 286         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 287         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 288         smbd.set_simple_acl(self.tempf, 0670, BA_gid)
 289         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 290
 291         self.assertEquals(posix_acl.count, 5)
 292
 293         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 294         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 295
 296         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 297         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 298
 299         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 300         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 301
 302         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_GROUP)
 303         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 304         self.assertEquals(posix_acl.acl[3].info.gid, BA_gid)
 305
 306         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_MASK)
 307         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 308
 309     def test_setntacl_sysvol_check_getposixacl(self):
 310         acl = provision.SYSVOL_ACL
 311         domsid = passdb.get_global_sam_sid()
 312         setntacl(self.lp, self.tempf,acl,str(domsid), use_ntvfs=False)
 313         facl = getntacl(self.lp, self.tempf)
 314         self.assertEquals(facl.as_sddl(domsid),acl)
 315         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 316
 317         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 318         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 319         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 320         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 321         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 322
 323         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 324
 325         # These assertions correct for current plugin_s4_dc selftest
 326         # configuration.  When other environments have a broad range of
 327         # groups mapped via passdb, we can relax some of these checks
 328         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 329         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 330         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 331         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 332         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 333         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 334         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 335         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 336         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 337         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 338
 339         self.assertEquals(posix_acl.count, 13)
 340
 341         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 342         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 343         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 344
 345         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 346         self.assertEquals(posix_acl.acl[1].a_perm, 6)
 347         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 348
 349         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 350         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 351
 352         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 353         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 354
 355         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 356         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 357         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 358
 359         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 360         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 361
 362         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 363         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 364         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 365
 366         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 367         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 368         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 369
 370         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 371         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 372         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 373
 374         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 375         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 376         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 377
 378         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 379         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 380         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 381
 382         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 383         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 384         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 385
 386         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_MASK)
 387         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 388
 389
 390 # check that it matches:
 391 # user::rwx
 392 # user:root:rwx (selftest user actually)
 393 # group::rwx
 394 # group:Local Admins:rwx
 395 # group:3000000:r-x
 396 # group:3000001:rwx
 397 # group:3000002:r-x
 398 # mask::rwx
 399 # other::---
 400
 401 #
 402 # This is in this order in the NDR smb_acl (not re-orderded for display)
 403 # a_type: GROUP
 404 # a_perm: 7
 405 # uid: -1
 406 # gid: 10
 407 # a_type: USER
 408 # a_perm: 6
 409 # uid: 0 (selftest user actually)
 410 # gid: -1
 411 # a_type: OTHER
 412 # a_perm: 0
 413 # uid: -1
 414 # gid: -1
 415 # a_type: USER_OBJ
 416 # a_perm: 6
 417 # uid: -1
 418 # gid: -1
 419 # a_type: GROUP_OBJ
 420 # a_perm: 7
 421 # uid: -1
 422 # gid: -1
 423 # a_type: GROUP
 424 # a_perm: 5
 425 # uid: -1
 426 # gid: 3000020
 427 # a_type: GROUP
 428 # a_perm: 7
 429 # uid: -1
 430 # gid: 3000000
 431 # a_type: GROUP
 432 # a_perm: 5
 433 # uid: -1
 434 # gid: 3000001
 435 # a_type: MASK
 436 # a_perm: 7
 437 # uid: -1
 438 # gid: -1
 439
 440 #
 441
 442
 443     def test_setntacl_sysvol_dir_check_getposixacl(self):
 444         acl = provision.SYSVOL_ACL
 445         domsid = passdb.get_global_sam_sid()
 446         setntacl(self.lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
 447         facl = getntacl(self.lp, self.tempdir)
 448         self.assertEquals(facl.as_sddl(domsid),acl)
 449         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 450
 451         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 452         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 453         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 454         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 455         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 456
 457         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 458
 459         # These assertions correct for current plugin_s4_dc selftest
 460         # configuration.  When other environments have a broad range of
 461         # groups mapped via passdb, we can relax some of these checks
 462         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 463         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 464         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 465         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 466         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 467         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 468         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 469         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 470         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 471         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 472
 473         self.assertEquals(posix_acl.count, 13)
 474
 475         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 476         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 477         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 478
 479         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 480         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 481         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 482
 483         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 484         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 485
 486         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 487         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 488
 489         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 490         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 491         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 492
 493         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 494         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 495
 496         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 497         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 498         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 499
 500         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 501         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 502         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 503
 504         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 505         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 506         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 507
 508         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 509         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 510         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 511
 512         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 513         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 514         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 515
 516         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 517         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 518         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 519
 520         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_MASK)
 521         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 522
 523
 524 # check that it matches:
 525 # user::rwx
 526 # user:root:rwx (selftest user actually)
 527 # group::rwx
 528 # group:3000000:rwx
 529 # group:3000001:r-x
 530 # group:3000002:rwx
 531 # group:3000003:r-x
 532 # mask::rwx
 533 # other::---
 534
 535
 536     def test_setntacl_policies_dir_check_getposixacl(self):
 537         acl = provision.POLICIES_ACL
 538         domsid = passdb.get_global_sam_sid()
 539         setntacl(self.lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
 540         facl = getntacl(self.lp, self.tempdir)
 541         self.assertEquals(facl.as_sddl(domsid),acl)
 542         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 543
 544         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 545         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 546         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 547         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 548         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 549         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 550
 551         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 552
 553         # These assertions correct for current plugin_s4_dc selftest
 554         # configuration.  When other environments have a broad range of
 555         # groups mapped via passdb, we can relax some of these checks
 556         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 557         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 558         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 559         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 560         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 561         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 562         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 563         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 564         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 565         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 566         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 567         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 568
 569         self.assertEquals(posix_acl.count, 15)
 570
 571         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 572         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 573         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 574
 575         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 576         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 577         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 578
 579         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 580         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 581
 582         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 583         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 584
 585         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 586         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 587         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 588
 589         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 590         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 591
 592         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 593         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 594         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 595
 596         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 597         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 598         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 599
 600         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 601         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 602         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 603
 604         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 605         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 606         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 607
 608         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 609         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 610         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 611
 612         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 613         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 614         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 615
 616         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_USER)
 617         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 618         self.assertEquals(posix_acl.acl[12].info.uid, PA_gid)
 619
 620         self.assertEquals(posix_acl.acl[13].a_type, smb_acl.SMB_ACL_GROUP)
 621         self.assertEquals(posix_acl.acl[13].a_perm, 7)
 622         self.assertEquals(posix_acl.acl[13].info.gid, PA_gid)
 623
 624         self.assertEquals(posix_acl.acl[14].a_type, smb_acl.SMB_ACL_MASK)
 625         self.assertEquals(posix_acl.acl[14].a_perm, 7)
 626
 627
 628 # check that it matches:
 629 # user::rwx
 630 # user:root:rwx  (selftest user actually)
 631 # group::rwx
 632 # group:3000000:rwx
 633 # group:3000001:r-x
 634 # group:3000002:rwx
 635 # group:3000003:r-x
 636 # group:3000004:rwx
 637 # mask::rwx
 638 # other::---
 639
 640
 641
 642     def test_setntacl_policies_check_getposixacl(self):
 643         acl = provision.POLICIES_ACL
 644
 645         domsid = passdb.get_global_sam_sid()
 646         setntacl(self.lp, self.tempf, acl, str(domsid), use_ntvfs=False)
 647         facl = getntacl(self.lp, self.tempf)
 648         self.assertEquals(facl.as_sddl(domsid),acl)
 649         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 650
 651         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 652         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 653         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 654         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 655         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 656         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 657
 658         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 659
 660         # These assertions correct for current plugin_s4_dc selftest
 661         # configuration.  When other environments have a broad range of
 662         # groups mapped via passdb, we can relax some of these checks
 663         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 664         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 665         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 666         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 667         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 668         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 669         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 670         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 671         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 672         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 673         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 674         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 675
 676         self.assertEquals(posix_acl.count, 15)
 677
 678         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 679         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 680         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 681
 682         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 683         self.assertEquals(posix_acl.acl[1].a_perm, 6)
 684         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 685
 686         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 687         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 688
 689         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 690         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 691
 692         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 693         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 694         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 695
 696         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 697         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 698
 699         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 700         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 701         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 702
 703         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 704         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 705         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 706
 707         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 708         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 709         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 710
 711         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 712         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 713         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 714
 715         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 716         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 717         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 718
 719         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 720         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 721         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 722
 723         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_USER)
 724         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 725         self.assertEquals(posix_acl.acl[12].info.uid, PA_gid)
 726
 727         self.assertEquals(posix_acl.acl[13].a_type, smb_acl.SMB_ACL_GROUP)
 728         self.assertEquals(posix_acl.acl[13].a_perm, 7)
 729         self.assertEquals(posix_acl.acl[13].info.gid, PA_gid)
 730
 731         self.assertEquals(posix_acl.acl[14].a_type, smb_acl.SMB_ACL_MASK)
 732         self.assertEquals(posix_acl.acl[14].a_perm, 7)
 733
 734
 735 # check that it matches:
 736 # user::rwx
 737 # user:root:rwx (selftest user actually)
 738 # group::rwx
 739 # group:Local Admins:rwx
 740 # group:3000000:r-x
 741 # group:3000001:rwx
 742 # group:3000002:r-x
 743 # group:3000003:rwx
 744 # mask::rwx
 745 # other::---
 746
 747 #
 748 # This is in this order in the NDR smb_acl (not re-orderded for display)
 749 # a_type: GROUP
 750 # a_perm: 7
 751 # uid: -1
 752 # gid: 10
 753 # a_type: USER
 754 # a_perm: 6
 755 # uid: 0 (selftest user actually)
 756 # gid: -1
 757 # a_type: OTHER
 758 # a_perm: 0
 759 # uid: -1
 760 # gid: -1
 761 # a_type: USER_OBJ
 762 # a_perm: 6
 763 # uid: -1
 764 # gid: -1
 765 # a_type: GROUP_OBJ
 766 # a_perm: 7
 767 # uid: -1
 768 # gid: -1
 769 # a_type: GROUP
 770 # a_perm: 5
 771 # uid: -1
 772 # gid: 3000020
 773 # a_type: GROUP
 774 # a_perm: 7
 775 # uid: -1
 776 # gid: 3000000
 777 # a_type: GROUP
 778 # a_perm: 5
 779 # uid: -1
 780 # gid: 3000001
 781 # a_type: GROUP
 782 # a_perm: 7
 783 # uid: -1
 784 # gid: 3000003
 785 # a_type: MASK
 786 # a_perm: 7
 787 # uid: -1
 788 # gid: -1
 789
 790 #
 791
 792     def setUp(self):
 793         super(PosixAclMappingTests, self).setUp()
 794         s3conf = s3param.get_context()
 795         s3conf.load(self.get_loadparm().configfile)
 796         s3conf.set("xattr_tdb:file", os.path.join(self.tempdir,"xattr.tdb"))
 797         self.lp = s3conf
 798         self.tempf = os.path.join(self.tempdir, "test")
 799         open(self.tempf, 'w').write("empty")
 800
 801     def tearDown(self):
 802         smbd.unlink(self.tempf)
 803         os.unlink(os.path.join(self.tempdir,"xattr.tdb"))
 804         super(PosixAclMappingTests, self).tearDown()