python/samba/tests/posixacl.py

   1 # Unix SMB/CIFS implementation. Tests for NT and posix ACL manipulation
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
   3 # Copyright (C) Andrew Bartlett 2012
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 """Tests for the Samba3 NT -> posix ACL layer"""
  20
  21 from samba.ntacls import setntacl, getntacl, checkset_backend
  22 from samba.dcerpc import xattr, security, smb_acl, idmap
  23 from samba.param import LoadParm
  24 from samba.tests import TestCaseInTempDir
  25 from samba import provision
  26 import random
  27 import os
  28 from samba.samba3 import smbd, passdb
  29 from samba.samba3 import param as s3param
  30
  31 # To print a posix ACL use:
  32 #        for entry in posix_acl.acl:
  33 #            print "a_type: %d" % entry.a_type
  34 #            print "a_perm: %o" % entry.a_perm
  35 #            print "uid: %d" % entry.uid
  36 #            print "gid: %d" % entry.gid
  37
  38 class PosixAclMappingTests(TestCaseInTempDir):
  39
  40     def test_setntacl(self):
  41         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  42         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  43
  44     def test_setntacl_smbd_getntacl(self):
  45         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  46         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  47         facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  48         anysid = security.dom_sid(security.SID_NT_SELF)
  49         self.assertEquals(facl.as_sddl(anysid),acl)
  50
  51     def test_setntacl_smbd_setposixacl_getntacl(self):
  52         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  53         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  54
  55         # This will invalidate the ACL, as we have a hook!
  56         smbd.set_simple_acl(self.tempf, 0640)
  57
  58         # However, this only asks the xattr
  59         try:
  60             facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  61             self.assertTrue(False)
  62         except TypeError:
  63             pass
  64
  65     def test_setntacl_invalidate_getntacl(self):
  66         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  67         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  68
  69         # This should invalidate the ACL, as we include the posix ACL in the hash
  70         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
  71         backend_obj.wrap_setxattr(dbname,
  72                                   self.tempf, "system.fake_access_acl", "")
  73
  74         #however, as this is direct DB access, we do not notice it
  75         facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  76         anysid = security.dom_sid(security.SID_NT_SELF)
  77         self.assertEquals(acl, facl.as_sddl(anysid))
  78
  79     def test_setntacl_invalidate_getntacl_smbd(self):
  80         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  81         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  82
  83         # This should invalidate the ACL, as we include the posix ACL in the hash
  84         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
  85         backend_obj.wrap_setxattr(dbname,
  86                                   self.tempf, "system.fake_access_acl", "")
  87
  88         #the hash would break, and we return an ACL based only on the mode, except we set the ACL using the 'ntvfs' mode that doesn't include a hash
  89         facl = getntacl(self.lp, self.tempf)
  90         anysid = security.dom_sid(security.SID_NT_SELF)
  91         self.assertEquals(acl, facl.as_sddl(anysid))
  92
  93     def test_setntacl_smbd_invalidate_getntacl_smbd(self):
  94         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  95         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x001200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
  96         os.chmod(self.tempf, 0750)
  97         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  98
  99         # This should invalidate the ACL, as we include the posix ACL in the hash
 100         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
 101         backend_obj.wrap_setxattr(dbname,
 102                                   self.tempf, "system.fake_access_acl", "")
 103
 104         #the hash will break, and we return an ACL based only on the mode
 105         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 106         anysid = security.dom_sid(security.SID_NT_SELF)
 107         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 108
 109     def test_setntacl_smbd_dont_invalidate_getntacl_smbd(self):
 110         # set an ACL on a tempfile
 111         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 112         os.chmod(self.tempf, 0750)
 113         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 114
 115         # now influence the POSIX ACL->SD mapping it returns something else than
 116         # what was set previously
 117         # this should not invalidate the hash and the complete ACL should still
 118         # be returned
 119         self.lp.set("profile acls", "yes")
 120         # we should still get back the ACL (and not one mapped from POSIX ACL)
 121         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 122         self.lp.set("profile acls", "no")
 123         anysid = security.dom_sid(security.SID_NT_SELF)
 124         self.assertEquals(acl, facl.as_sddl(anysid))
 125
 126     def test_setntacl_getntacl_smbd(self):
 127         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 128         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
 129         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 130         anysid = security.dom_sid(security.SID_NT_SELF)
 131         self.assertEquals(facl.as_sddl(anysid),acl)
 132
 133     def test_setntacl_smbd_getntacl_smbd(self):
 134         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 135         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 136         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 137         anysid = security.dom_sid(security.SID_NT_SELF)
 138         self.assertEquals(facl.as_sddl(anysid),acl)
 139
 140     def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
 141         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 142         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 143         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 144         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 145         smbd.set_simple_acl(self.tempf, 0640)
 146         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 147         anysid = security.dom_sid(security.SID_NT_SELF)
 148         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 149
 150     def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
 151         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 152         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 153         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;BA)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 154         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 155         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 156         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 157         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 158         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 159
 160         # This should re-calculate an ACL based on the posix details
 161         facl = getntacl(self.lp,self.tempf, direct_db_access=False)
 162         anysid = security.dom_sid(security.SID_NT_SELF)
 163         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 164
 165     def test_setntacl_smbd_getntacl_smbd_gpo(self):
 166         acl = "O:DAG:DUD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 167         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 168         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 169         domsid = security.dom_sid("S-1-5-21-2212615479-2695158682-2101375467")
 170         self.assertEquals(facl.as_sddl(domsid),acl)
 171
 172     def test_setntacl_getposixacl(self):
 173         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 174         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 175         facl = getntacl(self.lp, self.tempf)
 176         anysid = security.dom_sid(security.SID_NT_SELF)
 177         self.assertEquals(facl.as_sddl(anysid),acl)
 178         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 179
 180     def test_setposixacl_getposixacl(self):
 181         smbd.set_simple_acl(self.tempf, 0640)
 182         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 183         self.assertEquals(posix_acl.count, 4)
 184
 185         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 186         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 187
 188         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 189         self.assertEquals(posix_acl.acl[1].a_perm, 4)
 190
 191         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 192         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 193
 194         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 195         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 196
 197     def test_setposixacl_getntacl(self):
 198         acl = ""
 199         smbd.set_simple_acl(self.tempf, 0750)
 200         try:
 201             facl = getntacl(self.lp, self.tempf)
 202             self.assertTrue(False)
 203         except TypeError:
 204             # We don't expect the xattr to be filled in in this case
 205             pass
 206
 207     def test_setposixacl_getntacl_smbd(self):
 208         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 209         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 210         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 211         smbd.set_simple_acl(self.tempf, 0640)
 212         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 213         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 214         anysid = security.dom_sid(security.SID_NT_SELF)
 215         self.assertEquals(acl, facl.as_sddl(anysid))
 216
 217     def test_setposixacl_dir_getntacl_smbd(self):
 218         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 219         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempdir).st_uid)
 220         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 221         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 222         (BA_id,BA_type) = s4_passdb.sid_to_id(BA_sid)
 223         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 224         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 225         (SO_id,SO_type) = s4_passdb.sid_to_id(SO_sid)
 226         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 227         smbd.chown(self.tempdir, BA_id, SO_id)
 228         smbd.set_simple_acl(self.tempdir, 0750)
 229         facl = getntacl(self.lp, self.tempdir, direct_db_access=False)
 230         acl = "O:BAG:SOD:(A;;0x001f01ff;;;BA)(A;;0x001200a9;;;SO)(A;;;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001f01ff;;;CG)(A;OICIIO;0x001f01ff;;;WD)"
 231
 232         anysid = security.dom_sid(security.SID_NT_SELF)
 233         self.assertEquals(acl, facl.as_sddl(anysid))
 234
 235     def test_setposixacl_group_getntacl_smbd(self):
 236         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 237         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 238         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 239         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 240         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 241         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 242         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 243         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 244         domsid = passdb.get_global_sam_sid()
 245         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 246         anysid = security.dom_sid(security.SID_NT_SELF)
 247         self.assertEquals(acl, facl.as_sddl(anysid))
 248
 249     def test_setposixacl_getposixacl(self):
 250         smbd.set_simple_acl(self.tempf, 0640)
 251         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 252         self.assertEquals(posix_acl.count, 4)
 253
 254         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 255         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 256
 257         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 258         self.assertEquals(posix_acl.acl[1].a_perm, 4)
 259
 260         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 261         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 262
 263         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 264         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 265
 266     def test_setposixacl_dir_getposixacl(self):
 267         smbd.set_simple_acl(self.tempdir, 0750)
 268         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 269         self.assertEquals(posix_acl.count, 4)
 270
 271         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 272         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 273
 274         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 275         self.assertEquals(posix_acl.acl[1].a_perm, 5)
 276
 277         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 278         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 279
 280         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 281         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 282
 283     def test_setposixacl_group_getposixacl(self):
 284         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 285         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 286         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 287         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 288         smbd.set_simple_acl(self.tempf, 0670, BA_gid)
 289         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 290
 291         self.assertEquals(posix_acl.count, 5)
 292
 293         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 294         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 295
 296         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 297         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 298
 299         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 300         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 301
 302         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_GROUP)
 303         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 304         self.assertEquals(posix_acl.acl[3].info.gid, BA_gid)
 305
 306         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_MASK)
 307         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 308
 309     def test_setntacl_sysvol_check_getposixacl(self):
 310         acl = provision.SYSVOL_ACL
 311         domsid = passdb.get_global_sam_sid()
 312         setntacl(self.lp, self.tempf,acl,str(domsid), use_ntvfs=False)
 313         facl = getntacl(self.lp, self.tempf)
 314         self.assertEquals(facl.as_sddl(domsid),acl)
 315         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 316
 317         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 318         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 319         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 320         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 321         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 322
 323         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 324
 325         # These assertions correct for current plugin_s4_dc selftest
 326         # configuration.  When other environments have a broad range of
 327         # groups mapped via passdb, we can relax some of these checks
 328         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 329         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 330         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 331         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 332         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 333         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 334         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 335         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 336         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 337         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 338
 339         self.assertEquals(posix_acl.count, 9)
 340
 341         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 342         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 343         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 344
 345         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 346         self.assertEquals(posix_acl.acl[1].a_perm, 6)
 347         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 348
 349         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 350         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 351
 352         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 353         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 354
 355         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 356         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 357
 358         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 359         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 360         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 361
 362         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 363         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 364         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 365
 366         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 367         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 368         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 369
 370         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_MASK)
 371         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 372
 373
 374 # check that it matches:
 375 # user::rwx
 376 # user:root:rwx (selftest user actually)
 377 # group::rwx
 378 # group:Local Admins:rwx
 379 # group:3000000:r-x
 380 # group:3000001:rwx
 381 # group:3000002:r-x
 382 # mask::rwx
 383 # other::---
 384
 385 #
 386 # This is in this order in the NDR smb_acl (not re-orderded for display)
 387 # a_type: GROUP
 388 # a_perm: 7
 389 # uid: -1
 390 # gid: 10
 391 # a_type: USER
 392 # a_perm: 6
 393 # uid: 0 (selftest user actually)
 394 # gid: -1
 395 # a_type: OTHER
 396 # a_perm: 0
 397 # uid: -1
 398 # gid: -1
 399 # a_type: USER_OBJ
 400 # a_perm: 6
 401 # uid: -1
 402 # gid: -1
 403 # a_type: GROUP_OBJ
 404 # a_perm: 7
 405 # uid: -1
 406 # gid: -1
 407 # a_type: GROUP
 408 # a_perm: 5
 409 # uid: -1
 410 # gid: 3000020
 411 # a_type: GROUP
 412 # a_perm: 7
 413 # uid: -1
 414 # gid: 3000000
 415 # a_type: GROUP
 416 # a_perm: 5
 417 # uid: -1
 418 # gid: 3000001
 419 # a_type: MASK
 420 # a_perm: 7
 421 # uid: -1
 422 # gid: -1
 423
 424 #
 425
 426
 427     def test_setntacl_sysvol_dir_check_getposixacl(self):
 428         acl = provision.SYSVOL_ACL
 429         domsid = passdb.get_global_sam_sid()
 430         setntacl(self.lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
 431         facl = getntacl(self.lp, self.tempdir)
 432         self.assertEquals(facl.as_sddl(domsid),acl)
 433         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 434
 435         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 436         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 437         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 438         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 439         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 440
 441         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 442
 443         # These assertions correct for current plugin_s4_dc selftest
 444         # configuration.  When other environments have a broad range of
 445         # groups mapped via passdb, we can relax some of these checks
 446         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 447         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 448         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 449         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 450         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 451         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 452         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 453         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 454         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 455         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 456
 457         self.assertEquals(posix_acl.count, 9)
 458
 459         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 460         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 461         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 462
 463         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 464         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 465         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 466
 467         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 468         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 469
 470         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 471         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 472
 473         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 474         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 475
 476         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 477         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 478         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 479
 480         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 481         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 482         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 483
 484         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 485         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 486         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 487
 488         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_MASK)
 489         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 490
 491
 492 # check that it matches:
 493 # user::rwx
 494 # user:root:rwx (selftest user actually)
 495 # group::rwx
 496 # group:3000000:rwx
 497 # group:3000001:r-x
 498 # group:3000002:rwx
 499 # group:3000003:r-x
 500 # mask::rwx
 501 # other::---
 502
 503
 504     def test_setntacl_policies_dir_check_getposixacl(self):
 505         acl = provision.POLICIES_ACL
 506         domsid = passdb.get_global_sam_sid()
 507         setntacl(self.lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
 508         facl = getntacl(self.lp, self.tempdir)
 509         self.assertEquals(facl.as_sddl(domsid),acl)
 510         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 511
 512         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 513         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 514         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 515         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 516         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 517         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 518
 519         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 520
 521         # These assertions correct for current plugin_s4_dc selftest
 522         # configuration.  When other environments have a broad range of
 523         # groups mapped via passdb, we can relax some of these checks
 524         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 525         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 526         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 527         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 528         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 529         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 530         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 531         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 532         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 533         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 534         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 535         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 536
 537         self.assertEquals(posix_acl.count, 10)
 538
 539         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 540         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 541         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 542
 543         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 544         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 545         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 546
 547         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 548         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 549
 550         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 551         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 552
 553         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 554         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 555
 556         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 557         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 558         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 559
 560         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 561         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 562         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 563
 564         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 565         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 566         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 567
 568         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_GROUP)
 569         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 570         self.assertEquals(posix_acl.acl[8].info.gid, PA_gid)
 571
 572         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_MASK)
 573         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 574
 575
 576 # check that it matches:
 577 # user::rwx
 578 # user:root:rwx  (selftest user actually)
 579 # group::rwx
 580 # group:3000000:rwx
 581 # group:3000001:r-x
 582 # group:3000002:rwx
 583 # group:3000003:r-x
 584 # group:3000004:rwx
 585 # mask::rwx
 586 # other::---
 587
 588
 589
 590     def test_setntacl_policies_check_getposixacl(self):
 591         acl = provision.POLICIES_ACL
 592
 593         domsid = passdb.get_global_sam_sid()
 594         setntacl(self.lp, self.tempf, acl, str(domsid), use_ntvfs=False)
 595         facl = getntacl(self.lp, self.tempf)
 596         self.assertEquals(facl.as_sddl(domsid),acl)
 597         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 598
 599         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 600         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 601         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 602         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 603         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 604         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 605
 606         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 607
 608         # These assertions correct for current plugin_s4_dc selftest
 609         # configuration.  When other environments have a broad range of
 610         # groups mapped via passdb, we can relax some of these checks
 611         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 612         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 613         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 614         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 615         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 616         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 617         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 618         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 619         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 620         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 621         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 622         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 623
 624         self.assertEquals(posix_acl.count, 10)
 625
 626         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 627         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 628         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 629
 630         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 631         self.assertEquals(posix_acl.acl[1].a_perm, 6)
 632         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 633
 634         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 635         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 636
 637         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 638         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 639
 640         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 641         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 642
 643         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 644         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 645         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 646
 647         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 648         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 649         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 650
 651         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 652         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 653         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 654
 655         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_GROUP)
 656         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 657         self.assertEquals(posix_acl.acl[8].info.gid, PA_gid)
 658
 659         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_MASK)
 660         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 661
 662
 663 # check that it matches:
 664 # user::rwx
 665 # user:root:rwx (selftest user actually)
 666 # group::rwx
 667 # group:Local Admins:rwx
 668 # group:3000000:r-x
 669 # group:3000001:rwx
 670 # group:3000002:r-x
 671 # group:3000003:rwx
 672 # mask::rwx
 673 # other::---
 674
 675 #
 676 # This is in this order in the NDR smb_acl (not re-orderded for display)
 677 # a_type: GROUP
 678 # a_perm: 7
 679 # uid: -1
 680 # gid: 10
 681 # a_type: USER
 682 # a_perm: 6
 683 # uid: 0 (selftest user actually)
 684 # gid: -1
 685 # a_type: OTHER
 686 # a_perm: 0
 687 # uid: -1
 688 # gid: -1
 689 # a_type: USER_OBJ
 690 # a_perm: 6
 691 # uid: -1
 692 # gid: -1
 693 # a_type: GROUP_OBJ
 694 # a_perm: 7
 695 # uid: -1
 696 # gid: -1
 697 # a_type: GROUP
 698 # a_perm: 5
 699 # uid: -1
 700 # gid: 3000020
 701 # a_type: GROUP
 702 # a_perm: 7
 703 # uid: -1
 704 # gid: 3000000
 705 # a_type: GROUP
 706 # a_perm: 5
 707 # uid: -1
 708 # gid: 3000001
 709 # a_type: GROUP
 710 # a_perm: 7
 711 # uid: -1
 712 # gid: 3000003
 713 # a_type: MASK
 714 # a_perm: 7
 715 # uid: -1
 716 # gid: -1
 717
 718 #
 719
 720     def setUp(self):
 721         super(PosixAclMappingTests, self).setUp()
 722         s3conf = s3param.get_context()
 723         s3conf.load(self.get_loadparm().configfile)
 724         s3conf.set("xattr_tdb:file", os.path.join(self.tempdir,"xattr.tdb"))
 725         self.lp = s3conf
 726         self.tempf = os.path.join(self.tempdir, "test")
 727         open(self.tempf, 'w').write("empty")
 728
 729     def tearDown(self):
 730         smbd.unlink(self.tempf)
 731         os.unlink(os.path.join(self.tempdir,"xattr.tdb"))
 732         super(PosixAclMappingTests, self).tearDown()