python/samba/tests/posixacl.py

   1 # Unix SMB/CIFS implementation. Tests for NT and posix ACL manipulation
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
   3 # Copyright (C) Andrew Bartlett 2012
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 """Tests for the Samba3 NT -> posix ACL layer"""
  20
  21 from samba.ntacls import setntacl, getntacl, checkset_backend
  22 from samba.dcerpc import security, smb_acl, idmap
  23 from samba.tests.smbd_base import SmbdBaseTests
  24 from samba import provision
  25 import os
  26 from samba.samba3 import smbd, passdb
  27 from samba.samba3 import param as s3param
  28 from samba import auth
  29 from samba.samdb import SamDB
  30 from samba.auth_util import system_session_unix
  31 from errno import ENODATA
  32
  33 DOM_SID = "S-1-5-21-2212615479-2695158682-2101375467"
  34 ACL = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;FA;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  35
  36
  37 class PosixAclMappingTests(SmbdBaseTests):
  38
  39     def setUp(self):
  40         super().setUp()
  41         s3conf = s3param.get_context()
  42         s3conf.load(self.get_loadparm().configfile)
  43         s3conf.set("xattr_tdb:file", os.path.join(self.tempdir, "xattr.tdb"))
  44         self.lp = s3conf
  45         self.tempf = os.path.join(self.tempdir, "test")
  46         open(self.tempf, 'w').write("empty")
  47         self.samdb = SamDB(lp=self.lp, session_info=auth.system_session())
  48
  49     def tearDown(self):
  50         smbd.unlink(self.tempf, self.get_session_info())
  51         os.unlink(os.path.join(self.tempdir, "xattr.tdb"))
  52         super().tearDown()
  53
  54     def get_session_info(self, domsid=DOM_SID):
  55         """
  56         Get session_info for setntacl.
  57         """
  58         return system_session_unix()
  59
  60     def print_posix_acl(self, posix_acl):
  61         aclstr = ""
  62         for entry in posix_acl.acl:
  63             aclstr += "a_type: %d\n" % entry.a_type +\
  64                       "a_perm: %o\n" % entry.a_perm
  65             if entry.a_type == smb_acl.SMB_ACL_USER:
  66                 aclstr += "uid: %d\n" % entry.info.uid
  67             if entry.a_type == smb_acl.SMB_ACL_GROUP:
  68                 aclstr += "gid: %d\n" % entry.info.gid
  69         return aclstr
  70
  71     def test_setntacl(self):
  72         acl = ACL
  73         setntacl(self.lp, self.tempf, acl, DOM_SID,
  74                  self.get_session_info(), use_ntvfs=False)
  75
  76     def test_setntacl_smbd_getntacl(self):
  77         acl = ACL
  78         setntacl(self.lp, self.tempf, acl, DOM_SID,
  79                  self.get_session_info(), use_ntvfs=True)
  80         facl = getntacl(self.lp, self.tempf, self.get_session_info(), direct_db_access=True)
  81         anysid = security.dom_sid(security.SID_NT_SELF)
  82         self.assertEqual(facl.as_sddl(anysid), acl)
  83
  84     def test_setntacl_smbd_setposixacl_getntacl(self):
  85         acl = ACL
  86         setntacl(self.lp, self.tempf, acl, DOM_SID,
  87                  self.get_session_info(), use_ntvfs=True)
  88
  89         # This will invalidate the ACL, as we have a hook!
  90         smbd.set_simple_acl(self.tempf, 0o640, self.get_session_info())
  91
  92         # However, this only asks the xattr
  93         with self.assertRaises(OSError) as cm:
  94             getntacl(self.lp, self.tempf, self.get_session_info(),
  95                      direct_db_access=True)
  96
  97         self.assertEqual(cm.exception.errno, ENODATA)
  98
  99     def test_setntacl_invalidate_getntacl(self):
 100         acl = ACL
 101         setntacl(self.lp, self.tempf, acl, DOM_SID,
 102                  self.get_session_info(), use_ntvfs=True)
 103
 104         # This should invalidate the ACL, as we include the posix ACL in the hash
 105         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
 106         backend_obj.wrap_setxattr(dbname,
 107                                   self.tempf, "system.fake_access_acl", b"")
 108
 109         # however, as this is direct DB access, we do not notice it
 110         facl = getntacl(self.lp, self.tempf, self.get_session_info(), direct_db_access=True)
 111         anysid = security.dom_sid(security.SID_NT_SELF)
 112         self.assertEqual(acl, facl.as_sddl(anysid))
 113
 114     def test_setntacl_invalidate_getntacl_smbd(self):
 115         acl = ACL
 116         setntacl(self.lp, self.tempf, acl, DOM_SID,
 117                  self.get_session_info(), use_ntvfs=False)
 118
 119         # This should invalidate the ACL, as we include the posix ACL in the hash
 120         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
 121         backend_obj.wrap_setxattr(dbname,
 122                                   self.tempf, "system.fake_access_acl", b"")
 123
 124         # the hash would break, and we return an ACL based only on the mode, except we set the ACL using the 'ntvfs' mode that doesn't include a hash
 125         facl = getntacl(self.lp, self.tempf, self.get_session_info())
 126         anysid = security.dom_sid(security.SID_NT_SELF)
 127         self.assertEqual(acl, facl.as_sddl(anysid))
 128
 129     def test_setntacl_smbd_invalidate_getntacl_smbd(self):
 130         acl = ACL
 131         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;FA;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x1200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 132         os.chmod(self.tempf, 0o750)
 133         setntacl(self.lp, self.tempf, acl, DOM_SID,
 134                  self.get_session_info(), use_ntvfs=False)
 135
 136         # This should invalidate the ACL, as we include the posix ACL in the hash
 137         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
 138         backend_obj.wrap_setxattr(dbname,
 139                                   self.tempf, "system.fake_access_acl", b"")
 140
 141         # the hash will break, and we return an ACL based only on the mode
 142         facl = getntacl(self.lp, self.tempf, self.get_session_info(), direct_db_access=False)
 143         anysid = security.dom_sid(security.SID_NT_SELF)
 144         self.assertEqual(simple_acl_from_posix, facl.as_sddl(anysid))
 145
 146     def test_setntacl_getntacl_smbd(self):
 147         acl = ACL
 148         setntacl(self.lp, self.tempf, acl, DOM_SID,
 149                  self.get_session_info(), use_ntvfs=True)
 150         facl = getntacl(self.lp, self.tempf, self.get_session_info(), direct_db_access=False)
 151         anysid = security.dom_sid(security.SID_NT_SELF)
 152         self.assertEqual(facl.as_sddl(anysid), acl)
 153
 154     def test_setntacl_smbd_getntacl_smbd(self):
 155         acl = ACL
 156         setntacl(self.lp, self.tempf, acl, DOM_SID,
 157                  self.get_session_info(), use_ntvfs=False)
 158         facl = getntacl(self.lp, self.tempf, self.get_session_info(), direct_db_access=False)
 159         anysid = security.dom_sid(security.SID_NT_SELF)
 160         self.assertEqual(facl.as_sddl(anysid), acl)
 161
 162     def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
 163         acl = ACL
 164         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x1f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;FR;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 165         setntacl(self.lp, self.tempf, acl, DOM_SID,
 166                  self.get_session_info(), use_ntvfs=False)
 167         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 168         smbd.set_simple_acl(self.tempf, 0o640, self.get_session_info())
 169         facl = getntacl(self.lp, self.tempf, self.get_session_info(), direct_db_access=False)
 170         anysid = security.dom_sid(security.SID_NT_SELF)
 171         self.assertEqual(simple_acl_from_posix, facl.as_sddl(anysid))
 172
 173     def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
 174         acl = ACL
 175         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 176         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x1f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;FR;;;BA)(A;;FR;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 177         setntacl(self.lp, self.tempf, acl, DOM_SID,
 178                  self.get_session_info(), use_ntvfs=False)
 179         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 180         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 181         (BA_gid, BA_type) = s4_passdb.sid_to_id(BA_sid)
 182         smbd.set_simple_acl(self.tempf, 0o640, self.get_session_info(), BA_gid)
 183
 184         # This should re-calculate an ACL based on the posix details
 185         facl = getntacl(self.lp, self.tempf, self.get_session_info(), direct_db_access=False)
 186         anysid = security.dom_sid(security.SID_NT_SELF)
 187         self.assertEqual(simple_acl_from_posix, facl.as_sddl(anysid))
 188
 189     def test_setntacl_smbd_getntacl_smbd_gpo(self):
 190         acl = "O:DAG:DUD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 191         setntacl(self.lp, self.tempf, acl, DOM_SID,
 192                  self.get_session_info(), use_ntvfs=False)
 193         facl = getntacl(self.lp, self.tempf, self.get_session_info(), direct_db_access=False)
 194         domsid = security.dom_sid(DOM_SID)
 195         self.assertEqual(facl.as_sddl(domsid), acl)
 196
 197     def test_setntacl_getposixacl(self):
 198         acl = ACL
 199         setntacl(self.lp, self.tempf, acl, DOM_SID,
 200                  self.get_session_info(), use_ntvfs=False)
 201         facl = getntacl(self.lp, self.tempf, self.get_session_info())
 202         anysid = security.dom_sid(security.SID_NT_SELF)
 203         self.assertEqual(facl.as_sddl(anysid), acl)
 204         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS, self.get_session_info())
 205
 206     def test_setposixacl_getntacl(self):
 207         smbd.set_simple_acl(self.tempf, 0o750, self.get_session_info())
 208         # We don't expect the xattr to be filled in in this case
 209         with self.assertRaises(OSError) as cm:
 210             getntacl(self.lp, self.tempf, self.get_session_info())
 211
 212         self.assertEqual(cm.exception.errno, ENODATA)
 213
 214     def test_setposixacl_getntacl_smbd(self):
 215         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 216         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 217         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 218         smbd.set_simple_acl(self.tempf, 0o640, self.get_session_info())
 219         facl = getntacl(self.lp, self.tempf, self.get_session_info(), direct_db_access=False)
 220         acl = "O:%sG:%sD:(A;;0x1f019f;;;%s)(A;;FR;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 221         anysid = security.dom_sid(security.SID_NT_SELF)
 222         self.assertEqual(acl, facl.as_sddl(anysid))
 223
 224     def test_setposixacl_dir_getntacl_smbd(self):
 225         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 226         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempdir).st_uid)
 227         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 228         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 229         (BA_id, BA_type) = s4_passdb.sid_to_id(BA_sid)
 230         self.assertEqual(BA_type, idmap.ID_TYPE_BOTH)
 231         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 232         (SO_id, SO_type) = s4_passdb.sid_to_id(SO_sid)
 233         self.assertEqual(SO_type, idmap.ID_TYPE_BOTH)
 234         smbd.chown(self.tempdir, BA_id, SO_id, self.get_session_info())
 235         smbd.set_simple_acl(self.tempdir, 0o750, self.get_session_info())
 236         facl = getntacl(self.lp, self.tempdir, self.get_session_info(), direct_db_access=False)
 237         acl = "O:BAG:SOD:(A;;FA;;;BA)(A;;0x1200a9;;;SO)(A;;;;;WD)(A;OICIIO;FA;;;CO)(A;OICIIO;0x1200a9;;;CG)(A;OICIIO;0x1200a9;;;WD)"
 238
 239         anysid = security.dom_sid(security.SID_NT_SELF)
 240         self.assertEqual(acl, facl.as_sddl(anysid))
 241
 242     def test_setposixacl_group_getntacl_smbd(self):
 243         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 244         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 245         (BA_gid, BA_type) = s4_passdb.sid_to_id(BA_sid)
 246         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 247         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 248         self.assertEqual(BA_type, idmap.ID_TYPE_BOTH)
 249         smbd.set_simple_acl(self.tempf, 0o640, self.get_session_info(), BA_gid)
 250         facl = getntacl(self.lp, self.tempf, self.get_session_info(), direct_db_access=False)
 251         domsid = passdb.get_global_sam_sid()
 252         acl = "O:%sG:%sD:(A;;0x1f019f;;;%s)(A;;FR;;;BA)(A;;FR;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 253         anysid = security.dom_sid(security.SID_NT_SELF)
 254         self.assertEqual(acl, facl.as_sddl(anysid))
 255
 256     def test_setposixacl_getposixacl(self):
 257         smbd.set_simple_acl(self.tempf, 0o640, self.get_session_info())
 258         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS, self.get_session_info())
 259         self.assertEqual(posix_acl.count, 4, self.print_posix_acl(posix_acl))
 260
 261         self.assertEqual(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 262         self.assertEqual(posix_acl.acl[0].a_perm, 6)
 263
 264         self.assertEqual(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 265         self.assertEqual(posix_acl.acl[1].a_perm, 4)
 266
 267         self.assertEqual(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 268         self.assertEqual(posix_acl.acl[2].a_perm, 0)
 269
 270         self.assertEqual(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 271         self.assertEqual(posix_acl.acl[3].a_perm, 7)
 272
 273     def test_setposixacl_dir_getposixacl(self):
 274         smbd.set_simple_acl(self.tempdir, 0o750, self.get_session_info())
 275         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS, self.get_session_info())
 276         self.assertEqual(posix_acl.count, 4, self.print_posix_acl(posix_acl))
 277
 278         self.assertEqual(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 279         self.assertEqual(posix_acl.acl[0].a_perm, 7)
 280
 281         self.assertEqual(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 282         self.assertEqual(posix_acl.acl[1].a_perm, 5)
 283
 284         self.assertEqual(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 285         self.assertEqual(posix_acl.acl[2].a_perm, 0)
 286
 287         self.assertEqual(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 288         self.assertEqual(posix_acl.acl[3].a_perm, 7)
 289
 290     def test_setposixacl_group_getposixacl(self):
 291         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 292         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 293         (BA_gid, BA_type) = s4_passdb.sid_to_id(BA_sid)
 294         self.assertEqual(BA_type, idmap.ID_TYPE_BOTH)
 295         smbd.set_simple_acl(self.tempf, 0o670, self.get_session_info(), BA_gid)
 296         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS, self.get_session_info())
 297
 298         self.assertEqual(posix_acl.count, 5, self.print_posix_acl(posix_acl))
 299
 300         self.assertEqual(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 301         self.assertEqual(posix_acl.acl[0].a_perm, 6)
 302
 303         self.assertEqual(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 304         self.assertEqual(posix_acl.acl[1].a_perm, 7)
 305
 306         self.assertEqual(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 307         self.assertEqual(posix_acl.acl[2].a_perm, 0)
 308
 309         self.assertEqual(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_GROUP)
 310         self.assertEqual(posix_acl.acl[3].a_perm, 7)
 311         self.assertEqual(posix_acl.acl[3].info.gid, BA_gid)
 312
 313         self.assertEqual(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_MASK)
 314         self.assertEqual(posix_acl.acl[4].a_perm, 7)
 315
 316     def test_setntacl_sysvol_check_getposixacl(self):
 317         acl = provision.SYSVOL_ACL
 318         domsid = passdb.get_global_sam_sid()
 319         session_info = self.get_session_info(domsid)
 320         setntacl(self.lp, self.tempf, acl, str(domsid),
 321                  session_info, use_ntvfs=False)
 322         facl = getntacl(self.lp, self.tempf, session_info)
 323         self.assertEqual(facl.as_sddl(domsid), acl)
 324         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS, session_info)
 325
 326         nwrap_module_so_path = os.getenv('NSS_WRAPPER_MODULE_SO_PATH')
 327         nwrap_module_fn_prefix = os.getenv('NSS_WRAPPER_MODULE_FN_PREFIX')
 328
 329         nwrap_winbind_active = (nwrap_module_so_path != "" and
 330                                 nwrap_module_fn_prefix == "winbind")
 331         is_user_session = not session_info.security_token.is_system()
 332
 333         LA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_ADMINISTRATOR))
 334         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 335         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 336         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 337         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 338
 339         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 340
 341         # These assertions correct for current ad_dc selftest
 342         # configuration.  When other environments have a broad range of
 343         # groups mapped via passdb, we can relax some of these checks
 344         (LA_uid, LA_type) = s4_passdb.sid_to_id(LA_sid)
 345         self.assertEqual(LA_type, idmap.ID_TYPE_UID)
 346         (BA_gid, BA_type) = s4_passdb.sid_to_id(BA_sid)
 347         self.assertEqual(BA_type, idmap.ID_TYPE_BOTH)
 348         (SO_gid, SO_type) = s4_passdb.sid_to_id(SO_sid)
 349         self.assertEqual(SO_type, idmap.ID_TYPE_BOTH)
 350         (SY_gid, SY_type) = s4_passdb.sid_to_id(SY_sid)
 351         self.assertEqual(SO_type, idmap.ID_TYPE_BOTH)
 352         (AU_gid, AU_type) = s4_passdb.sid_to_id(AU_sid)
 353         self.assertEqual(AU_type, idmap.ID_TYPE_BOTH)
 354
 355         self.assertEqual(posix_acl.count, 13, self.print_posix_acl(posix_acl))
 356
 357         self.assertEqual(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 358         self.assertEqual(posix_acl.acl[0].a_perm, 7)
 359         self.assertEqual(posix_acl.acl[0].info.gid, BA_gid)
 360
 361         self.assertEqual(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 362         if nwrap_winbind_active or is_user_session:
 363             self.assertEqual(posix_acl.acl[1].a_perm, 7)
 364         else:
 365             self.assertEqual(posix_acl.acl[1].a_perm, 6)
 366         self.assertEqual(posix_acl.acl[1].info.uid, LA_uid)
 367
 368         self.assertEqual(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 369         self.assertEqual(posix_acl.acl[2].a_perm, 0)
 370
 371         self.assertEqual(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 372         if nwrap_winbind_active or is_user_session:
 373             self.assertEqual(posix_acl.acl[3].a_perm, 7)
 374         else:
 375             self.assertEqual(posix_acl.acl[3].a_perm, 6)
 376
 377         self.assertEqual(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 378         self.assertEqual(posix_acl.acl[4].a_perm, 7)
 379         self.assertEqual(posix_acl.acl[4].info.uid, BA_gid)
 380
 381         self.assertEqual(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 382         self.assertEqual(posix_acl.acl[5].a_perm, 7)
 383
 384         self.assertEqual(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 385         self.assertEqual(posix_acl.acl[6].a_perm, 5)
 386         self.assertEqual(posix_acl.acl[6].info.uid, SO_gid)
 387
 388         self.assertEqual(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 389         self.assertEqual(posix_acl.acl[7].a_perm, 5)
 390         self.assertEqual(posix_acl.acl[7].info.gid, SO_gid)
 391
 392         self.assertEqual(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 393         self.assertEqual(posix_acl.acl[8].a_perm, 7)
 394         self.assertEqual(posix_acl.acl[8].info.uid, SY_gid)
 395
 396         self.assertEqual(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 397         self.assertEqual(posix_acl.acl[9].a_perm, 7)
 398         self.assertEqual(posix_acl.acl[9].info.gid, SY_gid)
 399
 400         self.assertEqual(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 401         self.assertEqual(posix_acl.acl[10].a_perm, 5)
 402         self.assertEqual(posix_acl.acl[10].info.uid, AU_gid)
 403
 404         self.assertEqual(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 405         self.assertEqual(posix_acl.acl[11].a_perm, 5)
 406         self.assertEqual(posix_acl.acl[11].info.gid, AU_gid)
 407
 408         self.assertEqual(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_MASK)
 409         self.assertEqual(posix_acl.acl[12].a_perm, 7)
 410
 411         # check that it matches:
 412         # user::rwx
 413         # user:root:rwx (selftest user actually)
 414         # group::rwx
 415         # group:Local Admins:rwx
 416         # group:3000000:r-x
 417         # group:3000001:rwx
 418         # group:3000002:r-x
 419         # mask::rwx
 420         # other::---
 421
 422         # This is in this order in the NDR smb_acl(not re-orderded for display)
 423         # a_type: GROUP
 424         # a_perm: 7
 425         # uid: -1
 426         # gid: 10
 427         # a_type: USER
 428         # a_perm: 6
 429         # uid: 0 (selftest user actually)
 430         # gid: -1
 431         # a_type: OTHER
 432         # a_perm: 0
 433         # uid: -1
 434         # gid: -1
 435         # a_type: USER_OBJ
 436         # a_perm: 6
 437         # uid: -1
 438         # gid: -1
 439         # a_type: GROUP_OBJ
 440         # a_perm: 7
 441         # uid: -1
 442         # gid: -1
 443         # a_type: GROUP
 444         # a_perm: 5
 445         # uid: -1
 446         # gid: 3000020
 447         # a_type: GROUP
 448         # a_perm: 7
 449         # uid: -1
 450         # gid: 3000000
 451         # a_type: GROUP
 452         # a_perm: 5
 453         # uid: -1
 454         # gid: 3000001
 455         # a_type: MASK
 456         # a_perm: 7
 457         # uid: -1
 458         # gid: -1
 459
 460     def test_setntacl_sysvol_dir_check_getposixacl(self):
 461         acl = provision.SYSVOL_ACL
 462         domsid = passdb.get_global_sam_sid()
 463         session_info = self.get_session_info(domsid)
 464         setntacl(self.lp, self.tempdir, acl, str(domsid),
 465                  session_info, use_ntvfs=False)
 466         facl = getntacl(self.lp, self.tempdir, session_info)
 467         self.assertEqual(facl.as_sddl(domsid), acl)
 468         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS, session_info)
 469
 470         LA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_ADMINISTRATOR))
 471         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 472         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 473         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 474         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 475
 476         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 477
 478         # These assertions correct for current ad_dc selftest
 479         # configuration.  When other environments have a broad range of
 480         # groups mapped via passdb, we can relax some of these checks
 481         (LA_uid, LA_type) = s4_passdb.sid_to_id(LA_sid)
 482         self.assertEqual(LA_type, idmap.ID_TYPE_UID)
 483         (BA_gid, BA_type) = s4_passdb.sid_to_id(BA_sid)
 484         self.assertEqual(BA_type, idmap.ID_TYPE_BOTH)
 485         (SO_gid, SO_type) = s4_passdb.sid_to_id(SO_sid)
 486         self.assertEqual(SO_type, idmap.ID_TYPE_BOTH)
 487         (SY_gid, SY_type) = s4_passdb.sid_to_id(SY_sid)
 488         self.assertEqual(SO_type, idmap.ID_TYPE_BOTH)
 489         (AU_gid, AU_type) = s4_passdb.sid_to_id(AU_sid)
 490         self.assertEqual(AU_type, idmap.ID_TYPE_BOTH)
 491
 492         self.assertEqual(posix_acl.count, 13, self.print_posix_acl(posix_acl))
 493
 494         self.assertEqual(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 495         self.assertEqual(posix_acl.acl[0].a_perm, 7)
 496         self.assertEqual(posix_acl.acl[0].info.gid, BA_gid)
 497
 498         self.assertEqual(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 499         self.assertEqual(posix_acl.acl[1].a_perm, 7)
 500         self.assertEqual(posix_acl.acl[1].info.uid, LA_uid)
 501
 502         self.assertEqual(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 503         self.assertEqual(posix_acl.acl[2].a_perm, 0)
 504
 505         self.assertEqual(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 506         self.assertEqual(posix_acl.acl[3].a_perm, 7)
 507
 508         self.assertEqual(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 509         self.assertEqual(posix_acl.acl[4].a_perm, 7)
 510         self.assertEqual(posix_acl.acl[4].info.uid, BA_gid)
 511
 512         self.assertEqual(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 513         self.assertEqual(posix_acl.acl[5].a_perm, 7)
 514
 515         self.assertEqual(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 516         self.assertEqual(posix_acl.acl[6].a_perm, 5)
 517         self.assertEqual(posix_acl.acl[6].info.uid, SO_gid)
 518
 519         self.assertEqual(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 520         self.assertEqual(posix_acl.acl[7].a_perm, 5)
 521         self.assertEqual(posix_acl.acl[7].info.gid, SO_gid)
 522
 523         self.assertEqual(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 524         self.assertEqual(posix_acl.acl[8].a_perm, 7)
 525         self.assertEqual(posix_acl.acl[8].info.uid, SY_gid)
 526
 527         self.assertEqual(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 528         self.assertEqual(posix_acl.acl[9].a_perm, 7)
 529         self.assertEqual(posix_acl.acl[9].info.gid, SY_gid)
 530
 531         self.assertEqual(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 532         self.assertEqual(posix_acl.acl[10].a_perm, 5)
 533         self.assertEqual(posix_acl.acl[10].info.uid, AU_gid)
 534
 535         self.assertEqual(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 536         self.assertEqual(posix_acl.acl[11].a_perm, 5)
 537         self.assertEqual(posix_acl.acl[11].info.gid, AU_gid)
 538
 539         self.assertEqual(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_MASK)
 540         self.assertEqual(posix_acl.acl[12].a_perm, 7)
 541
 542         # check that it matches:
 543         # user::rwx
 544         # user:root:rwx (selftest user actually)
 545         # group::rwx
 546         # group:3000000:rwx
 547         # group:3000001:r-x
 548         # group:3000002:rwx
 549         # group:3000003:r-x
 550         # mask::rwx
 551         # other::---
 552
 553     def test_setntacl_policies_dir_check_getposixacl(self):
 554         acl = provision.POLICIES_ACL
 555         domsid = passdb.get_global_sam_sid()
 556         session_info = self.get_session_info(domsid)
 557         setntacl(self.lp, self.tempdir, acl, str(domsid),
 558                  session_info, use_ntvfs=False)
 559         facl = getntacl(self.lp, self.tempdir, session_info)
 560         self.assertEqual(facl.as_sddl(domsid), acl)
 561         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS, session_info)
 562
 563         LA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_ADMINISTRATOR))
 564         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 565         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 566         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 567         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 568         PA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_POLICY_ADMINS))
 569
 570         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 571
 572         # These assertions correct for current ad_dc selftest
 573         # configuration.  When other environments have a broad range of
 574         # groups mapped via passdb, we can relax some of these checks
 575         (LA_uid, LA_type) = s4_passdb.sid_to_id(LA_sid)
 576         self.assertEqual(LA_type, idmap.ID_TYPE_UID)
 577         (BA_gid, BA_type) = s4_passdb.sid_to_id(BA_sid)
 578         self.assertEqual(BA_type, idmap.ID_TYPE_BOTH)
 579         (SO_gid, SO_type) = s4_passdb.sid_to_id(SO_sid)
 580         self.assertEqual(SO_type, idmap.ID_TYPE_BOTH)
 581         (SY_gid, SY_type) = s4_passdb.sid_to_id(SY_sid)
 582         self.assertEqual(SO_type, idmap.ID_TYPE_BOTH)
 583         (AU_gid, AU_type) = s4_passdb.sid_to_id(AU_sid)
 584         self.assertEqual(AU_type, idmap.ID_TYPE_BOTH)
 585         (PA_gid, PA_type) = s4_passdb.sid_to_id(PA_sid)
 586         self.assertEqual(PA_type, idmap.ID_TYPE_BOTH)
 587
 588         self.assertEqual(posix_acl.count, 15, self.print_posix_acl(posix_acl))
 589
 590         self.assertEqual(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 591         self.assertEqual(posix_acl.acl[0].a_perm, 7)
 592         self.assertEqual(posix_acl.acl[0].info.gid, BA_gid)
 593
 594         self.assertEqual(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 595         self.assertEqual(posix_acl.acl[1].a_perm, 7)
 596         self.assertEqual(posix_acl.acl[1].info.uid, LA_uid)
 597
 598         self.assertEqual(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 599         self.assertEqual(posix_acl.acl[2].a_perm, 0)
 600
 601         self.assertEqual(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 602         self.assertEqual(posix_acl.acl[3].a_perm, 7)
 603
 604         self.assertEqual(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 605         self.assertEqual(posix_acl.acl[4].a_perm, 7)
 606         self.assertEqual(posix_acl.acl[4].info.uid, BA_gid)
 607
 608         self.assertEqual(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 609         self.assertEqual(posix_acl.acl[5].a_perm, 7)
 610
 611         self.assertEqual(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 612         self.assertEqual(posix_acl.acl[6].a_perm, 5)
 613         self.assertEqual(posix_acl.acl[6].info.uid, SO_gid)
 614
 615         self.assertEqual(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 616         self.assertEqual(posix_acl.acl[7].a_perm, 5)
 617         self.assertEqual(posix_acl.acl[7].info.gid, SO_gid)
 618
 619         self.assertEqual(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 620         self.assertEqual(posix_acl.acl[8].a_perm, 7)
 621         self.assertEqual(posix_acl.acl[8].info.uid, SY_gid)
 622
 623         self.assertEqual(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 624         self.assertEqual(posix_acl.acl[9].a_perm, 7)
 625         self.assertEqual(posix_acl.acl[9].info.gid, SY_gid)
 626
 627         self.assertEqual(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 628         self.assertEqual(posix_acl.acl[10].a_perm, 5)
 629         self.assertEqual(posix_acl.acl[10].info.uid, AU_gid)
 630
 631         self.assertEqual(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 632         self.assertEqual(posix_acl.acl[11].a_perm, 5)
 633         self.assertEqual(posix_acl.acl[11].info.gid, AU_gid)
 634
 635         self.assertEqual(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_USER)
 636         self.assertEqual(posix_acl.acl[12].a_perm, 7)
 637         self.assertEqual(posix_acl.acl[12].info.uid, PA_gid)
 638
 639         self.assertEqual(posix_acl.acl[13].a_type, smb_acl.SMB_ACL_GROUP)
 640         self.assertEqual(posix_acl.acl[13].a_perm, 7)
 641         self.assertEqual(posix_acl.acl[13].info.gid, PA_gid)
 642
 643         self.assertEqual(posix_acl.acl[14].a_type, smb_acl.SMB_ACL_MASK)
 644         self.assertEqual(posix_acl.acl[14].a_perm, 7)
 645
 646         # check that it matches:
 647         # user::rwx
 648         # user:root:rwx  (selftest user actually)
 649         # group::rwx
 650         # group:3000000:rwx
 651         # group:3000001:r-x
 652         # group:3000002:rwx
 653         # group:3000003:r-x
 654         # group:3000004:rwx
 655         # mask::rwx
 656         # other::---
 657
 658     def test_setntacl_policies_check_getposixacl(self):
 659         acl = provision.POLICIES_ACL
 660
 661         domsid = passdb.get_global_sam_sid()
 662         session_info = self.get_session_info(domsid)
 663         setntacl(self.lp, self.tempf, acl, str(domsid),
 664                  session_info, use_ntvfs=False)
 665         facl = getntacl(self.lp, self.tempf, session_info)
 666         self.assertEqual(facl.as_sddl(domsid), acl)
 667         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS, session_info)
 668
 669         nwrap_module_so_path = os.getenv('NSS_WRAPPER_MODULE_SO_PATH')
 670         nwrap_module_fn_prefix = os.getenv('NSS_WRAPPER_MODULE_FN_PREFIX')
 671
 672         nwrap_winbind_active = (nwrap_module_so_path != "" and
 673                                 nwrap_module_fn_prefix == "winbind")
 674         is_user_session = not session_info.security_token.is_system()
 675
 676         LA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_ADMINISTRATOR))
 677         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 678         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 679         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 680         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 681         PA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_POLICY_ADMINS))
 682
 683         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 684
 685         # These assertions correct for current ad_dc selftest
 686         # configuration.  When other environments have a broad range of
 687         # groups mapped via passdb, we can relax some of these checks
 688         (LA_uid, LA_type) = s4_passdb.sid_to_id(LA_sid)
 689         self.assertEqual(LA_type, idmap.ID_TYPE_UID)
 690         (BA_gid, BA_type) = s4_passdb.sid_to_id(BA_sid)
 691         self.assertEqual(BA_type, idmap.ID_TYPE_BOTH)
 692         (SO_gid, SO_type) = s4_passdb.sid_to_id(SO_sid)
 693         self.assertEqual(SO_type, idmap.ID_TYPE_BOTH)
 694         (SY_gid, SY_type) = s4_passdb.sid_to_id(SY_sid)
 695         self.assertEqual(SO_type, idmap.ID_TYPE_BOTH)
 696         (AU_gid, AU_type) = s4_passdb.sid_to_id(AU_sid)
 697         self.assertEqual(AU_type, idmap.ID_TYPE_BOTH)
 698         (PA_gid, PA_type) = s4_passdb.sid_to_id(PA_sid)
 699         self.assertEqual(PA_type, idmap.ID_TYPE_BOTH)
 700
 701         self.assertEqual(posix_acl.count, 15, self.print_posix_acl(posix_acl))
 702
 703         self.assertEqual(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 704         self.assertEqual(posix_acl.acl[0].a_perm, 7)
 705         self.assertEqual(posix_acl.acl[0].info.gid, BA_gid)
 706
 707         self.assertEqual(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 708         if nwrap_winbind_active or is_user_session:
 709             self.assertEqual(posix_acl.acl[1].a_perm, 7)
 710         else:
 711             self.assertEqual(posix_acl.acl[1].a_perm, 6)
 712         self.assertEqual(posix_acl.acl[1].info.uid, LA_uid)
 713
 714         self.assertEqual(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 715         self.assertEqual(posix_acl.acl[2].a_perm, 0)
 716
 717         self.assertEqual(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 718         if nwrap_winbind_active or is_user_session:
 719             self.assertEqual(posix_acl.acl[3].a_perm, 7)
 720         else:
 721             self.assertEqual(posix_acl.acl[3].a_perm, 6)
 722
 723         self.assertEqual(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 724         self.assertEqual(posix_acl.acl[4].a_perm, 7)
 725         self.assertEqual(posix_acl.acl[4].info.uid, BA_gid)
 726
 727         self.assertEqual(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 728         self.assertEqual(posix_acl.acl[5].a_perm, 7)
 729
 730         self.assertEqual(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 731         self.assertEqual(posix_acl.acl[6].a_perm, 5)
 732         self.assertEqual(posix_acl.acl[6].info.uid, SO_gid)
 733
 734         self.assertEqual(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 735         self.assertEqual(posix_acl.acl[7].a_perm, 5)
 736         self.assertEqual(posix_acl.acl[7].info.gid, SO_gid)
 737
 738         self.assertEqual(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 739         self.assertEqual(posix_acl.acl[8].a_perm, 7)
 740         self.assertEqual(posix_acl.acl[8].info.uid, SY_gid)
 741
 742         self.assertEqual(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 743         self.assertEqual(posix_acl.acl[9].a_perm, 7)
 744         self.assertEqual(posix_acl.acl[9].info.gid, SY_gid)
 745
 746         self.assertEqual(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 747         self.assertEqual(posix_acl.acl[10].a_perm, 5)
 748         self.assertEqual(posix_acl.acl[10].info.uid, AU_gid)
 749
 750         self.assertEqual(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 751         self.assertEqual(posix_acl.acl[11].a_perm, 5)
 752         self.assertEqual(posix_acl.acl[11].info.gid, AU_gid)
 753
 754         self.assertEqual(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_USER)
 755         self.assertEqual(posix_acl.acl[12].a_perm, 7)
 756         self.assertEqual(posix_acl.acl[12].info.uid, PA_gid)
 757
 758         self.assertEqual(posix_acl.acl[13].a_type, smb_acl.SMB_ACL_GROUP)
 759         self.assertEqual(posix_acl.acl[13].a_perm, 7)
 760         self.assertEqual(posix_acl.acl[13].info.gid, PA_gid)
 761
 762         self.assertEqual(posix_acl.acl[14].a_type, smb_acl.SMB_ACL_MASK)
 763         self.assertEqual(posix_acl.acl[14].a_perm, 7)
 764
 765         # check that it matches:
 766         # user::rwx
 767         # user:root:rwx (selftest user actually)
 768         # group::rwx
 769         # group:Local Admins:rwx
 770         # group:3000000:r-x
 771         # group:3000001:rwx
 772         # group:3000002:r-x
 773         # group:3000003:rwx
 774         # mask::rwx
 775         # other::---
 776
 777         # This is in this order in the NDR smb_acl(not re-orderded for display)
 778         # a_type: GROUP
 779         # a_perm: 7
 780         # uid: -1
 781         # gid: 10
 782         # a_type: USER
 783         # a_perm: 6
 784         # uid: 0 (selftest user actually)
 785         # gid: -1
 786         # a_type: OTHER
 787         # a_perm: 0
 788         # uid: -1
 789         # gid: -1
 790         # a_type: USER_OBJ
 791         # a_perm: 6
 792         # uid: -1
 793         # gid: -1
 794         # a_type: GROUP_OBJ
 795         # a_perm: 7
 796         # uid: -1
 797         # gid: -1
 798         # a_type: GROUP
 799         # a_perm: 5
 800         # uid: -1
 801         # gid: 3000020
 802         # a_type: GROUP
 803         # a_perm: 7
 804         # uid: -1
 805         # gid: 3000000
 806         # a_type: GROUP
 807         # a_perm: 5
 808         # uid: -1
 809         # gid: 3000001
 810         # a_type: GROUP
 811         # a_perm: 7
 812         # uid: -1
 813         # gid: 3000003
 814         # a_type: MASK
 815         # a_perm: 7
 816         # uid: -1
 817         # gid: -1
 818
 819
 820 class SessionedPosixAclMappingTests(PosixAclMappingTests):
 821     """
 822     Run same test suite with session enabled.
 823     """
 824
 825     def get_session_info(self, domsid=DOM_SID):
 826         """
 827         Get session_info for setntacl.
 828         """
 829         if str(domsid) != str(self.samdb.get_domain_sid()):
 830             # fake it with admin session as domsid is not in local db
 831             admin_session = auth.admin_session(self.lp, str(domsid))
 832             auth.session_info_fill_unix(admin_session,
 833                                         lp_ctx=self.lp,
 834                                         user_name="Administrator")
 835             return admin_session
 836
 837         dn = '<SID={0}-{1}>'.format(domsid, security.DOMAIN_RID_ADMINISTRATOR)
 838         flags = (auth.AUTH_SESSION_INFO_DEFAULT_GROUPS |
 839                  auth.AUTH_SESSION_INFO_AUTHENTICATED |
 840                  auth.AUTH_SESSION_INFO_SIMPLE_PRIVILEGES)
 841         user_session = auth.user_session(self.samdb,
 842                                          lp_ctx=self.lp,
 843                                          dn=dn,
 844                                          session_info_flags=flags)
 845         auth.session_info_fill_unix(user_session,
 846                                     lp_ctx=self.lp,
 847                                     user_name="Administrator")
 848         return user_session
 849
 850
 851 class UnixSessionedPosixAclMappingTests(PosixAclMappingTests):
 852     """
 853     Run same test suite with session enabled.
 854     """
 855
 856     def get_session_info(self, domsid=DOM_SID):
 857         """
 858         Get session_info for setntacl.
 859         """
 860         if str(domsid) != str(self.samdb.get_domain_sid()):
 861             # fake it with admin session as domsid is not in local db
 862             admin_session = auth.admin_session(self.lp, str(domsid))
 863             auth.session_info_fill_unix(admin_session,
 864                                         lp_ctx=self.lp,
 865                                         user_name="Administrator")
 866             return admin_session
 867
 868         dn = '<SID={0}-{1}>'.format(domsid, security.DOMAIN_RID_ADMINISTRATOR)
 869         flags = (auth.AUTH_SESSION_INFO_DEFAULT_GROUPS |
 870                  auth.AUTH_SESSION_INFO_AUTHENTICATED |
 871                  auth.AUTH_SESSION_INFO_SIMPLE_PRIVILEGES)
 872
 873         session = auth.user_session(self.samdb, lp_ctx=self.lp, dn=dn,
 874                                     session_info_flags=flags)
 875         auth.session_info_fill_unix(session,
 876                                     lp_ctx=self.lp,
 877                                     user_name="Administrator")
 878         return session