source4/scripting/python/samba/tests/posixacl.py

   1 # Unix SMB/CIFS implementation. Tests for NT and posix ACL manipulation
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
   3 # Copyright (C) Andrew Bartlett 2012
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 """Tests for the Samba3 NT -> posix ACL layer"""
  20
  21 from samba.ntacls import setntacl, getntacl, checkset_backend
  22 from samba.dcerpc import xattr, security, smb_acl, idmap
  23 from samba.param import LoadParm
  24 from samba.tests import TestCaseInTempDir
  25 from samba import provision
  26 import random
  27 import os
  28 from samba.samba3 import smbd, passdb
  29 from samba.samba3 import param as s3param
  30
  31 # To print a posix ACL use:
  32 #        for entry in posix_acl.acl:
  33 #            print "a_type: %d" % entry.a_type
  34 #            print "a_perm: %o" % entry.a_perm
  35 #            print "uid: %d" % entry.uid
  36 #            print "gid: %d" % entry.gid
  37
  38 class PosixAclMappingTests(TestCaseInTempDir):
  39
  40     def test_setntacl(self):
  41         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  42         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  43
  44     def test_setntacl_smbd_getntacl(self):
  45         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  46         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  47         facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  48         anysid = security.dom_sid(security.SID_NT_SELF)
  49         self.assertEquals(facl.as_sddl(anysid),acl)
  50
  51     def test_setntacl_smbd_setposixacl_getntacl(self):
  52         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  53         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  54
  55         # This will invalidate the ACL, as we have a hook!
  56         smbd.set_simple_acl(self.tempf, 0640)
  57
  58         # However, this only asks the xattr
  59         try:
  60             facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  61             self.assertTrue(False)
  62         except TypeError:
  63             pass
  64
  65     def test_setntacl_invalidate_getntacl(self):
  66         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  67         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  68
  69         # This should invalidate the ACL, as we include the posix ACL in the hash
  70         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
  71         backend_obj.wrap_setxattr(dbname,
  72                                   self.tempf, "system.fake_access_acl", "")
  73
  74         #however, as this is direct DB access, we do not notice it
  75         facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  76         anysid = security.dom_sid(security.SID_NT_SELF)
  77         self.assertEquals(acl, facl.as_sddl(anysid))
  78
  79     def test_setntacl_invalidate_getntacl_smbd(self):
  80         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  81         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  82
  83         # This should invalidate the ACL, as we include the posix ACL in the hash
  84         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
  85         backend_obj.wrap_setxattr(dbname,
  86                                   self.tempf, "system.fake_access_acl", "")
  87
  88         #the hash would break, and we return an ACL based only on the mode, except we set the ACL using the 'ntvfs' mode that doesn't include a hash
  89         facl = getntacl(self.lp, self.tempf)
  90         anysid = security.dom_sid(security.SID_NT_SELF)
  91         self.assertEquals(acl, facl.as_sddl(anysid))
  92
  93     def test_setntacl_smbd_invalidate_getntacl_smbd(self):
  94         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  95         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x001200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
  96         os.chmod(self.tempf, 0750)
  97         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  98
  99         # This should invalidate the ACL, as we include the posix ACL in the hash
 100         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
 101         backend_obj.wrap_setxattr(dbname,
 102                                   self.tempf, "system.fake_access_acl", "")
 103
 104         #the hash will break, and we return an ACL based only on the mode
 105         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 106         anysid = security.dom_sid(security.SID_NT_SELF)
 107         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 108
 109     def test_setntacl_getntacl_smbd(self):
 110         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 111         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
 112         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 113         anysid = security.dom_sid(security.SID_NT_SELF)
 114         self.assertEquals(facl.as_sddl(anysid),acl)
 115
 116     def test_setntacl_smbd_getntacl_smbd(self):
 117         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 118         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 119         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 120         anysid = security.dom_sid(security.SID_NT_SELF)
 121         self.assertEquals(facl.as_sddl(anysid),acl)
 122
 123     def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
 124         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 125         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 126         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 127         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 128         smbd.set_simple_acl(self.tempf, 0640)
 129         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 130         anysid = security.dom_sid(security.SID_NT_SELF)
 131         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 132
 133     def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
 134         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 135         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 136         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;BA)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 137         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 138         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 139         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 140         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 141         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 142
 143         # This should re-calculate an ACL based on the posix details
 144         facl = getntacl(self.lp,self.tempf, direct_db_access=False)
 145         anysid = security.dom_sid(security.SID_NT_SELF)
 146         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 147
 148     def test_setntacl_smbd_getntacl_smbd_gpo(self):
 149         acl = "O:DAG:DUD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 150         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 151         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 152         domsid = security.dom_sid("S-1-5-21-2212615479-2695158682-2101375467")
 153         self.assertEquals(facl.as_sddl(domsid),acl)
 154
 155     def test_setntacl_getposixacl(self):
 156         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 157         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 158         facl = getntacl(self.lp, self.tempf)
 159         anysid = security.dom_sid(security.SID_NT_SELF)
 160         self.assertEquals(facl.as_sddl(anysid),acl)
 161         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 162
 163     def test_setposixacl_getposixacl(self):
 164         smbd.set_simple_acl(self.tempf, 0640)
 165         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 166         self.assertEquals(posix_acl.count, 4)
 167
 168         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 169         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 170
 171         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 172         self.assertEquals(posix_acl.acl[1].a_perm, 4)
 173
 174         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 175         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 176
 177         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 178         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 179
 180     def test_setposixacl_getntacl(self):
 181         acl = ""
 182         smbd.set_simple_acl(self.tempf, 0750)
 183         try:
 184             facl = getntacl(self.lp, self.tempf)
 185             self.assertTrue(False)
 186         except TypeError:
 187             # We don't expect the xattr to be filled in in this case
 188             pass
 189
 190     def test_setposixacl_getntacl_smbd(self):
 191         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 192         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 193         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 194         smbd.set_simple_acl(self.tempf, 0640)
 195         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 196         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 197         anysid = security.dom_sid(security.SID_NT_SELF)
 198         self.assertEquals(acl, facl.as_sddl(anysid))
 199
 200     def test_setposixacl_dir_getntacl_smbd(self):
 201         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 202         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempdir).st_uid)
 203         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 204         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 205         (BA_id,BA_type) = s4_passdb.sid_to_id(BA_sid)
 206         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 207         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 208         (SO_id,SO_type) = s4_passdb.sid_to_id(SO_sid)
 209         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 210         smbd.chown(self.tempdir, BA_id, SO_id)
 211         smbd.set_simple_acl(self.tempdir, 0750)
 212         facl = getntacl(self.lp, self.tempdir, direct_db_access=False)
 213         acl = "O:BAG:SOD:(A;;0x001f01ff;;;BA)(A;;0x001200a9;;;SO)(A;;;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001f01ff;;;CG)(A;OICIIO;0x001f01ff;;;WD)"
 214
 215         anysid = security.dom_sid(security.SID_NT_SELF)
 216         self.assertEquals(acl, facl.as_sddl(anysid))
 217
 218     def test_setposixacl_group_getntacl_smbd(self):
 219         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 220         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 221         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 222         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 223         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 224         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 225         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 226         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 227         domsid = passdb.get_global_sam_sid()
 228         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 229         anysid = security.dom_sid(security.SID_NT_SELF)
 230         self.assertEquals(acl, facl.as_sddl(anysid))
 231
 232     def test_setposixacl_getposixacl(self):
 233         smbd.set_simple_acl(self.tempf, 0640)
 234         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 235         self.assertEquals(posix_acl.count, 4)
 236
 237         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 238         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 239
 240         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 241         self.assertEquals(posix_acl.acl[1].a_perm, 4)
 242
 243         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 244         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 245
 246         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 247         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 248
 249     def test_setposixacl_dir_getposixacl(self):
 250         smbd.set_simple_acl(self.tempdir, 0750)
 251         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 252         self.assertEquals(posix_acl.count, 4)
 253
 254         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 255         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 256
 257         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 258         self.assertEquals(posix_acl.acl[1].a_perm, 5)
 259
 260         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 261         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 262
 263         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 264         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 265
 266     def test_setposixacl_group_getposixacl(self):
 267         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 268         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 269         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 270         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 271         smbd.set_simple_acl(self.tempf, 0670, BA_gid)
 272         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 273
 274         self.assertEquals(posix_acl.count, 5)
 275
 276         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 277         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 278
 279         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 280         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 281
 282         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 283         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 284
 285         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_GROUP)
 286         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 287         self.assertEquals(posix_acl.acl[3].info.gid, BA_gid)
 288
 289         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_MASK)
 290         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 291
 292     def test_setntacl_sysvol_check_getposixacl(self):
 293         acl = provision.SYSVOL_ACL
 294         domsid = passdb.get_global_sam_sid()
 295         setntacl(self.lp, self.tempf,acl,str(domsid), use_ntvfs=False)
 296         facl = getntacl(self.lp, self.tempf)
 297         self.assertEquals(facl.as_sddl(domsid),acl)
 298         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 299
 300         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 301         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 302         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 303         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 304         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 305
 306         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 307
 308         # These assertions correct for current plugin_s4_dc selftest
 309         # configuration.  When other environments have a broad range of
 310         # groups mapped via passdb, we can relax some of these checks
 311         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 312         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 313         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 314         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 315         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 316         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 317         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 318         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 319         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 320         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 321
 322         self.assertEquals(posix_acl.count, 9)
 323
 324         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 325         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 326         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 327
 328         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 329         self.assertEquals(posix_acl.acl[1].a_perm, 6)
 330         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 331
 332         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 333         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 334
 335         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 336         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 337
 338         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 339         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 340
 341         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 342         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 343         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 344
 345         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 346         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 347         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 348
 349         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 350         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 351         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 352
 353         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_MASK)
 354         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 355
 356
 357 # check that it matches:
 358 # user::rwx
 359 # user:root:rwx (selftest user actually)
 360 # group::rwx
 361 # group:Local Admins:rwx
 362 # group:3000000:r-x
 363 # group:3000001:rwx
 364 # group:3000002:r-x
 365 # mask::rwx
 366 # other::---
 367
 368 #
 369 # This is in this order in the NDR smb_acl (not re-orderded for display)
 370 # a_type: GROUP
 371 # a_perm: 7
 372 # uid: -1
 373 # gid: 10
 374 # a_type: USER
 375 # a_perm: 6
 376 # uid: 0 (selftest user actually)
 377 # gid: -1
 378 # a_type: OTHER
 379 # a_perm: 0
 380 # uid: -1
 381 # gid: -1
 382 # a_type: USER_OBJ
 383 # a_perm: 6
 384 # uid: -1
 385 # gid: -1
 386 # a_type: GROUP_OBJ
 387 # a_perm: 7
 388 # uid: -1
 389 # gid: -1
 390 # a_type: GROUP
 391 # a_perm: 5
 392 # uid: -1
 393 # gid: 3000020
 394 # a_type: GROUP
 395 # a_perm: 7
 396 # uid: -1
 397 # gid: 3000000
 398 # a_type: GROUP
 399 # a_perm: 5
 400 # uid: -1
 401 # gid: 3000001
 402 # a_type: MASK
 403 # a_perm: 7
 404 # uid: -1
 405 # gid: -1
 406
 407 #
 408
 409
 410     def test_setntacl_sysvol_dir_check_getposixacl(self):
 411         acl = provision.SYSVOL_ACL
 412         domsid = passdb.get_global_sam_sid()
 413         setntacl(self.lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
 414         facl = getntacl(self.lp, self.tempdir)
 415         self.assertEquals(facl.as_sddl(domsid),acl)
 416         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 417
 418         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 419         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 420         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 421         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 422         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 423
 424         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 425
 426         # These assertions correct for current plugin_s4_dc selftest
 427         # configuration.  When other environments have a broad range of
 428         # groups mapped via passdb, we can relax some of these checks
 429         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 430         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 431         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 432         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 433         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 434         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 435         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 436         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 437         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 438         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 439
 440         self.assertEquals(posix_acl.count, 9)
 441
 442         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 443         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 444         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 445
 446         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 447         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 448         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 449
 450         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 451         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 452
 453         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 454         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 455
 456         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 457         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 458
 459         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 460         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 461         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 462
 463         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 464         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 465         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 466
 467         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 468         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 469         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 470
 471         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_MASK)
 472         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 473
 474
 475 # check that it matches:
 476 # user::rwx
 477 # user:root:rwx (selftest user actually)
 478 # group::rwx
 479 # group:3000000:rwx
 480 # group:3000001:r-x
 481 # group:3000002:rwx
 482 # group:3000003:r-x
 483 # mask::rwx
 484 # other::---
 485
 486
 487     def test_setntacl_policies_dir_check_getposixacl(self):
 488         acl = provision.POLICIES_ACL
 489         domsid = passdb.get_global_sam_sid()
 490         setntacl(self.lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
 491         facl = getntacl(self.lp, self.tempdir)
 492         self.assertEquals(facl.as_sddl(domsid),acl)
 493         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 494
 495         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 496         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 497         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 498         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 499         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 500         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 501
 502         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 503
 504         # These assertions correct for current plugin_s4_dc selftest
 505         # configuration.  When other environments have a broad range of
 506         # groups mapped via passdb, we can relax some of these checks
 507         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 508         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 509         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 510         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 511         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 512         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 513         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 514         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 515         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 516         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 517         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 518         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 519
 520         self.assertEquals(posix_acl.count, 10)
 521
 522         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 523         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 524         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 525
 526         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 527         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 528         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 529
 530         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 531         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 532
 533         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 534         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 535
 536         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 537         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 538
 539         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 540         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 541         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 542
 543         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 544         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 545         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 546
 547         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 548         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 549         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 550
 551         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_GROUP)
 552         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 553         self.assertEquals(posix_acl.acl[8].info.gid, PA_gid)
 554
 555         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_MASK)
 556         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 557
 558
 559 # check that it matches:
 560 # user::rwx
 561 # user:root:rwx  (selftest user actually)
 562 # group::rwx
 563 # group:3000000:rwx
 564 # group:3000001:r-x
 565 # group:3000002:rwx
 566 # group:3000003:r-x
 567 # group:3000004:rwx
 568 # mask::rwx
 569 # other::---
 570
 571
 572
 573     def test_setntacl_policies_check_getposixacl(self):
 574         acl = provision.POLICIES_ACL
 575
 576         domsid = passdb.get_global_sam_sid()
 577         setntacl(self.lp, self.tempf, acl, str(domsid), use_ntvfs=False)
 578         facl = getntacl(self.lp, self.tempf)
 579         self.assertEquals(facl.as_sddl(domsid),acl)
 580         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 581
 582         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 583         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 584         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 585         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 586         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 587         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 588
 589         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 590
 591         # These assertions correct for current plugin_s4_dc selftest
 592         # configuration.  When other environments have a broad range of
 593         # groups mapped via passdb, we can relax some of these checks
 594         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 595         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 596         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 597         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 598         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 599         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 600         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 601         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 602         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 603         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 604         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 605         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 606
 607         self.assertEquals(posix_acl.count, 10)
 608
 609         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 610         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 611         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 612
 613         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 614         self.assertEquals(posix_acl.acl[1].a_perm, 6)
 615         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 616
 617         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 618         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 619
 620         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 621         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 622
 623         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 624         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 625
 626         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 627         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 628         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 629
 630         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 631         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 632         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 633
 634         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 635         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 636         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 637
 638         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_GROUP)
 639         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 640         self.assertEquals(posix_acl.acl[8].info.gid, PA_gid)
 641
 642         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_MASK)
 643         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 644
 645
 646 # check that it matches:
 647 # user::rwx
 648 # user:root:rwx (selftest user actually)
 649 # group::rwx
 650 # group:Local Admins:rwx
 651 # group:3000000:r-x
 652 # group:3000001:rwx
 653 # group:3000002:r-x
 654 # group:3000003:rwx
 655 # mask::rwx
 656 # other::---
 657
 658 #
 659 # This is in this order in the NDR smb_acl (not re-orderded for display)
 660 # a_type: GROUP
 661 # a_perm: 7
 662 # uid: -1
 663 # gid: 10
 664 # a_type: USER
 665 # a_perm: 6
 666 # uid: 0 (selftest user actually)
 667 # gid: -1
 668 # a_type: OTHER
 669 # a_perm: 0
 670 # uid: -1
 671 # gid: -1
 672 # a_type: USER_OBJ
 673 # a_perm: 6
 674 # uid: -1
 675 # gid: -1
 676 # a_type: GROUP_OBJ
 677 # a_perm: 7
 678 # uid: -1
 679 # gid: -1
 680 # a_type: GROUP
 681 # a_perm: 5
 682 # uid: -1
 683 # gid: 3000020
 684 # a_type: GROUP
 685 # a_perm: 7
 686 # uid: -1
 687 # gid: 3000000
 688 # a_type: GROUP
 689 # a_perm: 5
 690 # uid: -1
 691 # gid: 3000001
 692 # a_type: GROUP
 693 # a_perm: 7
 694 # uid: -1
 695 # gid: 3000003
 696 # a_type: MASK
 697 # a_perm: 7
 698 # uid: -1
 699 # gid: -1
 700
 701 #
 702
 703     def setUp(self):
 704         super(PosixAclMappingTests, self).setUp()
 705         s3conf = s3param.get_context()
 706         s3conf.load(self.get_loadparm().configfile)
 707         s3conf.set("xattr_tdb:file", os.path.join(self.tempdir,"xattr.tdb"))
 708         self.lp = s3conf
 709         self.tempf = os.path.join(self.tempdir, "test")
 710         open(self.tempf, 'w').write("empty")
 711
 712     def tearDown(self):
 713         smbd.unlink(self.tempf)
 714         os.unlink(os.path.join(self.tempdir,"xattr.tdb"))
 715         super(PosixAclMappingTests, self).tearDown()