source4/scripting/python/samba/tests/posixacl.py

   1 # Unix SMB/CIFS implementation. Tests for NT and posix ACL manipulation
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
   3 # Copyright (C) Andrew Bartlett 2012
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 """Tests for the Samba3 NT -> posix ACL layer"""
  20
  21 from samba.ntacls import setntacl, getntacl, checkset_backend
  22 from samba.dcerpc import xattr, security, smb_acl, idmap
  23 from samba.param import LoadParm
  24 from samba.tests import TestCaseInTempDir
  25 from samba import provision
  26 import random
  27 import os
  28 from samba.samba3 import smbd, passdb
  29 from samba.samba3 import param as s3param
  30
  31 # To print a posix ACL use:
  32 #        for entry in posix_acl.acl:
  33 #            print "a_type: %d" % entry.a_type
  34 #            print "a_perm: %o" % entry.a_perm
  35 #            print "uid: %d" % entry.uid
  36 #            print "gid: %d" % entry.gid
  37
  38 class PosixAclMappingTests(TestCaseInTempDir):
  39
  40     def test_setntacl(self):
  41         lp = LoadParm()
  42         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  43         setntacl(lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  44
  45     def test_setntacl_smbd_getntacl(self):
  46         lp = LoadParm()
  47         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  48         setntacl(lp,self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  49         facl = getntacl(lp,self.tempf, direct_db_access=True)
  50         anysid = security.dom_sid(security.SID_NT_SELF)
  51         self.assertEquals(facl.as_sddl(anysid),acl)
  52
  53     def test_setntacl_smbd_setposixacl_getntacl(self):
  54         lp = LoadParm()
  55         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  56         setntacl(lp,self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  57
  58         # This will invalidate the ACL, as we have a hook!
  59         smbd.set_simple_acl(self.tempf, 0640)
  60
  61         # However, this only asks the xattr
  62         try:
  63             facl = getntacl(lp, self.tempf, direct_db_access=True)
  64             self.assertTrue(False)
  65         except TypeError:
  66             pass
  67
  68     def test_setntacl_invalidate_getntacl(self):
  69         lp = LoadParm()
  70         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  71         setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  72
  73         # This should invalidate the ACL, as we include the posix ACL in the hash
  74         (backend_obj, dbname) = checkset_backend(lp, None, None)
  75         backend_obj.wrap_setxattr(dbname,
  76                                   self.tempf, "system.fake_access_acl", "")
  77
  78         #however, as this is direct DB access, we do not notice it
  79         facl = getntacl(lp, self.tempf, direct_db_access=True)
  80         anysid = security.dom_sid(security.SID_NT_SELF)
  81         self.assertEquals(acl, facl.as_sddl(anysid))
  82
  83     def test_setntacl_invalidate_getntacl_smbd(self):
  84         lp = LoadParm()
  85         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  86         setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  87
  88         # This should invalidate the ACL, as we include the posix ACL in the hash
  89         (backend_obj, dbname) = checkset_backend(lp, None, None)
  90         backend_obj.wrap_setxattr(dbname,
  91                                   self.tempf, "system.fake_access_acl", "")
  92
  93         #the hash would break, and we return an ACL based only on the mode, except we set the ACL using the 'ntvfs' mode that doesn't include a hash
  94         facl = getntacl(lp, self.tempf)
  95         anysid = security.dom_sid(security.SID_NT_SELF)
  96         self.assertEquals(acl, facl.as_sddl(anysid))
  97
  98     def test_setntacl_smbd_invalidate_getntacl_smbd(self):
  99         lp = LoadParm()
 100         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 101         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x001200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
 102         os.chmod(self.tempf, 0750)
 103         setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 104
 105         # This should invalidate the ACL, as we include the posix ACL in the hash
 106         (backend_obj, dbname) = checkset_backend(lp, None, None)
 107         backend_obj.wrap_setxattr(dbname,
 108                                   self.tempf, "system.fake_access_acl", "")
 109
 110         #the hash will break, and we return an ACL based only on the mode
 111         facl = getntacl(lp, self.tempf, direct_db_access=False)
 112         anysid = security.dom_sid(security.SID_NT_SELF)
 113         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 114
 115     def test_setntacl_getntacl_smbd(self):
 116         lp = LoadParm()
 117         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 118         setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
 119         facl = getntacl(lp, self.tempf, direct_db_access=False)
 120         anysid = security.dom_sid(security.SID_NT_SELF)
 121         self.assertEquals(facl.as_sddl(anysid),acl)
 122
 123     def test_setntacl_smbd_getntacl_smbd(self):
 124         lp = LoadParm()
 125         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 126         setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 127         facl = getntacl(lp, self.tempf, direct_db_access=False)
 128         anysid = security.dom_sid(security.SID_NT_SELF)
 129         self.assertEquals(facl.as_sddl(anysid),acl)
 130
 131     def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
 132         lp = LoadParm()
 133         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 134         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
 135         setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 136         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 137         smbd.set_simple_acl(self.tempf, 0640)
 138         facl = getntacl(lp, self.tempf, direct_db_access=False)
 139         anysid = security.dom_sid(security.SID_NT_SELF)
 140         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 141
 142     def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
 143         lp = LoadParm()
 144         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 145         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 146         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;BA)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
 147         setntacl(lp,self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 148         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 149         s3conf = s3param.get_context()
 150         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
 151         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 152         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 153
 154         # This should re-calculate an ACL based on the posix details
 155         facl = getntacl(lp,self.tempf, direct_db_access=False)
 156         anysid = security.dom_sid(security.SID_NT_SELF)
 157         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 158
 159     def test_setntacl_smbd_getntacl_smbd_gpo(self):
 160         lp = LoadParm()
 161         acl = "O:DAG:DUD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 162         setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 163         facl = getntacl(lp, self.tempf, direct_db_access=False)
 164         domsid = security.dom_sid("S-1-5-21-2212615479-2695158682-2101375467")
 165         self.assertEquals(facl.as_sddl(domsid),acl)
 166
 167     def test_setntacl_getposixacl(self):
 168         lp = LoadParm()
 169         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 170         setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 171         facl = getntacl(lp, self.tempf)
 172         anysid = security.dom_sid(security.SID_NT_SELF)
 173         self.assertEquals(facl.as_sddl(anysid),acl)
 174         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 175
 176     def test_setposixacl_getposixacl(self):
 177         lp = LoadParm()
 178         smbd.set_simple_acl(self.tempf, 0640)
 179         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 180         self.assertEquals(posix_acl.count, 4)
 181
 182         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 183         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 184
 185         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 186         self.assertEquals(posix_acl.acl[1].a_perm, 4)
 187
 188         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 189         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 190
 191         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 192         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 193
 194     def test_setposixacl_getntacl(self):
 195         lp = LoadParm()
 196         acl = ""
 197         smbd.set_simple_acl(self.tempf, 0750)
 198         try:
 199             facl = getntacl(lp, self.tempf)
 200             self.assertTrue(False)
 201         except TypeError:
 202             # We don't expect the xattr to be filled in in this case
 203             pass
 204
 205     def test_setposixacl_getntacl_smbd(self):
 206         lp = LoadParm()
 207         s3conf = s3param.get_context()
 208         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
 209         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 210         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 211         smbd.set_simple_acl(self.tempf, 0640)
 212         facl = getntacl(lp, self.tempf, direct_db_access=False)
 213         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 214         anysid = security.dom_sid(security.SID_NT_SELF)
 215         self.assertEquals(acl, facl.as_sddl(anysid))
 216
 217     def test_setposixacl_dir_getntacl_smbd(self):
 218         lp = LoadParm()
 219         s3conf = s3param.get_context()
 220         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
 221         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempdir).st_uid)
 222         smbd.set_simple_acl(self.tempdir, 0750)
 223         facl = getntacl(lp, self.tempdir, direct_db_access=False)
 224         acl = "O:%sG:BAD:(A;;0x001f01ff;;;%s)(A;;0x001200a9;;;BA)(A;;WO;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001f01ff;;;CG)(A;OICIIO;0x001f01ff;;;WD)" % (user_SID, user_SID)
 225
 226         anysid = security.dom_sid(security.SID_NT_SELF)
 227         self.assertEquals(acl, facl.as_sddl(anysid))
 228
 229     def test_setposixacl_group_getntacl_smbd(self):
 230         lp = LoadParm()
 231         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 232         s3conf = s3param.get_context()
 233         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
 234         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 235         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 236         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 237         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 238         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 239         facl = getntacl(lp, self.tempf, direct_db_access=False)
 240         domsid = passdb.get_global_sam_sid()
 241         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 242         anysid = security.dom_sid(security.SID_NT_SELF)
 243         self.assertEquals(acl, facl.as_sddl(anysid))
 244
 245     def test_setposixacl_getposixacl(self):
 246         lp = LoadParm()
 247         smbd.set_simple_acl(self.tempf, 0640)
 248         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 249         self.assertEquals(posix_acl.count, 4)
 250
 251         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 252         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 253
 254         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 255         self.assertEquals(posix_acl.acl[1].a_perm, 4)
 256
 257         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 258         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 259
 260         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 261         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 262
 263     def test_setposixacl_dir_getposixacl(self):
 264         lp = LoadParm()
 265         smbd.set_simple_acl(self.tempdir, 0750)
 266         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 267         self.assertEquals(posix_acl.count, 4)
 268
 269         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 270         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 271
 272         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 273         self.assertEquals(posix_acl.acl[1].a_perm, 5)
 274
 275         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 276         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 277
 278         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 279         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 280
 281     def test_setposixacl_group_getposixacl(self):
 282         lp = LoadParm()
 283         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 284         s3conf = s3param.get_context()
 285         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
 286         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 287         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 288         smbd.set_simple_acl(self.tempf, 0670, BA_gid)
 289         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 290
 291         self.assertEquals(posix_acl.count, 5)
 292
 293         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 294         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 295
 296         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 297         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 298
 299         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 300         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 301
 302         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_GROUP)
 303         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 304         self.assertEquals(posix_acl.acl[3].info.gid, BA_gid)
 305
 306         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_MASK)
 307         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 308
 309     def test_setntacl_sysvol_check_getposixacl(self):
 310         lp = LoadParm()
 311         s3conf = s3param.get_context()
 312         acl = provision.SYSVOL_ACL
 313         domsid = passdb.get_global_sam_sid()
 314         setntacl(lp, self.tempf,acl,str(domsid), use_ntvfs=False)
 315         facl = getntacl(lp, self.tempf)
 316         self.assertEquals(facl.as_sddl(domsid),acl)
 317         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 318
 319         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 320         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 321         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 322         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 323         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 324
 325         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
 326
 327         # These assertions correct for current plugin_s4_dc selftest
 328         # configuration.  When other environments have a broad range of
 329         # groups mapped via passdb, we can relax some of these checks
 330         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 331         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 332         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 333         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 334         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 335         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 336         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 337         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 338         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 339         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 340
 341         self.assertEquals(posix_acl.count, 9)
 342
 343         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 344         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 345         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 346
 347         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 348         self.assertEquals(posix_acl.acl[1].a_perm, 6)
 349         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 350
 351         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 352         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 353
 354         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 355         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 356
 357         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 358         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 359
 360         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 361         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 362         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 363
 364         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 365         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 366         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 367
 368         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 369         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 370         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 371
 372         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_MASK)
 373         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 374
 375
 376 # check that it matches:
 377 # user::rwx
 378 # user:root:rwx (selftest user actually)
 379 # group::rwx
 380 # group:Local Admins:rwx
 381 # group:3000000:r-x
 382 # group:3000001:rwx
 383 # group:3000002:r-x
 384 # mask::rwx
 385 # other::---
 386
 387 #
 388 # This is in this order in the NDR smb_acl (not re-orderded for display)
 389 # a_type: GROUP
 390 # a_perm: 7
 391 # uid: -1
 392 # gid: 10
 393 # a_type: USER
 394 # a_perm: 6
 395 # uid: 0 (selftest user actually)
 396 # gid: -1
 397 # a_type: OTHER
 398 # a_perm: 0
 399 # uid: -1
 400 # gid: -1
 401 # a_type: USER_OBJ
 402 # a_perm: 6
 403 # uid: -1
 404 # gid: -1
 405 # a_type: GROUP_OBJ
 406 # a_perm: 7
 407 # uid: -1
 408 # gid: -1
 409 # a_type: GROUP
 410 # a_perm: 5
 411 # uid: -1
 412 # gid: 3000020
 413 # a_type: GROUP
 414 # a_perm: 7
 415 # uid: -1
 416 # gid: 3000000
 417 # a_type: GROUP
 418 # a_perm: 5
 419 # uid: -1
 420 # gid: 3000001
 421 # a_type: MASK
 422 # a_perm: 7
 423 # uid: -1
 424 # gid: -1
 425
 426 #
 427
 428
 429     def test_setntacl_sysvol_dir_check_getposixacl(self):
 430         lp = LoadParm()
 431         s3conf = s3param.get_context()
 432         acl = provision.SYSVOL_ACL
 433         domsid = passdb.get_global_sam_sid()
 434         setntacl(lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
 435         facl = getntacl(lp, self.tempdir)
 436         self.assertEquals(facl.as_sddl(domsid),acl)
 437         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 438
 439         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 440         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 441         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 442         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 443         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 444
 445         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
 446
 447         # These assertions correct for current plugin_s4_dc selftest
 448         # configuration.  When other environments have a broad range of
 449         # groups mapped via passdb, we can relax some of these checks
 450         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 451         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 452         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 453         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 454         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 455         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 456         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 457         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 458         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 459         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 460
 461         self.assertEquals(posix_acl.count, 9)
 462
 463         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 464         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 465         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 466
 467         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 468         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 469         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 470
 471         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 472         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 473
 474         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 475         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 476
 477         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 478         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 479
 480         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 481         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 482         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 483
 484         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 485         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 486         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 487
 488         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 489         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 490         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 491
 492         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_MASK)
 493         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 494
 495
 496 # check that it matches:
 497 # user::rwx
 498 # user:root:rwx (selftest user actually)
 499 # group::rwx
 500 # group:3000000:rwx
 501 # group:3000001:r-x
 502 # group:3000002:rwx
 503 # group:3000003:r-x
 504 # mask::rwx
 505 # other::---
 506
 507
 508     def test_setntacl_policies_dir_check_getposixacl(self):
 509         lp = LoadParm()
 510         s3conf = s3param.get_context()
 511         acl = provision.POLICIES_ACL
 512         domsid = passdb.get_global_sam_sid()
 513         setntacl(lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
 514         facl = getntacl(lp, self.tempdir)
 515         self.assertEquals(facl.as_sddl(domsid),acl)
 516         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 517
 518         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 519         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 520         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 521         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 522         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 523         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 524
 525         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
 526
 527         # These assertions correct for current plugin_s4_dc selftest
 528         # configuration.  When other environments have a broad range of
 529         # groups mapped via passdb, we can relax some of these checks
 530         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 531         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 532         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 533         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 534         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 535         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 536         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 537         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 538         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 539         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 540         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 541         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 542
 543         self.assertEquals(posix_acl.count, 10)
 544
 545         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 546         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 547         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 548
 549         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 550         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 551         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 552
 553         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 554         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 555
 556         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 557         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 558
 559         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 560         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 561
 562         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 563         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 564         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 565
 566         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 567         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 568         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 569
 570         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 571         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 572         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 573
 574         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_GROUP)
 575         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 576         self.assertEquals(posix_acl.acl[8].info.gid, PA_gid)
 577
 578         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_MASK)
 579         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 580
 581
 582 # check that it matches:
 583 # user::rwx
 584 # user:root:rwx  (selftest user actually)
 585 # group::rwx
 586 # group:3000000:rwx
 587 # group:3000001:r-x
 588 # group:3000002:rwx
 589 # group:3000003:r-x
 590 # group:3000004:rwx
 591 # mask::rwx
 592 # other::---
 593
 594
 595
 596     def test_setntacl_policies_check_getposixacl(self):
 597         lp = LoadParm()
 598         s3conf = s3param.get_context()
 599         acl = provision.POLICIES_ACL
 600
 601         domsid = passdb.get_global_sam_sid()
 602         setntacl(lp, self.tempf,acl,str(domsid), use_ntvfs=False)
 603         facl = getntacl(lp, self.tempf)
 604         self.assertEquals(facl.as_sddl(domsid),acl)
 605         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 606
 607         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 608         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 609         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 610         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 611         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 612         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 613
 614         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
 615
 616         # These assertions correct for current plugin_s4_dc selftest
 617         # configuration.  When other environments have a broad range of
 618         # groups mapped via passdb, we can relax some of these checks
 619         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 620         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 621         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 622         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 623         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 624         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 625         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 626         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 627         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 628         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 629         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 630         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 631
 632         self.assertEquals(posix_acl.count, 10)
 633
 634         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 635         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 636         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 637
 638         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 639         self.assertEquals(posix_acl.acl[1].a_perm, 6)
 640         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 641
 642         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 643         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 644
 645         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 646         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 647
 648         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 649         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 650
 651         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 652         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 653         self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
 654
 655         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 656         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 657         self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
 658
 659         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 660         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 661         self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
 662
 663         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_GROUP)
 664         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 665         self.assertEquals(posix_acl.acl[8].info.gid, PA_gid)
 666
 667         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_MASK)
 668         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 669
 670
 671 # check that it matches:
 672 # user::rwx
 673 # user:root:rwx (selftest user actually)
 674 # group::rwx
 675 # group:Local Admins:rwx
 676 # group:3000000:r-x
 677 # group:3000001:rwx
 678 # group:3000002:r-x
 679 # group:3000003:rwx
 680 # mask::rwx
 681 # other::---
 682
 683 #
 684 # This is in this order in the NDR smb_acl (not re-orderded for display)
 685 # a_type: GROUP
 686 # a_perm: 7
 687 # uid: -1
 688 # gid: 10
 689 # a_type: USER
 690 # a_perm: 6
 691 # uid: 0 (selftest user actually)
 692 # gid: -1
 693 # a_type: OTHER
 694 # a_perm: 0
 695 # uid: -1
 696 # gid: -1
 697 # a_type: USER_OBJ
 698 # a_perm: 6
 699 # uid: -1
 700 # gid: -1
 701 # a_type: GROUP_OBJ
 702 # a_perm: 7
 703 # uid: -1
 704 # gid: -1
 705 # a_type: GROUP
 706 # a_perm: 5
 707 # uid: -1
 708 # gid: 3000020
 709 # a_type: GROUP
 710 # a_perm: 7
 711 # uid: -1
 712 # gid: 3000000
 713 # a_type: GROUP
 714 # a_perm: 5
 715 # uid: -1
 716 # gid: 3000001
 717 # a_type: GROUP
 718 # a_perm: 7
 719 # uid: -1
 720 # gid: 3000003
 721 # a_type: MASK
 722 # a_perm: 7
 723 # uid: -1
 724 # gid: -1
 725
 726 #
 727
 728     def setUp(self):
 729         super(PosixAclMappingTests, self).setUp()
 730         s3conf = s3param.get_context()
 731         s3conf.load(self.get_loadparm().configfile)
 732         self.tempf = os.path.join(self.tempdir, "test")
 733         open(self.tempf, 'w').write("empty")
 734
 735     def tearDown(self):
 736         smbd.unlink(self.tempf)
 737         super(PosixAclMappingTests, self).tearDown()