selftest: Restore the s3member environment by avoiding smbcacls

This removes the need for acls on the filesystem for simple domain
member tests.  ACL tests should be written at some point...

Andrew Bartlett

Pair-Programmed-With: Andrew Tridgell <tridge@samba.org>

diff --git a/selftest/selftest.pl b/selftest/selftest.pl
index 5077a179013322fb73b66ef4a8663fce9ec8f168..6f8cbe1fe8e9a2dc3e9516616aff68d20b4eb78f 100755 (executable)
--- a/selftest/selftest.pl
+++ b/selftest/selftest.pl
@@ -399,8 +399,14 @@ $prefix =~ s+/$++;
 
 die("using an empty prefix isn't allowed") unless $prefix ne "";
 
-#Ensure we have the test prefix around
-mkdir($prefix, 0777) unless -d $prefix;
+# Ensure we have the test prefix around.
+#
+# We need restrictive
+# permissions on this as some subdirectories in this tree will have
+# wider permissions (ie 0777) and this would allow other users on the
+# host to subvert the test process.
+mkdir($prefix, 0700) unless -d $prefix;
+chmod 0700, $prefix;
 
 my $prefix_abs = abs_path($prefix);
 my $tmpdir_abs = abs_path("$prefix/tmp");

diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 6312d650a0c4bdd08857d8baad27f562dbc5d41a..01158347b31f1989a46ad39b32f1f90ace3c7e47 100644 (file)
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -247,24 +247,16 @@ sub setup_admember($$$$)
            return undef;
        }
 
+       # We need world access to this share, as otherwise the domain
+       # administrator from the AD domain provided by Samba4 can't
+       # access the share for tests.
+       chmod 0777, "$prefix/share";
+
        $self->check_or_start($ret,
                              "yes", "yes", "yes");
 
        $self->wait_for_start($ret);
 
-       my $smbcacls = Samba::bindir_path($self, "smbcacls");
-       #Allow domain users to manipulate the share
-       $cmd = "";
-       $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
-       $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
-       $cmd .= "$smbcacls $ret->{CONFIGURATION} //127.0.0.29/tmp / -U$ret->{USERNAME}%$ret->{PASSWORD} ";
-       $cmd .= "-S ACL:$dcvars->{DOMAIN}\\\\Domain\\ Users:ALLOWED/0x0/FULL";
-
-       if (system($cmd) != 0) {
-           warn("smbcacls failed, your filesystem may not support ACLs.  Try mount $prefix_abs -oremount,acl\nThis support is required for S3 member in S4 tests\n$cmd");
-           return undef;
-       }
-
        $ret->{DC_SERVER} = $dcvars->{SERVER};
        $ret->{DC_SERVER_IP} = $dcvars->{SERVER_IP};
        $ret->{DC_NETBIOSNAME} = $dcvars->{NETBIOSNAME};