python/samba/tests/posixacl.py

   1 # Unix SMB/CIFS implementation. Tests for NT and posix ACL manipulation
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
   3 # Copyright (C) Andrew Bartlett 2012
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 """Tests for the Samba3 NT -> posix ACL layer"""
  20
  21 from samba.ntacls import setntacl, getntacl, checkset_backend
  22 from samba.dcerpc import xattr, security, smb_acl, idmap
  23 from samba.param import LoadParm
  24 from samba.tests import TestCaseInTempDir
  25 from samba import provision
  26 import random
  27 import os
  28 from samba.samba3 import smbd, passdb
  29 from samba.samba3 import param as s3param
  30
  31 # To print a posix ACL use:
  32 #        for entry in posix_acl.acl:
  33 #            print "a_type: %d" % entry.a_type
  34 #            print "a_perm: %o" % entry.a_perm
  35 #            if entry.a_type == smb_acl.SMB_ACL_USER:
  36 #                print "uid: %d" % entry.uid
  37 #            if entry.a_type == smb_acl.SMB_ACL_GROUP:
  38 #                print "gid: %d" % entry.gid
  39
  40 class PosixAclMappingTests(TestCaseInTempDir):
  41
  42     def test_setntacl(self):
  43         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  44         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  45
  46     def test_setntacl_smbd_getntacl(self):
  47         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  48         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  49         facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  50         anysid = security.dom_sid(security.SID_NT_SELF)
  51         self.assertEquals(facl.as_sddl(anysid),acl)
  52
  53     def test_setntacl_smbd_setposixacl_getntacl(self):
  54         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  55         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  56
  57         # This will invalidate the ACL, as we have a hook!
  58         smbd.set_simple_acl(self.tempf, 0640)
  59
  60         # However, this only asks the xattr
  61         try:
  62             facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  63             self.assertTrue(False)
  64         except TypeError:
  65             pass
  66
  67     def test_setntacl_invalidate_getntacl(self):
  68         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  69         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  70
  71         # This should invalidate the ACL, as we include the posix ACL in the hash
  72         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
  73         backend_obj.wrap_setxattr(dbname,
  74                                   self.tempf, "system.fake_access_acl", "")
  75
  76         #however, as this is direct DB access, we do not notice it
  77         facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  78         anysid = security.dom_sid(security.SID_NT_SELF)
  79         self.assertEquals(acl, facl.as_sddl(anysid))
  80
  81     def test_setntacl_invalidate_getntacl_smbd(self):
  82         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  83         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  84
  85         # This should invalidate the ACL, as we include the posix ACL in the hash
  86         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
  87         backend_obj.wrap_setxattr(dbname,
  88                                   self.tempf, "system.fake_access_acl", "")
  89
  90         #the hash would break, and we return an ACL based only on the mode, except we set the ACL using the 'ntvfs' mode that doesn't include a hash
  91         facl = getntacl(self.lp, self.tempf)
  92         anysid = security.dom_sid(security.SID_NT_SELF)
  93         self.assertEquals(acl, facl.as_sddl(anysid))
  94
  95     def test_setntacl_smbd_invalidate_getntacl_smbd(self):
  96         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  97         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x001200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
  98         os.chmod(self.tempf, 0750)
  99         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 100
 101         # This should invalidate the ACL, as we include the posix ACL in the hash
 102         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
 103         backend_obj.wrap_setxattr(dbname,
 104                                   self.tempf, "system.fake_access_acl", "")
 105
 106         #the hash will break, and we return an ACL based only on the mode
 107         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 108         anysid = security.dom_sid(security.SID_NT_SELF)
 109         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 110
 111     def test_setntacl_smbd_dont_invalidate_getntacl_smbd(self):
 112         # set an ACL on a tempfile
 113         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 114         os.chmod(self.tempf, 0750)
 115         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 116
 117         # now influence the POSIX ACL->SD mapping it returns something else than
 118         # what was set previously
 119         # this should not invalidate the hash and the complete ACL should still
 120         # be returned
 121         self.lp.set("profile acls", "yes")
 122         # we should still get back the ACL (and not one mapped from POSIX ACL)
 123         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 124         self.lp.set("profile acls", "no")
 125         anysid = security.dom_sid(security.SID_NT_SELF)
 126         self.assertEquals(acl, facl.as_sddl(anysid))
 127
 128     def test_setntacl_getntacl_smbd(self):
 129         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 130         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
 131         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 132         anysid = security.dom_sid(security.SID_NT_SELF)
 133         self.assertEquals(facl.as_sddl(anysid),acl)
 134
 135     def test_setntacl_smbd_getntacl_smbd(self):
 136         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 137         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 138         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 139         anysid = security.dom_sid(security.SID_NT_SELF)
 140         self.assertEquals(facl.as_sddl(anysid),acl)
 141
 142     def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
 143         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 144         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 145         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 146         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 147         smbd.set_simple_acl(self.tempf, 0640)
 148         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 149         anysid = security.dom_sid(security.SID_NT_SELF)
 150         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 151
 152     def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
 153         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 154         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 155         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;BA)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 156         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 157         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 158         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 159         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 160         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 161
 162         # This should re-calculate an ACL based on the posix details
 163         facl = getntacl(self.lp,self.tempf, direct_db_access=False)
 164         anysid = security.dom_sid(security.SID_NT_SELF)
 165         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 166
 167     def test_setntacl_smbd_getntacl_smbd_gpo(self):
 168         acl = "O:DAG:DUD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 169         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 170         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 171         domsid = security.dom_sid("S-1-5-21-2212615479-2695158682-2101375467")
 172         self.assertEquals(facl.as_sddl(domsid),acl)
 173
 174     def test_setntacl_getposixacl(self):
 175         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 176         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 177         facl = getntacl(self.lp, self.tempf)
 178         anysid = security.dom_sid(security.SID_NT_SELF)
 179         self.assertEquals(facl.as_sddl(anysid),acl)
 180         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 181
 182     def test_setposixacl_getposixacl(self):
 183         smbd.set_simple_acl(self.tempf, 0640)
 184         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 185         self.assertEquals(posix_acl.count, 4)
 186
 187         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 188         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 189
 190         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 191         self.assertEquals(posix_acl.acl[1].a_perm, 4)
 192
 193         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 194         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 195
 196         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 197         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 198
 199     def test_setposixacl_getntacl(self):
 200         acl = ""
 201         smbd.set_simple_acl(self.tempf, 0750)
 202         try:
 203             facl = getntacl(self.lp, self.tempf)
 204             self.assertTrue(False)
 205         except TypeError:
 206             # We don't expect the xattr to be filled in in this case
 207             pass
 208
 209     def test_setposixacl_getntacl_smbd(self):
 210         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 211         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 212         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 213         smbd.set_simple_acl(self.tempf, 0640)
 214         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 215         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 216         anysid = security.dom_sid(security.SID_NT_SELF)
 217         self.assertEquals(acl, facl.as_sddl(anysid))
 218
 219     def test_setposixacl_dir_getntacl_smbd(self):
 220         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 221         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempdir).st_uid)
 222         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 223         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 224         (BA_id,BA_type) = s4_passdb.sid_to_id(BA_sid)
 225         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 226         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 227         (SO_id,SO_type) = s4_passdb.sid_to_id(SO_sid)
 228         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 229         smbd.chown(self.tempdir, BA_id, SO_id)
 230         smbd.set_simple_acl(self.tempdir, 0750)
 231         facl = getntacl(self.lp, self.tempdir, direct_db_access=False)
 232         acl = "O:BAG:SOD:(A;;0x001f01ff;;;BA)(A;;0x001200a9;;;SO)(A;;;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001200a9;;;CG)(A;OICIIO;0x001200a9;;;WD)"
 233
 234         anysid = security.dom_sid(security.SID_NT_SELF)
 235         self.assertEquals(acl, facl.as_sddl(anysid))
 236
 237     def test_setposixacl_group_getntacl_smbd(self):
 238         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 239         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 240         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 241         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 242         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 243         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 244         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 245         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 246         domsid = passdb.get_global_sam_sid()
 247         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 248         anysid = security.dom_sid(security.SID_NT_SELF)
 249         self.assertEquals(acl, facl.as_sddl(anysid))
 250
 251     def test_setposixacl_getposixacl(self):
 252         smbd.set_simple_acl(self.tempf, 0640)
 253         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 254         self.assertEquals(posix_acl.count, 4)
 255
 256         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 257         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 258
 259         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 260         self.assertEquals(posix_acl.acl[1].a_perm, 4)
 261
 262         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 263         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 264
 265         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 266         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 267
 268     def test_setposixacl_dir_getposixacl(self):
 269         smbd.set_simple_acl(self.tempdir, 0750)
 270         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 271         self.assertEquals(posix_acl.count, 4)
 272
 273         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 274         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 275
 276         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 277         self.assertEquals(posix_acl.acl[1].a_perm, 5)
 278
 279         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 280         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 281
 282         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 283         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 284
 285     def test_setposixacl_group_getposixacl(self):
 286         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 287         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 288         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 289         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 290         smbd.set_simple_acl(self.tempf, 0670, BA_gid)
 291         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 292
 293         self.assertEquals(posix_acl.count, 5)
 294
 295         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 296         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 297
 298         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 299         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 300
 301         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 302         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 303
 304         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_GROUP)
 305         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 306         self.assertEquals(posix_acl.acl[3].info.gid, BA_gid)
 307
 308         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_MASK)
 309         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 310
 311     def test_setntacl_sysvol_check_getposixacl(self):
 312         acl = provision.SYSVOL_SUBFOLDER_SD
 313         domsid = passdb.get_global_sam_sid()
 314         setntacl(self.lp, self.tempf,acl,str(domsid), use_ntvfs=False)
 315         facl = getntacl(self.lp, self.tempf)
 316         self.assertEquals(facl.as_sddl(domsid),acl)
 317         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 318
 319         nwrap_module_so_path = os.getenv('NSS_WRAPPER_MODULE_SO_PATH')
 320         nwrap_module_fn_prefix = os.getenv('NSS_WRAPPER_MODULE_FN_PREFIX')
 321
 322         nwrap_winbind_active = (nwrap_module_so_path != "" and
 323                 nwrap_module_fn_prefix == "winbind")
 324
 325         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 326         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 327         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 328         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 329         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 330
 331         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 332
 333         # These assertions correct for current ad_dc selftest
 334         # configuration.  When other environments have a broad range of
 335         # groups mapped via passdb, we can relax some of these checks
 336         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 337         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 338         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 339         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 340         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 341         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 342         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 343         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 344         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 345         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 346
 347         self.assertEquals(posix_acl.count, 13)
 348
 349         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 350         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 351         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 352
 353         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 354         if nwrap_winbind_active:
 355             self.assertEquals(posix_acl.acl[1].a_perm, 7)
 356         else:
 357             self.assertEquals(posix_acl.acl[1].a_perm, 6)
 358         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 359
 360         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 361         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 362
 363         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 364         if nwrap_winbind_active:
 365             self.assertEquals(posix_acl.acl[3].a_perm, 7)
 366         else:
 367             self.assertEquals(posix_acl.acl[3].a_perm, 6)
 368
 369         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 370         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 371         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 372
 373         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 374         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 375
 376         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 377         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 378         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 379
 380         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 381         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 382         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 383
 384         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 385         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 386         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 387
 388         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 389         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 390         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 391
 392         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 393         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 394         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 395
 396         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 397         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 398         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 399
 400         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_MASK)
 401         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 402
 403
 404 # check that it matches:
 405 # user::rwx
 406 # user:root:rwx (selftest user actually)
 407 # group::rwx
 408 # group:Local Admins:rwx
 409 # group:3000000:r-x
 410 # group:3000001:rwx
 411 # group:3000002:r-x
 412 # mask::rwx
 413 # other::---
 414
 415 #
 416 # This is in this order in the NDR smb_acl (not re-orderded for display)
 417 # a_type: GROUP
 418 # a_perm: 7
 419 # uid: -1
 420 # gid: 10
 421 # a_type: USER
 422 # a_perm: 6
 423 # uid: 0 (selftest user actually)
 424 # gid: -1
 425 # a_type: OTHER
 426 # a_perm: 0
 427 # uid: -1
 428 # gid: -1
 429 # a_type: USER_OBJ
 430 # a_perm: 6
 431 # uid: -1
 432 # gid: -1
 433 # a_type: GROUP_OBJ
 434 # a_perm: 7
 435 # uid: -1
 436 # gid: -1
 437 # a_type: GROUP
 438 # a_perm: 5
 439 # uid: -1
 440 # gid: 3000020
 441 # a_type: GROUP
 442 # a_perm: 7
 443 # uid: -1
 444 # gid: 3000000
 445 # a_type: GROUP
 446 # a_perm: 5
 447 # uid: -1
 448 # gid: 3000001
 449 # a_type: MASK
 450 # a_perm: 7
 451 # uid: -1
 452 # gid: -1
 453
 454 #
 455
 456
 457     def test_setntacl_sysvol_dir_check_getposixacl(self):
 458         acl = provision.SYSVOL_SUBFOLDER_SD
 459         domsid = passdb.get_global_sam_sid()
 460         setntacl(self.lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
 461         facl = getntacl(self.lp, self.tempdir)
 462         self.assertEquals(facl.as_sddl(domsid),acl)
 463         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 464
 465         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 466         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 467         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 468         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 469         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 470
 471         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 472
 473         # These assertions correct for current ad_dc selftest
 474         # configuration.  When other environments have a broad range of
 475         # groups mapped via passdb, we can relax some of these checks
 476         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 477         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 478         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 479         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 480         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 481         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 482         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 483         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 484         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 485         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 486
 487         self.assertEquals(posix_acl.count, 13)
 488
 489         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 490         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 491         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 492
 493         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 494         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 495         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 496
 497         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 498         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 499
 500         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 501         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 502
 503         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 504         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 505         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 506
 507         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 508         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 509
 510         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 511         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 512         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 513
 514         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 515         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 516         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 517
 518         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 519         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 520         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 521
 522         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 523         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 524         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 525
 526         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 527         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 528         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 529
 530         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 531         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 532         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 533
 534         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_MASK)
 535         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 536
 537
 538 # check that it matches:
 539 # user::rwx
 540 # user:root:rwx (selftest user actually)
 541 # group::rwx
 542 # group:3000000:rwx
 543 # group:3000001:r-x
 544 # group:3000002:rwx
 545 # group:3000003:r-x
 546 # mask::rwx
 547 # other::---
 548
 549
 550     def test_setntacl_policies_dir_check_getposixacl(self):
 551         acl = provision.POLICIES_FOLDER_SD
 552         domsid = passdb.get_global_sam_sid()
 553         setntacl(self.lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
 554         facl = getntacl(self.lp, self.tempdir)
 555         self.assertEquals(facl.as_sddl(domsid),acl)
 556         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 557
 558         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 559         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 560         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 561         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 562         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 563         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 564
 565         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 566
 567         # These assertions correct for current ad_dc selftest
 568         # configuration.  When other environments have a broad range of
 569         # groups mapped via passdb, we can relax some of these checks
 570         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 571         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 572         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 573         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 574         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 575         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 576         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 577         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 578         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 579         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 580         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 581         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 582
 583         self.assertEquals(posix_acl.count, 15)
 584
 585         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 586         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 587         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 588
 589         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 590         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 591         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 592
 593         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 594         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 595
 596         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 597         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 598
 599         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 600         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 601         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 602
 603         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 604         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 605
 606         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 607         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 608         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 609
 610         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 611         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 612         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 613
 614         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 615         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 616         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 617
 618         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 619         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 620         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 621
 622         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 623         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 624         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 625
 626         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 627         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 628         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 629
 630         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_USER)
 631         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 632         self.assertEquals(posix_acl.acl[12].info.uid, PA_gid)
 633
 634         self.assertEquals(posix_acl.acl[13].a_type, smb_acl.SMB_ACL_GROUP)
 635         self.assertEquals(posix_acl.acl[13].a_perm, 7)
 636         self.assertEquals(posix_acl.acl[13].info.gid, PA_gid)
 637
 638         self.assertEquals(posix_acl.acl[14].a_type, smb_acl.SMB_ACL_MASK)
 639         self.assertEquals(posix_acl.acl[14].a_perm, 7)
 640
 641
 642 # check that it matches:
 643 # user::rwx
 644 # user:root:rwx  (selftest user actually)
 645 # group::rwx
 646 # group:3000000:rwx
 647 # group:3000001:r-x
 648 # group:3000002:rwx
 649 # group:3000003:r-x
 650 # group:3000004:rwx
 651 # mask::rwx
 652 # other::---
 653
 654
 655
 656     def test_setntacl_policies_check_getposixacl(self):
 657         acl = provision.POLICIES_FOLDER_SD
 658
 659         domsid = passdb.get_global_sam_sid()
 660         setntacl(self.lp, self.tempf, acl, str(domsid), use_ntvfs=False)
 661         facl = getntacl(self.lp, self.tempf)
 662         self.assertEquals(facl.as_sddl(domsid),acl)
 663         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 664
 665         nwrap_module_so_path = os.getenv('NSS_WRAPPER_MODULE_SO_PATH')
 666         nwrap_module_fn_prefix = os.getenv('NSS_WRAPPER_MODULE_FN_PREFIX')
 667
 668         nwrap_winbind_active = (nwrap_module_so_path != "" and
 669                 nwrap_module_fn_prefix == "winbind")
 670
 671         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 672         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 673         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 674         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 675         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 676         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 677
 678         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 679
 680         # These assertions correct for current ad_dc selftest
 681         # configuration.  When other environments have a broad range of
 682         # groups mapped via passdb, we can relax some of these checks
 683         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 684         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 685         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 686         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 687         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 688         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 689         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 690         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 691         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 692         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 693         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 694         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 695
 696         self.assertEquals(posix_acl.count, 15)
 697
 698         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 699         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 700         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 701
 702         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 703         if nwrap_winbind_active:
 704             self.assertEquals(posix_acl.acl[1].a_perm, 7)
 705         else:
 706             self.assertEquals(posix_acl.acl[1].a_perm, 6)
 707         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 708
 709         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 710         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 711
 712         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 713         if nwrap_winbind_active:
 714             self.assertEquals(posix_acl.acl[3].a_perm, 7)
 715         else:
 716             self.assertEquals(posix_acl.acl[3].a_perm, 6)
 717
 718         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 719         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 720         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 721
 722         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 723         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 724
 725         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 726         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 727         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 728
 729         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 730         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 731         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 732
 733         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 734         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 735         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 736
 737         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 738         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 739         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 740
 741         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 742         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 743         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 744
 745         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 746         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 747         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 748
 749         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_USER)
 750         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 751         self.assertEquals(posix_acl.acl[12].info.uid, PA_gid)
 752
 753         self.assertEquals(posix_acl.acl[13].a_type, smb_acl.SMB_ACL_GROUP)
 754         self.assertEquals(posix_acl.acl[13].a_perm, 7)
 755         self.assertEquals(posix_acl.acl[13].info.gid, PA_gid)
 756
 757         self.assertEquals(posix_acl.acl[14].a_type, smb_acl.SMB_ACL_MASK)
 758         self.assertEquals(posix_acl.acl[14].a_perm, 7)
 759
 760
 761 # check that it matches:
 762 # user::rwx
 763 # user:root:rwx (selftest user actually)
 764 # group::rwx
 765 # group:Local Admins:rwx
 766 # group:3000000:r-x
 767 # group:3000001:rwx
 768 # group:3000002:r-x
 769 # group:3000003:rwx
 770 # mask::rwx
 771 # other::---
 772
 773 #
 774 # This is in this order in the NDR smb_acl (not re-orderded for display)
 775 # a_type: GROUP
 776 # a_perm: 7
 777 # uid: -1
 778 # gid: 10
 779 # a_type: USER
 780 # a_perm: 6
 781 # uid: 0 (selftest user actually)
 782 # gid: -1
 783 # a_type: OTHER
 784 # a_perm: 0
 785 # uid: -1
 786 # gid: -1
 787 # a_type: USER_OBJ
 788 # a_perm: 6
 789 # uid: -1
 790 # gid: -1
 791 # a_type: GROUP_OBJ
 792 # a_perm: 7
 793 # uid: -1
 794 # gid: -1
 795 # a_type: GROUP
 796 # a_perm: 5
 797 # uid: -1
 798 # gid: 3000020
 799 # a_type: GROUP
 800 # a_perm: 7
 801 # uid: -1
 802 # gid: 3000000
 803 # a_type: GROUP
 804 # a_perm: 5
 805 # uid: -1
 806 # gid: 3000001
 807 # a_type: GROUP
 808 # a_perm: 7
 809 # uid: -1
 810 # gid: 3000003
 811 # a_type: MASK
 812 # a_perm: 7
 813 # uid: -1
 814 # gid: -1
 815
 816 #
 817
 818     def setUp(self):
 819         super(PosixAclMappingTests, self).setUp()
 820         s3conf = s3param.get_context()
 821         s3conf.load(self.get_loadparm().configfile)
 822         s3conf.set("xattr_tdb:file", os.path.join(self.tempdir,"xattr.tdb"))
 823         self.lp = s3conf
 824         self.tempf = os.path.join(self.tempdir, "test")
 825         open(self.tempf, 'w').write("empty")
 826
 827     def tearDown(self):
 828         smbd.unlink(self.tempf)
 829         os.unlink(os.path.join(self.tempdir,"xattr.tdb"))
 830         super(PosixAclMappingTests, self).tearDown()