selftest: Add tests for expected behaviour on directories as well as files

This is important because it covers the codepath which had the talloc
error fixed by commit 60cf4cb5a630506747431ecbf00d890509baf2f3
(vfs_acl_common: In add_directory_inheritable_components allocate on
psd as parent)

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sun Nov 11 15:48:10 CET 2012 on sn-devel-104

diff --git a/source4/scripting/python/samba/tests/posixacl.py b/source4/scripting/python/samba/tests/posixacl.py
index 50518f0d0e801622cefca07e34025128ce4e62c9..9df904b62c1ac0648f89b12add14ec2b75831c03 100644 (file)
--- a/source4/scripting/python/samba/tests/posixacl.py
+++ b/source4/scripting/python/samba/tests/posixacl.py
@@ -214,6 +214,18 @@ class PosixAclMappingTests(TestCaseInTempDir):
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
 
+    def test_setposixacl_dir_getntacl_smbd(self):
+        lp = LoadParm()
+        s3conf = s3param.get_context()
+        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        user_SID = s4_passdb.uid_to_sid(os.stat(self.tempdir).st_uid)
+        smbd.set_simple_acl(self.tempdir, 0750)
+        facl = getntacl(lp, self.tempdir, direct_db_access=False)
+        acl = "O:%sG:BAD:(A;;0x001f01ff;;;%s)(A;;0x001200a9;;;BA)(A;;WO;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001f01ff;;;CG)(A;OICIIO;0x001f01ff;;;WD)" % (user_SID, user_SID)
+
+        anysid = security.dom_sid(security.SID_NT_SELF)
+        self.assertEquals(acl, facl.as_sddl(anysid))
+
     def test_setposixacl_group_getntacl_smbd(self):
         lp = LoadParm()
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
@@ -248,6 +260,24 @@ class PosixAclMappingTests(TestCaseInTempDir):
         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 
+    def test_setposixacl_dir_getposixacl(self):
+        lp = LoadParm()
+        smbd.set_simple_acl(self.tempdir, 0750)
+        posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
+        self.assertEquals(posix_acl.count, 4)
+
+        self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
+        self.assertEquals(posix_acl.acl[0].a_perm, 7)
+
+        self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+        self.assertEquals(posix_acl.acl[1].a_perm, 5)
+
+        self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
+        self.assertEquals(posix_acl.acl[2].a_perm, 0)
+
+        self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
+        self.assertEquals(posix_acl.acl[3].a_perm, 7)
+
     def test_setposixacl_group_getposixacl(self):
         lp = LoadParm()
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
@@ -396,6 +426,173 @@ class PosixAclMappingTests(TestCaseInTempDir):
 #
 
 
+    def test_setntacl_sysvol_dir_check_getposixacl(self):
+        lp = LoadParm()
+        s3conf = s3param.get_context()
+        acl = provision.SYSVOL_ACL
+        domsid = passdb.get_global_sam_sid()
+        setntacl(lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
+        facl = getntacl(lp, self.tempdir)
+        self.assertEquals(facl.as_sddl(domsid),acl)
+        posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
+
+        LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
+        BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
+        SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
+        SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
+        AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
+
+        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+
+        # These assertions correct for current plugin_s4_dc selftest
+        # configuration.  When other environments have a broad range of
+        # groups mapped via passdb, we can relax some of these checks
+        (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
+        self.assertEquals(LA_type, idmap.ID_TYPE_UID)
+        (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
+        self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
+        (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
+        self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
+        (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
+        self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
+        (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
+        self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
+
+        self.assertEquals(posix_acl.count, 9)
+
+        self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[0].a_perm, 7)
+        self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
+
+        self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
+        self.assertEquals(posix_acl.acl[1].a_perm, 7)
+        self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
+
+        self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
+        self.assertEquals(posix_acl.acl[2].a_perm, 0)
+
+        self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
+        self.assertEquals(posix_acl.acl[3].a_perm, 7)
+
+        self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+        self.assertEquals(posix_acl.acl[4].a_perm, 7)
+
+        self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[5].a_perm, 5)
+        self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
+
+        self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[6].a_perm, 7)
+        self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
+
+        self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[7].a_perm, 5)
+        self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
+
+        self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_MASK)
+        self.assertEquals(posix_acl.acl[8].a_perm, 7)
+
+
+# check that it matches:
+# user::rwx
+# user:root:rwx (selftest user actually)
+# group::rwx
+# group:3000000:rwx
+# group:3000001:r-x
+# group:3000002:rwx
+# group:3000003:r-x
+# mask::rwx
+# other::---
+
+
+    def test_setntacl_policies_dir_check_getposixacl(self):
+        lp = LoadParm()
+        s3conf = s3param.get_context()
+        acl = provision.POLICIES_ACL
+        domsid = passdb.get_global_sam_sid()
+        setntacl(lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
+        facl = getntacl(lp, self.tempdir)
+        self.assertEquals(facl.as_sddl(domsid),acl)
+        posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
+
+        LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
+        BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
+        SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
+        SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
+        AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
+        PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
+
+        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+
+        # These assertions correct for current plugin_s4_dc selftest
+        # configuration.  When other environments have a broad range of
+        # groups mapped via passdb, we can relax some of these checks
+        (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
+        self.assertEquals(LA_type, idmap.ID_TYPE_UID)
+        (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
+        self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
+        (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
+        self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
+        (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
+        self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
+        (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
+        self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
+        (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
+        self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
+
+        self.assertEquals(posix_acl.count, 10)
+
+        self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[0].a_perm, 7)
+        self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
+
+        self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
+        self.assertEquals(posix_acl.acl[1].a_perm, 7)
+        self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
+
+        self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
+        self.assertEquals(posix_acl.acl[2].a_perm, 0)
+
+        self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
+        self.assertEquals(posix_acl.acl[3].a_perm, 7)
+
+        self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+        self.assertEquals(posix_acl.acl[4].a_perm, 7)
+
+        self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[5].a_perm, 5)
+        self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
+
+        self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[6].a_perm, 7)
+        self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
+
+        self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[7].a_perm, 5)
+        self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
+
+        self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[8].a_perm, 7)
+        self.assertEquals(posix_acl.acl[8].info.gid, PA_gid)
+
+        self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_MASK)
+        self.assertEquals(posix_acl.acl[9].a_perm, 7)
+
+
+# check that it matches:
+# user::rwx
+# user:root:rwx  (selftest user actually)
+# group::rwx
+# group:3000000:rwx
+# group:3000001:r-x
+# group:3000002:rwx
+# group:3000003:r-x
+# group:3000004:rwx
+# mask::rwx
+# other::---
+
+
+
     def test_setntacl_policies_check_getposixacl(self):
         lp = LoadParm()
         s3conf = s3param.get_context()