python/samba/tests/posixacl.py

   1 # Unix SMB/CIFS implementation. Tests for NT and posix ACL manipulation
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
   3 # Copyright (C) Andrew Bartlett 2012
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 """Tests for the Samba3 NT -> posix ACL layer"""
  20
  21 from samba.ntacls import setntacl, getntacl, checkset_backend
  22 from samba.dcerpc import security, smb_acl, idmap
  23 from samba.tests import TestCaseInTempDir
  24 from samba import provision
  25 import os
  26 from samba.samba3 import smbd, passdb
  27 from samba.samba3 import param as s3param
  28 from samba import auth
  29 from samba.samdb import SamDB
  30
  31 DOM_SID = "S-1-5-21-2212615479-2695158682-2101375467"
  32 ACL = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  33
  34
  35 class PosixAclMappingTests(TestCaseInTempDir):
  36
  37     def setUp(self):
  38         super(PosixAclMappingTests, self).setUp()
  39         s3conf = s3param.get_context()
  40         s3conf.load(self.get_loadparm().configfile)
  41         s3conf.set("xattr_tdb:file", os.path.join(self.tempdir, "xattr.tdb"))
  42         self.lp = s3conf
  43         self.tempf = os.path.join(self.tempdir, "test")
  44         open(self.tempf, 'w').write("empty")
  45         self.samdb = SamDB(lp=self.lp, session_info=auth.system_session())
  46
  47     def tearDown(self):
  48         smbd.unlink(self.tempf)
  49         os.unlink(os.path.join(self.tempdir, "xattr.tdb"))
  50         super(PosixAclMappingTests, self).tearDown()
  51
  52     def get_session_info(self, domsid=DOM_SID):
  53         """
  54         Get session_info for setntacl.
  55
  56         This test case always return None, to run tests without session_info
  57         like before. To be overrided in derived class.
  58         """
  59         return None
  60
  61     def print_posix_acl(self, posix_acl):
  62         aclstr = ""
  63         for entry in posix_acl.acl:
  64             aclstr += "a_type: %d\n" % entry.a_type
  65             aclstr += "a_perm: %o\n" % entry.a_perm
  66             if entry.a_type == smb_acl.SMB_ACL_USER:
  67                 aclstr += "uid: %d\n" % entry.info.uid
  68             if entry.a_type == smb_acl.SMB_ACL_GROUP:
  69                 aclstr += "gid: %d\n" % entry.info.gid
  70         return aclstr
  71
  72     def test_setntacl(self):
  73         acl = ACL
  74         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=False,
  75                  session_info=self.get_session_info())
  76
  77     def test_setntacl_smbd_getntacl(self):
  78         acl = ACL
  79         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=True,
  80                  session_info=self.get_session_info())
  81         facl = getntacl(self.lp, self.tempf, direct_db_access=True)
  82         anysid = security.dom_sid(security.SID_NT_SELF)
  83         self.assertEquals(facl.as_sddl(anysid),acl)
  84
  85     def test_setntacl_smbd_setposixacl_getntacl(self):
  86         acl = ACL
  87         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=True,
  88                  session_info=self.get_session_info())
  89
  90         # This will invalidate the ACL, as we have a hook!
  91         smbd.set_simple_acl(self.tempf, 0o640)
  92
  93         # However, this only asks the xattr
  94         self.assertRaises(
  95             TypeError, getntacl, self.lp, self.tempf, direct_db_access=True)
  96
  97     def test_setntacl_invalidate_getntacl(self):
  98         acl = ACL
  99         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=True,
 100                  session_info=self.get_session_info())
 101
 102         # This should invalidate the ACL, as we include the posix ACL in the hash
 103         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
 104         backend_obj.wrap_setxattr(dbname,
 105                                   self.tempf, "system.fake_access_acl", b"")
 106
 107         #however, as this is direct DB access, we do not notice it
 108         facl = getntacl(self.lp, self.tempf, direct_db_access=True)
 109         anysid = security.dom_sid(security.SID_NT_SELF)
 110         self.assertEquals(acl, facl.as_sddl(anysid))
 111
 112     def test_setntacl_invalidate_getntacl_smbd(self):
 113         acl = ACL
 114         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=False,
 115                  session_info=self.get_session_info())
 116
 117         # This should invalidate the ACL, as we include the posix ACL in the hash
 118         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
 119         backend_obj.wrap_setxattr(dbname,
 120                                   self.tempf, "system.fake_access_acl", b"")
 121
 122         #the hash would break, and we return an ACL based only on the mode, except we set the ACL using the 'ntvfs' mode that doesn't include a hash
 123         facl = getntacl(self.lp, self.tempf)
 124         anysid = security.dom_sid(security.SID_NT_SELF)
 125         self.assertEquals(acl, facl.as_sddl(anysid))
 126
 127     def test_setntacl_smbd_invalidate_getntacl_smbd(self):
 128         acl = ACL
 129         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x001200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 130         os.chmod(self.tempf, 0o750)
 131         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=False,
 132                  session_info=self.get_session_info())
 133
 134         # This should invalidate the ACL, as we include the posix ACL in the hash
 135         (backend_obj, dbname) = checkset_backend(self.lp, None, None)
 136         backend_obj.wrap_setxattr(dbname,
 137                                   self.tempf, "system.fake_access_acl", b"")
 138
 139         #the hash will break, and we return an ACL based only on the mode
 140         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 141         anysid = security.dom_sid(security.SID_NT_SELF)
 142         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 143
 144     def test_setntacl_getntacl_smbd(self):
 145         acl = ACL
 146         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=True,
 147                  session_info=self.get_session_info())
 148         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 149         anysid = security.dom_sid(security.SID_NT_SELF)
 150         self.assertEquals(facl.as_sddl(anysid),acl)
 151
 152     def test_setntacl_smbd_getntacl_smbd(self):
 153         acl = ACL
 154         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=False,
 155                  session_info=self.get_session_info())
 156         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 157         anysid = security.dom_sid(security.SID_NT_SELF)
 158         self.assertEquals(facl.as_sddl(anysid),acl)
 159
 160     def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
 161         acl = ACL
 162         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 163         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=False,
 164                  session_info=self.get_session_info())
 165         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 166         smbd.set_simple_acl(self.tempf, 0o640)
 167         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 168         anysid = security.dom_sid(security.SID_NT_SELF)
 169         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 170
 171     def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
 172         acl = ACL
 173         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 174         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;BA)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
 175         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=False,
 176                  session_info=self.get_session_info())
 177         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
 178         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 179         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 180         smbd.set_simple_acl(self.tempf, 0o640, BA_gid)
 181
 182         # This should re-calculate an ACL based on the posix details
 183         facl = getntacl(self.lp,self.tempf, direct_db_access=False)
 184         anysid = security.dom_sid(security.SID_NT_SELF)
 185         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 186
 187     def test_setntacl_smbd_getntacl_smbd_gpo(self):
 188         acl = "O:DAG:DUD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 189         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=False,
 190                  session_info=self.get_session_info())
 191         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 192         domsid = security.dom_sid(DOM_SID)
 193         self.assertEquals(facl.as_sddl(domsid),acl)
 194
 195     def test_setntacl_getposixacl(self):
 196         acl = ACL
 197         setntacl(self.lp, self.tempf, acl, DOM_SID, use_ntvfs=False,
 198                  session_info=self.get_session_info())
 199         facl = getntacl(self.lp, self.tempf)
 200         anysid = security.dom_sid(security.SID_NT_SELF)
 201         self.assertEquals(facl.as_sddl(anysid),acl)
 202         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 203
 204     def test_setposixacl_getntacl(self):
 205         smbd.set_simple_acl(self.tempf, 0o750)
 206         # We don't expect the xattr to be filled in in this case
 207         self.assertRaises(TypeError, getntacl, self.lp, self.tempf)
 208
 209     def test_setposixacl_getntacl_smbd(self):
 210         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 211         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 212         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 213         smbd.set_simple_acl(self.tempf, 0o640)
 214         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 215         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 216         anysid = security.dom_sid(security.SID_NT_SELF)
 217         self.assertEquals(acl, facl.as_sddl(anysid))
 218
 219     def test_setposixacl_dir_getntacl_smbd(self):
 220         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 221         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempdir).st_uid)
 222         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 223         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 224         (BA_id,BA_type) = s4_passdb.sid_to_id(BA_sid)
 225         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 226         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 227         (SO_id,SO_type) = s4_passdb.sid_to_id(SO_sid)
 228         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 229         smbd.chown(self.tempdir, BA_id, SO_id)
 230         smbd.set_simple_acl(self.tempdir, 0o750)
 231         facl = getntacl(self.lp, self.tempdir, direct_db_access=False)
 232         acl = "O:BAG:SOD:(A;;0x001f01ff;;;BA)(A;;0x001200a9;;;SO)(A;;;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001200a9;;;CG)(A;OICIIO;0x001200a9;;;WD)"
 233
 234         anysid = security.dom_sid(security.SID_NT_SELF)
 235         self.assertEquals(acl, facl.as_sddl(anysid))
 236
 237     def test_setposixacl_group_getntacl_smbd(self):
 238         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 239         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 240         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 241         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
 242         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
 243         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 244         smbd.set_simple_acl(self.tempf, 0o640, BA_gid)
 245         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
 246         domsid = passdb.get_global_sam_sid()
 247         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
 248         anysid = security.dom_sid(security.SID_NT_SELF)
 249         self.assertEquals(acl, facl.as_sddl(anysid))
 250
 251     def test_setposixacl_getposixacl(self):
 252         smbd.set_simple_acl(self.tempf, 0o640)
 253         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 254         self.assertEquals(posix_acl.count, 4, self.print_posix_acl(posix_acl))
 255
 256         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 257         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 258
 259         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 260         self.assertEquals(posix_acl.acl[1].a_perm, 4)
 261
 262         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 263         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 264
 265         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 266         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 267
 268     def test_setposixacl_dir_getposixacl(self):
 269         smbd.set_simple_acl(self.tempdir, 0o750)
 270         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 271         self.assertEquals(posix_acl.count, 4, self.print_posix_acl(posix_acl))
 272
 273         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 274         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 275
 276         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 277         self.assertEquals(posix_acl.acl[1].a_perm, 5)
 278
 279         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 280         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 281
 282         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
 283         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 284
 285     def test_setposixacl_group_getposixacl(self):
 286         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 287         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 288         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 289         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 290         smbd.set_simple_acl(self.tempf, 0o670, BA_gid)
 291         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 292
 293         self.assertEquals(posix_acl.count, 5, self.print_posix_acl(posix_acl))
 294
 295         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
 296         self.assertEquals(posix_acl.acl[0].a_perm, 6)
 297
 298         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 299         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 300
 301         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 302         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 303
 304         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_GROUP)
 305         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 306         self.assertEquals(posix_acl.acl[3].info.gid, BA_gid)
 307
 308         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_MASK)
 309         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 310
 311     def test_setntacl_sysvol_check_getposixacl(self):
 312         acl = provision.SYSVOL_ACL
 313         domsid = passdb.get_global_sam_sid()
 314         session_info = self.get_session_info(domsid)
 315         setntacl(self.lp, self.tempf, acl, str(domsid), use_ntvfs=False,
 316                  session_info=session_info)
 317         facl = getntacl(self.lp, self.tempf)
 318         self.assertEquals(facl.as_sddl(domsid),acl)
 319         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 320
 321         nwrap_module_so_path = os.getenv('NSS_WRAPPER_MODULE_SO_PATH')
 322         nwrap_module_fn_prefix = os.getenv('NSS_WRAPPER_MODULE_FN_PREFIX')
 323
 324         nwrap_winbind_active = (nwrap_module_so_path != "" and
 325                                 nwrap_module_fn_prefix == "winbind")
 326
 327         LA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_ADMINISTRATOR))
 328         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 329         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 330         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 331         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 332
 333         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 334
 335         # These assertions correct for current ad_dc selftest
 336         # configuration.  When other environments have a broad range of
 337         # groups mapped via passdb, we can relax some of these checks
 338         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 339         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 340         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 341         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 342         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 343         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 344         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 345         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 346         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 347         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 348
 349         self.assertEquals(posix_acl.count, 13, self.print_posix_acl(posix_acl))
 350
 351         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 352         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 353         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 354
 355         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 356         if nwrap_winbind_active or session_info:
 357             self.assertEquals(posix_acl.acl[1].a_perm, 7)
 358         else:
 359             self.assertEquals(posix_acl.acl[1].a_perm, 6)
 360         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 361
 362         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 363         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 364
 365         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 366         if nwrap_winbind_active or session_info:
 367             self.assertEquals(posix_acl.acl[3].a_perm, 7)
 368         else:
 369             self.assertEquals(posix_acl.acl[3].a_perm, 6)
 370
 371         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 372         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 373         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 374
 375         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 376         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 377
 378         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 379         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 380         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 381
 382         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 383         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 384         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 385
 386         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 387         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 388         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 389
 390         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 391         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 392         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 393
 394         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 395         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 396         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 397
 398         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 399         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 400         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 401
 402         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_MASK)
 403         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 404
 405
 406 # check that it matches:
 407 # user::rwx
 408 # user:root:rwx (selftest user actually)
 409 # group::rwx
 410 # group:Local Admins:rwx
 411 # group:3000000:r-x
 412 # group:3000001:rwx
 413 # group:3000002:r-x
 414 # mask::rwx
 415 # other::---
 416
 417 #
 418 # This is in this order in the NDR smb_acl (not re-orderded for display)
 419 # a_type: GROUP
 420 # a_perm: 7
 421 # uid: -1
 422 # gid: 10
 423 # a_type: USER
 424 # a_perm: 6
 425 # uid: 0 (selftest user actually)
 426 # gid: -1
 427 # a_type: OTHER
 428 # a_perm: 0
 429 # uid: -1
 430 # gid: -1
 431 # a_type: USER_OBJ
 432 # a_perm: 6
 433 # uid: -1
 434 # gid: -1
 435 # a_type: GROUP_OBJ
 436 # a_perm: 7
 437 # uid: -1
 438 # gid: -1
 439 # a_type: GROUP
 440 # a_perm: 5
 441 # uid: -1
 442 # gid: 3000020
 443 # a_type: GROUP
 444 # a_perm: 7
 445 # uid: -1
 446 # gid: 3000000
 447 # a_type: GROUP
 448 # a_perm: 5
 449 # uid: -1
 450 # gid: 3000001
 451 # a_type: MASK
 452 # a_perm: 7
 453 # uid: -1
 454 # gid: -1
 455
 456 #
 457
 458
 459     def test_setntacl_sysvol_dir_check_getposixacl(self):
 460         acl = provision.SYSVOL_ACL
 461         domsid = passdb.get_global_sam_sid()
 462         session_info = self.get_session_info(domsid)
 463         setntacl(self.lp, self.tempdir, acl, str(domsid), use_ntvfs=False,
 464                  session_info=session_info)
 465         facl = getntacl(self.lp, self.tempdir)
 466         self.assertEquals(facl.as_sddl(domsid),acl)
 467         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 468
 469         LA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_ADMINISTRATOR))
 470         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 471         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 472         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 473         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 474
 475         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 476
 477         # These assertions correct for current ad_dc selftest
 478         # configuration.  When other environments have a broad range of
 479         # groups mapped via passdb, we can relax some of these checks
 480         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 481         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 482         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 483         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 484         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 485         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 486         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 487         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 488         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 489         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 490
 491         self.assertEquals(posix_acl.count, 13, self.print_posix_acl(posix_acl))
 492
 493         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 494         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 495         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 496
 497         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 498         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 499         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 500
 501         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 502         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 503
 504         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 505         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 506
 507         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 508         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 509         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 510
 511         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 512         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 513
 514         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 515         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 516         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 517
 518         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 519         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 520         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 521
 522         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 523         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 524         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 525
 526         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 527         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 528         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 529
 530         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 531         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 532         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 533
 534         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 535         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 536         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 537
 538         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_MASK)
 539         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 540
 541
 542 # check that it matches:
 543 # user::rwx
 544 # user:root:rwx (selftest user actually)
 545 # group::rwx
 546 # group:3000000:rwx
 547 # group:3000001:r-x
 548 # group:3000002:rwx
 549 # group:3000003:r-x
 550 # mask::rwx
 551 # other::---
 552
 553
 554     def test_setntacl_policies_dir_check_getposixacl(self):
 555         acl = provision.POLICIES_ACL
 556         domsid = passdb.get_global_sam_sid()
 557         session_info = self.get_session_info(domsid)
 558         setntacl(self.lp, self.tempdir, acl, str(domsid), use_ntvfs=False,
 559                  session_info=session_info)
 560         facl = getntacl(self.lp, self.tempdir)
 561         self.assertEquals(facl.as_sddl(domsid),acl)
 562         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 563
 564         LA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_ADMINISTRATOR))
 565         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 566         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 567         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 568         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 569         PA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_POLICY_ADMINS))
 570
 571         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 572
 573         # These assertions correct for current ad_dc selftest
 574         # configuration.  When other environments have a broad range of
 575         # groups mapped via passdb, we can relax some of these checks
 576         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 577         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 578         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 579         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 580         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 581         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 582         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 583         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 584         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 585         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 586         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 587         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 588
 589         self.assertEquals(posix_acl.count, 15, self.print_posix_acl(posix_acl))
 590
 591         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 592         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 593         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 594
 595         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 596         self.assertEquals(posix_acl.acl[1].a_perm, 7)
 597         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 598
 599         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 600         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 601
 602         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 603         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 604
 605         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 606         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 607         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 608
 609         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 610         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 611
 612         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 613         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 614         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 615
 616         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 617         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 618         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 619
 620         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 621         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 622         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 623
 624         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 625         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 626         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 627
 628         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 629         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 630         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 631
 632         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 633         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 634         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 635
 636         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_USER)
 637         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 638         self.assertEquals(posix_acl.acl[12].info.uid, PA_gid)
 639
 640         self.assertEquals(posix_acl.acl[13].a_type, smb_acl.SMB_ACL_GROUP)
 641         self.assertEquals(posix_acl.acl[13].a_perm, 7)
 642         self.assertEquals(posix_acl.acl[13].info.gid, PA_gid)
 643
 644         self.assertEquals(posix_acl.acl[14].a_type, smb_acl.SMB_ACL_MASK)
 645         self.assertEquals(posix_acl.acl[14].a_perm, 7)
 646
 647
 648 # check that it matches:
 649 # user::rwx
 650 # user:root:rwx  (selftest user actually)
 651 # group::rwx
 652 # group:3000000:rwx
 653 # group:3000001:r-x
 654 # group:3000002:rwx
 655 # group:3000003:r-x
 656 # group:3000004:rwx
 657 # mask::rwx
 658 # other::---
 659
 660
 661
 662     def test_setntacl_policies_check_getposixacl(self):
 663         acl = provision.POLICIES_ACL
 664
 665         domsid = passdb.get_global_sam_sid()
 666         session_info = self.get_session_info(domsid)
 667         setntacl(self.lp, self.tempf, acl, str(domsid), use_ntvfs=False,
 668                  session_info=session_info)
 669         facl = getntacl(self.lp, self.tempf)
 670         self.assertEquals(facl.as_sddl(domsid),acl)
 671         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 672
 673         nwrap_module_so_path = os.getenv('NSS_WRAPPER_MODULE_SO_PATH')
 674         nwrap_module_fn_prefix = os.getenv('NSS_WRAPPER_MODULE_FN_PREFIX')
 675
 676         nwrap_winbind_active = (nwrap_module_so_path != "" and
 677                                 nwrap_module_fn_prefix == "winbind")
 678
 679         LA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_ADMINISTRATOR))
 680         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 681         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 682         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 683         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 684         PA_sid = security.dom_sid(str(domsid) + "-" + str(security.DOMAIN_RID_POLICY_ADMINS))
 685
 686         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 687
 688         # These assertions correct for current ad_dc selftest
 689         # configuration.  When other environments have a broad range of
 690         # groups mapped via passdb, we can relax some of these checks
 691         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 692         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 693         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 694         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
 695         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 696         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 697         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 698         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 699         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 700         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 701         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 702         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 703
 704         self.assertEquals(posix_acl.count, 15, self.print_posix_acl(posix_acl))
 705
 706         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 707         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 708         self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
 709
 710         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 711         if nwrap_winbind_active or session_info:
 712             self.assertEquals(posix_acl.acl[1].a_perm, 7)
 713         else:
 714             self.assertEquals(posix_acl.acl[1].a_perm, 6)
 715         self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
 716
 717         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 718         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 719
 720         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 721         if nwrap_winbind_active or session_info:
 722             self.assertEquals(posix_acl.acl[3].a_perm, 7)
 723         else:
 724             self.assertEquals(posix_acl.acl[3].a_perm, 6)
 725
 726         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_USER)
 727         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 728         self.assertEquals(posix_acl.acl[4].info.uid, BA_gid)
 729
 730         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 731         self.assertEquals(posix_acl.acl[5].a_perm, 7)
 732
 733         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_USER)
 734         self.assertEquals(posix_acl.acl[6].a_perm, 5)
 735         self.assertEquals(posix_acl.acl[6].info.uid, SO_gid)
 736
 737         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 738         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 739         self.assertEquals(posix_acl.acl[7].info.gid, SO_gid)
 740
 741         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_USER)
 742         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 743         self.assertEquals(posix_acl.acl[8].info.uid, SY_gid)
 744
 745         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_GROUP)
 746         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 747         self.assertEquals(posix_acl.acl[9].info.gid, SY_gid)
 748
 749         self.assertEquals(posix_acl.acl[10].a_type, smb_acl.SMB_ACL_USER)
 750         self.assertEquals(posix_acl.acl[10].a_perm, 5)
 751         self.assertEquals(posix_acl.acl[10].info.uid, AU_gid)
 752
 753         self.assertEquals(posix_acl.acl[11].a_type, smb_acl.SMB_ACL_GROUP)
 754         self.assertEquals(posix_acl.acl[11].a_perm, 5)
 755         self.assertEquals(posix_acl.acl[11].info.gid, AU_gid)
 756
 757         self.assertEquals(posix_acl.acl[12].a_type, smb_acl.SMB_ACL_USER)
 758         self.assertEquals(posix_acl.acl[12].a_perm, 7)
 759         self.assertEquals(posix_acl.acl[12].info.uid, PA_gid)
 760
 761         self.assertEquals(posix_acl.acl[13].a_type, smb_acl.SMB_ACL_GROUP)
 762         self.assertEquals(posix_acl.acl[13].a_perm, 7)
 763         self.assertEquals(posix_acl.acl[13].info.gid, PA_gid)
 764
 765         self.assertEquals(posix_acl.acl[14].a_type, smb_acl.SMB_ACL_MASK)
 766         self.assertEquals(posix_acl.acl[14].a_perm, 7)
 767
 768
 769 # check that it matches:
 770 # user::rwx
 771 # user:root:rwx (selftest user actually)
 772 # group::rwx
 773 # group:Local Admins:rwx
 774 # group:3000000:r-x
 775 # group:3000001:rwx
 776 # group:3000002:r-x
 777 # group:3000003:rwx
 778 # mask::rwx
 779 # other::---
 780
 781 #
 782 # This is in this order in the NDR smb_acl (not re-orderded for display)
 783 # a_type: GROUP
 784 # a_perm: 7
 785 # uid: -1
 786 # gid: 10
 787 # a_type: USER
 788 # a_perm: 6
 789 # uid: 0 (selftest user actually)
 790 # gid: -1
 791 # a_type: OTHER
 792 # a_perm: 0
 793 # uid: -1
 794 # gid: -1
 795 # a_type: USER_OBJ
 796 # a_perm: 6
 797 # uid: -1
 798 # gid: -1
 799 # a_type: GROUP_OBJ
 800 # a_perm: 7
 801 # uid: -1
 802 # gid: -1
 803 # a_type: GROUP
 804 # a_perm: 5
 805 # uid: -1
 806 # gid: 3000020
 807 # a_type: GROUP
 808 # a_perm: 7
 809 # uid: -1
 810 # gid: 3000000
 811 # a_type: GROUP
 812 # a_perm: 5
 813 # uid: -1
 814 # gid: 3000001
 815 # a_type: GROUP
 816 # a_perm: 7
 817 # uid: -1
 818 # gid: 3000003
 819 # a_type: MASK
 820 # a_perm: 7
 821 # uid: -1
 822 # gid: -1
 823
 824 class SessionedPosixAclMappingTests(PosixAclMappingTests):
 825     """
 826     Run same test suite with session enabled.
 827     """
 828
 829     def get_session_info(self, domsid=DOM_SID):
 830         """
 831         Get session_info for setntacl.
 832         """
 833         if str(domsid) != str(self.samdb.get_domain_sid()):
 834             # fake it with admin session as domsid is not in local db
 835             return auth.admin_session(self.lp, str(domsid))
 836
 837         dn = '<SID={}-{}>'.format(domsid, security.DOMAIN_RID_ADMINISTRATOR)
 838         flags = (auth.AUTH_SESSION_INFO_DEFAULT_GROUPS |
 839                  auth.AUTH_SESSION_INFO_AUTHENTICATED |
 840                  auth.AUTH_SESSION_INFO_SIMPLE_PRIVILEGES)
 841         return auth.user_session(self.samdb, lp_ctx=self.lp, dn=dn,
 842                                  session_info_flags=flags)
 843
 844 class UnixSessionedPosixAclMappingTests(PosixAclMappingTests):
 845     """
 846     Run same test suite with session enabled.
 847     """
 848
 849     def get_session_info(self, domsid=DOM_SID):
 850         """
 851         Get session_info for setntacl.
 852         """
 853         if str(domsid) != str(self.samdb.get_domain_sid()):
 854             # fake it with admin session as domsid is not in local db
 855             return auth.admin_session(self.lp, str(domsid))
 856
 857         dn = '<SID={}-{}>'.format(domsid, security.DOMAIN_RID_ADMINISTRATOR)
 858         flags = (auth.AUTH_SESSION_INFO_DEFAULT_GROUPS |
 859                  auth.AUTH_SESSION_INFO_AUTHENTICATED |
 860                  auth.AUTH_SESSION_INFO_SIMPLE_PRIVILEGES)
 861
 862         session = auth.user_session(self.samdb, lp_ctx=self.lp, dn=dn,
 863                                     session_info_flags=flags)
 864         auth.session_info_fill_unix(session,
 865                                     lp_ctx=self.lp,
 866                                     user_name="Administrator")
 867         return session