git.samba.org / garming / samba-autobuild / .git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 6554cfa)
selftest: add tests for samba-tool ntacl changedomsid
authorBjörn Baumbach <bb@sernet.de>
Wed, 12 Jun 2019 19:02:43 +0000 (21:02 +0200)
committerBjörn Baumbach <bb@sernet.de>
Tue, 18 Jun 2019 16:54:22 +0000 (16:54 +0000)
Signed-off-by: Björn Baumbach <bb@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Björn Baumbach <bb@sernet.de>
Autobuild-Date(master): Tue Jun 18 16:54:22 UTC 2019 on sn-devel-184

python/samba/tests/samba_tool/ntacl.py patch | blob | history
source4/selftest/tests.py patch | blob | history
testprogs/blackbox/test_samba-tool_ntacl.sh patch | blob | history

diff --git a/python/samba/tests/samba_tool/ntacl.py b/python/samba/tests/samba_tool/ntacl.py
index e8fee852651578ae00e9fffa6002b1699803ca06..ee166764b6add5492b6c22c5e2e509f2df8a797b 100644 (file)
--- a/python/samba/tests/samba_tool/ntacl.py
+++ b/python/samba/tests/samba_tool/ntacl.py
@@ -133,3 +133,90 @@ class NtACLCmdGetSetTestCase(SambaToolCmdTest):
         self.assertCmdSuccess(result, out, err)
         self.assertEquals(err, "", "Shouldn't be any error messages")
         self.assertEquals(self.acl + "\n", out, "Output should be the ACL")
         self.assertCmdSuccess(result, out, err)
         self.assertEquals(err, "", "Shouldn't be any error messages")
         self.assertEquals(self.acl + "\n", out, "Output should be the ACL")
+
+class NtACLCmdChangedomsidTestCase(SambaToolCmdTest):
+    """Tests for samba-tool ntacl changedomsid subcommand"""
+
+    acl = "O:DAG:DUD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
+    new_acl="O:S-1-5-21-2212615479-2695158682-2101375468-512G:S-1-5-21-2212615479-2695158682-2101375468-513D:P(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375468-512)(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375468-519)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375468-512)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
+    domain_sid=os.environ['DOMSID']
+    new_domain_sid="S-1-5-21-2212615479-2695158682-2101375468"
+
+    def test_ntvfs_check(self):
+        path = os.environ['SELFTEST_PREFIX']
+        tempf = os.path.join(
+            path, "pytests" + str(int(100000 * random.random())))
+        open(tempf, 'w').write("empty")
+
+        print("DOMSID: %s", self.domain_sid)
+
+        (result, out, err) = self.runsubcmd("ntacl",
+                                            "set",
+                                            self.acl,
+                                            tempf,
+                                            "--use-ntvfs")
+        self.assertCmdSuccess(result, out, err)
+        self.assertEquals(out, "", "Shouldn't be any output messages")
+        self.assertIn("Please note that POSIX permissions have NOT been "
+                      "changed, only the stored NT ACL", err)
+
+        (result, out, err) = self.runsubcmd("ntacl",
+                                            "changedomsid",
+                                            self.domain_sid,
+                                            self.new_domain_sid,
+                                            tempf,
+                                            "--use-ntvfs")
+        self.assertCmdSuccess(result, out, err)
+        self.assertEquals(out, "", "Shouldn't be any output messages")
+        self.assertIn("Please note that POSIX permissions have NOT been "
+                      "changed, only the stored NT ACL.", err)
+
+        # Now check they were set correctly
+        (result, out, err) = self.runsubcmd("ntacl",
+                                            "get",
+                                            tempf,
+                                            "--use-ntvfs",
+                                            "--as-sddl")
+        self.assertCmdSuccess(result, out, err)
+        self.assertEquals(err, "", "Shouldn't be any error messages")
+        self.assertEquals(self.new_acl + "\n", out, "Output should be the ACL")
+
+    def test_s3fs_check(self):
+        path = os.environ['SELFTEST_PREFIX']
+        tempf = os.path.join(
+            path, "pytests" + str(int(100000 * random.random())))
+        open(tempf, 'w').write("empty")
+
+        print("DOMSID: %s" % self.domain_sid)
+
+        (result, out, err) = self.runsubcmd("ntacl",
+                                            "set",
+                                            self.acl,
+                                            tempf,
+                                            "--use-s3fs",
+                                            "--service=sysvol")
+        self.assertCmdSuccess(result, out, err)
+        self.assertEquals(out, "", "Shouldn't be any output messages")
+        self.assertEquals(err, "", "Shouldn't be any error messages")
+
+        (result, out, err) = self.runsubcmd("ntacl",
+                                            "changedomsid",
+                                            self.domain_sid,
+                                            self.new_domain_sid,
+                                            tempf,
+                                            "--use-s3fs",
+                                            "--service=sysvol")
+        self.assertCmdSuccess(result, out, err)
+        self.assertEquals(out, "", "Shouldn't be any output messages")
+        self.assertEquals(err, "", "Shouldn't be any error messages")
+
+        # Now check they were set correctly
+        (result, out, err) = self.runsubcmd("ntacl",
+                                            "get",
+                                            tempf,
+                                            "--use-s3fs",
+                                            "--as-sddl",
+                                            "--service=sysvol")
+        self.assertCmdSuccess(result, out, err)
+        self.assertEquals(err, "", "Shouldn't be any error messages")
+        self.assertEquals(self.new_acl + "\n", out, "Output should be the ACL")
diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index 156bd2003721cc15fc3c92b43e8b94f89c7f31bf..0e2138a007cd0dce7a3e758cd803d73e44c9ac83 100755 (executable)
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -488,7 +488,7 @@ plantestsuite("samba4.blackbox.client_etypes_all(ad_dc:client)", "ad_dc:client",
 plantestsuite("samba4.blackbox.client_etypes_legacy(ad_dc:client)", "ad_dc:client", [os.path.join(bbdir, "test_client_etypes.sh"), '$DC_SERVER', '$DC_USERNAME', '$DC_PASSWORD', '$PREFIX_ABS', 'legacy', '23'])
 plantestsuite("samba4.blackbox.client_etypes_strong(ad_dc:client)", "ad_dc:client", [os.path.join(bbdir, "test_client_etypes.sh"), '$DC_SERVER', '$DC_USERNAME', '$DC_PASSWORD', '$PREFIX_ABS', 'strong', '17_18'])
 plantestsuite("samba4.blackbox.net_ads_dns(ad_member:local)", "ad_member:local", [os.path.join(bbdir, "test_net_ads_dns.sh"), '$DC_SERVER', '$DC_USERNAME', '$DC_PASSWORD', '$REALM', '$USERNAME', '$PASSWORD'])
 plantestsuite("samba4.blackbox.client_etypes_legacy(ad_dc:client)", "ad_dc:client", [os.path.join(bbdir, "test_client_etypes.sh"), '$DC_SERVER', '$DC_USERNAME', '$DC_PASSWORD', '$PREFIX_ABS', 'legacy', '23'])
 plantestsuite("samba4.blackbox.client_etypes_strong(ad_dc:client)", "ad_dc:client", [os.path.join(bbdir, "test_client_etypes.sh"), '$DC_SERVER', '$DC_USERNAME', '$DC_PASSWORD', '$PREFIX_ABS', 'strong', '17_18'])
 plantestsuite("samba4.blackbox.net_ads_dns(ad_member:local)", "ad_member:local", [os.path.join(bbdir, "test_net_ads_dns.sh"), '$DC_SERVER', '$DC_USERNAME', '$DC_PASSWORD', '$REALM', '$USERNAME', '$PASSWORD'])
-plantestsuite("samba4.blackbox.samba-tool_ntacl(ad_member:local)", "ad_member:local", [os.path.join(bbdir, "test_samba-tool_ntacl.sh"), '$PREFIX'])
+plantestsuite("samba4.blackbox.samba-tool_ntacl(ad_member:local)", "ad_member:local", [os.path.join(bbdir, "test_samba-tool_ntacl.sh"), '$PREFIX', '$DOMSID'])
 plantestsuite_loadlist("samba4.rpc.echo against NetBIOS alias", "ad_dc_ntvfs", [valgrindify(smbtorture4), "$LISTOPT", "$LOADLIST", 'ncacn_np:$NETBIOSALIAS', '-U$DOMAIN/$USERNAME%$PASSWORD', 'rpc.echo'])
 # json tests hook into ``chgdcpass'' to make them run in contributor CI on
 # gitlab
 plantestsuite_loadlist("samba4.rpc.echo against NetBIOS alias", "ad_dc_ntvfs", [valgrindify(smbtorture4), "$LISTOPT", "$LOADLIST", 'ncacn_np:$NETBIOSALIAS', '-U$DOMAIN/$USERNAME%$PASSWORD', 'rpc.echo'])
 # json tests hook into ``chgdcpass'' to make them run in contributor CI on
 # gitlab
diff --git a/testprogs/blackbox/test_samba-tool_ntacl.sh b/testprogs/blackbox/test_samba-tool_ntacl.sh
index 64a7e6b55d3b45882ef3034fb5680191b6dd07ec..6991165cc632abafc15a99dbf9bfd3903d97b46d 100755 (executable)
--- a/testprogs/blackbox/test_samba-tool_ntacl.sh
+++ b/testprogs/blackbox/test_samba-tool_ntacl.sh
@@ -10,6 +10,7 @@ exit 1;
 fi
 
 PREFIX=$1
 fi
 
 PREFIX=$1
+domain_sid=$2
 
 failed=0
 
 
 failed=0
 
@@ -20,6 +21,8 @@ testfile="$PREFIX/ntacl_testfile"
 
 # acl from samba_tool/ntacl.py tests
 acl="O:DAG:DUD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
 
 # acl from samba_tool/ntacl.py tests
 acl="O:DAG:DUD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
+new_acl="O:S-1-5-21-2212615479-2695158682-2101375468-512G:S-1-5-21-2212615479-2695158682-2101375468-513D:P(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375468-512)(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375468-519)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375468-512)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
+new_domain_sid="S-1-5-21-2212615479-2695158682-2101375468"
 
 . `dirname $0`/subunit.sh
 
 
 . `dirname $0`/subunit.sh
 
@@ -62,6 +65,44 @@ test_set_acl_ntvfs()
        $PYTHON $samba_tool ntacl set "$acl" "$testfile" --use-ntvfs --xattr-backend=tdb -s $PREFIX/ad_member/lib/server.conf
 }
 
        $PYTHON $samba_tool ntacl set "$acl" "$testfile" --use-ntvfs --xattr-backend=tdb -s $PREFIX/ad_member/lib/server.conf
 }
 
+test_changedomsid()
+{
+       testfile="$1"
+
+       $PYTHON $samba_tool ntacl changedomsid \
+               "$domain_sid" "$new_domain_sid" "$testfile" \
+               --service=tmp \
+               -s $PREFIX/ad_member/lib/server.conf
+
+       retacl=$($PYTHON $samba_tool ntacl get \
+                       "$testfile" \
+                       --as-sddl \
+                       --service=tmp \
+                       -s $PREFIX/ad_member/lib/server.conf) || return $?
+
+       test "$retacl" = "$new_acl"
+}
+
+test_changedomsid_ntvfs()
+{
+       testfile="$1"
+
+       $PYTHON $samba_tool ntacl changedomsid \
+               "$domain_sid" "$new_domain_sid" "$testfile" \
+               --use-ntvfs \
+               --xattr-backend=tdb \
+               -s $PREFIX/ad_member/lib/server.conf
+
+       retacl=$($PYTHON $samba_tool ntacl get \
+                       "$testfile" \
+                       --as-sddl \
+                       --xattr-backend=tdb \
+                       --use-ntvfs \
+                       -s $PREFIX/ad_member/lib/server.conf) || return $?
+
+       test "$retacl" = "$new_acl"
+}
+
 # work around include error - s4-loadparm does not allow missing include files
 #
 # Unable to load file /home/bbaumba/src/git/samba/st/ad_member/lib/server.conf
 # work around include error - s4-loadparm does not allow missing include files
 #
 # Unable to load file /home/bbaumba/src/git/samba/st/ad_member/lib/server.conf
@@ -81,9 +122,13 @@ testit "set_ntacl" test_set_acl "$testfile" "$acl" || failed=`expr $failed + 1`
 
 testit "get_ntacl" test_get_acl "$testfile" "$acl" || failed=`expr $failed + 1`
 
 
 testit "get_ntacl" test_get_acl "$testfile" "$acl" || failed=`expr $failed + 1`
 
+testit "changedomsid" test_changedomsid "$testfile" || failed=`expr $failed + 1`
+
 testit "set_ntacl_ntvfs" test_set_acl_ntvfs "$testfile" "$acl" || failed=`expr $failed + 1`
 testit "get_ntacl_ntvfs" test_get_acl_ntvfs "$testfile" "$acl" || failed=`expr $failed + 1`
 
 testit "set_ntacl_ntvfs" test_set_acl_ntvfs "$testfile" "$acl" || failed=`expr $failed + 1`
 testit "get_ntacl_ntvfs" test_get_acl_ntvfs "$testfile" "$acl" || failed=`expr $failed + 1`
 
+testit "changedomsid_ntvfs" test_changedomsid_ntvfs "$testfile" || failed=`expr $failed + 1`
+
 rm -f "$testfile"
 
 exit $failed
 rm -f "$testfile"
 
 exit $failed
Unnamed repository; edit this file 'description' to name the repository.