source4/scripting/python/samba/tests/posixacl.py

   1 # Unix SMB/CIFS implementation. Tests for NT and posix ACL manipulation
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
   3 # Copyright (C) Andrew Bartlett 2012
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 #
  18
  19 """Tests for the Samba3 NT -> posix ACL layer"""
  20
  21 from samba.ntacls import setntacl, getntacl, XattrBackendError
  22 from samba.dcerpc import xattr, security, smb_acl, idmap
  23 from samba.param import LoadParm
  24 from samba.tests import TestCase, TestSkipped
  25 from samba import provision
  26 import random
  27 import os
  28 from samba.samba3 import smbd, passdb
  29 from samba.samba3 import param as s3param
  30
  31 # To print a posix ACL use:
  32 #        for entry in posix_acl.acl:
  33 #            print "a_type: %d" % entry.a_type
  34 #            print "a_perm: %o" % entry.a_perm
  35 #            print "uid: %d" % entry.uid
  36 #            print "gid: %d" % entry.gid
  37
  38 def is_minus_one(val):
  39     return (val == -1 or val == 4294967295)
  40
  41 class PosixAclMappingTests(TestCase):
  42
  43     def test_setntacl(self):
  44         random.seed()
  45         lp = LoadParm()
  46         path = os.environ['SELFTEST_PREFIX']
  47         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  48         tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
  49         open(tempf, 'w').write("empty")
  50         setntacl(lp, tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  51         os.unlink(tempf)
  52
  53     def test_setntacl_smbd_getntacl(self):
  54         random.seed()
  55         lp = LoadParm()
  56         path = None
  57         path = os.environ['SELFTEST_PREFIX']
  58         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  59         tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
  60         open(tempf, 'w').write("empty")
  61         setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  62         facl = getntacl(lp,tempf, direct_db_access=True)
  63         anysid = security.dom_sid(security.SID_NT_SELF)
  64         self.assertEquals(facl.as_sddl(anysid),acl)
  65         os.unlink(tempf)
  66
  67     def test_setntacl_getntacl_smbd(self):
  68         random.seed()
  69         lp = LoadParm()
  70         path = None
  71         path = os.environ['SELFTEST_PREFIX']
  72         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  73         tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
  74         open(tempf, 'w').write("empty")
  75         setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
  76         facl = getntacl(lp,tempf, direct_db_access=False)
  77         anysid = security.dom_sid(security.SID_NT_SELF)
  78         self.assertEquals(facl.as_sddl(anysid),acl)
  79         os.unlink(tempf)
  80
  81     def test_setntacl_smbd_getntacl_smbd(self):
  82         random.seed()
  83         lp = LoadParm()
  84         path = None
  85         path = os.environ['SELFTEST_PREFIX']
  86         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
  87         tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
  88         open(tempf, 'w').write("empty")
  89         setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
  90         facl = getntacl(lp,tempf, direct_db_access=False)
  91         anysid = security.dom_sid(security.SID_NT_SELF)
  92         self.assertEquals(facl.as_sddl(anysid),acl)
  93         os.unlink(tempf)
  94
  95     def test_setntacl_getposixacl(self):
  96         random.seed()
  97         lp = LoadParm()
  98         path = None
  99         path = os.environ['SELFTEST_PREFIX']
 100         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
 101         tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
 102         open(tempf, 'w').write("empty")
 103         setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 104         facl = getntacl(lp,tempf)
 105         anysid = security.dom_sid(security.SID_NT_SELF)
 106         self.assertEquals(facl.as_sddl(anysid),acl)
 107         posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 108         os.unlink(tempf)
 109
 110     def test_setntacl_sysvol_check_getposixacl(self):
 111         random.seed()
 112         lp = LoadParm()
 113         s3conf = s3param.get_context()
 114         path = None
 115         path = os.environ['SELFTEST_PREFIX']
 116         acl = provision.SYSVOL_ACL
 117         tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
 118         open(tempf, 'w').write("empty")
 119         domsid = passdb.get_global_sam_sid()
 120         setntacl(lp,tempf,acl,str(domsid), use_ntvfs=False)
 121         facl = getntacl(lp,tempf)
 122         self.assertEquals(facl.as_sddl(domsid),acl)
 123         posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 124
 125         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 126         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 127         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 128         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 129         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 130
 131         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
 132
 133         # These assertions correct for current plugin_s4_dc selftest
 134         # configuration.  When other environments have a broad range of
 135         # groups mapped via passdb, we can relax some of these checks
 136         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 137         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 138         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 139         self.assertEquals(BA_type, idmap.ID_TYPE_GID)
 140         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 141         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 142         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 143         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 144         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 145         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 146
 147         self.assertEquals(posix_acl.count, 9)
 148
 149         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 150         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 151         self.assertEquals(posix_acl.acl[0].gid, BA_gid)
 152         self.assertTrue(is_minus_one(posix_acl.acl[0].uid))
 153
 154         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 155         self.assertEquals(posix_acl.acl[1].a_perm, 6)
 156         self.assertEquals(posix_acl.acl[1].uid, LA_uid)
 157         self.assertTrue(is_minus_one(posix_acl.acl[1].gid))
 158
 159         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 160         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 161         self.assertTrue(is_minus_one(posix_acl.acl[2].uid))
 162         self.assertTrue(is_minus_one(posix_acl.acl[2].gid))
 163
 164         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 165         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 166         self.assertTrue(is_minus_one(posix_acl.acl[3].uid))
 167         self.assertTrue(is_minus_one(posix_acl.acl[3].gid))
 168
 169         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 170         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 171         self.assertTrue(is_minus_one(posix_acl.acl[4].uid))
 172         self.assertTrue(is_minus_one(posix_acl.acl[4].gid))
 173
 174         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 175         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 176         self.assertEquals(posix_acl.acl[5].gid, SO_gid)
 177         self.assertTrue(is_minus_one(posix_acl.acl[5].uid))
 178
 179         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 180         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 181         self.assertEquals(posix_acl.acl[6].gid, SY_gid)
 182         self.assertTrue(is_minus_one(posix_acl.acl[6].uid))
 183
 184         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 185         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 186         self.assertEquals(posix_acl.acl[7].gid, AU_gid)
 187         self.assertTrue(is_minus_one(posix_acl.acl[7].uid))
 188
 189         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_MASK)
 190         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 191         self.assertTrue(is_minus_one(posix_acl.acl[8].uid))
 192         self.assertTrue(is_minus_one(posix_acl.acl[8].gid))
 193
 194
 195 # check that it matches:
 196 # user::rwx
 197 # user:root:rwx (selftest user actually)
 198 # group::rwx
 199 # group:wheel:rwx
 200 # group:3000000:r-x
 201 # group:3000001:rwx
 202 # group:3000002:r-x
 203 # mask::rwx
 204 # other::---
 205
 206 #
 207 # This is in this order in the NDR smb_acl (not re-orderded for display)
 208 # a_type: GROUP
 209 # a_perm: 7
 210 # uid: -1
 211 # gid: 10
 212 # a_type: USER
 213 # a_perm: 6
 214 # uid: 0 (selftest user actually)
 215 # gid: -1
 216 # a_type: OTHER
 217 # a_perm: 0
 218 # uid: -1
 219 # gid: -1
 220 # a_type: USER_OBJ
 221 # a_perm: 6
 222 # uid: -1
 223 # gid: -1
 224 # a_type: GROUP_OBJ
 225 # a_perm: 7
 226 # uid: -1
 227 # gid: -1
 228 # a_type: GROUP
 229 # a_perm: 5
 230 # uid: -1
 231 # gid: 3000020
 232 # a_type: GROUP
 233 # a_perm: 7
 234 # uid: -1
 235 # gid: 3000000
 236 # a_type: GROUP
 237 # a_perm: 5
 238 # uid: -1
 239 # gid: 3000001
 240 # a_type: MASK
 241 # a_perm: 7
 242 # uid: -1
 243 # gid: -1
 244
 245 #
 246
 247         os.unlink(tempf)
 248
 249     def test_setntacl_policies_check_getposixacl(self):
 250         random.seed()
 251         lp = LoadParm()
 252         s3conf = s3param.get_context()
 253         path = None
 254         path = os.environ['SELFTEST_PREFIX']
 255         acl = provision.POLICIES_ACL
 256         tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
 257         open(tempf, 'w').write("empty")
 258         domsid = passdb.get_global_sam_sid()
 259         setntacl(lp,tempf,acl,str(domsid), use_ntvfs=False)
 260         facl = getntacl(lp,tempf)
 261         self.assertEquals(facl.as_sddl(domsid),acl)
 262         posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 263
 264         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
 265         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
 266         SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
 267         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
 268         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 269         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 270
 271         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
 272
 273         # These assertions correct for current plugin_s4_dc selftest
 274         # configuration.  When other environments have a broad range of
 275         # groups mapped via passdb, we can relax some of these checks
 276         (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
 277         self.assertEquals(LA_type, idmap.ID_TYPE_UID)
 278         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
 279         self.assertEquals(BA_type, idmap.ID_TYPE_GID)
 280         (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
 281         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 282         (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
 283         self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
 284         (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
 285         self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
 286         (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
 287         self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
 288
 289         self.assertEquals(posix_acl.count, 10)
 290
 291         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
 292         self.assertEquals(posix_acl.acl[0].a_perm, 7)
 293         self.assertEquals(posix_acl.acl[0].gid, BA_gid)
 294         self.assertTrue(is_minus_one(posix_acl.acl[0].uid))
 295
 296         self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
 297         self.assertEquals(posix_acl.acl[1].a_perm, 6)
 298         self.assertEquals(posix_acl.acl[1].uid, LA_uid)
 299         self.assertTrue(is_minus_one(posix_acl.acl[1].gid))
 300
 301         self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
 302         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 303         self.assertTrue(is_minus_one(posix_acl.acl[2].uid))
 304         self.assertTrue(is_minus_one(posix_acl.acl[2].gid))
 305
 306         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
 307         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 308         self.assertTrue(is_minus_one(posix_acl.acl[3].uid))
 309         self.assertTrue(is_minus_one(posix_acl.acl[3].gid))
 310
 311         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
 312         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 313         self.assertTrue(is_minus_one(posix_acl.acl[4].uid))
 314         self.assertTrue(is_minus_one(posix_acl.acl[4].gid))
 315
 316         self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
 317         self.assertEquals(posix_acl.acl[5].a_perm, 5)
 318         self.assertEquals(posix_acl.acl[5].gid, SO_gid)
 319         self.assertTrue(is_minus_one(posix_acl.acl[5].uid))
 320
 321         self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
 322         self.assertEquals(posix_acl.acl[6].a_perm, 7)
 323         self.assertEquals(posix_acl.acl[6].gid, SY_gid)
 324         self.assertTrue(is_minus_one(posix_acl.acl[6].uid))
 325
 326         self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
 327         self.assertEquals(posix_acl.acl[7].a_perm, 5)
 328         self.assertEquals(posix_acl.acl[7].gid, AU_gid)
 329         self.assertTrue(is_minus_one(posix_acl.acl[7].uid))
 330
 331         self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_GROUP)
 332         self.assertEquals(posix_acl.acl[8].a_perm, 7)
 333         self.assertEquals(posix_acl.acl[8].gid, PA_gid)
 334         self.assertTrue(is_minus_one(posix_acl.acl[8].uid))
 335
 336         self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_MASK)
 337         self.assertEquals(posix_acl.acl[9].a_perm, 7)
 338         self.assertTrue(is_minus_one(posix_acl.acl[9].uid))
 339         self.assertTrue(is_minus_one(posix_acl.acl[9].gid))
 340
 341
 342 # check that it matches:
 343 # user::rwx
 344 # user:root:rwx (selftest user actually)
 345 # group::rwx
 346 # group:wheel:rwx
 347 # group:3000000:r-x
 348 # group:3000001:rwx
 349 # group:3000002:r-x
 350 # group:3000003:rwx
 351 # mask::rwx
 352 # other::---
 353
 354 #
 355 # This is in this order in the NDR smb_acl (not re-orderded for display)
 356 # a_type: GROUP
 357 # a_perm: 7
 358 # uid: -1
 359 # gid: 10
 360 # a_type: USER
 361 # a_perm: 6
 362 # uid: 0 (selftest user actually)
 363 # gid: -1
 364 # a_type: OTHER
 365 # a_perm: 0
 366 # uid: -1
 367 # gid: -1
 368 # a_type: USER_OBJ
 369 # a_perm: 6
 370 # uid: -1
 371 # gid: -1
 372 # a_type: GROUP_OBJ
 373 # a_perm: 7
 374 # uid: -1
 375 # gid: -1
 376 # a_type: GROUP
 377 # a_perm: 5
 378 # uid: -1
 379 # gid: 3000020
 380 # a_type: GROUP
 381 # a_perm: 7
 382 # uid: -1
 383 # gid: 3000000
 384 # a_type: GROUP
 385 # a_perm: 5
 386 # uid: -1
 387 # gid: 3000001
 388 # a_type: GROUP
 389 # a_perm: 7
 390 # uid: -1
 391 # gid: 3000003
 392 # a_type: MASK
 393 # a_perm: 7
 394 # uid: -1
 395 # gid: -1
 396
 397 #
 398
 399         os.unlink(tempf)
 400
 401     def setUp(self):
 402         super(PosixAclMappingTests, self).setUp()
 403         s3conf = s3param.get_context()
 404         s3conf.load(self.get_loadparm().configfile)