test_nfs4_acls: Add test for mapping from NFS4 to DACL in config mode special

The mapping code between NFSv4 ACLs and security descriptors still has
the deprecated config setting "nfs4:mode = special". This should not be
used as it has security problems: All entries matching owner or group
are mapped to "special owner" or "special group", which can change its
meaning when being inherited to a new file or directory with different
owner and owning group.

This mode should eventually be removed, but as long as it still exists
add testcases to verify the expected behavior. This patch adds the
testcase for "nfs4:mode = special" when mapping from the NFS4 ACL to the
DACL in the security descriptor.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14032

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

diff --git a/source3/modules/test_nfs4_acls.c b/source3/modules/test_nfs4_acls.c
index eda2fe56d324f72236a4e3b20f7fd1255b67882c..341bf179ea98390fc0908d0bbb645bf8afc1d503 100644 (file)
--- a/source3/modules/test_nfs4_acls.c
+++ b/source3/modules/test_nfs4_acls.c
@@ -1537,6 +1537,68 @@ static void test_dacl_to_nfs4_config_special(void **state)
        TALLOC_FREE(frame);
 }
 
+static void test_nfs4_to_dacl_config_special(void **state)
+{
+       struct dom_sid *sids = *state;
+       TALLOC_CTX *frame = talloc_stackframe();
+       struct SMB4ACL_T *nfs4_acl;
+       SMB_ACE4PROP_T nfs4_ace;
+       struct security_ace *dacl_aces;
+       int good_aces;
+       struct smbacl4_vfs_params params = {
+               .mode = e_special,
+               .do_chown = true,
+               .acedup = e_dontcare,
+               .map_full_control = true,
+       };
+
+       nfs4_acl = smb_create_smb4acl(frame);
+       assert_non_null(nfs4_acl);
+
+       /*
+        * In config mode special, this is not mapped to Creator Owner
+        */
+       nfs4_ace = (SMB_ACE4PROP_T) {
+               .flags          = SMB_ACE4_ID_SPECIAL,
+               .who.special_id = SMB_ACE4_WHO_OWNER,
+               .aceType        = SMB_ACE4_ACCESS_ALLOWED_ACE_TYPE,
+               .aceFlags       = SMB_ACE4_FILE_INHERIT_ACE,
+               .aceMask        = SMB_ACE4_READ_DATA,
+       };
+       assert_non_null(smb_add_ace4(nfs4_acl, &nfs4_ace));
+
+       /*
+        * In config mode special, this is not mapped to Creator Group
+        */
+       nfs4_ace = (SMB_ACE4PROP_T) {
+               .flags          = SMB_ACE4_ID_SPECIAL,
+               .who.special_id = SMB_ACE4_WHO_GROUP,
+               .aceType        = SMB_ACE4_ACCESS_ALLOWED_ACE_TYPE,
+               .aceFlags       = SMB_ACE4_DIRECTORY_INHERIT_ACE,
+               .aceMask        = SMB_ACE4_WRITE_DATA,
+       };
+       assert_non_null(smb_add_ace4(nfs4_acl, &nfs4_ace));
+
+       assert_true(smbacl4_nfs42win(frame, &params, nfs4_acl,
+                                    &sids[0], &sids[1], true,
+                                    &dacl_aces, &good_aces));
+
+       assert_int_equal(good_aces, 2);
+       assert_non_null(dacl_aces);
+
+       assert_int_equal(dacl_aces[0].type, SEC_ACE_TYPE_ACCESS_ALLOWED);
+       assert_int_equal(dacl_aces[0].flags, SEC_ACE_FLAG_OBJECT_INHERIT);
+       assert_int_equal(dacl_aces[0].access_mask, SEC_FILE_READ_DATA);
+       assert_true(dom_sid_equal(&dacl_aces[0].trustee, &sids[0]));
+
+       assert_int_equal(dacl_aces[1].type, SEC_ACE_TYPE_ACCESS_ALLOWED);
+       assert_int_equal(dacl_aces[1].flags, SEC_ACE_FLAG_CONTAINER_INHERIT);
+       assert_int_equal(dacl_aces[1].access_mask, SEC_FILE_WRITE_DATA);
+       assert_true(dom_sid_equal(&dacl_aces[1].trustee, &sids[1]));
+
+       TALLOC_FREE(frame);
+}
+
 int main(int argc, char **argv)
 {
        const struct CMUnitTest tests[] = {
@@ -1557,6 +1619,7 @@ int main(int argc, char **argv)
                cmocka_unit_test(test_dacl_to_nfs4_acedup_settings),
                cmocka_unit_test(test_dacl_to_nfs4_acedup_match),
                cmocka_unit_test(test_dacl_to_nfs4_config_special),
+               cmocka_unit_test(test_nfs4_to_dacl_config_special),
        };
 
        cmocka_set_message_output(CM_OUTPUT_SUBUNIT);