sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-11 16:58:40 +03:00
Code

tests/ntacls: unblock failing gitlab pipelines because test_setntacl_forcenative

Browse Source 
This expects PermissionError: [Errno 1] Operation not permitted,
but it seems that setxattr() for security.NTACL works on gitlab
runners without being root.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Stefan Metzmacher 2024-05-08 18:03:54 +02:00 committed by Andrew Bartlett
parent 380d9c5a73
commit 237d9d0228
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
python/samba/tests/ntacls.py
View File

@ -83,5 +83,5 @@ class NtaclsTests(TestCaseInTempDir):
lp = LoadParm() lp = LoadParm()
open(self.tempf, 'w').write("empty") open(self.tempf, 'w').write("empty")
lp.set("posix:eadb", os.path.join(self.tempdir, "eadbtest.tdb")) lp.set("posix:eadb", os.path.join(self.tempdir, "eadbtest.tdb"))
self.assertRaises(Exception, setntacl, lp, self.tempf, NTACL_SDDL, self.assertRaises(PermissionError, setntacl, lp, self.tempf, NTACL_SDDL,
DOMAIN_SID, self.session_info, "native") DOMAIN_SID, self.session_info, "native")

18
selftest/flapping.d/gitlab-setxattr-security Normal file
View File

@ -0,0 +1,18 @@
# gitlab runners with kernel 5.15.109+
# allow setxattr() on security.NTACL
#
# It's not clear in detail why there's a difference
# between various systems, one reason could be that
# with selinux inode_owner_or_capable() is used to check
# setxattr() permissions:
# it checks for the fileowner too, as well as CAP_FOWNER.
# Otherwise cap_inode_setxattr() is used, which checks for
# CAP_SYS_ADMIN.
#
# But the kernel doesn't have selinux only apparmor...
#
# test_setntacl_forcenative expects
# PermissionError: [Errno 1] Operation not permitted
#
# So for now we allow this to fail...
^samba.tests.ntacls.samba.tests.ntacls.NtaclsTests.test_setntacl_forcenative.none