sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-10 01:18:15 +03:00
Code

pytest: security_descriptors: tests without revision number hack

Browse Source 
ACL revision 4 (SECURITY_ACL_REVISION_ADS) is effectively a superset
of revision 2 (SECURITY_ACL_REVISION_NT4), so any revision 2
ACL can be called revision 4 without any problem. But not vice versa:
a revision 4 ACL can contain ACE types that a revision 2 ACL can't. The
extra ACE types relate to objects.

Samba currently simplifies things by calling all its ACLs revision 4,
even if (as is commonly the case) the ACLs contain only revision 2 ACEs.
On the other hand, Windows will use revision 2 whenever it can. In other
tests we skip past this by forcing Windows ACLs to v4 before comparison.
This test is to remind us of the incompatibility.

It would not be hard to fix.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Douglas Bagnall 2023-08-09 14:15:27 +12:00 committed by Andrew Bartlett
parent afec8524bc
commit 7b9462faf0
3 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
libcli/security/tests/data/short-ordinary-acls-v2.json.gz Normal file
View File

Binary file not shown.

9
python/samba/tests/security_descriptors.py
View File

@ -148,3 +148,12 @@ class SDDLvsDescriptorOverSizeAcls(SDDLvsDescriptorBase):
ACEs), these cannot currently be parsed by Samba.
"""
json_file = TEST_DIR / 'oversize-acls.json.gz'
@DynamicTestCase
class SDDLvsDescriptorShortOrdinaryAclsNoMungeV4(SDDLvsDescriptorBase):
"""These ones have revision 2 ACLs (NT4), but Samba's SDDL only writes
revision 4 ACLs (which are otherwise identical).
"""
munge_to_v4 = False
json_file = TEST_DIR / 'short-ordinary-acls-v2.json.gz'

1
selftest/knownfail.d/security-descriptors
View File

@ -1,3 +1,4 @@
^samba.tests.security_descriptors.+SDDLvsDescriptorRegistryObjectRights.+
^samba.tests.security_descriptors.+SDDLvsDescriptorShortOrdinaryAclsNoMungeV4.+
^samba.tests.security_descriptors.+SDDLvsDescriptorOverSizeAcls.+