[SCM] Samba Shared Repository - branch master updated
Jeremy Allison
jra at samba.org
Tue Jul 7 23:04:05 UTC 2020
The branch, master has been updated
via cd5a2d015bf s3:smbcacls: Add support for DFS path
via 449259f6e1f selftest: run smbcacls test against a share with a DFS link
via 3dced6a436b selftest: Add basic smbcacls test(s)
from 61e93698e59 s4:rpc_server: Implement epmapper LookupHandleFree
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit cd5a2d015bfe62b2ff334c1ebf34e371e7cf1238
Author: Anubhav Rakshit <anubhav.rakshit at gmail.com>
Date: Mon Jun 8 00:39:59 2020 +0530
s3:smbcacls: Add support for DFS path
smbcacls does not handle DFS paths correctly. This is beacuse once the
command encounters a path which returns STATUS_PATH_NOT_COVERED, it does
not attempt a GET REFERRAL.
We use cli_resolve_path API to perform a DFS path resolution to solve
the above problem.
Additionally this removes the known fail against smbcacls tests
Signed-off-by: Anubhav Rakshit <anubhav.rakshit at gmail.com>
Reviewed-by: Noel Power <noel.power at suse.com>
Reviewed-by: Jeremy Allison <jra at samba.org>
Autobuild-User(master): Jeremy Allison <jra at samba.org>
Autobuild-Date(master): Tue Jul 7 23:03:00 UTC 2020 on sn-devel-184
commit 449259f6e1fbfb41a03d502a277b5f1fccd2182b
Author: Noel Power <noel.power at suse.com>
Date: Thu Jul 2 11:44:36 2020 +0100
selftest: run smbcacls test against a share with a DFS link
The commit creates a dfs link in existing 'fileserver' env
share msdfs_share. Additionally we create a new dfs target in
a new share (with associated directory)
Additionally add a known fail as smbcacls doesn't not yet navigate DFS links.
A subsequent commit will fix smcacls to handle DFS (and remove the
knownfail)
Signed-off-by: Noel Power <noel.power at suse.com>
Reviewed-by: Jeremy Allison <jra at samba.org>
commit 3dced6a436beee0de8d38b295a6711b3b7bc20e6
Author: Noel Power <noel.power at suse.com>
Date: Tue Jun 30 18:03:42 2020 +0100
selftest: Add basic smbcacls test(s)
Signed-off-by: Noel Power <noel.power at suse.com>
Reviewed-by: Jeremy Allison <jra at samba.org>
-----------------------------------------------------------------------
Summary of changes:
python/samba/tests/blackbox/smbcacls.py | 147 +++++++++++++++++++++
python/samba/tests/blackbox/smbcacls_basic.py | 133 +++++++++++++++++++
.../__init__.py => selftest/knownfail.d/smbcacls | 0
selftest/target/Samba3.pm | 11 ++
source3/utils/smbcacls.c | 23 +++-
source4/selftest/tests.py | 7 +
6 files changed, 317 insertions(+), 4 deletions(-)
create mode 100644 python/samba/tests/blackbox/smbcacls.py
create mode 100644 python/samba/tests/blackbox/smbcacls_basic.py
copy buildtools/wafsamba/__init__.py => selftest/knownfail.d/smbcacls (100%)
Changeset truncated at 500 lines:
diff --git a/python/samba/tests/blackbox/smbcacls.py b/python/samba/tests/blackbox/smbcacls.py
new file mode 100644
index 00000000000..b749124ccac
--- /dev/null
+++ b/python/samba/tests/blackbox/smbcacls.py
@@ -0,0 +1,147 @@
+# Blackbox tests for smbcaclcs
+#
+# Copyright (C) Noel Power noel.power at suse.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+from __future__ import print_function
+from samba.tests import BlackboxTestCase, BlackboxProcessError
+from samba.samba3 import param as s3param
+
+from samba.credentials import Credentials
+
+import os
+
+class SmbCaclsBlockboxTestBase(BlackboxTestCase):
+
+ def setUp(self):
+ super(SmbCaclsBlockboxTestBase, self).setUp()
+ self.lp = s3param.get_context()
+ self.server = os.environ["SERVER"]
+ self.user = os.environ["USER"]
+ self.passwd = os.environ["PASSWORD"]
+ self.creds = Credentials()
+ self.creds.guess(self.lp)
+ self.creds.set_username(self.user)
+ self.creds.set_password(self.passwd)
+ self.testdir = os.getenv("TESTDIR", "smbcacls")
+ self.share = os.getenv("SHARE", "tmp")
+
+ def tearDown(self):
+ try:
+ # remote removal doesn't seem to work with dfs share(s)
+ # #TODO find out if this is intentional (it very well might be)
+ # so if we fail with remote remove perform local remove
+ # (of remote files) instead
+ smbclient_args = self.build_test_cmd("smbclient", ["//%s/%s" % (self.server, self.share), "-c", "deltree %s/*" % self.testdir])
+ self.check_output(smbclient_args)
+ except Exception as e:
+ print("remote remove failed: %s" % str(e))
+ dirpath = os.path.join(os.environ["LOCAL_PATH"],self.testdir)
+ print("falling back to removing contents of local dir: %s" % dirpath)
+ if os.path.exists(dirpath):
+ for entry in os.listdir(dirpath):
+ fullpath = os.path.join(dirpath, entry)
+ if os.path.isdir(fullpath):
+ import shutil
+ shutil.rmtree(fullpath)
+ else:
+ os.unlink(fullpath)
+
+ def ace_dump(self, ace):
+ for key, value in ace.items():
+ print ("%s=%s," % (key, value), end="")
+ print ("")
+
+ def ace_cmp(self, left, right):
+ for key, value in left.items():
+ if key == "user_dom":
+ continue
+ if not key in right:
+ print ("no entry for: %s" % key)
+ return False
+ if value != right[key]:
+ print ("mismatch: %s:%s != %s:%s" % (key, value, key, right[key]))
+ return False
+ return True
+
+ def ace_parse_str(self, ace):
+ parts = ace.split(':')
+ result = {}
+ if parts[0] != "ACL":
+ raise Exception("invalid ace string:%" % ace)
+ if "\\" in parts[1]:
+ result["user_dom"], result["user"] = parts[1].split("\\")
+ elif "/" in parts[1]:
+ result["user_dom"], result["user"] = parts[1].split("/")
+ else:
+ result["user"] = parts[1]
+ result["type"], result["inherit"], result["permissions"] = parts[2].split('/')
+ return result
+
+ def build_test_cmd(self, cmd, args):
+ cmd = [cmd, "-U%s%%%s" % (self.user, self.passwd)]
+ cmd.extend(args)
+ return cmd
+
+ def smb_cacls(self, args):
+ cacls_args = ["//%s/%s" % (self.server, self.share)]
+ cacls_args.extend(args)
+ out = self.check_output(self.build_test_cmd("smbcacls", cacls_args))
+ return out
+
+ def create_remote_test_file(self, remotepath):
+ with self.mktemp() as tmpfile:
+ filepath = os.path.join(self.testdir, remotepath)
+ (dirpath, filename) = os.path.split(remotepath)
+ remote_path = ""
+ if len(dirpath):
+ remote_path = self.testdir.replace("/", "\\", 10)
+ for seg in dirpath.split(os.sep):
+ remote_path = remote_path + "\\" + seg
+ smbclient_args = self.build_test_cmd("smbclient", ["//%s/%s" % (self.server, self.share), "-c", "mkdir %s" % remote_path])
+ self.check_output(smbclient_args)
+ smbclient_args = self.build_test_cmd("smbclient", ["//%s/%s" % (self.server, self.share), "-c", "put %s %s" % (tmpfile, filepath)])
+ out = self.check_output(smbclient_args)
+ return filepath
+
+
+ def file_ace_check(self, remotepath, ace):
+ smbcacls_args = self.build_test_cmd("smbcacls",
+ ["//%s/%s" % (self.server, self.share), "--get",
+ remotepath])
+ try:
+ output = self.check_output(smbcacls_args)
+ except BlackboxProcessError as e:
+ print(str(e))
+ return False
+ out_str = output.decode()
+ aces = []
+ for line in out_str.split("\n"):
+ if line.startswith("ACL"):
+ aces.append(line)
+ for acl in aces:
+ acl_ace = self.ace_parse_str(acl)
+ if ace["user"] == acl_ace["user"] and ace["type"] == acl_ace["type"]:
+ print ("found ACE for %s" % acl_ace["user"])
+ if not self.ace_cmp(acl_ace, ace):
+ print ("differences between file ACE: ")
+ self.ace_dump(acl_ace)
+ print ("and expected ACE: ")
+ self.ace_dump(ace)
+ else:
+ print ("matched ACE for %s" % acl_ace["user"])
+ self.ace_dump(ace)
+ return True
+ return False
diff --git a/python/samba/tests/blackbox/smbcacls_basic.py b/python/samba/tests/blackbox/smbcacls_basic.py
new file mode 100644
index 00000000000..3562157e701
--- /dev/null
+++ b/python/samba/tests/blackbox/smbcacls_basic.py
@@ -0,0 +1,133 @@
+# Blackbox tests for smbcaclcs
+#
+# Copyright (C) Noel Power noel.power at suse.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+from __future__ import print_function
+from samba.tests.blackbox.smbcacls import SmbCaclsBlockboxTestBase
+from samba.tests import BlackboxProcessError
+
+class BasicSmbCaclsTests(SmbCaclsBlockboxTestBase):
+
+ def setUp(self):
+ super(BasicSmbCaclsTests, self).setUp()
+
+ def test_simple_single_set(self):
+ """test smbcacls '--set' attempts to overwrite the ACL for the file
+
+ before:
+
+ +-test_dir/
+ +-file.1 (I)(F)
+
+ after/expected:
+
+ +-test_dir/
+ +-file.1 (F)"""
+
+ file1 = "file-1"
+ try:
+ filepath = self.create_remote_test_file(file1)
+ except BlackboxProcessError as e:
+ self.fail(str(e))
+
+ acl = ("ACL:%s:ALLOWED/0x0/FULL" % self.user)
+ command = "bin/smbcacls -U%s%%%s --set %s //%s/%s %s" % (self.user, self.passwd, acl, self.server, self.share, filepath)
+
+ try:
+ result = self.check_output(command)
+ except BlackboxProcessError as e:
+ self.fail(str(e))
+
+ ace = self.ace_parse_str(acl)
+ self.assertTrue(self.file_ace_check(filepath, ace))
+
+ def test_simple_single_mod(self):
+
+ """test smbcacls '--modify' attempts to modify the ACL for the file
+ (note: first part of the test 'set' ACL to (F) then attempts to modify
+ before:
+
+ +-test_dir/
+ +-file.1 (F)
+
+ after/expected:
+
+ +-test_dir/
+ +-file.1 (READ)"""
+
+ acl_str = "ACL:%s:ALLOWED/0x0/FULL" % self.user
+ try:
+ remotepath = self.create_remote_test_file("file-1")
+
+ self.smb_cacls(["--set", acl_str, remotepath])
+
+ ace = self.ace_parse_str(acl_str)
+ self.assertTrue(self.file_ace_check(remotepath, ace))
+
+ # overwrite existing entry
+ acl_str = "ACL:%s:ALLOWED/0x0/READ" % self.user
+ self.smb_cacls(["--modify", acl_str, remotepath])
+
+ ace = self.ace_parse_str(acl_str)
+ self.assertTrue(self.file_ace_check(remotepath, ace))
+ except BlackboxProcessError as e:
+ self.fail(str(e))
+
+ def test_simple_single_del(self):
+ """test smbcacls '--delete' attempts to delete the ACL for the file
+ (note: first part of the test 'set' ACL to (F) then attempts to delete
+ before:
+
+ +-tar_test_dir/
+ +-file.1 (F)
+
+ after/expected:
+
+ +-tar_test_dir/
+ +-file.1 (none) - meaning no (F) ACL for this user"""
+
+ acl_str = "ACL:%s:ALLOWED/0x0/FULL" % self.user
+
+ try:
+ remotepath = self.create_remote_test_file("file-1")
+
+ # only a single ACE string in the ACL
+ ace = self.ace_parse_str(acl_str)
+ self.assertTrue(self.file_ace_check(remotepath, ace))
+
+ self.smb_cacls(["--delete", acl_str, remotepath])
+ self.assertFalse(self.file_ace_check(remotepath, ace))
+ except BlackboxProcessError as e:
+ self.fail(str(e))
+
+
+ def test_simple_single_add(self):
+ acl_str = "ACL:%s:ALLOWED/0x0/FULL" % self.user
+ dny_str = "ACL:%s:DENIED/0x0/READ" % self.user
+
+ try:
+ remotepath = self.create_remote_test_file("file-1")
+
+ self.smb_cacls(["--set", acl_str, remotepath])
+
+ ace = self.ace_parse_str(acl_str)
+ self.assertTrue(self.file_ace_check(remotepath, ace))
+
+ self.smb_cacls(["--set", dny_str, remotepath])
+ ace = self.ace_parse_str(dny_str)
+ self.assertTrue(self.file_ace_check(remotepath, ace))
+ except BlackboxProcessError as e:
+ self.fail(str(e))
diff --git a/buildtools/wafsamba/__init__.py b/selftest/knownfail.d/smbcacls
similarity index 100%
copy from buildtools/wafsamba/__init__.py
copy to selftest/knownfail.d/smbcacls
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 591c43b7d0a..2e2f74efb79 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -1329,6 +1329,9 @@ sub setup_fileserver
my $tarmode_sharedir="$share_dir/tarmode";
push(@dirs,$tarmode_sharedir);
+ my $smbcacls_sharedir="$share_dir/smbcacls";
+ push(@dirs,$smbcacls_sharedir);
+
my $usershare_sharedir="$share_dir/usershares";
push(@dirs,$usershare_sharedir);
@@ -1988,6 +1991,9 @@ sub provision($$)
my $msdfs_deeppath="$msdfs_shrdir/deeppath";
push(@dirs,$msdfs_deeppath);
+ my $smbcacls_sharedir_dfs="$shrdir/smbcacls_sharedir_dfs";
+ push(@dirs,$smbcacls_sharedir_dfs);
+
my $badnames_shrdir="$shrdir/badnames";
push(@dirs,$badnames_shrdir);
@@ -2069,6 +2075,8 @@ sub provision($$)
symlink "msdfs:$server_ip\\ro-tmp,$server_ipv6\\ro-tmp",
"$msdfs_shrdir/msdfs-src1";
symlink "msdfs:$server_ipv6\\ro-tmp", "$msdfs_shrdir/deeppath/msdfs-src2";
+ symlink "msdfs:$server_ip\\smbcacls_sharedir_dfs,$server_ipv6\\smbcacls_sharedir_dfs",
+ "$msdfs_shrdir/smbcacls_sharedir_dfs";
##
## create bad names in $badnames_shrdir
@@ -2313,6 +2321,9 @@ sub provision($$)
}
print CONF "
+[smbcacls_sharedir_dfs]
+ path = $smbcacls_sharedir_dfs
+ comment = smb username is [%U]
[tmp]
path = $shrdir
comment = smb username is [%U]
diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c
index ecd2aa0e824..f3209c31877 100644
--- a/source3/utils/smbcacls.c
+++ b/source3/utils/smbcacls.c
@@ -816,6 +816,9 @@ int main(int argc, char *argv[])
/* numeric is set when the user wants numeric SIDs and ACEs rather
than going via LSA calls to resolve them */
int numeric = 0;
+ struct cli_state *targetcli = NULL;
+ char *targetfile = NULL;
+ NTSTATUS status;
struct poptOption long_options[] = {
POPT_AUTOHELP
@@ -1077,16 +1080,28 @@ int main(int argc, char *argv[])
}
}
+ status = cli_resolve_path(frame,
+ "",
+ popt_get_cmdline_auth_info(),
+ cli,
+ filename,
+ &targetcli,
+ &targetfile);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(0,("cli_resolve_path failed for %s! (%s)\n", filename, nt_errstr(status)));
+ return -1;
+ }
+
/* Perform requested action */
if (change_mode == REQUEST_INHERIT) {
- result = inherit(cli, filename, owner_username);
+ result = inherit(targetcli, targetfile, owner_username);
} else if (change_mode != REQUEST_NONE) {
- result = owner_set(cli, change_mode, filename, owner_username);
+ result = owner_set(targetcli, change_mode, targetfile, owner_username);
} else if (the_acl) {
- result = cacl_set(cli, filename, the_acl, mode, numeric);
+ result = cacl_set(targetcli, targetfile, the_acl, mode, numeric);
} else {
- result = cacl_dump(cli, filename, numeric);
+ result = cacl_dump(targetcli, targetfile, numeric);
}
popt_free_cmdline_auth_info();
diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index 4d3030e4700..0e219f94d04 100755
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -925,6 +925,13 @@ planoldpythontestsuite("none", "samba.tests.loadparm")
planoldpythontestsuite("fileserver",
"samba.tests.blackbox.mdfind",
extra_args=['-U"$USERNAME%$PASSWORD"'])
+planoldpythontestsuite("fileserver",
+ "samba.tests.blackbox.smbcacls_basic")
+planoldpythontestsuite("fileserver",
+ "samba.tests.blackbox.smbcacls_basic",
+ "samba.tests.blackbox.smbcacls_basic(DFS)",
+ environ={'SHARE': 'msdfs-share',
+ 'TESTDIR': 'smbcacls_sharedir_dfs'})
#
# Want a selection of environments across the process models
--
Samba Shared Repository
More information about the samba-cvs
mailing list