Python tests of Access Control Lists and Privileges

[Nadezhda Ivanova]

HI Richard,
This is the approach most often taken when we worked on the DC acls. I
would also suggest testing with permissions granted to the particular user,
to a group, and testing conflicting permissions - granted to a group but
forbidden to another group, with the user part of both for example. I know
this is not an usual scenario, but we are talking security here :).
I have not looked at your implementation and am a bit rusty in samba
development, so forgive me if this is pointless, but I suggest you have a
log for every access check that dumps the descriptors, it really helps to
determine why a test has failed.

Regards,
Nadya

2012/3/26 Richard Sharpe <realrichardsharpe at gmail.com>

> Hi,
>
> Here are my thoughts with respect to tests of the Samba ACL handling
> and Privileges.
>
> It should consist of:
>
> 1. A set of tests, where each test is a Python function or perhaps a
> class (not sure of the utility of classes here, hmmm, as classes we
> can maintain useful info about each test with some interesting info
> and a standard set of methods).
>
> Each test should focus on a specific item, eg: Apply a specific set of
> ACEs in an ACL to a file and then try to access the file in ways that
> should be allowed and ways that are not allowed.
>
> Privilege tests should test that a user who has privileges get the
> access provided by those privileges, even in the presence of DENY
> entries etc.
>
> Each test return True for pass, False for fail.
>
> Each test should use normal Python Documentation to document what it
> tests and what a failure indicates.
>
> 2. A list of those tests.
>
> 3. A driver that connects to a server, retrieves version information
> etc, and then runs the tests one at a time until they have already
> been run. It should then report the statistics, and in particular list
> all the tests that fail.
>
> Any other suggestions? Comments.
>
> --
> Regards,
> Richard Sharpe
> (何以解憂？唯有杜康。--曹操)
>