summaryrefslogtreecommitdiff
path: root/source4/lib
diff options
context:
space:
mode:
authorNadezhda Ivanova <nadezhda.ivanova@postpath.com>2010-03-07 21:42:53 +0200
committerNadezhda Ivanova <nadezhda.ivanova@postpath.com>2010-03-09 13:07:18 +0200
commitf742623b7b8a19ff3230754562deeac7657cd8cd (patch)
treeef33cf9231cff19b7e09562396930520192a95b2 /source4/lib
parentec53a0ca5a568627df8dac91ec2c736b0d106829 (diff)
downloadsamba-f742623b7b8a19ff3230754562deeac7657cd8cd.tar.gz
samba-f742623b7b8a19ff3230754562deeac7657cd8cd.tar.bz2
samba-f742623b7b8a19ff3230754562deeac7657cd8cd.zip
Added a check for permissions to modify the RDN attribute on rename.
Necessary because rdn module will be moved lower than acl in the stack.
Diffstat (limited to 'source4/lib')
-rwxr-xr-xsource4/lib/ldb/tests/python/acl.py32
1 files changed, 32 insertions, 0 deletions
diff --git a/source4/lib/ldb/tests/python/acl.py b/source4/lib/ldb/tests/python/acl.py
index 083c7ae1a2..42c8c7efda 100755
--- a/source4/lib/ldb/tests/python/acl.py
+++ b/source4/lib/ldb/tests/python/acl.py
@@ -785,6 +785,7 @@ class AclRenameTests(AclTests):
self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou1," + self.base_dn)
self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
+ self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou1," + self.base_dn)
self.delete_force(self.ldb_admin, "OU=test_rename_ou1," + self.base_dn)
if self.SAMBA:
self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
@@ -939,6 +940,37 @@ class AclRenameTests(AclTests):
% rename_user_dn )
self.assertNotEqual( res, [] )
+ def test_rename_u8(self):
+ """Test rename on an object with and without modify access on the RDN attribute"""
+ ou1_dn = "OU=test_rename_ou1," + self.base_dn
+ ou2_dn = "OU=test_rename_ou2," + ou1_dn
+ ou3_dn = "OU=test_rename_ou3," + ou1_dn
+ # Create OU structure
+ self.create_ou(self.ldb_admin, ou1_dn)
+ self.create_ou(self.ldb_admin, ou2_dn)
+ sid = self.get_object_sid(self.get_user_dn(self.regular_user))
+ mod = "(OA;;WP;bf967a0e-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
+ self.dacl_add_ace(ou2_dn, mod)
+ mod = "(OD;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
+ self.dacl_add_ace(ou2_dn, mod)
+ try:
+ self.ldb_user.rename(ou2_dn, ou3_dn)
+ except LdbError, (num, _):
+ self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
+ else:
+ # This rename operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
+ self.fail()
+ sid = self.get_object_sid(self.get_user_dn(self.regular_user))
+ mod = "(A;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
+ self.dacl_add_ace(ou2_dn, mod)
+ self.ldb_user.rename(ou2_dn, ou3_dn)
+ res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
+ % ou2_dn )
+ self.assertEqual( res, [] )
+ res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
+ % ou3_dn )
+ self.assertNotEqual( res, [] )
+
# Important unit running information
if not "://" in host: