summaryrefslogtreecommitdiff
path: root/source4
diff options
context:
space:
mode:
authorNadezhda Ivanova <nivanova@samba.org>2010-10-27 15:20:49 +0300
committerNadezhda Ivanova <nivanova@samba.org>2010-10-27 13:18:50 +0000
commit5bc2b8f0a494511800696d6d411a426463089e8b (patch)
tree7720f8306ee7ba428b08526941b7fd4677024dd5 /source4
parent3003bd40379b669e8b2cef7a40784f0114344f8e (diff)
downloadsamba-5bc2b8f0a494511800696d6d411a426463089e8b.tar.gz
samba-5bc2b8f0a494511800696d6d411a426463089e8b.tar.bz2
samba-5bc2b8f0a494511800696d6d411a426463089e8b.zip
s4-ldb: Added the correct extended check for read access to nTSecurityDescriptor
It does not depend on READ_PROPERTY, but on SECURITY_PRIVILEGE and READ_CONTROL Autobuild-User: Nadezhda Ivanova <nivanova@samba.org> Autobuild-Date: Wed Oct 27 13:18:50 UTC 2010 on sn-devel-104
Diffstat (limited to 'source4')
-rw-r--r--source4/dsdb/samdb/ldb_modules/acl_read.c2
-rwxr-xr-xsource4/dsdb/tests/python/acl.py62
-rw-r--r--source4/selftest/knownfail1
3 files changed, 64 insertions, 1 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/acl_read.c b/source4/dsdb/samdb/ldb_modules/acl_read.c
index 78a9e28396..bd9e1289f3 100644
--- a/source4/dsdb/samdb/ldb_modules/acl_read.c
+++ b/source4/dsdb/samdb/ldb_modules/acl_read.c
@@ -146,7 +146,7 @@ static int aclread_callback(struct ldb_request *req, struct ldb_reply *ares)
tmp_ctx,
sd,
sid,
- SEC_FLAG_SYSTEM_SECURITY,
+ SEC_FLAG_SYSTEM_SECURITY|SEC_STD_READ_CONTROL,
attr);
} else {
ret = acl_check_access_on_attribute(ac->module,
diff --git a/source4/dsdb/tests/python/acl.py b/source4/dsdb/tests/python/acl.py
index ae51044c60..d4c55a44ac 100755
--- a/source4/dsdb/tests/python/acl.py
+++ b/source4/dsdb/tests/python/acl.py
@@ -1621,6 +1621,65 @@ replace: userPassword
userPassword: thatsAcomplPASS1
""")
+class AclExtendedTests(AclTests):
+
+ def setUp(self):
+ super(AclExtendedTests, self).setUp()
+ #regular user, will be the creator
+ self.u1 = "ext_u1"
+ #regular user
+ self.u2 = "ext_u2"
+ #admin user
+ self.u3 = "ext_u3"
+ self.create_enable_user(self.u1)
+ self.create_enable_user(self.u2)
+ self.create_enable_user(self.u3)
+ self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn,
+ self.get_user_dn(self.u3))
+ self.ldb_user1 = self.get_ldb_connection(self.u1, self.user_pass)
+ self.ldb_user2 = self.get_ldb_connection(self.u2, self.user_pass)
+ self.ldb_user3 = self.get_ldb_connection(self.u3, self.user_pass)
+ self.user_sid1 = self.get_object_sid(self.get_user_dn(self.u1))
+ self.user_sid2 = self.get_object_sid(self.get_user_dn(self.u2))
+
+ def tearDown(self):
+ super(AclExtendedTests, self).tearDown()
+ self.delete_force(self.ldb_admin, self.get_user_dn(self.u1))
+ self.delete_force(self.ldb_admin, self.get_user_dn(self.u2))
+ self.delete_force(self.ldb_admin, self.get_user_dn(self.u3))
+ self.delete_force(self.ldb_admin, "CN=ext_group1,OU=ext_ou1," + self.base_dn)
+ self.delete_force(self.ldb_admin, "ou=ext_ou1," + self.base_dn)
+
+ def test_ntSecurityDescriptor(self):
+ #create empty ou
+ self.create_ou(self.ldb_admin, "ou=ext_ou1," + self.base_dn)
+ #give u1 Create children access
+ mod = "(A;;CC;;;%s)" % str(self.user_sid1)
+ self.dacl_add_ace("OU=ext_ou1," + self.base_dn, mod)
+ mod = "(A;;LC;;;%s)" % str(self.user_sid2)
+ self.dacl_add_ace("OU=ext_ou1," + self.base_dn, mod)
+ #create a group under that, grant RP to u2
+ self.create_group(self.ldb_user1, "CN=ext_group1,OU=ext_ou1," + self.base_dn)
+ mod = "(A;;RP;;;%s)" % str(self.user_sid2)
+ self.dacl_add_ace("CN=ext_group1,OU=ext_ou1," + self.base_dn, mod)
+ #u2 must not read the descriptor
+ res = self.ldb_user2.search("CN=ext_group1,OU=ext_ou1," + self.base_dn,
+ SCOPE_BASE, None, ["nTSecurityDescriptor"])
+ self.assertNotEqual(res,[])
+ self.assertFalse("nTSecurityDescriptor" in res[0].keys())
+ #grant RC to u2 - still no access
+ mod = "(A;;RC;;;%s)" % str(self.user_sid2)
+ self.dacl_add_ace("CN=ext_group1,OU=ext_ou1," + self.base_dn, mod)
+ res = self.ldb_user2.search("CN=ext_group1,OU=ext_ou1," + self.base_dn,
+ SCOPE_BASE, None, ["nTSecurityDescriptor"])
+ self.assertNotEqual(res,[])
+ self.assertFalse("nTSecurityDescriptor" in res[0].keys())
+ #u3 is member of administrators group, should be able to read sd
+ res = self.ldb_user3.search("CN=ext_group1,OU=ext_ou1," + self.base_dn,
+ SCOPE_BASE, None, ["nTSecurityDescriptor"])
+ self.assertEqual(len(res),1)
+ self.assertTrue("nTSecurityDescriptor" in res[0].keys())
+
# Important unit running information
if not "://" in host:
@@ -1641,5 +1700,8 @@ if not runner.run(unittest.makeSuite(AclCARTests)).wasSuccessful():
rc = 1
if not runner.run(unittest.makeSuite(AclSearchTests)).wasSuccessful():
rc = 1
+if not runner.run(unittest.makeSuite(AclExtendedTests)).wasSuccessful():
+ rc = 1
+
sys.exit(rc)
diff --git a/source4/selftest/knownfail b/source4/selftest/knownfail
index cc7e2ae513..d3c7277f89 100644
--- a/source4/selftest/knownfail
+++ b/source4/selftest/knownfail
@@ -78,4 +78,5 @@ samba4.smb2.compound.*.RELATED1
samba4.smb2.compound.*.RELATED2
samba4.smb2.compound.*.INVALID2
samba4.ldap.acl.*.search.* # ACL search behaviour not enabled by default
+samba4.ldap.acl.*.ntSecurityDescriptor.* # ACL extended checks on search not enabled by default