4 files changed, 78 insertions, 3 deletions
diff --git a/selftest/knownfail b/selftest/knownfail
index 180a543f79..77c8f9ec7e 100644
--- a/selftest/knownfail
+++ b/selftest/knownfail
@@ -163,6 +163,7 @@
 ^samba4.blackbox.upgradeprovision.alpha13.ldapcmp_full_sd\(none\) # Due to something rewriting the NT ACL on DNS objects and not getting the DC ACL right
 ^samba4.blackbox.upgradeprovision.release-4-0-0.ldapcmp_sd\(none\) # Due to something rewriting the NT ACL on DNS objects and not getting the DC ACL right
 ^samba4.blackbox.upgradeprovision.release-4-0-0.ldapcmp_full_sd\(none\) # Due to something rewriting the NT ACL on DNS objects and not getting the DC ACL right
+^samba4.blackbox.dbcheck.release-4-0-0.ldapcmp_sd\(none\) # We do not yet know how to reset the DC ACL with dbcheck
 ^samba3.smb2.create.gentest
 ^samba3.smb2.create.blob
 ^samba3.smb2.create.open
diff --git a/testprogs/blackbox/dbcheck-oldrelease.sh b/testprogs/blackbox/dbcheck-oldrelease.sh
index 6032bbc985..a06e025c2a 100755
--- a/testprogs/blackbox/dbcheck-oldrelease.sh
+++ b/testprogs/blackbox/dbcheck-oldrelease.sh
@@ -25,16 +25,41 @@ undump() {
 }
 
 reindex() {
-       $BINDIR/samba-tool dbcheck --reindex -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb $@
+       $PYTHON $BINDIR/samba-tool dbcheck --reindex -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb $@
 }
 
 # This should 'fail', because it returns the number of modified records
 dbcheck() {
-       $BINDIR/samba-tool dbcheck --cross-ncs --fix --yes -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb $@
+       $PYTHON $BINDIR/samba-tool dbcheck --cross-ncs --fix --yes -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb $@
 }
 # But having fixed it all up, this should pass
 dbcheck_clean() {
-       $BINDIR/samba-tool dbcheck --cross-ncs -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb $@
+       $PYTHON $BINDIR/samba-tool dbcheck --cross-ncs -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb $@
+}
+
+# This should 'fail', because it returns the number of modified records
+dbcheck_acl_reset() {
+       $PYTHON $BINDIR/samba-tool dbcheck --reset-well-known-acls --cross-ncs --fix --yes -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb $@
+}
+# But having fixed it all up, this should pass
+dbcheck_acl_reset_clean() {
+       $PYTHON $BINDIR/samba-tool dbcheck --reset-well-known-acls --cross-ncs -H tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb $@
+}
+
+referenceprovision() {
+        $PYTHON $BINDIR/samba-tool domain provision --server-role="dc" --domain=SAMBA --host-name=ares --realm=${RELEASE}.samba.corp --targetdir=$PREFIX_ABS/${RELEASE}_reference --use-ntvfs --host-ip=127.0.0.1 --host-ip6=::1
+}
+
+ldapcmp() {
+    if [ x$RELEASE != x"alpha13" ]; then
+         $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb --two --skip-missing-dn --filter=dnsRecord
+    fi
+}
+
+ldapcmp_sd() {
+    if [ x$RELEASE != x"alpha13" ]; then
+        $PYTHON $BINDIR/samba-tool ldapcmp tdb://$PREFIX_ABS/${RELEASE}_reference/private/sam.ldb tdb://$PREFIX_ABS/${RELEASE}/private/sam.ldb --two --sd --skip-missing-dn
+    fi
 }
 
 if [ -d $release_dir ]; then
@@ -42,6 +67,11 @@ if [ -d $release_dir ]; then
     testit "reindex" reindex
     testit_expect_failure "dbcheck" dbcheck
     testit "dbcheck_clean" dbcheck_clean
+    testit_expect_failure "dbcheck_acl_reset" dbcheck_acl_reset
+    testit "dbcheck_acl_reset_clean" dbcheck_acl_reset_clean
+    testit "referenceprovision" referenceprovision
+    testit "ldapcmp" ldapcmp
+    testit "ldapcmp_sd" ldapcmp_sd
 else
     subunit_start_test $RELEASE
     subunit_skip_test $RELEASE <<EOF
@@ -60,6 +90,34 @@ EOF
     subunit_skip_test "dbcheck_clean" <<EOF
 no test provision
 EOF
+    subunit_start_test "dbcheck_acl_reset"
+    subunit_skip_test "dbcheck_acl_reset" <<EOF
+no test provision
+EOF
+    subunit_start_test "dbcheck_clean_acl_reset"
+    subunit_skip_test "dbcheck_clean_acl_reset" <<EOF
+no test provision
+EOF
+    subunit_start_test "referenceprovision"
+    subunit_skip_test "referenceprovision" <<EOF
+no test provision
+EOF
+    subunit_start_test "ldapcmp"
+    subunit_skip_test "ldapcmp" <<EOF
+no test provision
+EOF
+    subunit_start_test "ldapcmp_sd"
+    subunit_skip_test "ldapcmp_sd" <<EOF
+no test provision
+EOF
+fi
+
+if [ -d $PREFIX_ABS/${RELEASE} ]; then
+  rm -fr $PREFIX_ABS/${RELEASE}
+fi
+
+if [ -d $PREFIX_ABS/${RELEASE}_reference ]; then
+  rm -fr $PREFIX_ABS/${RELEASE}_reference
 fi
 
 exit $failed
diff --git a/testprogs/blackbox/dbcheck.sh b/testprogs/blackbox/dbcheck.sh
index faf6fab82e..c1e8aafd36 100755
--- a/testprogs/blackbox/dbcheck.sh
+++ b/testprogs/blackbox/dbcheck.sh
@@ -16,6 +16,12 @@ dbcheck() {
 	$BINDIR/samba-tool dbcheck --cross-ncs $@
 }
 
+# This test shows that this does not do anything to a current
+# provision (that would be a bug)
+dbcheck_reset_well_known_acls() {
+	$BINDIR/samba-tool dbcheck --cross-ncs --reset-well-known-acls $@
+}
+
 reindex() {
 	$BINDIR/samba-tool dbcheck --reindex
 }
diff --git a/testprogs/blackbox/upgradeprovision-oldrelease.sh b/testprogs/blackbox/upgradeprovision-oldrelease.sh
index 105483d70b..d12c2cf172 100755
--- a/testprogs/blackbox/upgradeprovision-oldrelease.sh
+++ b/testprogs/blackbox/upgradeprovision-oldrelease.sh
@@ -68,6 +68,11 @@ dbcheck_full_clean() {
        $BINDIR/samba-tool dbcheck --cross-ncs -H tdb://$PREFIX_ABS/${RELEASE}_upgrade_full/private/sam.ldb $@
 }
 
+# This checks that after the upgrade, the well known ACLs are correct, so this reset should not want to do anything
+dbcheck_full_clean_well_known_acls() {
+       $BINDIR/samba-tool dbcheck --reset-well-known-acls --cross-ncs -H tdb://$PREFIX_ABS/${RELEASE}_upgrade_full/private/sam.ldb $@
+}
+
 upgradeprovision() {
 	$PYTHON $BINDIR/samba_upgradeprovision -s "$PREFIX_ABS/${RELEASE}_upgrade/etc/smb.conf" --debugchange
 }
@@ -124,6 +129,7 @@ if [ -d $release_dir ]; then
     testit_expect_failure "dbcheck_full" dbcheck_full
     testit "dbcheck_clean" dbcheck_clean
     testit "dbcheck_full_clean" dbcheck_full_clean
+    testit "dbcheck_full_clean_well_known_acls" dbcheck_full_clean_well_known_acls
     testit "referenceprovision" referenceprovision
     testit "samba_upgradedns" samba_upgradedns
     testit "ldapcmp" ldapcmp
@@ -171,6 +177,10 @@ EOF
     subunit_skip_test "dbcheck_full_clean" <<EOF
 no test provision
 EOF
+    subunit_start_test "dbcheck_full_clean_well_known_acls"
+    subunit_skip_test "dbcheck_full_clean_well_known_acls" <<EOF
+no test provision
+EOF
     subunit_start_test "samba_dnsupgrade"
     subunit_skip_test "samba_dnsupgrade" <<EOF
 no test provision