samba.git/source4/dsdb, branch talloc-2.3.2

selftest: add test for new "samba-tool user unlock" command

2020-11-04T00:19:25+00:00

Signed-off-by: Björn Baumbach 
Reviewed-by: Douglas Bagnall 

Autobuild-User(master): Douglas Bagnall 
Autobuild-Date(master): Wed Nov  4 00:19:25 UTC 2020 on sn-devel-184

dsdb/mod/operational: correct comment arithmetic

2020-11-03T00:33:41+00:00

E + F is not 1F! E + F is 1D!

Signed-off-by: Douglas Bagnall 
Reviewed-by: Andrew Bartlett

s4:dsdb:acl_read: Implement "List Object" mode feature

2020-10-21T08:48:01+00:00

See [MS-ADTS] 5.1.3.3.6 Checking Object Visibility

I tried to avoid any possible overhead for the common cases:

- SEC_ADS_LIST (List Children) is already granted by default
- fDoListObject is off by default

Overhead is only added if the administrator turned on
the fDoListObject feature and removed SEC_ADS_LIST (List Children)
from a parent object.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Douglas Bagnall 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Wed Oct 21 08:48:02 UTC 2020 on sn-devel-184

s4:dsdb:util: add dsdb_do_list_object() helper

2020-10-21T07:25:37+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Douglas Bagnall

s4:dsdb:acl_read: defer LDB_ERR_NO_SUCH_OBJECT

2020-10-21T07:25:37+00:00

We may need to return child objects even if the base dn
is invisible.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Douglas Bagnall

s4:dsdb:acl_read: make use of aclread_check_object_visible() for the search base

2020-10-21T07:25:37+00:00

We should only have one place to do access checks.

Use 'git show -w' to see the minimal diff.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Douglas Bagnall

s4:dsdb:acl_read: fully set up 'struct aclread_context' before the search base acl check

2020-10-21T07:25:37+00:00

This makes further change much easier.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Douglas Bagnall

s4:dsdb:acl_read: introduce aclread_check_object_visible() helper

2020-10-21T07:25:37+00:00

In future this will do more than aclread_check_parent(),
if we implement fDoListObject and SEC_ADS_LIST_OBJECT handling.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Douglas Bagnall

s4:dsdb:tests: add AclVisibiltyTests

2020-10-21T07:25:37+00:00

This tests a sorts of combinations in order to
demonstrate the visibility of objects depending on:

- with or without fDoListObject
- with or without explicit DENY ACEs
- A hierachy of objects with 4 levels from the base dn
- SEC_ADS_LIST (List Children)
- SEC_ADS_LIST_LIST_OBJECT (List Object)
- SEC_ADS_READ_PROP
- all possible scopes and basedns

This demonstrates that NO_SUCH_OBJECT doesn't depend purely
on the visibility of the base dn, it's still possible to
get children returned und an invisible base dn.

It also demonstrates the additional behavior with "List Object" mode.
See [MS-ADTS] 5.1.3.3.6 Checking Object Visibility

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14531

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Douglas Bagnall

python2 reduction: Merge remaining compat code into common

2020-10-02T14:49:36+00:00

The remaining compat code (get_string, get_bytes,
cmp) are useful helper routines which we should
simply merge into common (especially since there
is some duplication here).

Signed-off-by: David Mulder 
Reviewed-by: Douglas Bagnall 

Autobuild-User(master): David Mulder 
Autobuild-Date(master): Fri Oct  2 14:49:36 UTC 2020 on sn-devel-184