summaryrefslogtreecommitdiff
path: root/source4/dsdb/tests/python/sec_descriptor.py
AgeCommit message (Collapse)AuthorFilesLines
2023-08-08s4:dsdb:tests: Remove unused variablesJoseph Sutton1-7/+4
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-03s4:dsdb:tests: Fix code spellingAndreas Schneider1-7/+7
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-05-16s4:dsdb:tests: Refactor security descriptor testJoseph Sutton1-2/+2
Use more specific unittest methods. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-22s4:dsdb/tests: add more detailed tests to sec_descriptor.pyStefan Metzmacher1-0/+501
These demonstrate how inherited aces are constructed and applies per objectclass, with and without the NO_PROPAGATE_INHERIT flag. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15338 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-22s4:dsdb/tests: allow sec_descriptor.py to run against Windows 2022Stefan Metzmacher1-4/+4
We need SEC_STD_DELETE in order to run the test twice against the same server. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15338 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-22s4:dsdb/tests: convert sec_descriptor.py to use assert[Not]In()Stefan Metzmacher1-149/+149
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15338 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-22s4:dsdb/tests: let OwnerGroupDescriptorTests() remove temporary ACEs on cleanupStefan Metzmacher1-0/+2
Otherwise we impact other unrelated tests, e.g. 'blackbox.dbcheck'. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15338 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-22s4:dsdb/tests: let OwnerGroupDescriptorTests.test_141() set the required ACE ↵Stefan Metzmacher1-0/+3
explicitly All other tests use the same logic and run before, which means the ACE is already there and is implicitly required. As we want to cleanup the ACE after each test in the next step, as the tests should not have side effects for other tests, e.g. 'blackbox.dbcheck'. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15338 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-21libcli/security: Reorder SDDL access flags table to match WindowsJoseph Sutton1-6/+6
This means that encoding an ACE in string form will now match Windows. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Mar 21 01:19:16 UTC 2023 on atb-devel-224
2023-02-23selftest: source4: fix mutable default argumentsRob van der Linde1-1/+4
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-09-16CVE-2020-25720: s4-acl: Owner no longer has implicit Write DACLNadezhda Ivanova1-9/+36
The implicit right of an object's owner to modify its security descriptor no longer exists, according to the new access rules. However, we continue to grant this implicit right for fileserver access checks. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16CVE-2020-25720: s4-acl: Adjusted some tests to work with the new behaviorNadezhda Ivanova1-4/+4
Test using non-priviledged accounts now need to make sure they have WP access on the prvided attributes, or Write-DACL Some test create organizational units with a specific SD, and those now need the user to have WD or else they give errors BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16CVE-2020-25720: s4-acl: Change behavior of Create Children checkNadezhda Ivanova1-4/+16
Up to now, the rights to modify an attribute were not checked during an LDAP add operation. This means that even if a user has no right to modify an attribute, they can still specify any value during object creation, and the validated writes were not checked. This patch changes this behavior. During an add operation, a security descriptor is created that does not include the one provided by the user, and is used to verify that the user has the right to modify the supplied attributes. Exception is made for an object's mandatory attributes, and if the user has Write DACL right, further checks are skipped. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Pair-Programmed-With: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16CVE-2020-25720 s4:tests/sec_descriptor: Add missing security descriptor modifyJoseph Sutton1-1/+3
The variable sub_sddl1 previously went unused, so this call to modify_sd_on_dn() was presumably intended to go here. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14810 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-06-14python: Don't use deprecated escape sequencesJoseph Sutton1-3/+3
Certain escape sequences are not valid in Python string literals, and will eventually result in a SyntaxError. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2021-04-28python: remove all 'from __future__ import print_function'Douglas Bagnall1-1/+0
This made Python 2's print behave like Python 3's print(). In some cases, where we had: from __future__ import print_function """Intended module documentation...""" this will have the side effect of making the intended module documentation work as the actual module documentation (i.e. becoming __doc__), because it is once again the first statement in the module. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-02-07pytests: heed assertEquals deprecation warning en-masseDouglas Bagnall1-16/+16
TestCase.assertEquals() is an alias for TestCase.assertEqual() and has been deprecated since Python 2.7. When we run our tests with in python developer mode (`PYTHONDEVMODE=1 make test`) we get 580 DeprecationWarnings about this. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2019-05-06selftest: correcting empty attribute usage in requestsAaron Haslett1-1/+1
Many parts of Samba use an empty attribute list in requests expecting all attributes to be returned in the response, which is incorrect. This patch corrects the instances found by current CI tests. Static analysis and debugging will need to be done before changing ildap to the correct semantics. Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Garming Sam <garming@samba.org> Autobuild-Date(master): Mon May 6 05:45:55 UTC 2019 on sn-devel-184
2019-01-10Fix typos and ban the rams from sambatdb-1.3.17Swen Schillig1-1/+1
Signed-off-by: Swen Schillig <swen@linux.ibm.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Volker Lendecke <Volker.Lendecke@SerNet.DE>
2018-12-14PY3: change shebang to python3 in source4/dsdb dirJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2018-11-14s4/dsdb/tests/python: PY3 port samba4.ldap.secdescNoel Power1-8/+8
User str/bytes as needed for various asserts Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-01tests/python/sec_descriptor: safer use of super()Douglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <noel.power@suse.com>
2018-08-24PEP8: fix E713: test for membership should be 'not in'Joe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E502: the backslash is redundant between bracketsJoe Guo1-3/+3
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E305: expected 2 blank lines after class or function definition, ↵Joe Guo1-0/+1
found 1 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E302: expected 2 blank lines, found 1Joe Guo1-0/+5
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E265: block comment should start with '# 'Joe Guo1-22/+22
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E261: at least two spaces before inline commentJoe Guo1-7/+7
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E231: missing whitespace after ','Joe Guo1-4/+4
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E225: missing whitespace around operatorJoe Guo1-2/+2
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E203: whitespace before ':'Joe Guo1-98/+98
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E202: whitespace before ')'Joe Guo1-13/+13
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E201: whitespace after '('Joe Guo1-14/+14
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E128: continuation line under-indented for visual indentJoe Guo1-24/+24
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-05-12s4/dsdb/tests: py2/py3 compatability always decode result of b64encodeNoel Power1-3/+3
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-03-23s3/dsdb: convert print func to be py2/py3 compatibleNoel Power1-7/+8
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-02-28dsdb python tests: convert 'except X, (tuple)' to 'except X as e'Noel Power1-1/+2
In addition to converting the except line another line is also added for each except to extract the tuple contents. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-01-08selftest: close connections after tests in samba4.ldap.secdesc.pythonJamie McClymont1-0/+5
This test suite had a memory impact of around 2.2GB, from LDAP connection handlers under the standard process model. Signed-off-by: Jamie McClymont <jamiemcclymont@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Jan 8 08:02:15 CET 2018 on sn-devel-144
2017-01-12s4:tests/sec_descriptor: use more unique oid valuesStefan Metzmacher1-57/+25
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12507 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org> Autobuild-User(master): David Disseldorp <ddiss@samba.org> Autobuild-Date(master): Thu Jan 12 04:02:21 CET 2017 on sn-devel-144
2016-06-06selftest: Use random OIDs from under the Samba OID arcAndrew Bartlett1-1/+1
The urgent_replication.py test used the OID of uid, and this caused other tests to fail The other random OIDs should have been from under our arc, not under iso.member-body.us We split up the range a little to avoid some of the birthday paradox, in the tests that create multiple OIDs. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz
2014-11-22sec_descriptor: Use samba.tests.subunitrun.Jelmer Vernooij1-16/+6
Change-Id: I5caba3e27ad21cc5381883a823e0ec5e2966a264 Signed-off-by: Jelmer Vernooij <jelmer@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-11-22sec_descriptor test: Simplify, use samba.tests.subunitrun module.Jelmer Vernooij1-19/+13
Change-Id: I4ffda49cf3e209eaa28fc83f6fd9ded47f0ad7ee Signed-Off-By: Jelmer Vernooij <jelmer@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-27tests/sec_descriptor: the default owner behavior depends on ↵Stefan Metzmacher1-4/+4
domainControllerFunctionality (bug #9481) Not on the domainFunctionality. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2012-12-10s4:dsdb/tests/sec_descriptor: verify the search of a windows dc join keeps ↵Stefan Metzmacher1-0/+7
working This is a regression test for bug #9470. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org> Autobuild-User(master): Michael Adam <obnox@samba.org> Autobuild-Date(master): Mon Dec 10 15:41:12 CET 2012 on sn-devel-104
2012-12-10s4:dsdb/tests/sec_descriptor: verify the nTSecurityDescriptor and sd_flags ↵Stefan Metzmacher1-0/+116
interaction This is a regression test for bug #9470. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-30s4:dsdb/tests: add SdAutoInheritTestsStefan Metzmacher1-1/+83
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org> Autobuild-User(master): Michael Adam <obnox@samba.org> Autobuild-Date(master): Fri Nov 30 18:59:50 CET 2012 on sn-devel-104
2012-06-21samdb: Accept a list of member variables rather than a comma-separated string.Jelmer Vernooij1-4/+4
2012-02-20s4-selftest: Avoid running kinit for each new connectionAndrew Bartlett1-1/+2
Kerberos is efficient when the credentials cache is set up once and then reused. Sadly this test creates a user, does a test and deletes the user, over and over. For this, using NTLM saves a little time, but we also stress the rest of the DB, and should rework the test. Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Mon Feb 20 00:49:56 CET 2012 on sn-devel-104
2011-02-21s4-unittests: replace assertEquals(res, []) by assertEquals(len(res), 0)Matthieu Patou1-1/+1
2011-02-10s4-tests: Some tests that prove behavior for INHERITED user-provided ACEs is ↵Nadezhda Ivanova1-0/+34
different if the P flag is set. Autobuild-User: Nadezhda Ivanova <nivanova@samba.org> Autobuild-Date: Thu Feb 10 12:31:34 CET 2011 on sn-devel-104
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 22:56:25 +0000