From 1524da3c41757461cf994e8f2367403332d1af24 Mon Sep 17 00:00:00 2001
From: Tim Beale <timbeale@catalyst.net.nz>
Date: Fri, 15 Mar 2019 13:52:50 +1300
Subject: [PATCH] tests: Add test to check file-permissions are correct after
 provision

This provisions a new DC are checks there are no world-writable or
world-readable files in the new DC's private directory.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
---
 selftest/knownfail.d/provision_fileperms   |  2 +
 source4/selftest/tests.py                  |  1 +
 source4/setup/tests/provision_fileperms.sh | 64 ++++++++++++++++++++++++++++++
 3 files changed, 67 insertions(+)
 create mode 100644 selftest/knownfail.d/provision_fileperms
 create mode 100755 source4/setup/tests/provision_fileperms.sh

diff --git a/selftest/knownfail.d/provision_fileperms b/selftest/knownfail.d/provision_fileperms
new file mode 100644
index 0000000..3d77be3
--- /dev/null
+++ b/selftest/knownfail.d/provision_fileperms
@@ -0,0 +1,2 @@
+samba4.blackbox.provision_fileperms.provision-fileperms\(none\)
+
diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index c6355f3..2c226ce 100755
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -959,6 +959,7 @@ plantestsuite_loadlist("samba4.deletetest.python(ad_dc_default)", "ad_dc_default
 plantestsuite("samba4.blackbox.samba3dump", "none", [os.path.join(samba4srcdir, "selftest/test_samba3dump.sh")])
 plantestsuite("samba4.blackbox.upgrade", "none", ["PYTHON=%s" % python, os.path.join(samba4srcdir, "setup/tests/blackbox_s3upgrade.sh"), '$PREFIX/provision'])
 plantestsuite("samba4.blackbox.provision.py", "none", ["PYTHON=%s" % python, os.path.join(samba4srcdir, "setup/tests/blackbox_provision.sh"), '$PREFIX/provision'])
+plantestsuite("samba4.blackbox.provision_fileperms", "none", ["PYTHON=%s" % python, os.path.join(samba4srcdir, "setup/tests/provision_fileperms.sh"), '$PREFIX/provision'])
 plantestsuite("samba4.blackbox.supported_features", "none",
               ["PYTHON=%s" % python,
                os.path.join(samba4srcdir,
diff --git a/source4/setup/tests/provision_fileperms.sh b/source4/setup/tests/provision_fileperms.sh
new file mode 100755
index 0000000..1238b4f
--- /dev/null
+++ b/source4/setup/tests/provision_fileperms.sh
@@ -0,0 +1,64 @@
+#!/bin/sh
+
+if [ $# -lt 1 ]; then
+cat <<EOF
+Usage: $0 PREFIX
+EOF
+exit 1;
+fi
+
+PREFIX="$1"
+shift 1
+
+. `dirname $0`/../../../testprogs/blackbox/subunit.sh
+
+# checks that the files in the 'private' directory created are not
+# world-reable/-writable
+check_private_file_perms()
+{
+    target_dir="$1/private"
+    result=0
+
+    for file in `ls $target_dir/`
+    do
+        filepath="$target_dir/$file"
+
+        # skip directories/sockets for now
+        if [ ! -f $filepath ] ; then
+            continue;
+        fi
+
+        # use stat to get the file permissions in numeric form,
+        # then use cut to drop the first digit (i.e. the owner)
+        global_perm=`stat -c "%a" $filepath | cut -c2-`
+
+        # what's left is the group and other users, both of which
+        # should have no permissions (zero in numeric form)
+        if [ "$global_perm" != "00" ] ; then
+            # display the permissions in human-readable format
+            file_perm=`stat -c "%A" $filepath`
+            echo "Error: $file has $file_perm permissions"
+            result=1
+        fi
+    done
+    return $result
+}
+
+TARGET_DIR=$PREFIX/basic-dc
+rm -rf $TARGET_DIR
+
+# create a dummy smb.conf - we need to use fake ACLs for the file system here
+# (but passing --option args with spaces in it proved too difficult in bash)
+SMB_CONF=$TARGET_DIR/tmp/smb.conf
+mkdir -p `dirname $SMB_CONF`
+echo "vfs objects = fake_acls xattr_tdb" > $SMB_CONF
+
+# provision a basic DC
+testit "basic-provision" $PYTHON $BINDIR/samba-tool domain provision --server-role="dc" --domain=FOO --realm=foo.example.com --targetdir=$TARGET_DIR --configfile=$SMB_CONF
+
+# check the file permissions in the 'private' directory really are private
+testit "provision-fileperms" check_private_file_perms $TARGET_DIR
+
+rm -rf $TARGET_DIR
+
+exit $failed
-- 
2.7.4