From 8ebd2a57d6256f85ba0970a82c181aa7d94f8d0a Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Fri, 5 Oct 2012 15:09:06 -0700
Subject: [PATCH 01/42] Simplify ensure_canon_entry_valid by splitting out the
 _get codepath.

---
 source3/smbd/posix_acls.c | 89 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 86 insertions(+), 3 deletions(-)

diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 5ce3bf3..c9ae440 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -1342,6 +1342,89 @@ static bool uid_entry_in_group(connection_struct *conn, canon_ace *uid_ace, cano
 }
 
 /****************************************************************************
+ A well formed POSIX file or default ACL has at least 3 entries, a
+ SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
+ In addition, the owner must always have at least read access.
+ When using this call on get_acl, the pst struct is valid and contains
+ the mode of the file.
+****************************************************************************/
+
+static bool ensure_canon_entry_valid_on_get(connection_struct *conn,
+					canon_ace **pp_ace,
+					const struct dom_sid *pfile_owner_sid,
+					const struct dom_sid *pfile_grp_sid,
+					const SMB_STRUCT_STAT *pst)
+{
+	canon_ace *pace;
+	bool got_user = false;
+	bool got_group = false;
+	bool got_other = false;
+
+	for (pace = *pp_ace; pace; pace = pace->next) {
+		if (pace->type == SMB_ACL_USER_OBJ) {
+			got_user = true;
+		} else if (pace->type == SMB_ACL_GROUP_OBJ) {
+			got_group = true;
+		} else if (pace->type == SMB_ACL_OTHER) {
+			got_other = true;
+		}
+	}
+
+	if (!got_user) {
+		if ((pace = talloc(talloc_tos(), canon_ace)) == NULL) {
+			DEBUG(0,("malloc fail.\n"));
+			return false;
+		}
+
+		ZERO_STRUCTP(pace);
+		pace->type = SMB_ACL_USER_OBJ;
+		pace->owner_type = UID_ACE;
+		pace->unix_ug.type = ID_TYPE_UID;
+		pace->unix_ug.id = pst->st_ex_uid;
+		pace->trustee = *pfile_owner_sid;
+		pace->attr = ALLOW_ACE;
+		pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRUSR, S_IWUSR, S_IXUSR);
+		DLIST_ADD(*pp_ace, pace);
+	}
+
+	if (!got_group) {
+		if ((pace = talloc(talloc_tos(), canon_ace)) == NULL) {
+			DEBUG(0,("malloc fail.\n"));
+			return false;
+		}
+
+		ZERO_STRUCTP(pace);
+		pace->type = SMB_ACL_GROUP_OBJ;
+		pace->owner_type = GID_ACE;
+		pace->unix_ug.type = ID_TYPE_GID;
+		pace->unix_ug.id = pst->st_ex_gid;
+		pace->trustee = *pfile_grp_sid;
+		pace->attr = ALLOW_ACE;
+		pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRGRP, S_IWGRP, S_IXGRP);
+		DLIST_ADD(*pp_ace, pace);
+	}
+
+	if (!got_other) {
+		if ((pace = talloc(talloc_tos(), canon_ace)) == NULL) {
+			DEBUG(0,("malloc fail.\n"));
+			return false;
+		}
+
+		ZERO_STRUCTP(pace);
+		pace->type = SMB_ACL_OTHER;
+		pace->owner_type = WORLD_ACE;
+		pace->unix_ug.type = ID_TYPE_NOT_SPECIFIED;
+		pace->unix_ug.id = -1;
+		pace->trustee = global_sid_World;
+		pace->attr = ALLOW_ACE;
+		pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IROTH, S_IWOTH, S_IXOTH);
+		DLIST_ADD(*pp_ace, pace);
+	}
+
+	return true;
+}
+
+/****************************************************************************
  A well formed POSIX file or default ACL has at least 3 entries, a 
  SMB_ACL_USER_OBJ, SMB_ACL_GROUP_OBJ, SMB_ACL_OTHER_OBJ.
  In addition, the owner must always have at least read access.
@@ -2755,9 +2838,9 @@ static canon_ace *canonicalise_acl(struct connection_struct *conn,
 	 * This next call will ensure we have at least a user/group/world set.
 	 */
 
-	if (!ensure_canon_entry_valid(conn, &l_head, is_default_acl, conn->params,
-				      S_ISDIR(psbuf->st_ex_mode), powner, pgroup,
-				      psbuf, False))
+	if (!ensure_canon_entry_valid_on_get(conn, &l_head,
+				      powner, pgroup,
+				      psbuf))
 		goto fail;
 
 	/*
-- 
1.7.11.7


From 063f7154eed817232077a8f5347170f055aeb6c2 Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Fri, 5 Oct 2012 15:51:19 -0700
Subject: [PATCH 02/42] We should never just assign an st_mode to an
 ace->perms field, theoretically they are different so
 should go through a mapping function. Ensure this is
 so.

Practically this does not matter, as for user permissions the mapping
function is an identity, and the extra bits we may add are ignored
anyway, but this makes the intent clear.

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Oct  6 03:04:14 CEST 2012 on sn-devel-104
---
 source3/smbd/posix_acls.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index c9ae440..fe0f23a 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -1508,9 +1508,9 @@ static bool ensure_canon_entry_valid(connection_struct *conn,
 		pace->unix_ug.id = pst->st_ex_uid;
 		pace->trustee = *pfile_owner_sid;
 		pace->attr = ALLOW_ACE;
-		/* Start with existing permissions, principle of least
+		/* Start with existing user permissions, principle of least
 		   surprises for the user. */
-		pace->perms = pst->st_ex_mode;
+		pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRUSR, S_IWUSR, S_IXUSR);
 
 		if (setting_acl) {
 			/* See if the owning user is in any of the other groups in
-- 
1.7.11.7


From 49133e42f115b3a7a37dead60be9086bd2559edf Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Tue, 9 Oct 2012 12:45:30 -0700
Subject: [PATCH 03/42] Move setting of psd->dacl->revision and protect
 against null SD's.

---
 source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
index 107e459..2b03f09 100644
--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
@@ -2100,6 +2100,10 @@ WERROR _srvsvc_NetGetFileSecurity(struct pipes_struct *p,
 		goto error_exit;
 	}
 
+	if (psd && psd->dacl) {
+		psd->dacl->revision = NT4_ACL_REVISION;
+	}
+
 	sd_size = ndr_size_security_descriptor(psd, 0);
 
 	sd_buf = talloc_zero(p->mem_ctx, struct sec_desc_buf);
@@ -2113,8 +2117,6 @@ WERROR _srvsvc_NetGetFileSecurity(struct pipes_struct *p,
 
 	*r->out.sd_buf = sd_buf;
 
-	psd->dacl->revision = NT4_ACL_REVISION;
-
 	close_file(NULL, fsp, NORMAL_CLOSE);
 	vfs_ChDir(conn, oldcwd);
 	SMB_VFS_DISCONNECT(conn);
-- 
1.7.11.7


From f2ee984da84579134d165bbe6b3c060aacd6c4b0 Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Tue, 9 Oct 2012 12:46:57 -0700
Subject: [PATCH 04/42] Make sure the returned sd is on the right context, and
 if not it's always freed.

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Oct  9 23:35:50 CEST 2012 on sn-devel-104
---
 source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
index 2b03f09..696c7bf 100644
--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
@@ -2113,7 +2113,7 @@ WERROR _srvsvc_NetGetFileSecurity(struct pipes_struct *p,
 	}
 
 	sd_buf->sd_size = sd_size;
-	sd_buf->sd = psd;
+	sd_buf->sd = talloc_move(p->mem_ctx, &psd);
 
 	*r->out.sd_buf = sd_buf;
 
@@ -2140,6 +2140,8 @@ error_exit:
 	}
 
  done:
+
+	TALLOC_FREE(psd);
 	TALLOC_FREE(smb_fname);
 
 	return werr;
-- 
1.7.11.7


From 4b42e2bd1a8e17e85babac7c545379de8ddc5909 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 10 Oct 2012 10:18:32 +1100
Subject: [PATCH 05/42] smbd: Add mem_ctx to sys_acl_init() and all callers

This changes from allocation on NULL to allocation on the supplied
memory context.

Currently that supplied context is talloc_tos() at the the final consumer of
the ACL.

Andrew Bartlett
---
 examples/VFS/skel_opaque.c          |  9 +++++--
 examples/VFS/skel_transparent.c     | 13 ++++++----
 source3/include/smb_acls.h          |  8 ++++---
 source3/include/vfs.h               | 15 ++++++++----
 source3/include/vfs_macros.h        | 18 +++++++-------
 source3/lib/sysacls.c               | 12 +++++-----
 source3/modules/vfs_aixacl2.c       |  9 +++----
 source3/modules/vfs_aixacl_util.c   |  4 ++--
 source3/modules/vfs_aixacl_util.h   |  2 +-
 source3/modules/vfs_cap.c           |  6 +++--
 source3/modules/vfs_catia.c         |  5 ++--
 source3/modules/vfs_default.c       | 13 ++++++----
 source3/modules/vfs_fake_acls.c     | 18 ++++++++------
 source3/modules/vfs_full_audit.c    |  9 +++----
 source3/modules/vfs_gpfs.c          | 24 +++++++++++--------
 source3/modules/vfs_hpuxacl.c       | 17 ++++++++------
 source3/modules/vfs_media_harmony.c |  9 +++----
 source3/modules/vfs_posixacl.c      | 15 ++++++------
 source3/modules/vfs_posixacl.h      |  6 +++--
 source3/modules/vfs_solarisacl.c    | 12 +++++-----
 source3/modules/vfs_time_audit.c    | 10 ++++----
 source3/modules/vfs_tru64acl.c      | 18 ++++++++------
 source3/smbd/posix_acls.c           | 47 +++++++++++++++++++++++++------------
 source3/smbd/pysmbd.c               | 40 +++++++++++++++----------------
 source3/smbd/trans2.c               | 12 ++++++----
 source3/smbd/vfs.c                  | 10 ++++----
 source3/torture/cmd_vfs.c           |  4 ++--
 27 files changed, 219 insertions(+), 146 deletions(-)

diff --git a/examples/VFS/skel_opaque.c b/examples/VFS/skel_opaque.c
index a786a23..3b91848 100644
--- a/examples/VFS/skel_opaque.c
+++ b/examples/VFS/skel_opaque.c
@@ -574,13 +574,18 @@ static int skel_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, mode_t
 	return -1;
 }
 
-static SMB_ACL_T skel_sys_acl_get_file(vfs_handle_struct *handle,  const char *path_p, SMB_ACL_TYPE_T type)
+static SMB_ACL_T skel_sys_acl_get_file(vfs_handle_struct *handle,
+				       const char *path_p,
+				       SMB_ACL_TYPE_T type,
+				       TALLOC_CTX *mem_ctx)
 {
 	errno = ENOSYS;
 	return (SMB_ACL_T)NULL;
 }
 
-static SMB_ACL_T skel_sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp)
+static SMB_ACL_T skel_sys_acl_get_fd(vfs_handle_struct *handle,
+				     files_struct *fsp,
+				     TALLOC_CTX *mem_ctx)
 {
 	errno = ENOSYS;
 	return (SMB_ACL_T)NULL;
diff --git a/examples/VFS/skel_transparent.c b/examples/VFS/skel_transparent.c
index 02a994c..a00b0e1 100644
--- a/examples/VFS/skel_transparent.c
+++ b/examples/VFS/skel_transparent.c
@@ -689,14 +689,19 @@ static int skel_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, mode_t
 	return SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
 }
 
-static SMB_ACL_T skel_sys_acl_get_file(vfs_handle_struct *handle,  const char *path_p, SMB_ACL_TYPE_T type)
+static SMB_ACL_T skel_sys_acl_get_file(vfs_handle_struct *handle,
+				       const char *path_p,
+				       SMB_ACL_TYPE_T type,
+				       TALLOC_CTX *mem_ctx)
 {
-	return SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
+	return SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type, mem_ctx);
 }
 
-static SMB_ACL_T skel_sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp)
+static SMB_ACL_T skel_sys_acl_get_fd(vfs_handle_struct *handle,
+				     files_struct *fsp,
+				     TALLOC_CTX *mem_ctx)
 {
-	return SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp);
+	return SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
 }
 
 static int skel_sys_acl_blob_get_file(vfs_handle_struct *handle,  const char *path_p, SMB_ACL_TYPE_T type,
diff --git a/source3/include/smb_acls.h b/source3/include/smb_acls.h
index dbcf3b7..3ac23db 100644
--- a/source3/include/smb_acls.h
+++ b/source3/include/smb_acls.h
@@ -44,7 +44,7 @@ int sys_acl_clear_perms(SMB_ACL_PERMSET_T permset_d);
 int sys_acl_add_perm(SMB_ACL_PERMSET_T permset_d, SMB_ACL_PERM_T perm);
 int sys_acl_get_perm(SMB_ACL_PERMSET_T permset_d, SMB_ACL_PERM_T perm);
 char *sys_acl_to_text(const struct smb_acl_t *acl_d, ssize_t *len_p);
-SMB_ACL_T sys_acl_init(void);
+SMB_ACL_T sys_acl_init(TALLOC_CTX *mem_ctx);
 int sys_acl_create_entry(SMB_ACL_T *acl_p, SMB_ACL_ENTRY_T *entry_p);
 int sys_acl_set_tag_type(SMB_ACL_ENTRY_T entry_d, SMB_ACL_TAG_T tag_type);
 int sys_acl_set_qualifier(SMB_ACL_ENTRY_T entry_d, void *qual_p);
@@ -52,8 +52,10 @@ int sys_acl_set_permset(SMB_ACL_ENTRY_T entry_d, SMB_ACL_PERMSET_T permset_d);
 int sys_acl_free_text(char *text);
 int sys_acl_valid(SMB_ACL_T acl_d);
 SMB_ACL_T sys_acl_get_file(struct vfs_handle_struct *handle,
-			   const char *path_p, SMB_ACL_TYPE_T type);
-SMB_ACL_T sys_acl_get_fd(struct vfs_handle_struct *handle, struct files_struct *fsp);
+			   const char *path_p, SMB_ACL_TYPE_T type,
+			   TALLOC_CTX *mem_ctx);
+SMB_ACL_T sys_acl_get_fd(struct vfs_handle_struct *handle, struct files_struct *fsp,
+			 TALLOC_CTX *mem_ctx);
 int sys_acl_set_file(struct vfs_handle_struct *handle,
 		     const char *name, SMB_ACL_TYPE_T type, SMB_ACL_T acl_d);
 int sys_acl_set_fd(struct vfs_handle_struct *handle, struct files_struct *fsp,
diff --git a/source3/include/vfs.h b/source3/include/vfs.h
index c83e7ed..4ba11be 100644
--- a/source3/include/vfs.h
+++ b/source3/include/vfs.h
@@ -692,8 +692,13 @@ struct vfs_fn_pointers {
 	int (*chmod_acl_fn)(struct vfs_handle_struct *handle, const char *name, mode_t mode);
 	int (*fchmod_acl_fn)(struct vfs_handle_struct *handle, struct files_struct *fsp, mode_t mode);
 
-	SMB_ACL_T (*sys_acl_get_file_fn)(struct vfs_handle_struct *handle, const char *path_p, SMB_ACL_TYPE_T type);
-	SMB_ACL_T (*sys_acl_get_fd_fn)(struct vfs_handle_struct *handle, struct files_struct *fsp);
+	SMB_ACL_T (*sys_acl_get_file_fn)(struct vfs_handle_struct *handle,
+					 const char *path_p,
+					 SMB_ACL_TYPE_T type,
+					 TALLOC_CTX *mem_ctx);
+	SMB_ACL_T (*sys_acl_get_fd_fn)(struct vfs_handle_struct *handle,
+				       struct files_struct *fsp,
+				       TALLOC_CTX *mem_ctx);
 	int (*sys_acl_blob_get_file_fn)(struct vfs_handle_struct *handle, const char *path_p, SMB_ACL_TYPE_T type, 	
 					TALLOC_CTX *mem_ctx, char **blob_description,
 					DATA_BLOB *blob);
@@ -1094,9 +1099,11 @@ int smb_vfs_call_fchmod_acl(struct vfs_handle_struct *handle,
 			    struct files_struct *fsp, mode_t mode);
 SMB_ACL_T smb_vfs_call_sys_acl_get_file(struct vfs_handle_struct *handle,
 					const char *path_p,
-					SMB_ACL_TYPE_T type);
+					SMB_ACL_TYPE_T type,
+					TALLOC_CTX *mem_ctx);
 SMB_ACL_T smb_vfs_call_sys_acl_get_fd(struct vfs_handle_struct *handle,
-				      struct files_struct *fsp);
+				      struct files_struct *fsp,
+				      TALLOC_CTX *mem_ctx);
 int smb_vfs_call_sys_acl_blob_get_file(struct vfs_handle_struct *handle,
 				       const char *path_p,
 				       SMB_ACL_TYPE_T type, 	
diff --git a/source3/include/vfs_macros.h b/source3/include/vfs_macros.h
index 4eca1b0..f1bc8ff 100644
--- a/source3/include/vfs_macros.h
+++ b/source3/include/vfs_macros.h
@@ -429,15 +429,15 @@
 #define SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode) \
 	smb_vfs_call_fchmod_acl((handle)->next, (fsp), (mode))
 
-#define SMB_VFS_SYS_ACL_GET_FILE(conn, path_p, type) \
-	smb_vfs_call_sys_acl_get_file((conn)->vfs_handles, (path_p), (type))
-#define SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type) \
-	smb_vfs_call_sys_acl_get_file((handle)->next, (path_p), (type))
-
-#define SMB_VFS_SYS_ACL_GET_FD(fsp) \
-	smb_vfs_call_sys_acl_get_fd((fsp)->conn->vfs_handles, (fsp))
-#define SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp) \
-	smb_vfs_call_sys_acl_get_fd((handle)->next, (fsp))
+#define SMB_VFS_SYS_ACL_GET_FILE(conn, path_p, type, mem_ctx)		\
+	smb_vfs_call_sys_acl_get_file((conn)->vfs_handles, (path_p), (type), (mem_ctx))
+#define SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type, mem_ctx)		\
+	smb_vfs_call_sys_acl_get_file((handle)->next, (path_p), (type), (mem_ctx))
+
+#define SMB_VFS_SYS_ACL_GET_FD(fsp, mem_ctx) \
+	smb_vfs_call_sys_acl_get_fd((fsp)->conn->vfs_handles, (fsp), (mem_ctx))
+#define SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx) \
+	smb_vfs_call_sys_acl_get_fd((handle)->next, (fsp), (mem_ctx))
 
 #define SMB_VFS_SYS_ACL_BLOB_GET_FILE(conn, path_p, type, mem_ctx, blob_description, blob)	\
 	smb_vfs_call_sys_acl_blob_get_file((conn)->vfs_handles, (path_p), (type), (mem_ctx), (blob_description), (blob))
diff --git a/source3/lib/sysacls.c b/source3/lib/sysacls.c
index a5430d6..2245491 100644
--- a/source3/lib/sysacls.c
+++ b/source3/lib/sysacls.c
@@ -249,11 +249,11 @@ char *sys_acl_to_text(const struct smb_acl_t *acl_d, ssize_t *len_p)
 	return text;
 }
 
-SMB_ACL_T sys_acl_init(void)
+SMB_ACL_T sys_acl_init(TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T	a;
 
-	if ((a = talloc(NULL, struct smb_acl_t)) == NULL) {
+	if ((a = talloc(mem_ctx, struct smb_acl_t)) == NULL) {
 		errno = ENOMEM;
 		return NULL;
 	}
@@ -364,14 +364,14 @@ int sys_acl_valid(SMB_ACL_T acl_d)
 #if defined(HAVE_POSIX_ACLS)
  
 SMB_ACL_T sys_acl_get_file(vfs_handle_struct *handle, 
-			   const char *path_p, SMB_ACL_TYPE_T type)
+			   const char *path_p, SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx)
 {
-	return posixacl_sys_acl_get_file(handle, path_p, type);
+	return posixacl_sys_acl_get_file(handle, path_p, type, mem_ctx);
 }
  
-SMB_ACL_T sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp)
+SMB_ACL_T sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp, TALLOC_CTX *mem_ctx)
 {
-	return posixacl_sys_acl_get_fd(handle, fsp);
+	return posixacl_sys_acl_get_fd(handle, fsp, mem_ctx);
 }
  
 int sys_acl_set_file(vfs_handle_struct *handle,
diff --git a/source3/modules/vfs_aixacl2.c b/source3/modules/vfs_aixacl2.c
index dd705ea..0d754d7 100644
--- a/source3/modules/vfs_aixacl2.c
+++ b/source3/modules/vfs_aixacl2.c
@@ -200,7 +200,7 @@ static NTSTATUS aixjfs2_get_nt_acl(vfs_handle_struct *handle,
 				   pacl);
 }
 
-static SMB_ACL_T aixjfs2_get_posix_acl(const char *path, acl_type_t type)
+static SMB_ACL_T aixjfs2_get_posix_acl(const char *path, acl_type_t type, TALLOC_CTX *mem_ctx)
 {
         aixc_acl_t *pacl;
 	AIXJFS2_ACL_T *acl;
@@ -222,7 +222,7 @@ static SMB_ACL_T aixjfs2_get_posix_acl(const char *path, acl_type_t type)
         DEBUG(10, ("len: %d, mode: %d\n",
                    pacl->acl_len, pacl->acl_mode));
 
-        result = aixacl_to_smbacl(pacl);
+        result = aixacl_to_smbacl(pacl, mem_ctx);
         if (result == NULL) {
                 goto done;
         }
@@ -236,7 +236,8 @@ static SMB_ACL_T aixjfs2_get_posix_acl(const char *path, acl_type_t type)
 
 SMB_ACL_T aixjfs2_sys_acl_get_file(vfs_handle_struct *handle,
                                     const char *path_p,
-                                    SMB_ACL_TYPE_T type)
+				   SMB_ACL_TYPE_T type,
+				   TALLOC_CTX *mem_ctx)
 {
         acl_type_t aixjfs2_type;
 
@@ -252,7 +253,7 @@ SMB_ACL_T aixjfs2_sys_acl_get_file(vfs_handle_struct *handle,
                 smb_panic("exiting");
         }
 
-        return aixjfs2_get_posix_acl(path_p, aixjfs2_type);
+        return aixjfs2_get_posix_acl(path_p, aixjfs2_type, mem_ctx);
 }
 
 SMB_ACL_T aixjfs2_sys_acl_get_fd(vfs_handle_struct *handle,
diff --git a/source3/modules/vfs_aixacl_util.c b/source3/modules/vfs_aixacl_util.c
index 82e8bd1..1194d27 100644
--- a/source3/modules/vfs_aixacl_util.c
+++ b/source3/modules/vfs_aixacl_util.c
@@ -22,12 +22,12 @@
 #include "smbd/smbd.h"
 #include "vfs_aixacl_util.h"
 
-SMB_ACL_T aixacl_to_smbacl(struct acl *file_acl)
+SMB_ACL_T aixacl_to_smbacl(struct acl *file_acl, TALLOC_CTX *mem_ctx)
 {
 	struct acl_entry *acl_entry;
 	struct ace_id *idp;
 	
-	struct smb_acl_t *result = sys_acl_init();
+	struct smb_acl_t *result = sys_acl_init(mem_ctx);
 	struct smb_acl_entry *ace;
 	int i;
 	
diff --git a/source3/modules/vfs_aixacl_util.h b/source3/modules/vfs_aixacl_util.h
index 2447252..e283a3d 100644
--- a/source3/modules/vfs_aixacl_util.h
+++ b/source3/modules/vfs_aixacl_util.h
@@ -17,6 +17,6 @@
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-SMB_ACL_T aixacl_to_smbacl( struct acl *file_acl);
+SMB_ACL_T aixacl_to_smbacl( struct acl *file_acl, TALLOC_CTX *mem_ctx);
 struct acl *aixacl_smb_to_aixacl(SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl);
 
diff --git a/source3/modules/vfs_cap.c b/source3/modules/vfs_cap.c
index 2454e12..f2f8d71 100644
--- a/source3/modules/vfs_cap.c
+++ b/source3/modules/vfs_cap.c
@@ -409,7 +409,9 @@ static int cap_chmod_acl(vfs_handle_struct *handle, const char *path, mode_t mod
 	return SMB_VFS_NEXT_CHMOD_ACL(handle, cappath, mode);
 }
 
-static SMB_ACL_T cap_sys_acl_get_file(vfs_handle_struct *handle, const char *path, SMB_ACL_TYPE_T type)
+static SMB_ACL_T cap_sys_acl_get_file(vfs_handle_struct *handle,
+				      const char *path, SMB_ACL_TYPE_T type,
+				      TALLOC_CTX *mem_ctx)
 {
 	char *cappath = capencode(talloc_tos(), path);
 
@@ -417,7 +419,7 @@ static SMB_ACL_T cap_sys_acl_get_file(vfs_handle_struct *handle, const char *pat
 		errno = ENOMEM;
 		return (SMB_ACL_T)NULL;
 	}
-	return SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, cappath, type);
+	return SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, cappath, type, mem_ctx);
 }
 
 static int cap_sys_acl_set_file(vfs_handle_struct *handle, const char *path, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl)
diff --git a/source3/modules/vfs_catia.c b/source3/modules/vfs_catia.c
index 821a755..a2bef44 100644
--- a/source3/modules/vfs_catia.c
+++ b/source3/modules/vfs_catia.c
@@ -745,7 +745,8 @@ catia_chmod_acl(vfs_handle_struct *handle,
 static SMB_ACL_T
 catia_sys_acl_get_file(vfs_handle_struct *handle,
 		       const char *path,
-		       SMB_ACL_TYPE_T type)
+		       SMB_ACL_TYPE_T type,
+		       TALLOC_CTX *mem_ctx)
 {
 	char *mapped_name = NULL;
 	NTSTATUS status;
@@ -758,7 +759,7 @@ catia_sys_acl_get_file(vfs_handle_struct *handle,
 		return NULL;
 	}
 
-	ret = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, mapped_name, type);
+	ret = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, mapped_name, type, mem_ctx);
 	TALLOC_FREE(mapped_name);
 
 	return ret;
diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c
index ebfa607..a03a4f8 100644
--- a/source3/modules/vfs_default.c
+++ b/source3/modules/vfs_default.c
@@ -2128,14 +2128,19 @@ static int vfswrap_fchmod_acl(vfs_handle_struct *handle, files_struct *fsp, mode
 #endif
 }
 
-static SMB_ACL_T vfswrap_sys_acl_get_file(vfs_handle_struct *handle,  const char *path_p, SMB_ACL_TYPE_T type)
+static SMB_ACL_T vfswrap_sys_acl_get_file(vfs_handle_struct *handle,
+					  const char *path_p,
+					  SMB_ACL_TYPE_T type,
+					  TALLOC_CTX *mem_ctx)
 {
-	return sys_acl_get_file(handle, path_p, type);
+	return sys_acl_get_file(handle, path_p, type, mem_ctx);
 }
 
-static SMB_ACL_T vfswrap_sys_acl_get_fd(vfs_handle_struct *handle, files_struct *fsp)
+static SMB_ACL_T vfswrap_sys_acl_get_fd(vfs_handle_struct *handle,
+					files_struct *fsp,
+					TALLOC_CTX *mem_ctx)
 {
-	return sys_acl_get_fd(handle, fsp);
+	return sys_acl_get_fd(handle, fsp, mem_ctx);
 }
 
 static int vfswrap_sys_acl_set_file(vfs_handle_struct *handle,  const char *name, SMB_ACL_TYPE_T acltype, SMB_ACL_T theacl)
diff --git a/source3/modules/vfs_fake_acls.c b/source3/modules/vfs_fake_acls.c
index 258cb19..ea3db23 100644
--- a/source3/modules/vfs_fake_acls.c
+++ b/source3/modules/vfs_fake_acls.c
@@ -189,11 +189,10 @@ static int fake_acls_fstat(vfs_handle_struct *handle, files_struct *fsp, SMB_STR
 	return ret;
 }
 
-static SMB_ACL_T fake_acls_blob2acl(DATA_BLOB *blob)
+static SMB_ACL_T fake_acls_blob2acl(DATA_BLOB *blob, TALLOC_CTX *mem_ctx)
 {
 	enum ndr_err_code ndr_err;
-	/* For now, ACLs are allocated on NULL */
-	struct smb_acl_t *acl = talloc(NULL, struct smb_acl_t);
+	struct smb_acl_t *acl = talloc(mem_ctx, struct smb_acl_t);
 	if (!acl) {
 		errno = ENOMEM;
 		return NULL;
@@ -226,7 +225,10 @@ static DATA_BLOB fake_acls_acl2blob(TALLOC_CTX *mem_ctx, SMB_ACL_T acl)
 	return blob;
 }
 
-static SMB_ACL_T fake_acls_sys_acl_get_file(struct vfs_handle_struct *handle, const char *path, SMB_ACL_TYPE_T type)
+static SMB_ACL_T fake_acls_sys_acl_get_file(struct vfs_handle_struct *handle,
+					    const char *path,
+					    SMB_ACL_TYPE_T type,
+					    TALLOC_CTX *mem_ctx)
 {
 	DATA_BLOB blob = data_blob_null;
 	ssize_t length;
@@ -258,13 +260,15 @@ static SMB_ACL_T fake_acls_sys_acl_get_file(struct vfs_handle_struct *handle, co
 		return NULL;
 	}
 	if (length != -1) {
-		acl = fake_acls_blob2acl(&blob);
+		acl = fake_acls_blob2acl(&blob, mem_ctx);
 	}
 	TALLOC_FREE(frame);
 	return acl;
 }
 
-static SMB_ACL_T fake_acls_sys_acl_get_fd(struct vfs_handle_struct *handle, files_struct *fsp)
+static SMB_ACL_T fake_acls_sys_acl_get_fd(struct vfs_handle_struct *handle,
+					  files_struct *fsp,
+					  TALLOC_CTX *mem_ctx)
 {
 	DATA_BLOB blob = data_blob_null;
 	ssize_t length;
@@ -288,7 +292,7 @@ static SMB_ACL_T fake_acls_sys_acl_get_fd(struct vfs_handle_struct *handle, file
 		return NULL;
 	}
 	if (length != -1) {
-		acl = fake_acls_blob2acl(&blob);
+		acl = fake_acls_blob2acl(&blob, mem_ctx);
 	}
 	TALLOC_FREE(frame);
 	return acl;
diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c
index 6050c55..e56c4a8 100644
--- a/source3/modules/vfs_full_audit.c
+++ b/source3/modules/vfs_full_audit.c
@@ -1803,11 +1803,12 @@ static int smb_full_audit_fchmod_acl(vfs_handle_struct *handle, files_struct *fs
 
 static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
 					const char *path_p,
-					SMB_ACL_TYPE_T type)
+						 SMB_ACL_TYPE_T type,
+						 TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T result;
 
-	result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
+	result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type, mem_ctx);
 
 	do_log(SMB_VFS_OP_SYS_ACL_GET_FILE, (result != NULL), handle,
 	       "%s", path_p);
@@ -1816,11 +1817,11 @@ static SMB_ACL_T smb_full_audit_sys_acl_get_file(vfs_handle_struct *handle,
 }
 
 static SMB_ACL_T smb_full_audit_sys_acl_get_fd(vfs_handle_struct *handle,
-				      files_struct *fsp)
+					       files_struct *fsp, TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T result;
 
-	result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp);
+	result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
 
 	do_log(SMB_VFS_OP_SYS_ACL_GET_FD, (result != NULL), handle,
 	       "%s", fsp_str_do_log(fsp));
diff --git a/source3/modules/vfs_gpfs.c b/source3/modules/vfs_gpfs.c
index 8959fe6..412c48c 100644
--- a/source3/modules/vfs_gpfs.c
+++ b/source3/modules/vfs_gpfs.c
@@ -549,12 +549,12 @@ static NTSTATUS gpfsacl_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp
 	return gpfsacl_set_nt_acl_internal(fsp, security_info_sent, psd);
 }
 
-static SMB_ACL_T gpfs2smb_acl(const struct gpfs_acl *pacl)
+static SMB_ACL_T gpfs2smb_acl(const struct gpfs_acl *pacl, TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T result;
 	gpfs_aclCount_t i;
 
-	result = sys_acl_init();
+	result = sys_acl_init(mem_ctx);
 	if (result == NULL) {
 		errno = ENOMEM;
 		return NULL;
@@ -614,7 +614,8 @@ static SMB_ACL_T gpfs2smb_acl(const struct gpfs_acl *pacl)
 	return result;
 }
 
-static SMB_ACL_T gpfsacl_get_posix_acl(const char *path, gpfs_aclType_t type)
+static SMB_ACL_T gpfsacl_get_posix_acl(const char *path, gpfs_aclType_t type,
+				       TALLOC_CTX *mem_ctx)
 {
 	struct gpfs_acl *pacl;
 	SMB_ACL_T result = NULL;
@@ -641,7 +642,7 @@ static SMB_ACL_T gpfsacl_get_posix_acl(const char *path, gpfs_aclType_t type)
 		   pacl->acl_len, pacl->acl_level, pacl->acl_version,
 		   pacl->acl_nace));
 
-	result = gpfs2smb_acl(pacl);
+	result = gpfs2smb_acl(pacl, mem_ctx);
 	if (result != NULL) {
 		errno = 0;
 	}
@@ -656,7 +657,8 @@ static SMB_ACL_T gpfsacl_get_posix_acl(const char *path, gpfs_aclType_t type)
 
 static SMB_ACL_T gpfsacl_sys_acl_get_file(vfs_handle_struct *handle,
 					  const char *path_p,
-					  SMB_ACL_TYPE_T type)
+					  SMB_ACL_TYPE_T type,
+					  TALLOC_CTX *mem_ctx)
 {
 	gpfs_aclType_t gpfs_type;
 	struct gpfs_config_data *config;
@@ -666,7 +668,8 @@ static SMB_ACL_T gpfsacl_sys_acl_get_file(vfs_handle_struct *handle,
 				return NULL);
 
 	if (!config->acl) {
-		return SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
+		return SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p,
+						     type, mem_ctx);
 	}
 
 	switch(type) {
@@ -681,11 +684,12 @@ static SMB_ACL_T gpfsacl_sys_acl_get_file(vfs_handle_struct *handle,
 		smb_panic("exiting");
 	}
 
-	return gpfsacl_get_posix_acl(path_p, gpfs_type);
+	return gpfsacl_get_posix_acl(path_p, gpfs_type, mem_ctx);
 }
 
 static SMB_ACL_T gpfsacl_sys_acl_get_fd(vfs_handle_struct *handle,
-					files_struct *fsp)
+					files_struct *fsp,
+					TALLOC_CTX *mem_ctx)
 {
 	struct gpfs_config_data *config;
 
@@ -694,11 +698,11 @@ static SMB_ACL_T gpfsacl_sys_acl_get_fd(vfs_handle_struct *handle,
 				return NULL);
 
 	if (!config->acl) {
-		return SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp);
+		return SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
 	}
 
 	return gpfsacl_get_posix_acl(fsp->fsp_name->base_name,
-				     GPFS_ACL_TYPE_ACCESS);
+				     GPFS_ACL_TYPE_ACCESS, mem_ctx);
 }
 
 static struct gpfs_acl *smb2gpfs_acl(const SMB_ACL_T pacl,
diff --git a/source3/modules/vfs_hpuxacl.c b/source3/modules/vfs_hpuxacl.c
index 884cc5c..6a0fb9b 100644
--- a/source3/modules/vfs_hpuxacl.c
+++ b/source3/modules/vfs_hpuxacl.c
@@ -112,7 +112,7 @@ static bool smb_acl_to_hpux_acl(SMB_ACL_T smb_acl,
 		HPUX_ACL_T *solariacl, int *count, 
 		SMB_ACL_TYPE_T type);
 static SMB_ACL_T hpux_acl_to_smb_acl(HPUX_ACL_T hpuxacl, int count,
-		SMB_ACL_TYPE_T type);
+				     SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx);
 static HPUX_ACL_TAG_T smb_tag_to_hpux_tag(SMB_ACL_TAG_T smb_tag);
 static SMB_ACL_TAG_T hpux_tag_to_smb_tag(HPUX_ACL_TAG_T hpux_tag);
 static bool hpux_add_to_acl(HPUX_ACL_T *hpux_acl, int *count,
@@ -140,7 +140,8 @@ static bool hpux_aclsort_call_present(void);
 
 SMB_ACL_T hpuxacl_sys_acl_get_file(vfs_handle_struct *handle,
 				      const char *path_p,
-				      SMB_ACL_TYPE_T type)
+				   SMB_ACL_TYPE_T type,
+				   TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T result = NULL;
 	int count;
@@ -168,7 +169,7 @@ SMB_ACL_T hpuxacl_sys_acl_get_file(vfs_handle_struct *handle,
 	if (!hpux_acl_get_file(path_p, &hpux_acl, &count)) {
 		goto done;
 	}
-	result = hpux_acl_to_smb_acl(hpux_acl, count, type);
+	result = hpux_acl_to_smb_acl(hpux_acl, count, type, mem_ctx);
 	if (result == NULL) {
 		DEBUG(10, ("conversion hpux_acl -> smb_acl failed (%s).\n",
 			   strerror(errno)));
@@ -186,7 +187,8 @@ SMB_ACL_T hpuxacl_sys_acl_get_file(vfs_handle_struct *handle,
  * get the access ACL of a file referred to by a fd
  */
 SMB_ACL_T hpuxacl_sys_acl_get_fd(vfs_handle_struct *handle,
-				 files_struct *fsp)
+				 files_struct *fsp,
+				 TALLOC_CTX *mem_ctx)
 {
         /* 
 	 * HPUX doesn't have the facl call. Fake it using the path.... JRA. 
@@ -200,7 +202,8 @@ SMB_ACL_T hpuxacl_sys_acl_get_fd(vfs_handle_struct *handle,
 
         return hpuxacl_sys_acl_get_file(handle,
 					fsp->fsp_name->base_name,
-					SMB_ACL_TYPE_ACCESS);
+					SMB_ACL_TYPE_ACCESS,
+					mem_ctx);
 }
 
 
@@ -490,12 +493,12 @@ static bool smb_acl_to_hpux_acl(SMB_ACL_T smb_acl,
  * soaris acl to the SMB_ACL format.
  */
 static SMB_ACL_T hpux_acl_to_smb_acl(HPUX_ACL_T hpux_acl, int count, 
-					SMB_ACL_TYPE_T type)
+				     SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T result;
 	int i;
 
-	if ((result = sys_acl_init()) == NULL) {
+	if ((result = sys_acl_init(mem_ctx)) == NULL) {
 		DEBUG(10, ("error allocating memory for SMB_ACL\n"));
 		goto fail;
 	}
diff --git a/source3/modules/vfs_media_harmony.c b/source3/modules/vfs_media_harmony.c
index 647db7c..a10eb5e 100644
--- a/source3/modules/vfs_media_harmony.c
+++ b/source3/modules/vfs_media_harmony.c
@@ -2085,8 +2085,9 @@ out:
  * Failure: set errno, return NULL
  */
 static SMB_ACL_T mh_sys_acl_get_file(vfs_handle_struct *handle,
-		const char *path_p,
-		SMB_ACL_TYPE_T type)
+				     const char *path_p,
+				     SMB_ACL_TYPE_T type,
+				     TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T ret;
 	char *clientPath;
@@ -2095,7 +2096,7 @@ static SMB_ACL_T mh_sys_acl_get_file(vfs_handle_struct *handle,
 	DEBUG(MH_INFO_DEBUG, ("Entering mh_sys_acl_get_file\n"));
 	if (!is_in_media_files(path_p))
 	{
-		ret = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
+		ret = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type, mem_ctx);
 		goto out;
 	}
 
@@ -2110,7 +2111,7 @@ static SMB_ACL_T mh_sys_acl_get_file(vfs_handle_struct *handle,
 		goto err;
 	}
 
-	ret = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, clientPath, type);
+	ret = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, clientPath, type, mem_ctx);
 err:
 	TALLOC_FREE(clientPath);
 out:
diff --git a/source3/modules/vfs_posixacl.c b/source3/modules/vfs_posixacl.c
index 50487ff..1714b13 100644
--- a/source3/modules/vfs_posixacl.c
+++ b/source3/modules/vfs_posixacl.c
@@ -26,7 +26,7 @@
 
 static bool smb_ace_to_internal(acl_entry_t posix_ace,
 				struct smb_acl_entry *ace);
-static struct smb_acl_t *smb_acl_to_internal(acl_t acl);
+static struct smb_acl_t *smb_acl_to_internal(acl_t acl, TALLOC_CTX *mem_ctx);
 static int smb_acl_set_mode(acl_entry_t entry, SMB_ACL_PERM_T perm);
 static acl_t smb_acl_to_posix(const struct smb_acl_t *acl);
 
@@ -35,7 +35,8 @@ static acl_t smb_acl_to_posix(const struct smb_acl_t *acl);
 
 SMB_ACL_T posixacl_sys_acl_get_file(vfs_handle_struct *handle,
 				    const char *path_p,
-				    SMB_ACL_TYPE_T type)
+				    SMB_ACL_TYPE_T type,
+				    TALLOC_CTX *mem_ctx)
 {
 	struct smb_acl_t *result;
 	acl_type_t acl_type;
@@ -59,13 +60,13 @@ SMB_ACL_T posixacl_sys_acl_get_file(vfs_handle_struct *handle,
 		return NULL;
 	}
 
-	result = smb_acl_to_internal(acl);
+	result = smb_acl_to_internal(acl, mem_ctx);
 	acl_free(acl);
 	return result;
 }
 
 SMB_ACL_T posixacl_sys_acl_get_fd(vfs_handle_struct *handle,
-				  files_struct *fsp)
+				  files_struct *fsp, TALLOC_CTX *mem_ctx)
 {
 	struct smb_acl_t *result;
 	acl_t acl = acl_get_fd(fsp->fh->fd);
@@ -74,7 +75,7 @@ SMB_ACL_T posixacl_sys_acl_get_fd(vfs_handle_struct *handle,
 		return NULL;
 	}
 
-	result = smb_acl_to_internal(acl);
+	result = smb_acl_to_internal(acl, mem_ctx);
 	acl_free(acl);
 	return result;
 }
@@ -212,9 +213,9 @@ static bool smb_ace_to_internal(acl_entry_t posix_ace,
 	return True;
 }
 
-static struct smb_acl_t *smb_acl_to_internal(acl_t acl)
+static struct smb_acl_t *smb_acl_to_internal(acl_t acl, TALLOC_CTX *mem_ctx)
 {
-	struct smb_acl_t *result = sys_acl_init();
+	struct smb_acl_t *result = sys_acl_init(mem_ctx);
 	int entry_id = ACL_FIRST_ENTRY;
 	acl_entry_t e;
 	if (result == NULL) {
diff --git a/source3/modules/vfs_posixacl.h b/source3/modules/vfs_posixacl.h
index 9ef3f86..b0fe841 100644
--- a/source3/modules/vfs_posixacl.h
+++ b/source3/modules/vfs_posixacl.h
@@ -23,10 +23,12 @@
 
 SMB_ACL_T posixacl_sys_acl_get_file(vfs_handle_struct *handle,
 				    const char *path_p,
-				    SMB_ACL_TYPE_T type);
+				    SMB_ACL_TYPE_T type,
+				    TALLOC_CTX *mem_ctx);
 
 SMB_ACL_T posixacl_sys_acl_get_fd(vfs_handle_struct *handle,
-				  files_struct *fsp);
+				  files_struct *fsp,
+				  TALLOC_CTX *mem_ctx);
 
 int posixacl_sys_acl_set_file(vfs_handle_struct *handle,
 			      const char *name,
diff --git a/source3/modules/vfs_solarisacl.c b/source3/modules/vfs_solarisacl.c
index 10b6f70..ad25e88 100644
--- a/source3/modules/vfs_solarisacl.c
+++ b/source3/modules/vfs_solarisacl.c
@@ -45,7 +45,7 @@ static bool smb_acl_to_solaris_acl(SMB_ACL_T smb_acl,
 		SOLARIS_ACL_T *solariacl, int *count, 
 		SMB_ACL_TYPE_T type);
 static SMB_ACL_T solaris_acl_to_smb_acl(SOLARIS_ACL_T solarisacl, int count,
-		SMB_ACL_TYPE_T type);
+					SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx);
 static SOLARIS_ACL_TAG_T smb_tag_to_solaris_tag(SMB_ACL_TAG_T smb_tag);
 static SMB_ACL_TAG_T solaris_tag_to_smb_tag(SOLARIS_ACL_TAG_T solaris_tag);
 static bool solaris_add_to_acl(SOLARIS_ACL_T *solaris_acl, int *count,
@@ -64,7 +64,7 @@ static bool solaris_acl_check(SOLARIS_ACL_T solaris_acl, int count);
 
 SMB_ACL_T solarisacl_sys_acl_get_file(vfs_handle_struct *handle,
 				      const char *path_p,
-				      SMB_ACL_TYPE_T type)
+				      SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T result = NULL;
 	int count;
@@ -85,7 +85,7 @@ SMB_ACL_T solarisacl_sys_acl_get_file(vfs_handle_struct *handle,
 	if (!solaris_acl_get_file(path_p, &solaris_acl, &count)) {
 		goto done;
 	}
-	result = solaris_acl_to_smb_acl(solaris_acl, count, type);
+	result = solaris_acl_to_smb_acl(solaris_acl, count, type, mem_ctx);
 	if (result == NULL) {
 		DEBUG(10, ("conversion solaris_acl -> smb_acl failed (%s).\n",
 			   strerror(errno)));
@@ -103,7 +103,7 @@ SMB_ACL_T solarisacl_sys_acl_get_file(vfs_handle_struct *handle,
  * get the access ACL of a file referred to by a fd
  */
 SMB_ACL_T solarisacl_sys_acl_get_fd(vfs_handle_struct *handle,
-				    files_struct *fsp)
+				    files_struct *fsp, TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T result = NULL;
 	int count;
@@ -424,12 +424,12 @@ static bool smb_acl_to_solaris_acl(SMB_ACL_T smb_acl,
  * soaris acl to the SMB_ACL format.
  */
 static SMB_ACL_T solaris_acl_to_smb_acl(SOLARIS_ACL_T solaris_acl, int count, 
-					SMB_ACL_TYPE_T type)
+					SMB_ACL_TYPE_T type, TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T result;
 	int i;
 
-	if ((result = sys_acl_init()) == NULL) {
+	if ((result = sys_acl_init(mem_ctx)) == NULL) {
 		DEBUG(10, ("error allocating memory for SMB_ACL\n"));
 		goto fail;
 	}
diff --git a/source3/modules/vfs_time_audit.c b/source3/modules/vfs_time_audit.c
index 7571b2f..b7d399b 100644
--- a/source3/modules/vfs_time_audit.c
+++ b/source3/modules/vfs_time_audit.c
@@ -1772,14 +1772,15 @@ static int smb_time_audit_fchmod_acl(vfs_handle_struct *handle,
 
 static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
 						 const char *path_p,
-						 SMB_ACL_TYPE_T type)
+						 SMB_ACL_TYPE_T type,
+						 TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T result;
 	struct timespec ts1,ts2;
 	double timediff;
 
 	clock_gettime_mono(&ts1);
-	result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type);
+	result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type, mem_ctx);
 	clock_gettime_mono(&ts2);
 	timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 
@@ -1791,14 +1792,15 @@ static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
 }
 
 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
-					       files_struct *fsp)
+					       files_struct *fsp,
+					       TALLOC_CTX *mem_ctx)
 {
 	SMB_ACL_T result;
 	struct timespec ts1,ts2;
 	double timediff;
 
 	clock_gettime_mono(&ts1);
-	result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp);
+	result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
 	clock_gettime_mono(&ts2);
 	timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 
diff --git a/source3/modules/vfs_tru64acl.c b/source3/modules/vfs_tru64acl.c
index 918f7c6..6eadee6 100644
--- a/source3/modules/vfs_tru64acl.c
+++ b/source3/modules/vfs_tru64acl.c
@@ -24,7 +24,8 @@
 
 /* prototypes for private functions first - for clarity */
 
-static struct smb_acl_t *tru64_acl_to_smb_acl(const struct acl *tru64_acl);
+static struct smb_acl_t *tru64_acl_to_smb_acl(const struct acl *tru64_acl,
+					      TALLOC_CTX *mem_ctx);
 static bool tru64_ace_to_smb_ace(acl_entry_t tru64_ace, 
 				struct smb_acl_entry *smb_ace);
 static acl_t smb_acl_to_tru64_acl(const SMB_ACL_T smb_acl);
@@ -38,7 +39,8 @@ static SMB_ACL_PERM_T tru64_permset_to_smb(const acl_perm_t tru64_permset);
 
 SMB_ACL_T tru64acl_sys_acl_get_file(vfs_handle_struct *handle,
 				    const char *path_p,
-				    SMB_ACL_TYPE_T type)
+				    SMB_ACL_TYPE_T type,
+				    TALLOC_CTX *mem_ctx)
 {
         struct smb_acl_t *result;
         acl_type_t the_acl_type;
@@ -64,13 +66,14 @@ SMB_ACL_T tru64acl_sys_acl_get_file(vfs_handle_struct *handle,
                 return NULL;
         }
 
-        result = tru64_acl_to_smb_acl(tru64_acl);
+        result = tru64_acl_to_smb_acl(tru64_acl, mem_ctx);
         acl_free(tru64_acl);
         return result;
 }
 
 SMB_ACL_T tru64acl_sys_acl_get_fd(vfs_handle_struct *handle,
-				  files_struct *fsp)
+				  files_struct *fsp,
+				  TALLOC_CTX *mem_ctx)
 {
 	struct smb_acl_t *result;
 	acl_t tru64_acl = acl_get_fd(fsp->fh->fd, ACL_TYPE_ACCESS);
@@ -79,7 +82,7 @@ SMB_ACL_T tru64acl_sys_acl_get_fd(vfs_handle_struct *handle,
 		return NULL;
 	}
 	
-	result = tru64_acl_to_smb_acl(tru64_acl);
+	result = tru64_acl_to_smb_acl(tru64_acl, mem_ctx);
 	acl_free(tru64_acl);
 	return result;
 }
@@ -153,14 +156,15 @@ int tru64acl_sys_acl_delete_def_file(vfs_handle_struct *handle,
 
 /* private functions */
 
-static struct smb_acl_t *tru64_acl_to_smb_acl(const struct acl *tru64_acl) 
+static struct smb_acl_t *tru64_acl_to_smb_acl(const struct acl *tru64_acl,
+					      TALLOC_CTX *mem_ctx)
 {
 	struct smb_acl_t *result;
 	acl_entry_t entry;
 
 	DEBUG(10, ("Hi! This is tru64_acl_to_smb_acl.\n"));
 	
-	if ((result = sys_acl_init()) == NULL) {
+	if ((result = sys_acl_init(mem_ctx)) == NULL) {
 		DEBUG(0, ("sys_acl_init() failed in tru64_acl_to_smb_acl\n"));
 		errno = ENOMEM;
 		goto fail;
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index fe0f23a..96bd6ec 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -2934,7 +2934,7 @@ static bool set_canon_ace_list(files_struct *fsp,
 {
 	connection_struct *conn = fsp->conn;
 	bool ret = False;
-	SMB_ACL_T the_acl = sys_acl_init();
+	SMB_ACL_T the_acl = sys_acl_init(talloc_tos());
 	canon_ace *p_ace;
 	int i;
 	SMB_ACL_ENTRY_T mask_entry;
@@ -3694,7 +3694,7 @@ NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
 	}
 
 	/* Get the ACL from the fd. */
-	posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
+	posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, talloc_tos());
 
 	pal = fload_inherited_info(fsp);
 
@@ -3731,11 +3731,14 @@ NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
 	}
 
 	/* Get the ACL from the path. */
-	posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_ACCESS);
+	posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name,
+					     SMB_ACL_TYPE_ACCESS, talloc_tos());
 
 	/* If it's a directory get the default POSIX ACL. */
 	if(S_ISDIR(smb_fname.st.st_ex_mode)) {
-		def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name, SMB_ACL_TYPE_DEFAULT);
+		def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name,
+                                                   SMB_ACL_TYPE_DEFAULT,
+                                                   talloc_tos());
 		def_acl = free_empty_sys_acl(conn, def_acl);
 	}
 
@@ -4372,7 +4375,8 @@ int get_acl_group_bits( connection_struct *conn, const char *fname, mode_t *mode
 	SMB_ACL_T posix_acl;
 	int result = -1;
 
-	posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname, SMB_ACL_TYPE_ACCESS);
+	posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname,
+					     SMB_ACL_TYPE_ACCESS, talloc_tos());
 	if (posix_acl == (SMB_ACL_T)NULL)
 		return -1;
 
@@ -4480,7 +4484,9 @@ static int copy_access_posix_acl(connection_struct *conn, const char *from, cons
 	SMB_ACL_T posix_acl = NULL;
 	int ret = -1;
 
-	if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from, SMB_ACL_TYPE_ACCESS)) == NULL)
+	if ((posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, from,
+						  SMB_ACL_TYPE_ACCESS,
+						  talloc_tos())) == NULL)
 		return -1;
 
 	if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
@@ -4511,7 +4517,9 @@ int chmod_acl(connection_struct *conn, const char *name, mode_t mode)
 
 static bool directory_has_default_posix_acl(connection_struct *conn, const char *fname)
 {
-	SMB_ACL_T def_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_DEFAULT);
+	SMB_ACL_T def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname,
+						     SMB_ACL_TYPE_DEFAULT,
+						     talloc_tos());
 	bool has_acl = False;
 	SMB_ACL_ENTRY_T entry;
 
@@ -4550,7 +4558,7 @@ int fchmod_acl(files_struct *fsp, mode_t mode)
 	SMB_ACL_T posix_acl = NULL;
 	int ret = -1;
 
-	if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp)) == NULL)
+	if ((posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, talloc_tos())) == NULL)
 		return -1;
 
 	if ((ret = chmod_acl_internals(conn, posix_acl, mode)) == -1)
@@ -4632,10 +4640,13 @@ static bool unix_ex_wire_to_tagtype(unsigned char wire_tt, SMB_ACL_TAG_T *p_tt)
  FIXME ! How does the share mask/mode fit into this.... ?
 ****************************************************************************/
 
-static SMB_ACL_T create_posix_acl_from_wire(connection_struct *conn, uint16 num_acls, const char *pdata)
+static SMB_ACL_T create_posix_acl_from_wire(connection_struct *conn,
+					    uint16 num_acls,
+					    const char *pdata,
+					    TALLOC_CTX *mem_ctx)
 {
 	unsigned int i;
-	SMB_ACL_T the_acl = sys_acl_init();
+	SMB_ACL_T the_acl = sys_acl_init(mem_ctx);
 
 	if (the_acl == NULL) {
 		return NULL;
@@ -4748,7 +4759,9 @@ bool set_unix_posix_default_acl(connection_struct *conn, const char *fname, cons
 		return True;
 	}
 
-	if ((def_acl = create_posix_acl_from_wire(conn, num_def_acls, pdata)) == NULL) {
+	if ((def_acl = create_posix_acl_from_wire(conn, num_def_acls,
+						  pdata,
+						  talloc_tos())) == NULL) {
 		return False;
 	}
 
@@ -4779,7 +4792,7 @@ static bool remove_posix_acl(connection_struct *conn, files_struct *fsp, const c
 	SMB_ACL_ENTRY_T entry;
 	bool ret = False;
 	/* Create a new ACL with only 3 entries, u/g/w. */
-	SMB_ACL_T new_file_acl = sys_acl_init();
+	SMB_ACL_T new_file_acl = sys_acl_init(talloc_tos());
 	SMB_ACL_ENTRY_T user_ent = NULL;
 	SMB_ACL_ENTRY_T group_ent = NULL;
 	SMB_ACL_ENTRY_T other_ent = NULL;
@@ -4825,9 +4838,11 @@ static bool remove_posix_acl(connection_struct *conn, files_struct *fsp, const c
 
 	/* Get the current file ACL. */
 	if (fsp && fsp->fh->fd != -1) {
-		file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
+		file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, talloc_tos());
 	} else {
-		file_acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, SMB_ACL_TYPE_ACCESS);
+		file_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, fname,
+						    SMB_ACL_TYPE_ACCESS,
+						    talloc_tos());
 	}
 
 	if (file_acl == NULL) {
@@ -4917,7 +4932,9 @@ bool set_unix_posix_acl(connection_struct *conn, files_struct *fsp, const char *
 		return remove_posix_acl(conn, fsp, fname);
 	}
 
-	if ((file_acl = create_posix_acl_from_wire(conn, num_acls, pdata)) == NULL) {
+	if ((file_acl = create_posix_acl_from_wire(conn, num_acls,
+						   pdata,
+						   talloc_tos())) == NULL) {
 		return False;
 	}
 
diff --git a/source3/smbd/pysmbd.c b/source3/smbd/pysmbd.c
index 9b9b358..32ddc2f 100644
--- a/source3/smbd/pysmbd.c
+++ b/source3/smbd/pysmbd.c
@@ -153,98 +153,99 @@ static NTSTATUS set_nt_acl_no_snum(const char *fname,
 
 static SMB_ACL_T make_simple_acl(gid_t gid, mode_t chmod_mode)
 {
+	TALLOC_CTX *frame = talloc_stackframe();
+
 	mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE;
 
 	mode_t mode_user = (chmod_mode & 0700) >> 16;
 	mode_t mode_group = (chmod_mode & 070) >> 8;
 	mode_t mode_other = chmod_mode &  07;
-
 	SMB_ACL_ENTRY_T entry;
-	SMB_ACL_T acl = sys_acl_init();
+	SMB_ACL_T acl = sys_acl_init(frame);
 
 	if (!acl) {
 		return NULL;
 	}
 
 	if (sys_acl_create_entry(&acl, &entry) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 
 	if (sys_acl_set_tag_type(entry, SMB_ACL_USER_OBJ) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 
 	if (sys_acl_set_permset(entry, &mode_user) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 
 	if (sys_acl_create_entry(&acl, &entry) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 
 	if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP_OBJ) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 
 	if (sys_acl_set_permset(entry, &mode_group) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 
 	if (sys_acl_create_entry(&acl, &entry) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 
 	if (sys_acl_set_tag_type(entry, SMB_ACL_OTHER) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 
 	if (sys_acl_set_permset(entry, &mode_other) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 
 	if (gid != -1) {
 		if (sys_acl_create_entry(&acl, &entry) != 0) {
-			TALLOC_FREE(acl);
+			TALLOC_FREE(frame);
 			return NULL;
 		}
 		
 		if (sys_acl_set_tag_type(entry, SMB_ACL_GROUP) != 0) {
-			TALLOC_FREE(acl);
+			TALLOC_FREE(frame);
 			return NULL;
 		}
 		
 		if (sys_acl_set_qualifier(entry, &gid) != 0) {
-			TALLOC_FREE(acl);
+			TALLOC_FREE(frame);
 			return NULL;
 		}
 		
 		if (sys_acl_set_permset(entry, &mode_group) != 0) {
-			TALLOC_FREE(acl);
+			TALLOC_FREE(frame);
 			return NULL;
 		}
 	}
 
 	if (sys_acl_create_entry(&acl, &entry) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 
 	if (sys_acl_set_tag_type(entry, SMB_ACL_MASK) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 
 	if (sys_acl_set_permset(entry, &mode) != 0) {
-		TALLOC_FREE(acl);
+		TALLOC_FREE(frame);
 		return NULL;
 	}
 	return acl;
@@ -454,7 +455,7 @@ static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args)
 
 	smbd_vfs_init(conn);
 
-	acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, acl_type);
+	acl = SMB_VFS_SYS_ACL_GET_FILE( conn, fname, acl_type, frame);
 	if (!acl) {
 		TALLOC_FREE(frame);
 		status = map_nt_error_from_unix_common(errno);
@@ -462,7 +463,6 @@ static PyObject *py_smbd_get_sys_acl(PyObject *self, PyObject *args)
 		PyErr_NTSTATUS_IS_ERR_RAISE(status);
 	}
 
-	talloc_steal(frame, acl);
 	conn_free(conn);
 
 	py_acl = py_return_ndr_struct("samba.dcerpc.smb_acl", "t", acl, acl);
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 90d07d4..5d2cd15 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -4910,12 +4910,14 @@ NTSTATUS smbd_do_qfilepathinfo(connection_struct *conn,
 				uint16 num_def_acls = 0;
 
 				if (fsp && fsp->fh->fd != -1) {
-					file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp);
+					file_acl = SMB_VFS_SYS_ACL_GET_FD(fsp,
+						talloc_tos());
 				} else {
 					file_acl =
 					    SMB_VFS_SYS_ACL_GET_FILE(conn,
 						smb_fname->base_name,
-						SMB_ACL_TYPE_ACCESS);
+						SMB_ACL_TYPE_ACCESS,
+						talloc_tos());
 				}
 
 				if (file_acl == NULL && no_acl_syscall_error(errno)) {
@@ -4932,13 +4934,15 @@ NTSTATUS smbd_do_qfilepathinfo(connection_struct *conn,
 						    SMB_VFS_SYS_ACL_GET_FILE(
 							    conn,
 							    fsp->fsp_name->base_name,
-							    SMB_ACL_TYPE_DEFAULT);
+							    SMB_ACL_TYPE_DEFAULT,
+							    talloc_tos());
 					} else {
 						def_acl =
 						    SMB_VFS_SYS_ACL_GET_FILE(
 							    conn,
 							    smb_fname->base_name,
-							    SMB_ACL_TYPE_DEFAULT);
+							    SMB_ACL_TYPE_DEFAULT,
+							    talloc_tos());
 					}
 					def_acl = free_empty_sys_acl(conn, def_acl);
 				}
diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c
index fe99ee2..182e334 100644
--- a/source3/smbd/vfs.c
+++ b/source3/smbd/vfs.c
@@ -2221,17 +2221,19 @@ int smb_vfs_call_fchmod_acl(struct vfs_handle_struct *handle,
 
 SMB_ACL_T smb_vfs_call_sys_acl_get_file(struct vfs_handle_struct *handle,
 					const char *path_p,
-					SMB_ACL_TYPE_T type)
+					SMB_ACL_TYPE_T type,
+					TALLOC_CTX *mem_ctx)
 {
 	VFS_FIND(sys_acl_get_file);
-	return handle->fns->sys_acl_get_file_fn(handle, path_p, type);
+	return handle->fns->sys_acl_get_file_fn(handle, path_p, type, mem_ctx);
 }
 
 SMB_ACL_T smb_vfs_call_sys_acl_get_fd(struct vfs_handle_struct *handle,
-				      struct files_struct *fsp)
+				      struct files_struct *fsp,
+				      TALLOC_CTX *mem_ctx)
 {
 	VFS_FIND(sys_acl_get_fd);
-	return handle->fns->sys_acl_get_fd_fn(handle, fsp);
+	return handle->fns->sys_acl_get_fd_fn(handle, fsp, mem_ctx);
 }
 
 int smb_vfs_call_sys_acl_blob_get_file(struct vfs_handle_struct *handle,
diff --git a/source3/torture/cmd_vfs.c b/source3/torture/cmd_vfs.c
index 236b9c0..7755f8a 100644
--- a/source3/torture/cmd_vfs.c
+++ b/source3/torture/cmd_vfs.c
@@ -1572,7 +1572,7 @@ static NTSTATUS cmd_sys_acl_get_fd(struct vfs_state *vfs, TALLOC_CTX *mem_ctx,
 		return NT_STATUS_OK;
 	}
 
-	acl = SMB_VFS_SYS_ACL_GET_FD(vfs->files[fd]);
+	acl = SMB_VFS_SYS_ACL_GET_FD(vfs->files[fd], talloc_tos());
 	if (!acl) {
 		printf("sys_acl_get_fd failed (%s)\n", strerror(errno));
 		return status;
@@ -1597,7 +1597,7 @@ static NTSTATUS cmd_sys_acl_get_file(struct vfs_state *vfs, TALLOC_CTX *mem_ctx,
 	}
 
 	type = atoi(argv[2]);
-	acl = SMB_VFS_SYS_ACL_GET_FILE(vfs->conn, argv[1], type);
+	acl = SMB_VFS_SYS_ACL_GET_FILE(vfs->conn, argv[1], type, talloc_tos());
 	if (!acl) {
 		printf("sys_acl_get_file failed (%s)\n", strerror(errno));
 		return status;
-- 
1.7.11.7


From f8d5f5edb7752f5c6419fce5f8b71ab38f52f8ec Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 10 Oct 2012 11:50:27 +1100
Subject: [PATCH 06/42] smbd: Add mem_ctx to {f,}get_nt_acl VFS call

This makes it clear which context the returned SD is allocated on, as
a number of callers do not want it on talloc_tos().

As the ACL transformation allocates and then no longer needs a great
deal of memory, a talloc_stackframe() call is used to contain the
memory that is not returned further up the stack.

Andrew Bartlett
---
 examples/VFS/skel_opaque.c                |  8 +++-
 examples/VFS/skel_transparent.c           | 12 ++++--
 source3/include/vfs.h                     |  4 ++
 source3/include/vfs_macros.h              | 18 ++++----
 source3/modules/nfs4_acls.c               | 18 +++++---
 source3/modules/nfs4_acls.h               |  2 +
 source3/modules/vfs_acl_common.c          | 68 ++++++++++++++++++++-----------
 source3/modules/vfs_afsacl.c              | 16 +++++---
 source3/modules/vfs_aixacl2.c             | 16 +++++---
 source3/modules/vfs_catia.c               |  3 +-
 source3/modules/vfs_default.c             |  8 +++-
 source3/modules/vfs_full_audit.c          | 12 ++++--
 source3/modules/vfs_gpfs.c                | 14 ++++---
 source3/modules/vfs_media_harmony.c       | 13 +++---
 source3/modules/vfs_shadow_copy2.c        | 11 +++--
 source3/modules/vfs_time_audit.c          |  8 +++-
 source3/modules/vfs_zfsacl.c              | 18 ++++----
 source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 16 ++++----
 source3/smbd/file_access.c                |  4 +-
 source3/smbd/nttrans.c                    | 13 +++---
 source3/smbd/open.c                       | 22 ++++++----
 source3/smbd/posix_acls.c                 | 52 +++++++++++++++--------
 source3/smbd/proto.h                      |  5 ++-
 source3/smbd/vfs.c                        |  6 ++-
 source3/torture/cmd_vfs.c                 |  8 +++-
 25 files changed, 245 insertions(+), 130 deletions(-)

diff --git a/examples/VFS/skel_opaque.c b/examples/VFS/skel_opaque.c
index 3b91848..6dd83bb 100644
--- a/examples/VFS/skel_opaque.c
+++ b/examples/VFS/skel_opaque.c
@@ -545,13 +545,17 @@ static NTSTATUS skel_fsctl(struct vfs_handle_struct *handle,
 }
 
 static NTSTATUS skel_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
-	uint32 security_info, struct security_descriptor **ppdesc)
+				 uint32 security_info,
+				 TALLOC_CTX *mem_ctx,
+				 struct security_descriptor **ppdesc)
 {
 	return NT_STATUS_NOT_IMPLEMENTED;
 }
 
 static NTSTATUS skel_get_nt_acl(vfs_handle_struct *handle,
-	const char *name, uint32 security_info, struct security_descriptor **ppdesc)
+				const char *name, uint32 security_info,
+				TALLOC_CTX *mem_ctx,
+				struct security_descriptor **ppdesc)
 {
 	return NT_STATUS_NOT_IMPLEMENTED;
 }
diff --git a/examples/VFS/skel_transparent.c b/examples/VFS/skel_transparent.c
index a00b0e1..f8a743e 100644
--- a/examples/VFS/skel_transparent.c
+++ b/examples/VFS/skel_transparent.c
@@ -662,15 +662,19 @@ static NTSTATUS skel_fsctl(struct vfs_handle_struct *handle,
 }
 
 static NTSTATUS skel_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
-	uint32 security_info, struct security_descriptor **ppdesc)
+				 uint32 security_info,
+				 TALLOC_CTX *mem_ctx,
+				 struct security_descriptor **ppdesc)
 {
-	return SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, ppdesc);
+	return SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, mem_ctx, ppdesc);
 }
 
 static NTSTATUS skel_get_nt_acl(vfs_handle_struct *handle,
-	const char *name, uint32 security_info, struct security_descriptor **ppdesc)
+				const char *name, uint32 security_info,
+				TALLOC_CTX *mem_ctx,
+				struct security_descriptor **ppdesc)
 {
-	return SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, ppdesc);
+	return SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, mem_ctx, ppdesc);
 }
 
 static NTSTATUS skel_fset_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
diff --git a/source3/include/vfs.h b/source3/include/vfs.h
index 4ba11be..2d18265 100644
--- a/source3/include/vfs.h
+++ b/source3/include/vfs.h
@@ -671,10 +671,12 @@ struct vfs_fn_pointers {
 	NTSTATUS (*fget_nt_acl_fn)(struct vfs_handle_struct *handle,
 				   struct files_struct *fsp,
 				   uint32 security_info,
+				   TALLOC_CTX *mem_ctx,
 				   struct security_descriptor **ppdesc);
 	NTSTATUS (*get_nt_acl_fn)(struct vfs_handle_struct *handle,
 				  const char *name,
 				  uint32 security_info,
+				   TALLOC_CTX *mem_ctx,
 				  struct security_descriptor **ppdesc);
 	NTSTATUS (*fset_nt_acl_fn)(struct vfs_handle_struct *handle,
 				   struct files_struct *fsp,
@@ -1079,10 +1081,12 @@ NTSTATUS smb_vfs_call_fsctl(struct vfs_handle_struct *handle,
 NTSTATUS smb_vfs_call_fget_nt_acl(struct vfs_handle_struct *handle,
 				  struct files_struct *fsp,
 				  uint32 security_info,
+				  TALLOC_CTX *mem_ctx,
 				  struct security_descriptor **ppdesc);
 NTSTATUS smb_vfs_call_get_nt_acl(struct vfs_handle_struct *handle,
 				 const char *name,
 				 uint32 security_info,
+				 TALLOC_CTX *mem_ctx,
 				 struct security_descriptor **ppdesc);
 NTSTATUS smb_vfs_call_fset_nt_acl(struct vfs_handle_struct *handle,
 				  struct files_struct *fsp,
diff --git a/source3/include/vfs_macros.h b/source3/include/vfs_macros.h
index f1bc8ff..a5ff90b 100644
--- a/source3/include/vfs_macros.h
+++ b/source3/include/vfs_macros.h
@@ -399,15 +399,15 @@
 #define SMB_VFS_NEXT_FSCTL(handle, fsp, ctx, function, req_flags, in_data, in_len, out_data, max_out_len, out_len) \
 	smb_vfs_call_fsctl((handle)->next, (fsp), (ctx), (function), (req_flags), (in_data), (in_len), (out_data), (max_out_len), (out_len))
 
-#define SMB_VFS_FGET_NT_ACL(fsp, security_info, ppdesc) \
-	smb_vfs_call_fget_nt_acl((fsp)->conn->vfs_handles, (fsp), (security_info), (ppdesc))
-#define SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, ppdesc) \
-	smb_vfs_call_fget_nt_acl((handle)->next, (fsp), (security_info), (ppdesc))
-
-#define SMB_VFS_GET_NT_ACL(conn, name, security_info, ppdesc) \
-	smb_vfs_call_get_nt_acl((conn)->vfs_handles, (name), (security_info), (ppdesc))
-#define SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, ppdesc) \
-	smb_vfs_call_get_nt_acl((handle)->next, (name), (security_info), (ppdesc))
+#define SMB_VFS_FGET_NT_ACL(fsp, security_info, mem_ctx, ppdesc)		\
+		smb_vfs_call_fget_nt_acl((fsp)->conn->vfs_handles, (fsp), (security_info), (mem_ctx), (ppdesc))
+#define SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, mem_ctx, ppdesc) \
+	smb_vfs_call_fget_nt_acl((handle)->next, (fsp), (security_info), (mem_ctx), (ppdesc))
+
+#define SMB_VFS_GET_NT_ACL(conn, name, security_info, mem_ctx, ppdesc)	\
+	smb_vfs_call_get_nt_acl((conn)->vfs_handles, (name), (security_info), (mem_ctx), (ppdesc))
+#define SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, mem_ctx, ppdesc) \
+	smb_vfs_call_get_nt_acl((handle)->next, (name), (security_info), (mem_ctx), (ppdesc))
 
 #define SMB_VFS_AUDIT_FILE(conn, name, sacl, access_requested, access_denied) \
 	smb_vfs_call_audit_file((conn)->vfs_handles, (name), (sacl), (access_requested), (access_denied))
diff --git a/source3/modules/nfs4_acls.c b/source3/modules/nfs4_acls.c
index 05f90f7..48b045f 100644
--- a/source3/modules/nfs4_acls.c
+++ b/source3/modules/nfs4_acls.c
@@ -370,7 +370,7 @@ static bool smbacl4_nfs42win(TALLOC_CTX *mem_ctx, SMB4ACL_T *theacl, /* in */
 }
 
 static NTSTATUS smb_get_nt_acl_nfs4_common(const SMB_STRUCT_STAT *sbuf,
-	uint32 security_info,
+					   uint32 security_info, TALLOC_CTX *mem_ctx,
 	struct security_descriptor **ppdesc, SMB4ACL_T *theacl)
 {
 	int	good_aces = 0;
@@ -378,7 +378,7 @@ static NTSTATUS smb_get_nt_acl_nfs4_common(const SMB_STRUCT_STAT *sbuf,
 	size_t sd_size = 0;
 	struct security_ace *nt_ace_list = NULL;
 	struct security_acl *psa = NULL;
-	TALLOC_CTX *mem_ctx = talloc_tos();
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	if (theacl==NULL || smb_get_naces(theacl)==0)
 		return NT_STATUS_ACCESS_DENIED; /* special because we
@@ -392,12 +392,14 @@ static NTSTATUS smb_get_nt_acl_nfs4_common(const SMB_STRUCT_STAT *sbuf,
 			     S_ISDIR(sbuf->st_ex_mode),
 				&nt_ace_list, &good_aces)==False) {
 		DEBUG(8,("smbacl4_nfs42win failed\n"));
+		TALLOC_FREE(frame);
 		return map_nt_error_from_unix(errno);
 	}
 
-	psa = make_sec_acl(mem_ctx, NT4_ACL_REVISION, good_aces, nt_ace_list);
+	psa = make_sec_acl(frame, NT4_ACL_REVISION, good_aces, nt_ace_list);
 	if (psa == NULL) {
 		DEBUG(2,("make_sec_acl failed\n"));
+		TALLOC_FREE(frame);
 		return NT_STATUS_NO_MEMORY;
 	}
 
@@ -409,6 +411,7 @@ static NTSTATUS smb_get_nt_acl_nfs4_common(const SMB_STRUCT_STAT *sbuf,
 		NULL, psa, &sd_size);
 	if (*ppdesc==NULL) {
 		DEBUG(2,("make_sec_desc failed\n"));
+		TALLOC_FREE(frame);
 		return NT_STATUS_NO_MEMORY;
 	}
 
@@ -416,11 +419,13 @@ static NTSTATUS smb_get_nt_acl_nfs4_common(const SMB_STRUCT_STAT *sbuf,
 		   "sd_size %d\n",
 		   (int)ndr_size_security_descriptor(*ppdesc, 0)));
 
+	TALLOC_FREE(frame);
 	return NT_STATUS_OK;
 }
 
 NTSTATUS smb_fget_nt_acl_nfs4(files_struct *fsp,
 			      uint32 security_info,
+			      TALLOC_CTX *mem_ctx,
 			      struct security_descriptor **ppdesc,
 			      SMB4ACL_T *theacl)
 {
@@ -432,13 +437,15 @@ NTSTATUS smb_fget_nt_acl_nfs4(files_struct *fsp,
 		return map_nt_error_from_unix(errno);
 	}
 
-	return smb_get_nt_acl_nfs4_common(&sbuf, security_info, ppdesc,
+	return smb_get_nt_acl_nfs4_common(&sbuf, security_info,
+					  mem_ctx, ppdesc,
 					  theacl);
 }
 
 NTSTATUS smb_get_nt_acl_nfs4(struct connection_struct *conn,
 			     const char *name,
 			     uint32 security_info,
+			     TALLOC_CTX *mem_ctx,
 			     struct security_descriptor **ppdesc,
 			     SMB4ACL_T *theacl)
 {
@@ -450,7 +457,8 @@ NTSTATUS smb_get_nt_acl_nfs4(struct connection_struct *conn,
 		return map_nt_error_from_unix(errno);
 	}
 
-	return smb_get_nt_acl_nfs4_common(&sbuf, security_info, ppdesc,
+	return smb_get_nt_acl_nfs4_common(&sbuf, security_info,
+					  mem_ctx, ppdesc,
 					  theacl);
 }
 
diff --git a/source3/modules/nfs4_acls.h b/source3/modules/nfs4_acls.h
index fcab635..c461229 100644
--- a/source3/modules/nfs4_acls.h
+++ b/source3/modules/nfs4_acls.h
@@ -132,11 +132,13 @@ uint32 smb_get_naces(SMB4ACL_T *theacl);
 
 NTSTATUS smb_fget_nt_acl_nfs4(files_struct *fsp,
 	uint32 security_info,
+	TALLOC_CTX *mem_ctx,
 	struct security_descriptor **ppdesc, SMB4ACL_T *theacl);
 
 NTSTATUS smb_get_nt_acl_nfs4(connection_struct *conn,
 	const char *name,
 	uint32 security_info,
+	TALLOC_CTX *mem_ctx,
 	struct security_descriptor **ppdesc, SMB4ACL_T *theacl);
 
 /* Callback function needed to set the native acl
diff --git a/source3/modules/vfs_acl_common.c b/source3/modules/vfs_acl_common.c
index c2ac875..ef2dda1 100644
--- a/source3/modules/vfs_acl_common.c
+++ b/source3/modules/vfs_acl_common.c
@@ -74,27 +74,29 @@ static NTSTATUS hash_sd_sha256(struct security_descriptor *psd,
 *******************************************************************/
 
 static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
+			       TALLOC_CTX *mem_ctx,
 				struct security_descriptor **ppdesc,
 				uint16_t *p_hash_type,
 				uint8_t hash[XATTR_SD_HASH_SIZE])
 {
-	TALLOC_CTX *ctx = talloc_tos();
 	struct xattr_NTACL xacl;
 	enum ndr_err_code ndr_err;
 	size_t sd_size;
+	TALLOC_CTX *frame = talloc_stackframe();
 
-	ndr_err = ndr_pull_struct_blob(pblob, ctx, &xacl,
+	ndr_err = ndr_pull_struct_blob(pblob, frame, &xacl,
 			(ndr_pull_flags_fn_t)ndr_pull_xattr_NTACL);
 
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		DEBUG(5, ("parse_acl_blob: ndr_pull_xattr_NTACL failed: %s\n",
 			ndr_errstr(ndr_err)));
+		TALLOC_FREE(frame);
 		return ndr_map_error2ntstatus(ndr_err);
 	}
 
 	switch (xacl.version) {
 		case 1:
-			*ppdesc = make_sec_desc(ctx, SD_REVISION,
+			*ppdesc = make_sec_desc(mem_ctx, SD_REVISION,
 					xacl.info.sd->type | SEC_DESC_SELF_RELATIVE,
 					xacl.info.sd->owner_sid,
 					xacl.info.sd->group_sid,
@@ -106,7 +108,7 @@ static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
 			memset(hash, '\0', XATTR_SD_HASH_SIZE);
 			break;
 		case 2:
-			*ppdesc = make_sec_desc(ctx, SD_REVISION,
+			*ppdesc = make_sec_desc(mem_ctx, SD_REVISION,
 					xacl.info.sd_hs2->sd->type | SEC_DESC_SELF_RELATIVE,
 					xacl.info.sd_hs2->sd->owner_sid,
 					xacl.info.sd_hs2->sd->group_sid,
@@ -118,7 +120,7 @@ static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
 			memset(hash, '\0', XATTR_SD_HASH_SIZE);
 			break;
 		case 3:
-			*ppdesc = make_sec_desc(ctx, SD_REVISION,
+			*ppdesc = make_sec_desc(mem_ctx, SD_REVISION,
 					xacl.info.sd_hs3->sd->type | SEC_DESC_SELF_RELATIVE,
 					xacl.info.sd_hs3->sd->owner_sid,
 					xacl.info.sd_hs3->sd->group_sid,
@@ -130,10 +132,11 @@ static NTSTATUS parse_acl_blob(const DATA_BLOB *pblob,
 			memcpy(hash, xacl.info.sd_hs3->hash, XATTR_SD_HASH_SIZE);
 			break;
 		default:
+			TALLOC_FREE(frame);
 			return NT_STATUS_REVISION_MISMATCH;
 	}
 
-	TALLOC_FREE(xacl.info.sd);
+	TALLOC_FREE(frame);
 
 	return (*ppdesc != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 }
@@ -274,7 +277,8 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
 				files_struct *fsp,
 				const char *name,
 			        uint32_t security_info,
-				struct security_descriptor **ppdesc)
+				TALLOC_CTX *mem_ctx,
+				    struct security_descriptor **ppdesc)
 {
 	DATA_BLOB blob = data_blob_null;
 	NTSTATUS status;
@@ -298,14 +302,16 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
 	   or to return as backup. */
 	if (fsp) {
 		status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
-				fsp,
-				HASH_SECURITY_INFO,
-				&pdesc_next);
+						  fsp,
+						  HASH_SECURITY_INFO,
+						  mem_ctx,
+						  &pdesc_next);
 	} else {
 		status = SMB_VFS_NEXT_GET_NT_ACL(handle,
-				name,
-				HASH_SECURITY_INFO,
-				&pdesc_next);
+						 name,
+						 HASH_SECURITY_INFO,
+						 mem_ctx,
+						 &pdesc_next);
 	}
 
 	if (!NT_STATUS_IS_OK(status)) {
@@ -324,7 +330,7 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
 		goto out;
 	}
 
-	status = parse_acl_blob(&blob, &psd,
+	status = parse_acl_blob(&blob, mem_ctx, &psd,
 				&hash_type, &hash[0]);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(10, ("parse_acl_blob returned %s\n",
@@ -417,7 +423,7 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
 
 		if (ignore_file_system_acl) {
 			TALLOC_FREE(pdesc_next);
-			status = make_default_filesystem_acl(talloc_tos(),
+			status = make_default_filesystem_acl(mem_ctx,
 						name,
 						psbuf,
 						&psd);
@@ -476,11 +482,14 @@ static NTSTATUS get_nt_acl_internal(vfs_handle_struct *handle,
  Fetch a security descriptor given an fsp.
 *********************************************************************/
 
-static NTSTATUS fget_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
-        uint32_t security_info, struct security_descriptor **ppdesc)
+static NTSTATUS fget_nt_acl_common(vfs_handle_struct *handle,
+				   files_struct *fsp,
+				   uint32_t security_info,
+				   TALLOC_CTX *mem_ctx,
+				   struct security_descriptor **ppdesc)
 {
 	return get_nt_acl_internal(handle, fsp,
-				NULL, security_info, ppdesc);
+				   NULL, security_info, mem_ctx, ppdesc);
 }
 
 /*********************************************************************
@@ -488,10 +497,13 @@ static NTSTATUS fget_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
 *********************************************************************/
 
 static NTSTATUS get_nt_acl_common(vfs_handle_struct *handle,
-        const char *name, uint32_t security_info, struct security_descriptor **ppdesc)
+				  const char *name,
+				  uint32_t security_info,
+				  TALLOC_CTX *mem_ctx,
+				  struct security_descriptor **ppdesc)
 {
 	return get_nt_acl_internal(handle, NULL,
-				name, security_info, ppdesc);
+				   name, security_info, mem_ctx, ppdesc);
 }
 
 /*********************************************************************
@@ -507,6 +519,7 @@ static NTSTATUS fset_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
 	struct security_descriptor *psd = NULL;
 	uint8_t hash[XATTR_SD_HASH_SIZE];
 	bool chown_needed = false;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	if (DEBUGLEVEL >= 10) {
 		DEBUG(10,("fset_nt_acl_xattr: incoming sd for file %s\n",
@@ -518,9 +531,11 @@ static NTSTATUS fset_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
 	status = get_nt_acl_internal(handle, fsp,
 			NULL,
 			SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL|SECINFO_SACL,
+				     frame,
 			&psd);
 
 	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -554,6 +569,7 @@ static NTSTATUS fset_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
 	status = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent, psd);
 	if (!NT_STATUS_IS_OK(status)) {
 		if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
+			TALLOC_FREE(frame);
 			return status;
 		}
 		/* We got access denied here. If we're already root,
@@ -578,22 +594,26 @@ static NTSTATUS fset_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
 				security_info_sent, psd);
 		unbecome_root();
 		if (!NT_STATUS_IS_OK(status)) {
+			TALLOC_FREE(frame);
 			return status;
 		}
 	}
 
 	/* Get the full underlying sd, then hash. */
 	status = SMB_VFS_NEXT_FGET_NT_ACL(handle,
-				fsp,
-				HASH_SECURITY_INFO,
-				&pdesc_next);
+					  fsp,
+					  HASH_SECURITY_INFO,
+					  frame,
+					  &pdesc_next);
 
 	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
 	status = hash_sd_sha256(pdesc_next, hash);
 	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -610,11 +630,13 @@ static NTSTATUS fset_nt_acl_common(vfs_handle_struct *handle, files_struct *fsp,
 	status = create_acl_blob(psd, &blob, XATTR_SD_HASH_TYPE_SHA256, hash);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(10, ("fset_nt_acl_xattr: create_acl_blob failed\n"));
+		TALLOC_FREE(frame);
 		return status;
 	}
 
 	status = store_acl_blob_fsp(handle, fsp, &blob);
 
+	TALLOC_FREE(frame);
 	return status;
 }
 
diff --git a/source3/modules/vfs_afsacl.c b/source3/modules/vfs_afsacl.c
index 770f6a3..96521bc 100644
--- a/source3/modules/vfs_afsacl.c
+++ b/source3/modules/vfs_afsacl.c
@@ -594,6 +594,7 @@ static uint32 nt_to_afs_file_rights(const char *filename, const struct security_
 static size_t afs_to_nt_acl_common(struct afs_acl *afs_acl,
 				   SMB_STRUCT_STAT *psbuf,
 				   uint32 security_info,
+				   TALLOC_CTX *mem_ctx,
 				   struct security_descriptor **ppdesc)
 {
 	struct security_ace *nt_ace_list;
@@ -601,7 +602,6 @@ static size_t afs_to_nt_acl_common(struct afs_acl *afs_acl,
 	struct security_acl *psa = NULL;
 	int good_aces;
 	size_t sd_size;
-	TALLOC_CTX *mem_ctx = talloc_tos();
 
 	struct afs_ace *afs_ace;
 
@@ -663,6 +663,7 @@ static size_t afs_to_nt_acl(struct afs_acl *afs_acl,
 			    struct connection_struct *conn,
 			    struct smb_filename *smb_fname,
 			    uint32 security_info,
+			     TALLOC_CTX *mem_ctx,
 			    struct security_descriptor **ppdesc)
 {
 	int ret;
@@ -678,12 +679,13 @@ static size_t afs_to_nt_acl(struct afs_acl *afs_acl,
 	}
 
 	return afs_to_nt_acl_common(afs_acl, &smb_fname->st, security_info,
-				    ppdesc);
+				    mem_ctx, ppdesc);
 }
 
 static size_t afs_fto_nt_acl(struct afs_acl *afs_acl,
 			     struct files_struct *fsp,
 			     uint32 security_info,
+			     TALLOC_CTX *mem_ctx,
 			     struct security_descriptor **ppdesc)
 {
 	SMB_STRUCT_STAT sbuf;
@@ -691,7 +693,7 @@ static size_t afs_fto_nt_acl(struct afs_acl *afs_acl,
 	if (fsp->fh->fd == -1) {
 		/* Get the stat struct for the owner info. */
 		return afs_to_nt_acl(afs_acl, fsp->conn, fsp->fsp_name,
-				     security_info, ppdesc);
+				     security_info, mem_ctx, ppdesc);
 	}
 
 	if(SMB_VFS_FSTAT(fsp, &sbuf) != 0) {
@@ -1008,6 +1010,7 @@ static NTSTATUS afs_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 static NTSTATUS afsacl_fget_nt_acl(struct vfs_handle_struct *handle,
 				   struct files_struct *fsp,
 				   uint32 security_info,
+				   TALLOC_CTX *mem_ctx,
 				   struct security_descriptor **ppdesc)
 {
 	struct afs_acl acl;
@@ -1021,7 +1024,7 @@ static NTSTATUS afsacl_fget_nt_acl(struct vfs_handle_struct *handle,
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
-	sd_size = afs_fto_nt_acl(&acl, fsp, security_info, ppdesc);
+	sd_size = afs_fto_nt_acl(&acl, fsp, security_info, mem_ctx, ppdesc);
 
 	free_afs_acl(&acl);
 
@@ -1029,7 +1032,8 @@ static NTSTATUS afsacl_fget_nt_acl(struct vfs_handle_struct *handle,
 }
 
 static NTSTATUS afsacl_get_nt_acl(struct vfs_handle_struct *handle,
-				  const char *name,  uint32 security_info,
+				  const char *name, uint32 security_info,
+				  TALLOC_CTX *mem_ctx,
 				  struct security_descriptor **ppdesc)
 {
 	struct afs_acl acl;
@@ -1053,7 +1057,7 @@ static NTSTATUS afsacl_get_nt_acl(struct vfs_handle_struct *handle,
 	}
 
 	sd_size = afs_to_nt_acl(&acl, handle->conn, smb_fname, security_info,
-				ppdesc);
+				mem_ctx, ppdesc);
 	TALLOC_FREE(smb_fname);
 
 	free_afs_acl(&acl);
diff --git a/source3/modules/vfs_aixacl2.c b/source3/modules/vfs_aixacl2.c
index 0d754d7..0f89eb6 100644
--- a/source3/modules/vfs_aixacl2.c
+++ b/source3/modules/vfs_aixacl2.c
@@ -157,6 +157,7 @@ static bool aixjfs2_get_nfs4_acl(const char *name,
 
 static NTSTATUS aixjfs2_fget_nt_acl(vfs_handle_struct *handle,
 	files_struct *fsp, uint32 security_info,
+	TALLOC_CTX *mem_ctx,
 	struct security_descriptor **ppdesc)
 {
 	SMB4ACL_T *pacl = NULL;
@@ -169,17 +170,21 @@ static NTSTATUS aixjfs2_fget_nt_acl(vfs_handle_struct *handle,
 	if (retryPosix)
 	{
 		DEBUG(10, ("retrying with posix acl...\n"));
-		return posix_fget_nt_acl(fsp, security_info, ppdesc);
+		return posix_fget_nt_acl(fsp, security_info,
+					 mem_ctx, ppdesc);
 	}
 	if (result==False)
 		return NT_STATUS_ACCESS_DENIED;
 
-	return smb_fget_nt_acl_nfs4(fsp, security_info, ppdesc, pacl);
+	return smb_fget_nt_acl_nfs4(fsp, security_info, ppdesc,
+				    mem_ctx, pacl);
 }
 
 static NTSTATUS aixjfs2_get_nt_acl(vfs_handle_struct *handle,
 	const char *name,
-	uint32 security_info, struct security_descriptor **ppdesc)
+	uint32 security_info,
+	TALLOC_CTX *mem_ctx,
+	struct security_descriptor **ppdesc)
 {
 	SMB4ACL_T *pacl = NULL;
 	bool	result;
@@ -191,12 +196,13 @@ static NTSTATUS aixjfs2_get_nt_acl(vfs_handle_struct *handle,
 	{
 		DEBUG(10, ("retrying with posix acl...\n"));
 		return posix_get_nt_acl(handle->conn, name, security_info,
-					ppdesc);
+					mem_ctx, ppdesc);
 	}
 	if (result==False)
 		return NT_STATUS_ACCESS_DENIED;
 
-	return smb_get_nt_acl_nfs4(handle->conn, name, security_info, ppdesc,
+	return smb_get_nt_acl_nfs4(handle->conn, name, security_info,
+				   mem_ctx, ppdesc,
 				   pacl);
 }
 
diff --git a/source3/modules/vfs_catia.c b/source3/modules/vfs_catia.c
index a2bef44..b9f241e 100644
--- a/source3/modules/vfs_catia.c
+++ b/source3/modules/vfs_catia.c
@@ -703,6 +703,7 @@ static NTSTATUS
 catia_get_nt_acl(struct vfs_handle_struct *handle,
 		 const char *path,
 		 uint32 security_info,
+		 TALLOC_CTX *mem_ctx,
 		 struct security_descriptor **ppdesc)
 {
 	char *mapped_name = NULL;
@@ -715,7 +716,7 @@ catia_get_nt_acl(struct vfs_handle_struct *handle,
 		return status;
 	}
 	status = SMB_VFS_NEXT_GET_NT_ACL(handle, mapped_name,
-					 security_info, ppdesc);
+					 security_info, mem_ctx, ppdesc);
 	TALLOC_FREE(mapped_name);
 
 	return status;
diff --git a/source3/modules/vfs_default.c b/source3/modules/vfs_default.c
index a03a4f8..84d12e3 100644
--- a/source3/modules/vfs_default.c
+++ b/source3/modules/vfs_default.c
@@ -2056,12 +2056,14 @@ static void vfswrap_strict_unlock(struct vfs_handle_struct *handle,
 static NTSTATUS vfswrap_fget_nt_acl(vfs_handle_struct *handle,
 				    files_struct *fsp,
 				    uint32 security_info,
+				    TALLOC_CTX *mem_ctx,
 				    struct security_descriptor **ppdesc)
 {
 	NTSTATUS result;
 
 	START_PROFILE(fget_nt_acl);
-	result = posix_fget_nt_acl(fsp, security_info, ppdesc);
+	result = posix_fget_nt_acl(fsp, security_info,
+				   mem_ctx, ppdesc);
 	END_PROFILE(fget_nt_acl);
 	return result;
 }
@@ -2069,12 +2071,14 @@ static NTSTATUS vfswrap_fget_nt_acl(vfs_handle_struct *handle,
 static NTSTATUS vfswrap_get_nt_acl(vfs_handle_struct *handle,
 				   const char *name,
 				   uint32 security_info,
+				   TALLOC_CTX *mem_ctx,
 				   struct security_descriptor **ppdesc)
 {
 	NTSTATUS result;
 
 	START_PROFILE(get_nt_acl);
-	result = posix_get_nt_acl(handle->conn, name, security_info, ppdesc);
+	result = posix_get_nt_acl(handle->conn, name, security_info,
+				  mem_ctx, ppdesc);
 	END_PROFILE(get_nt_acl);
 	return result;
 }
diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c
index e56c4a8..be8989c 100644
--- a/source3/modules/vfs_full_audit.c
+++ b/source3/modules/vfs_full_audit.c
@@ -1733,12 +1733,14 @@ static NTSTATUS smb_full_audit_translate_name(struct vfs_handle_struct *handle,
 }
 
 static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
-				uint32 security_info,
-				struct security_descriptor **ppdesc)
+					   uint32 security_info,
+					   TALLOC_CTX *mem_ctx,
+					   struct security_descriptor **ppdesc)
 {
 	NTSTATUS result;
 
-	result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, ppdesc);
+	result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
+					  mem_ctx, ppdesc);
 
 	do_log(SMB_VFS_OP_FGET_NT_ACL, NT_STATUS_IS_OK(result), handle,
 	       "%s", fsp_str_do_log(fsp));
@@ -1749,11 +1751,13 @@ static NTSTATUS smb_full_audit_fget_nt_acl(vfs_handle_struct *handle, files_stru
 static NTSTATUS smb_full_audit_get_nt_acl(vfs_handle_struct *handle,
 					  const char *name,
 					  uint32 security_info,
+					  TALLOC_CTX *mem_ctx,
 					  struct security_descriptor **ppdesc)
 {
 	NTSTATUS result;
 
-	result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, ppdesc);
+	result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info,
+					 mem_ctx, ppdesc);
 
 	do_log(SMB_VFS_OP_GET_NT_ACL, NT_STATUS_IS_OK(result), handle,
 	       "%s", name);
diff --git a/source3/modules/vfs_gpfs.c b/source3/modules/vfs_gpfs.c
index 412c48c..5ab5d4a 100644
--- a/source3/modules/vfs_gpfs.c
+++ b/source3/modules/vfs_gpfs.c
@@ -348,6 +348,7 @@ static int gpfs_get_nfs4_acl(const char *fname, SMB4ACL_T **ppacl)
 
 static NTSTATUS gpfsacl_fget_nt_acl(vfs_handle_struct *handle,
 	files_struct *fsp, uint32 security_info,
+	TALLOC_CTX *mem_ctx,
 	struct security_descriptor **ppdesc)
 {
 	SMB4ACL_T *pacl = NULL;
@@ -367,11 +368,11 @@ static NTSTATUS gpfsacl_fget_nt_acl(vfs_handle_struct *handle,
 	result = gpfs_get_nfs4_acl(fsp->fsp_name->base_name, &pacl);
 
 	if (result == 0)
-		return smb_fget_nt_acl_nfs4(fsp, security_info, ppdesc, pacl);
+		return smb_fget_nt_acl_nfs4(fsp, security_info, mem_ctx, ppdesc, pacl);
 
 	if (result > 0) {
 		DEBUG(10, ("retrying with posix acl...\n"));
-		return posix_fget_nt_acl(fsp, security_info, ppdesc);
+		return posix_fget_nt_acl(fsp, security_info, mem_ctx, ppdesc);
 	}
 
 	/* GPFS ACL was not read, something wrong happened, error code is set in errno */
@@ -380,7 +381,8 @@ static NTSTATUS gpfsacl_fget_nt_acl(vfs_handle_struct *handle,
 
 static NTSTATUS gpfsacl_get_nt_acl(vfs_handle_struct *handle,
 	const char *name,
-	uint32 security_info, struct security_descriptor **ppdesc)
+	uint32 security_info,
+	TALLOC_CTX *mem_ctx, struct security_descriptor **ppdesc)
 {
 	SMB4ACL_T *pacl = NULL;
 	int	result;
@@ -399,11 +401,13 @@ static NTSTATUS gpfsacl_get_nt_acl(vfs_handle_struct *handle,
 	result = gpfs_get_nfs4_acl(name, &pacl);
 
 	if (result == 0)
-		return smb_get_nt_acl_nfs4(handle->conn, name, security_info, ppdesc, pacl);
+		return smb_get_nt_acl_nfs4(handle->conn, name, security_info,
+					   mem_ctx, ppdesc, pacl);
 
 	if (result > 0) {
 		DEBUG(10, ("retrying with posix acl...\n"));
-		return posix_get_nt_acl(handle->conn, name, security_info, ppdesc);
+		return posix_get_nt_acl(handle->conn, name, security_info,
+					mem_ctx, ppdesc);
 	}
 
 	/* GPFS ACL was not read, something wrong happened, error code is set in errno */
diff --git a/source3/modules/vfs_media_harmony.c b/source3/modules/vfs_media_harmony.c
index a10eb5e..360fca6 100644
--- a/source3/modules/vfs_media_harmony.c
+++ b/source3/modules/vfs_media_harmony.c
@@ -2009,9 +2009,10 @@ out:
  * In this case, "name" is a path.
  */
 static NTSTATUS mh_get_nt_acl(vfs_handle_struct *handle,
-		const char *name,
-		uint32 security_info,
-		struct security_descriptor **ppdesc)
+			      const char *name,
+			      uint32 security_info,
+			      TALLOC_CTX *mem_ctx,
+			      struct security_descriptor **ppdesc)
 {
 	NTSTATUS status;
 	char *clientPath;
@@ -2021,7 +2022,8 @@ static NTSTATUS mh_get_nt_acl(vfs_handle_struct *handle,
 	if (!is_in_media_files(name))
 	{
 		status = SMB_VFS_NEXT_GET_NT_ACL(handle, name,
-				security_info, ppdesc);
+						 security_info,
+						 mem_ctx, ppdesc);
 		goto out;
 	}
 
@@ -2037,7 +2039,8 @@ static NTSTATUS mh_get_nt_acl(vfs_handle_struct *handle,
 	}
 
 	status = SMB_VFS_NEXT_GET_NT_ACL(handle, clientPath,
-			security_info, ppdesc);
+					 security_info,
+					 mem_ctx, ppdesc);
 err:
 	TALLOC_FREE(clientPath);
 out:
diff --git a/source3/modules/vfs_shadow_copy2.c b/source3/modules/vfs_shadow_copy2.c
index 7c42052..1cf8e37 100644
--- a/source3/modules/vfs_shadow_copy2.c
+++ b/source3/modules/vfs_shadow_copy2.c
@@ -1188,6 +1188,7 @@ static int shadow_copy2_get_shadow_copy_data(
 static NTSTATUS shadow_copy2_fget_nt_acl(vfs_handle_struct *handle,
 					struct files_struct *fsp,
 					uint32 security_info,
+					 TALLOC_CTX *mem_ctx,
 					struct security_descriptor **ppdesc)
 {
 	time_t timestamp;
@@ -1202,6 +1203,7 @@ static NTSTATUS shadow_copy2_fget_nt_acl(vfs_handle_struct *handle,
 	}
 	if (timestamp == 0) {
 		return SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
+						mem_ctx,
 						ppdesc);
 	}
 	conv = shadow_copy2_convert(talloc_tos(), handle, stripped, timestamp);
@@ -1209,7 +1211,8 @@ static NTSTATUS shadow_copy2_fget_nt_acl(vfs_handle_struct *handle,
 	if (conv == NULL) {
 		return map_nt_error_from_unix(errno);
 	}
-	status = SMB_VFS_NEXT_GET_NT_ACL(handle, conv, security_info, ppdesc);
+	status = SMB_VFS_NEXT_GET_NT_ACL(handle, conv, security_info,
+					 mem_ctx, ppdesc);
 	TALLOC_FREE(conv);
 	return status;
 }
@@ -1217,6 +1220,7 @@ static NTSTATUS shadow_copy2_fget_nt_acl(vfs_handle_struct *handle,
 static NTSTATUS shadow_copy2_get_nt_acl(vfs_handle_struct *handle,
 					const char *fname,
 					uint32 security_info,
+					TALLOC_CTX *mem_ctx,
 					struct security_descriptor **ppdesc)
 {
 	time_t timestamp;
@@ -1230,14 +1234,15 @@ static NTSTATUS shadow_copy2_get_nt_acl(vfs_handle_struct *handle,
 	}
 	if (timestamp == 0) {
 		return SMB_VFS_NEXT_GET_NT_ACL(handle, fname, security_info,
-					       ppdesc);
+					       mem_ctx, ppdesc);
 	}
 	conv = shadow_copy2_convert(talloc_tos(), handle, stripped, timestamp);
 	TALLOC_FREE(stripped);
 	if (conv == NULL) {
 		return map_nt_error_from_unix(errno);
 	}
-	status = SMB_VFS_NEXT_GET_NT_ACL(handle, conv, security_info, ppdesc);
+	status = SMB_VFS_NEXT_GET_NT_ACL(handle, conv, security_info,
+					 mem_ctx, ppdesc);
 	TALLOC_FREE(conv);
 	return status;
 }
diff --git a/source3/modules/vfs_time_audit.c b/source3/modules/vfs_time_audit.c
index b7d399b..6ff1a55 100644
--- a/source3/modules/vfs_time_audit.c
+++ b/source3/modules/vfs_time_audit.c
@@ -1671,6 +1671,7 @@ static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
 					   files_struct *fsp,
 					   uint32 security_info,
+					   TALLOC_CTX *mem_ctx,
 					   struct security_descriptor **ppdesc)
 {
 	NTSTATUS result;
@@ -1678,7 +1679,8 @@ static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
 	double timediff;
 
 	clock_gettime_mono(&ts1);
-	result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info, ppdesc);
+	result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
+					  mem_ctx, ppdesc);
 	clock_gettime_mono(&ts2);
 	timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 
@@ -1692,6 +1694,7 @@ static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
 static NTSTATUS smb_time_audit_get_nt_acl(vfs_handle_struct *handle,
 					  const char *name,
 					  uint32 security_info,
+					  TALLOC_CTX *mem_ctx,
 					  struct security_descriptor **ppdesc)
 {
 	NTSTATUS result;
@@ -1699,7 +1702,8 @@ static NTSTATUS smb_time_audit_get_nt_acl(vfs_handle_struct *handle,
 	double timediff;
 
 	clock_gettime_mono(&ts1);
-	result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info, ppdesc);
+	result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info,
+					 mem_ctx, ppdesc);
 	clock_gettime_mono(&ts2);
 	timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 
diff --git a/source3/modules/vfs_zfsacl.c b/source3/modules/vfs_zfsacl.c
index 7858a6a..bf06881 100644
--- a/source3/modules/vfs_zfsacl.c
+++ b/source3/modules/vfs_zfsacl.c
@@ -192,14 +192,16 @@ static NTSTATUS zfs_set_nt_acl(vfs_handle_struct *handle, files_struct *fsp,
 }
 
 static NTSTATUS zfsacl_fget_nt_acl(struct vfs_handle_struct *handle,
-				 struct files_struct *fsp,
-				 uint32 security_info,
-				 struct security_descriptor **ppdesc)
+				   struct files_struct *fsp,
+				   uint32 security_info,
+				   TALLOC_CTX *mem_ctx,
+				   struct security_descriptor **ppdesc)
 {
 	SMB4ACL_T *pacl;
 	NTSTATUS status;
 
-	status = zfs_get_nt_acl_common(fsp->fsp_name->base_name, security_info,
+	status = zfs_get_nt_acl_common(fsp->fsp_name->base_name,
+				       mem_ctx, security_info,
 				       &pacl);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
@@ -209,8 +211,9 @@ static NTSTATUS zfsacl_fget_nt_acl(struct vfs_handle_struct *handle,
 }
 
 static NTSTATUS zfsacl_get_nt_acl(struct vfs_handle_struct *handle,
-				const char *name,  uint32 security_info,
-				struct security_descriptor **ppdesc)
+				  const char *name, uint32 security_info,
+				  TALLOC_CTX *mem_ctx,
+				  struct security_descriptor **ppdesc)
 {
 	SMB4ACL_T *pacl;
 	NTSTATUS status;
@@ -220,7 +223,8 @@ static NTSTATUS zfsacl_get_nt_acl(struct vfs_handle_struct *handle,
 		return status;
 	}
 
-	return smb_get_nt_acl_nfs4(handle->conn, name, security_info, ppdesc,
+	return smb_get_nt_acl_nfs4(handle->conn, name, security_info,
+				   mem_ctx, ppdesc,
 				   pacl);
 }
 
diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
index 696c7bf..fb2a69e 100644
--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
@@ -2088,15 +2088,22 @@ WERROR _srvsvc_NetGetFileSecurity(struct pipes_struct *p,
 		goto error_exit;
 	}
 
+	sd_buf = talloc_zero(p->mem_ctx, struct sec_desc_buf);
+	if (!sd_buf) {
+		werr = WERR_NOMEM;
+		goto error_exit;
+	}
+
 	nt_status = SMB_VFS_FGET_NT_ACL(fsp,
 				       (SECINFO_OWNER
 					|SECINFO_GROUP
-					|SECINFO_DACL), &psd);
+					|SECINFO_DACL), sd_buf, &sd_buf->sd);
 
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		DEBUG(3,("_srvsvc_NetGetFileSecurity: Unable to get NT ACL "
 			"for file %s\n", smb_fname_str_dbg(smb_fname)));
 		werr = ntstatus_to_werror(nt_status);
+		TALLOC_FREE(sd_buf);
 		goto error_exit;
 	}
 
@@ -2106,14 +2113,7 @@ WERROR _srvsvc_NetGetFileSecurity(struct pipes_struct *p,
 
 	sd_size = ndr_size_security_descriptor(psd, 0);
 
-	sd_buf = talloc_zero(p->mem_ctx, struct sec_desc_buf);
-	if (!sd_buf) {
-		werr = WERR_NOMEM;
-		goto error_exit;
-	}
-
 	sd_buf->sd_size = sd_size;
-	sd_buf->sd = talloc_move(p->mem_ctx, &psd);
 
 	*r->out.sd_buf = sd_buf;
 
diff --git a/source3/smbd/file_access.c b/source3/smbd/file_access.c
index 6ced6a6..96a89e7 100644
--- a/source3/smbd/file_access.c
+++ b/source3/smbd/file_access.c
@@ -149,11 +149,11 @@ bool can_write_to_file(connection_struct *conn,
 
 bool directory_has_default_acl(connection_struct *conn, const char *fname)
 {
-	/* returns talloced off tos. */
 	struct security_descriptor *secdesc = NULL;
 	unsigned int i;
 	NTSTATUS status = SMB_VFS_GET_NT_ACL(conn, fname,
-				SECINFO_DACL, &secdesc);
+					     SECINFO_DACL, talloc_tos(),
+					     &secdesc);
 
 	if (!NT_STATUS_IS_OK(status) ||
 			secdesc == NULL ||
diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 997f721..1a82a02 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -1905,6 +1905,7 @@ NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
 {
 	NTSTATUS status;
 	struct security_descriptor *psd = NULL;
+	TALLOC_CTX *frame = talloc_stackframe();
 
 	/*
 	 * Get the permissions to return.
@@ -1930,13 +1931,13 @@ NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
 	}
 
 	if (!lp_nt_acl_support(SNUM(conn))) {
-		status = get_null_nt_acl(mem_ctx, &psd);
+		status = get_null_nt_acl(frame, &psd);
 	} else if (security_info_wanted & SECINFO_LABEL) {
 		/* Like W2K3 return a null object. */
-		status = get_null_nt_acl(mem_ctx, &psd);
+		status = get_null_nt_acl(frame, &psd);
 	} else {
 		status = SMB_VFS_FGET_NT_ACL(
-			fsp, security_info_wanted, &psd);
+			fsp, security_info_wanted, frame, &psd);
 	}
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
@@ -1987,7 +1988,7 @@ NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
 	}
 
 	if (max_data_count < *psd_size) {
-		TALLOC_FREE(psd);
+		TALLOC_FREE(frame);
 		return NT_STATUS_BUFFER_TOO_SMALL;
 	}
 
@@ -1995,11 +1996,11 @@ NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
 				   ppmarshalled_sd, psd_size);
 
 	if (!NT_STATUS_IS_OK(status)) {
-		TALLOC_FREE(psd);
+		TALLOC_FREE(frame);
 		return status;
 	}
 
-	TALLOC_FREE(psd);
+	TALLOC_FREE(frame);
 	return NT_STATUS_OK;
 }
 
diff --git a/source3/smbd/open.c b/source3/smbd/open.c
index a9a9198..d239f98 100644
--- a/source3/smbd/open.c
+++ b/source3/smbd/open.c
@@ -114,7 +114,7 @@ NTSTATUS smbd_check_access_rights(struct connection_struct *conn,
 	status = SMB_VFS_GET_NT_ACL(conn, smb_fname->base_name,
 			(SECINFO_OWNER |
 			SECINFO_GROUP |
-			SECINFO_DACL),&sd);
+			 SECINFO_DACL), talloc_tos(), &sd);
 
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(10, ("smbd_check_access_rights: Could not get acl "
@@ -236,6 +236,7 @@ static NTSTATUS check_parent_access(struct connection_struct *conn,
 	status = SMB_VFS_GET_NT_ACL(conn,
 				parent_dir,
 				SECINFO_DACL,
+				    talloc_tos(),
 				&parent_sd);
 
 	if (!NT_STATUS_IS_OK(status)) {
@@ -1675,7 +1676,8 @@ static NTSTATUS smbd_calculate_maximum_allowed_access(
 	status = SMB_VFS_GET_NT_ACL(conn, smb_fname->base_name,
 				    (SECINFO_OWNER |
 				     SECINFO_GROUP |
-				     SECINFO_DACL),&sd);
+				     SECINFO_DACL),
+				    talloc_tos(), &sd);
 
 	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 		/*
@@ -3407,7 +3409,7 @@ NTSTATUS open_streams_for_delete(connection_struct *conn,
 
 static NTSTATUS inherit_new_acl(files_struct *fsp)
 {
-	TALLOC_CTX *ctx = talloc_tos();
+	TALLOC_CTX *frame = talloc_stackframe();
 	char *parent_name = NULL;
 	struct security_descriptor *parent_desc = NULL;
 	NTSTATUS status = NT_STATUS_OK;
@@ -3419,14 +3421,15 @@ static NTSTATUS inherit_new_acl(files_struct *fsp)
 	bool inheritable_components = false;
 	size_t size = 0;
 
-	if (!parent_dirname(ctx, fsp->fsp_name->base_name, &parent_name, NULL)) {
+	if (!parent_dirname(frame, fsp->fsp_name->base_name, &parent_name, NULL)) {
 		return NT_STATUS_NO_MEMORY;
 	}
 
 	status = SMB_VFS_GET_NT_ACL(fsp->conn,
-				parent_name,
-				(SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL),
-				&parent_desc);
+				    parent_name,
+				    (SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL),
+				    frame,
+				    &parent_desc);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
@@ -3435,6 +3438,7 @@ static NTSTATUS inherit_new_acl(files_struct *fsp)
 					fsp->is_directory);
 
 	if (!inheritable_components && !inherit_owner) {
+		TALLOC_FREE(frame);
 		/* Nothing to inherit and not setting owner. */
 		return NT_STATUS_OK;
 	}
@@ -3460,7 +3464,7 @@ static NTSTATUS inherit_new_acl(files_struct *fsp)
 		group_sid = &fsp->conn->session_info->security_token->sids[PRIMARY_GROUP_SID_INDEX];
 	}
 
-	status = se_create_child_secdesc(ctx,
+	status = se_create_child_secdesc(frame,
 			&psd,
 			&size,
 			parent_desc,
@@ -3468,6 +3472,7 @@ static NTSTATUS inherit_new_acl(files_struct *fsp)
 			group_sid,
 			fsp->is_directory);
 	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
@@ -3498,6 +3503,7 @@ static NTSTATUS inherit_new_acl(files_struct *fsp)
 	if (inherit_owner) {
 		unbecome_root();
 	}
+	TALLOC_FREE(frame);
 	return status;
 }
 
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 96bd6ec..7f12f4b 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -3408,6 +3408,7 @@ static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
 				      SMB_ACL_T posix_acl,
 				      SMB_ACL_T def_acl,
 				      uint32_t security_info,
+				      TALLOC_CTX *mem_ctx,
 				      struct security_descriptor **ppdesc)
 {
 	struct dom_sid owner_sid;
@@ -3620,7 +3621,7 @@ static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
 		}
 	} /* security_info & SECINFO_DACL */
 
-	psd = make_standard_sec_desc( talloc_tos(),
+	psd = make_standard_sec_desc(mem_ctx,
 			(security_info & SECINFO_OWNER) ? &owner_sid : NULL,
 			(security_info & SECINFO_GROUP) ? &group_sid : NULL,
 			psa,
@@ -3671,11 +3672,14 @@ static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
 }
 
 NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
+			   TALLOC_CTX *mem_ctx,
 			   struct security_descriptor **ppdesc)
 {
 	SMB_STRUCT_STAT sbuf;
 	SMB_ACL_T posix_acl = NULL;
 	struct pai_val *pal;
+	TALLOC_CTX *frame = talloc_stackframe();
+	NTSTATUS status;
 
 	*ppdesc = NULL;
 
@@ -3684,33 +3688,42 @@ NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
 
 	/* can it happen that fsp_name == NULL ? */
 	if (fsp->is_directory ||  fsp->fh->fd == -1) {
-		return posix_get_nt_acl(fsp->conn, fsp->fsp_name->base_name,
-					security_info, ppdesc);
+		status = posix_get_nt_acl(fsp->conn, fsp->fsp_name->base_name,
+					  security_info, mem_ctx, ppdesc);
+		TALLOC_FREE(frame);
+		return status;
 	}
 
 	/* Get the stat struct for the owner info. */
 	if(SMB_VFS_FSTAT(fsp, &sbuf) != 0) {
+		TALLOC_FREE(frame);
 		return map_nt_error_from_unix(errno);
 	}
 
 	/* Get the ACL from the fd. */
-	posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, talloc_tos());
+	posix_acl = SMB_VFS_SYS_ACL_GET_FD(fsp, frame);
 
 	pal = fload_inherited_info(fsp);
 
-	return posix_get_nt_acl_common(fsp->conn, fsp->fsp_name->base_name,
-				       &sbuf, pal, posix_acl, NULL,
-				       security_info, ppdesc);
+	status = posix_get_nt_acl_common(fsp->conn, fsp->fsp_name->base_name,
+					 &sbuf, pal, posix_acl, NULL,
+					 security_info, mem_ctx, ppdesc);
+	TALLOC_FREE(frame);
+	return status;
 }
 
 NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
-			  uint32_t security_info, struct security_descriptor **ppdesc)
+			  uint32_t security_info,
+			  TALLOC_CTX *mem_ctx,
+			  struct security_descriptor **ppdesc)
 {
 	SMB_ACL_T posix_acl = NULL;
 	SMB_ACL_T def_acl = NULL;
 	struct pai_val *pal;
 	struct smb_filename smb_fname;
 	int ret;
+	TALLOC_CTX *frame = talloc_stackframe();
+	NTSTATUS status;
 
 	*ppdesc = NULL;
 
@@ -3727,26 +3740,29 @@ NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
 	}
 
 	if (ret == -1) {
+		TALLOC_FREE(frame);
 		return map_nt_error_from_unix(errno);
 	}
 
 	/* Get the ACL from the path. */
 	posix_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name,
-					     SMB_ACL_TYPE_ACCESS, talloc_tos());
+					     SMB_ACL_TYPE_ACCESS, frame);
 
 	/* If it's a directory get the default POSIX ACL. */
 	if(S_ISDIR(smb_fname.st.st_ex_mode)) {
 		def_acl = SMB_VFS_SYS_ACL_GET_FILE(conn, name,
-                                                   SMB_ACL_TYPE_DEFAULT,
-                                                   talloc_tos());
+						   SMB_ACL_TYPE_DEFAULT, frame);
 		def_acl = free_empty_sys_acl(conn, def_acl);
 	}
 
 	pal = load_inherited_info(conn, name);
 
-	return posix_get_nt_acl_common(conn, name, &smb_fname.st, pal,
-				       posix_acl, def_acl, security_info,
-				       ppdesc);
+	status = posix_get_nt_acl_common(conn, name, &smb_fname.st, pal,
+					 posix_acl, def_acl, security_info,
+					 mem_ctx,
+					 ppdesc);
+	TALLOC_FREE(frame);
+	return status;
 }
 
 /****************************************************************************
@@ -4972,7 +4988,7 @@ bool set_unix_posix_acl(connection_struct *conn, files_struct *fsp, const char *
 
 struct security_descriptor *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fname, uint32 security_info_wanted)
 {
-	struct security_descriptor *psd, *ret_sd;
+	struct security_descriptor *ret_sd;
 	connection_struct *conn;
 	files_struct finfo;
 	struct fd_handle fh;
@@ -5018,7 +5034,9 @@ struct security_descriptor *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fna
 		return NULL;
 	}
 
-	if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo, security_info_wanted, &psd))) {
+	if (!NT_STATUS_IS_OK(SMB_VFS_FGET_NT_ACL( &finfo,
+						  security_info_wanted,
+						  ctx, &ret_sd))) {
 		DEBUG(0,("get_nt_acl_no_snum: get_nt_acl returned zero.\n"));
 		TALLOC_FREE(finfo.fsp_name);
 		conn_free(conn);
@@ -5026,8 +5044,6 @@ struct security_descriptor *get_nt_acl_no_snum( TALLOC_CTX *ctx, const char *fna
 		return NULL;
 	}
 
-	ret_sd = dup_sec_desc( ctx, psd );
-
 	TALLOC_FREE(finfo.fsp_name);
 	conn_free(conn);
 	TALLOC_FREE(frame);
diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h
index a4b2fab..2e53a87 100644
--- a/source3/smbd/proto.h
+++ b/source3/smbd/proto.h
@@ -711,9 +711,12 @@ NTSTATUS unpack_nt_owners(connection_struct *conn, uid_t *puser, gid_t *pgrp, ui
 bool current_user_in_group(connection_struct *conn, gid_t gid);
 SMB_ACL_T free_empty_sys_acl(connection_struct *conn, SMB_ACL_T the_acl);
 NTSTATUS posix_fget_nt_acl(struct files_struct *fsp, uint32_t security_info,
+			   TALLOC_CTX *mem_ctx,
 			   struct security_descriptor **ppdesc);
 NTSTATUS posix_get_nt_acl(struct connection_struct *conn, const char *name,
-			  uint32_t security_info, struct security_descriptor **ppdesc);
+			  uint32_t security_info,
+			  TALLOC_CTX *mem_ctx,
+			  struct security_descriptor **ppdesc);
 NTSTATUS try_chown(files_struct *fsp, uid_t uid, gid_t gid);
 NTSTATUS append_parent_acl(files_struct *fsp,
 				const struct security_descriptor *pcsd,
diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c
index 182e334..3a95c58 100644
--- a/source3/smbd/vfs.c
+++ b/source3/smbd/vfs.c
@@ -2165,20 +2165,22 @@ NTSTATUS smb_vfs_call_fsctl(struct vfs_handle_struct *handle,
 NTSTATUS smb_vfs_call_fget_nt_acl(struct vfs_handle_struct *handle,
 				  struct files_struct *fsp,
 				  uint32 security_info,
+				  TALLOC_CTX *mem_ctx,
 				  struct security_descriptor **ppdesc)
 {
 	VFS_FIND(fget_nt_acl);
 	return handle->fns->fget_nt_acl_fn(handle, fsp, security_info,
-					   ppdesc);
+					   mem_ctx, ppdesc);
 }
 
 NTSTATUS smb_vfs_call_get_nt_acl(struct vfs_handle_struct *handle,
 				 const char *name,
 				 uint32 security_info,
+				 TALLOC_CTX *mem_ctx,
 				 struct security_descriptor **ppdesc)
 {
 	VFS_FIND(get_nt_acl);
-	return handle->fns->get_nt_acl_fn(handle, name, security_info, ppdesc);
+	return handle->fns->get_nt_acl_fn(handle, name, security_info, mem_ctx, ppdesc);
 }
 
 NTSTATUS smb_vfs_call_fset_nt_acl(struct vfs_handle_struct *handle,
diff --git a/source3/torture/cmd_vfs.c b/source3/torture/cmd_vfs.c
index 7755f8a..a37c9fc 100644
--- a/source3/torture/cmd_vfs.c
+++ b/source3/torture/cmd_vfs.c
@@ -1374,7 +1374,9 @@ static NTSTATUS cmd_fget_nt_acl(struct vfs_state *vfs, TALLOC_CTX *mem_ctx,
 		return NT_STATUS_OK;
 	}
 
-	status = SMB_VFS_FGET_NT_ACL(vfs->files[fd], SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL, &sd);
+	status = SMB_VFS_FGET_NT_ACL(vfs->files[fd],
+				     SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL,
+				     talloc_tos(), &sd);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("fget_nt_acl returned (%s)\n", nt_errstr(status));
 		return status;
@@ -1395,7 +1397,9 @@ static NTSTATUS cmd_get_nt_acl(struct vfs_state *vfs, TALLOC_CTX *mem_ctx,
 		return NT_STATUS_OK;
 	}
 
-	status = SMB_VFS_GET_NT_ACL(vfs->conn, argv[1], SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL, &sd);
+	status = SMB_VFS_GET_NT_ACL(vfs->conn, argv[1],
+				    SECINFO_OWNER | SECINFO_GROUP | SECINFO_DACL,
+				    talloc_tos(), &sd);
 	if (!NT_STATUS_IS_OK(status)) {
 		printf("get_nt_acl returned (%s)\n", nt_errstr(status));
 		return status;
-- 
1.7.11.7


From 2babb9d9c91fab7bde75f2d6798a426330e4cf04 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 11 Oct 2012 15:08:25 +1100
Subject: [PATCH 07/42] rpc_server:srvsvc Remove psd variable that was no
 longer set by SMB_VFS_FGET_NT_ACL

This fixes up an error introduced by c8ade07760ae0ccfdf2d875c9f3027926e62321b.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Oct 11 07:53:36 CEST 2012 on sn-devel-104
---
 source3/rpc_server/srvsvc/srv_srvsvc_nt.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
index fb2a69e..a6472a6 100644
--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
@@ -2009,7 +2009,6 @@ WERROR _srvsvc_NetGetFileSecurity(struct pipes_struct *p,
 				  struct srvsvc_NetGetFileSecurity *r)
 {
 	struct smb_filename *smb_fname = NULL;
-	struct security_descriptor *psd = NULL;
 	size_t sd_size;
 	char *servicename = NULL;
 	SMB_STRUCT_STAT st;
@@ -2107,11 +2106,11 @@ WERROR _srvsvc_NetGetFileSecurity(struct pipes_struct *p,
 		goto error_exit;
 	}
 
-	if (psd && psd->dacl) {
-		psd->dacl->revision = NT4_ACL_REVISION;
+	if (sd_buf->sd->dacl) {
+		sd_buf->sd->dacl->revision = NT4_ACL_REVISION;
 	}
 
-	sd_size = ndr_size_security_descriptor(psd, 0);
+	sd_size = ndr_size_security_descriptor(sd_buf->sd, 0);
 
 	sd_buf->sd_size = sd_size;
 
@@ -2141,7 +2140,6 @@ error_exit:
 
  done:
 
-	TALLOC_FREE(psd);
 	TALLOC_FREE(smb_fname);
 
 	return werr;
-- 
1.7.11.7


From 36dcaa30702df38b267e89925c32d550a5f5defb Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 11 Oct 2012 22:29:43 +1100
Subject: [PATCH 08/42] smbd: Always free the talloc_stackframe() before
 leaving smbd_do_query_security_desc

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Oct 11 15:20:54 CEST 2012 on sn-devel-104
---
 source3/smbd/nttrans.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 1a82a02..54e475d 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -1914,12 +1914,14 @@ NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
 	if ((security_info_wanted & SECINFO_SACL) &&
 			!(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
 		DEBUG(10, ("Access to SACL denied.\n"));
+		TALLOC_FREE(frame);
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
 	if ((security_info_wanted & (SECINFO_DACL|SECINFO_OWNER|SECINFO_GROUP)) &&
 			!(fsp->access_mask & SEC_STD_READ_CONTROL)) {
 		DEBUG(10, ("Access to DACL, OWNER, or GROUP denied.\n"));
+		TALLOC_FREE(frame);
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
@@ -1940,6 +1942,7 @@ NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
 			fsp, security_info_wanted, frame, &psd);
 	}
 	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(frame);
 		return status;
 	}
 
-- 
1.7.11.7


From 3660bca69619c6c1b38f93380c0c1ba1af55c5cf Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 23 Oct 2012 16:13:28 +1100
Subject: [PATCH 09/42] vfs: Fix compilation of ACL support on solaris

---
 source3/modules/vfs_solarisacl.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/source3/modules/vfs_solarisacl.h b/source3/modules/vfs_solarisacl.h
index 84c2cb7..20f1051 100644
--- a/source3/modules/vfs_solarisacl.h
+++ b/source3/modules/vfs_solarisacl.h
@@ -22,10 +22,12 @@
 
 SMB_ACL_T solarisacl_sys_acl_get_file(vfs_handle_struct *handle,
 				      const char *path_p,
-				      SMB_ACL_TYPE_T type);
+				      SMB_ACL_TYPE_T type, 
+				      TALLOC_CTX *mem_ctx);
 
 SMB_ACL_T solarisacl_sys_acl_get_fd(vfs_handle_struct *handle,
-				    files_struct *fsp);
+				    files_struct *fsp, 
+				    TALLOC_CTX *mem_ctx);
 
 int solarisacl_sys_acl_set_file(vfs_handle_struct *handle,
 				const char *name,
-- 
1.7.11.7


From c991387c3dff728a0a00170540f953e05e8af1d1 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 25 Oct 2012 16:25:22 +1100
Subject: [PATCH 10/42] pysmbd: Fix pysmbd octal mode handling

It is clearly too long since Computer Science 101... ;-)

Andrew Bartlett
---
 source3/smbd/pysmbd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/source3/smbd/pysmbd.c b/source3/smbd/pysmbd.c
index 32ddc2f..5035bda 100644
--- a/source3/smbd/pysmbd.c
+++ b/source3/smbd/pysmbd.c
@@ -157,8 +157,8 @@ static SMB_ACL_T make_simple_acl(gid_t gid, mode_t chmod_mode)
 
 	mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE;
 
-	mode_t mode_user = (chmod_mode & 0700) >> 16;
-	mode_t mode_group = (chmod_mode & 070) >> 8;
+	mode_t mode_user = (chmod_mode & 0700) >> 6;
+	mode_t mode_group = (chmod_mode & 070) >> 3;
 	mode_t mode_other = chmod_mode &  07;
 	SMB_ACL_ENTRY_T entry;
 	SMB_ACL_T acl = sys_acl_init(frame);
-- 
1.7.11.7


From d6d5b0b5bf8c2f63a87ae4cff69948b9d2c23c14 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 25 Oct 2012 16:27:19 +1100
Subject: [PATCH 11/42] selftest: Add many more tests for our posix ACL
 handling

This tests the mapping of posix ACLs to NT ACLs, the invalidation of
NT ACLs stored as an xattr and ensures this security-critical code
continues to work in the long term.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Oct 25 10:05:16 CEST 2012 on sn-devel-104
---
 source4/scripting/python/samba/tests/posixacl.py | 237 ++++++++++++++++++++++-
 1 file changed, 236 insertions(+), 1 deletion(-)

diff --git a/source4/scripting/python/samba/tests/posixacl.py b/source4/scripting/python/samba/tests/posixacl.py
index 78a07f7..449a87c 100644
--- a/source4/scripting/python/samba/tests/posixacl.py
+++ b/source4/scripting/python/samba/tests/posixacl.py
@@ -18,7 +18,7 @@
 
 """Tests for the Samba3 NT -> posix ACL layer"""
 
-from samba.ntacls import setntacl, getntacl
+from samba.ntacls import setntacl, getntacl, checkset_backend
 from samba.dcerpc import xattr, security, smb_acl, idmap
 from samba.param import LoadParm
 from samba.tests import TestCase
@@ -61,6 +61,70 @@ class PosixAclMappingTests(TestCase):
         self.assertEquals(facl.as_sddl(anysid),acl)
         os.unlink(tempf)
 
+    def test_setntacl_smbd_setposixacl_getntacl(self):
+        random.seed()
+        lp = LoadParm()
+        path = None
+        path = os.environ['SELFTEST_PREFIX']
+        acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+
+        # This will invalidate the ACL, as we have a hook!
+        smbd.set_simple_acl(tempf, 0640)
+
+        # However, this only asks the xattr
+        try:
+            facl = getntacl(lp,tempf, direct_db_access=True)
+            self.assertTrue(False)
+        except TypeError:
+            pass
+        os.unlink(tempf)
+
+    def test_setntacl_smbd_chmod_getntacl(self):
+        random.seed()
+        lp = LoadParm()
+        path = None
+        path = os.environ['SELFTEST_PREFIX']
+        acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+
+        # This should invalidate the ACL, as we include the posix ACL in the hash
+        (backend_obj, dbname) = checkset_backend(lp, None, None)
+        backend_obj.wrap_setxattr(dbname,
+                                  tempf, "system.fake_access_acl", "")
+
+        #however, as this is direct DB access, we do not notice it
+        facl = getntacl(lp,tempf, direct_db_access=True)
+        anysid = security.dom_sid(security.SID_NT_SELF)
+        self.assertEquals(acl, facl.as_sddl(anysid))
+        os.unlink(tempf)
+
+    def test_setntacl_smbd_chmod_getntacl_smbd(self):
+        random.seed()
+        lp = LoadParm()
+        path = None
+        path = os.environ['SELFTEST_PREFIX']
+        acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
+        simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+
+        # This should invalidate the ACL, as we include the posix ACL in the hash
+        (backend_obj, dbname) = checkset_backend(lp, None, None)
+        backend_obj.wrap_setxattr(dbname,
+                                  tempf, "system.fake_access_acl", "")
+
+        #the hash breaks, and we return an ACL based only on the mode
+        facl = getntacl(lp,tempf)
+        anysid = security.dom_sid(security.SID_NT_SELF)
+        self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
+        os.unlink(tempf)
+
     def test_setntacl_getntacl_smbd(self):
         random.seed()
         lp = LoadParm()
@@ -89,6 +153,46 @@ class PosixAclMappingTests(TestCase):
         self.assertEquals(facl.as_sddl(anysid),acl)
         os.unlink(tempf)
 
+    def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
+        random.seed()
+        lp = LoadParm()
+        path = None
+        path = os.environ['SELFTEST_PREFIX']
+        acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
+        simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        # This invalidates the hash of the NT acl just set
+        smbd.set_simple_acl(tempf, 0640)
+        facl = getntacl(lp,tempf, direct_db_access=False)
+        anysid = security.dom_sid(security.SID_NT_SELF)
+        self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
+        os.unlink(tempf)
+
+    def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
+        random.seed()
+        lp = LoadParm()
+        path = None
+        path = os.environ['SELFTEST_PREFIX']
+        acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
+        BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
+        simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;BA)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        # This invalidates the hash of the NT acl just set
+        s3conf = s3param.get_context()
+        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
+        smbd.set_simple_acl(tempf, 0640, BA_gid)
+
+        # This should re-calculate an ACL based on the posix details
+        facl = getntacl(lp,tempf, direct_db_access=False)
+        anysid = security.dom_sid(security.SID_NT_SELF)
+        self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
+        os.unlink(tempf)
+
     def test_setntacl_smbd_getntacl_smbd_gpo(self):
         random.seed()
         lp = LoadParm()
@@ -118,6 +222,137 @@ class PosixAclMappingTests(TestCase):
         posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
         os.unlink(tempf)
 
+    def test_setposixacl_getposixacl(self):
+        random.seed()
+        lp = LoadParm()
+        path = None
+        path = os.environ['SELFTEST_PREFIX']
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        smbd.set_simple_acl(tempf, 0640)
+        posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
+        self.assertEquals(posix_acl.count, 4)
+
+        self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
+        self.assertEquals(posix_acl.acl[0].a_perm, 6)
+
+        self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+        self.assertEquals(posix_acl.acl[1].a_perm, 4)
+
+        self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
+        self.assertEquals(posix_acl.acl[2].a_perm, 0)
+
+        self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
+        self.assertEquals(posix_acl.acl[3].a_perm, 6)
+        os.unlink(tempf)
+
+    def test_setposixacl_getntacl(self):
+        random.seed()
+        lp = LoadParm()
+        acl = ""
+        path = os.environ['SELFTEST_PREFIX']
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        smbd.set_simple_acl(tempf, 0750)
+        try:
+            facl = getntacl(lp,tempf)
+        except TypeError:
+            # We don't expect the xattr to be filled in in this case
+            pass
+
+    def test_setposixacl_getntacl_smbd(self):
+        random.seed()
+        lp = LoadParm()
+        path = os.environ['SELFTEST_PREFIX']
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        s3conf = s3param.get_context()
+        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        group_SID = s4_passdb.gid_to_sid(os.stat(tempf).st_gid)
+        user_SID = s4_passdb.uid_to_sid(os.stat(tempf).st_uid)
+        smbd.set_simple_acl(tempf, 0640)
+        facl = getntacl(lp, tempf, direct_db_access=False)
+        domsid = passdb.get_global_sam_sid()
+        acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
+        anysid = security.dom_sid(security.SID_NT_SELF)
+        self.assertEquals(acl, facl.as_sddl(anysid))
+
+    def test_setposixacl_group_getntacl_smbd(self):
+        random.seed()
+        lp = LoadParm()
+        path = os.environ['SELFTEST_PREFIX']
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
+        s3conf = s3param.get_context()
+        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
+        group_SID = s4_passdb.gid_to_sid(os.stat(tempf).st_gid)
+        user_SID = s4_passdb.uid_to_sid(os.stat(tempf).st_uid)
+        self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
+        smbd.set_simple_acl(tempf, 0640, BA_gid)
+        facl = getntacl(lp, tempf, direct_db_access=False)
+        domsid = passdb.get_global_sam_sid()
+        acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
+        anysid = security.dom_sid(security.SID_NT_SELF)
+        self.assertEquals(acl, facl.as_sddl(anysid))
+
+    def test_setposixacl_getposixacl(self):
+        random.seed()
+        lp = LoadParm()
+        path = os.environ['SELFTEST_PREFIX']
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        smbd.set_simple_acl(tempf, 0640)
+        posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
+        self.assertEquals(posix_acl.count, 4)
+
+        self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
+        self.assertEquals(posix_acl.acl[0].a_perm, 6)
+
+        self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+        self.assertEquals(posix_acl.acl[1].a_perm, 4)
+
+        self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
+        self.assertEquals(posix_acl.acl[2].a_perm, 0)
+
+        self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
+        self.assertEquals(posix_acl.acl[3].a_perm, 6)
+        os.unlink(tempf)
+
+    def test_setposixacl_group_getposixacl(self):
+        random.seed()
+        lp = LoadParm()
+        path = os.environ['SELFTEST_PREFIX']
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
+        s3conf = s3param.get_context()
+        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
+        self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
+        smbd.set_simple_acl(tempf, 0670, BA_gid)
+        posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
+
+        self.assertEquals(posix_acl.count, 5)
+
+        self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
+        self.assertEquals(posix_acl.acl[0].a_perm, 6)
+
+        self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+        self.assertEquals(posix_acl.acl[1].a_perm, 7)
+
+        self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
+        self.assertEquals(posix_acl.acl[2].a_perm, 0)
+
+        self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[3].a_perm, 7)
+        self.assertEquals(posix_acl.acl[3].info.gid, BA_gid)
+
+        self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_MASK)
+        self.assertEquals(posix_acl.acl[4].a_perm, 6)
+        os.unlink(tempf)
+
     def test_setntacl_sysvol_check_getposixacl(self):
         random.seed()
         lp = LoadParm()
-- 
1.7.11.7


From a0fb8f3abeb51677a1e004aa9d26966a1604d72e Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 25 Oct 2012 19:58:15 +1100
Subject: [PATCH 12/42] selftest: Cover one more NT ACL invalidation case and
 improve comments

This tries to show the difference between the cases where we trap
the POSIX ACL change and where we actually detect an OS-level change.

Andrew Bartlett
---
 source4/scripting/python/samba/tests/posixacl.py | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/source4/scripting/python/samba/tests/posixacl.py b/source4/scripting/python/samba/tests/posixacl.py
index 449a87c..a575138 100644
--- a/source4/scripting/python/samba/tests/posixacl.py
+++ b/source4/scripting/python/samba/tests/posixacl.py
@@ -82,7 +82,7 @@ class PosixAclMappingTests(TestCase):
             pass
         os.unlink(tempf)
 
-    def test_setntacl_smbd_chmod_getntacl(self):
+    def test_setntacl_invalidate_getntacl(self):
         random.seed()
         lp = LoadParm()
         path = None
@@ -103,26 +103,25 @@ class PosixAclMappingTests(TestCase):
         self.assertEquals(acl, facl.as_sddl(anysid))
         os.unlink(tempf)
 
-    def test_setntacl_smbd_chmod_getntacl_smbd(self):
+    def test_setntacl_invalidate_getntacl_smbd(self):
         random.seed()
         lp = LoadParm()
         path = None
         path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
         tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
         open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 
         # This should invalidate the ACL, as we include the posix ACL in the hash
         (backend_obj, dbname) = checkset_backend(lp, None, None)
         backend_obj.wrap_setxattr(dbname,
                                   tempf, "system.fake_access_acl", "")
 
-        #the hash breaks, and we return an ACL based only on the mode
+        #the hash would break, and we return an ACL based only on the mode, except we set the ACL using the 'ntvfs' mode that doesn't include a hash
         facl = getntacl(lp,tempf)
         anysid = security.dom_sid(security.SID_NT_SELF)
-        self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
+        self.assertEquals(acl, facl.as_sddl(anysid))
         os.unlink(tempf)
 
     def test_setntacl_getntacl_smbd(self):
@@ -163,7 +162,7 @@ class PosixAclMappingTests(TestCase):
         tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
         open(tempf, 'w').write("empty")
         setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
-        # This invalidates the hash of the NT acl just set
+        # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
         smbd.set_simple_acl(tempf, 0640)
         facl = getntacl(lp,tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
@@ -181,7 +180,7 @@ class PosixAclMappingTests(TestCase):
         tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
         open(tempf, 'w').write("empty")
         setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
-        # This invalidates the hash of the NT acl just set
+        # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
         s3conf = s3param.get_context()
         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
-- 
1.7.11.7


From 4bfca7ca4bc52c3c12e75e9d3b246222565fe43e Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 25 Oct 2012 20:17:55 +1100
Subject: [PATCH 13/42] selftest: Cover the important non-Samba invalidation
 of the NT ACL

This covers the case where we have a valid hash of the posix ACL (or the NT ACL from the
POSIX ACL) and we notice it no longer matches.

Andrew Bartlett
---
 source4/scripting/python/samba/tests/posixacl.py | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/source4/scripting/python/samba/tests/posixacl.py b/source4/scripting/python/samba/tests/posixacl.py
index a575138..cf7a40f 100644
--- a/source4/scripting/python/samba/tests/posixacl.py
+++ b/source4/scripting/python/samba/tests/posixacl.py
@@ -124,6 +124,29 @@ class PosixAclMappingTests(TestCase):
         self.assertEquals(acl, facl.as_sddl(anysid))
         os.unlink(tempf)
 
+    def test_setntacl_smbd_invalidate_getntacl_smbd(self):
+        random.seed()
+        lp = LoadParm()
+        path = None
+        path = os.environ['SELFTEST_PREFIX']
+        acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
+        simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x001200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
+        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
+        open(tempf, 'w').write("empty")
+        os.chmod(tempf, 0750)
+        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+
+        # This should invalidate the ACL, as we include the posix ACL in the hash
+        (backend_obj, dbname) = checkset_backend(lp, None, None)
+        backend_obj.wrap_setxattr(dbname,
+                                  tempf, "system.fake_access_acl", "")
+
+        #the hash will break, and we return an ACL based only on the mode
+        facl = getntacl(lp,tempf, direct_db_access=False)
+        anysid = security.dom_sid(security.SID_NT_SELF)
+        self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
+        os.unlink(tempf)
+
     def test_setntacl_getntacl_smbd(self):
         random.seed()
         lp = LoadParm()
-- 
1.7.11.7


From 721e846b3a57ad460e6f978a67feb4adf0fdaf69 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 25 Oct 2012 20:18:28 +1100
Subject: [PATCH 14/42] selftest: Always unlink the tempf in posixacl test

---
 source4/scripting/python/samba/tests/posixacl.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/source4/scripting/python/samba/tests/posixacl.py b/source4/scripting/python/samba/tests/posixacl.py
index cf7a40f..482b48b 100644
--- a/source4/scripting/python/samba/tests/posixacl.py
+++ b/source4/scripting/python/samba/tests/posixacl.py
@@ -278,9 +278,11 @@ class PosixAclMappingTests(TestCase):
         smbd.set_simple_acl(tempf, 0750)
         try:
             facl = getntacl(lp,tempf)
+            self.assertTrue(False)
         except TypeError:
             # We don't expect the xattr to be filled in in this case
             pass
+        os.unlink(tempf)
 
     def test_setposixacl_getntacl_smbd(self):
         random.seed()
@@ -294,10 +296,10 @@ class PosixAclMappingTests(TestCase):
         user_SID = s4_passdb.uid_to_sid(os.stat(tempf).st_uid)
         smbd.set_simple_acl(tempf, 0640)
         facl = getntacl(lp, tempf, direct_db_access=False)
-        domsid = passdb.get_global_sam_sid()
         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
+        os.unlink(tempf)
 
     def test_setposixacl_group_getntacl_smbd(self):
         random.seed()
@@ -318,6 +320,7 @@ class PosixAclMappingTests(TestCase):
         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
+        os.unlink(tempf)
 
     def test_setposixacl_getposixacl(self):
         random.seed()
-- 
1.7.11.7


From 66a81f0067f011044bc5cbd7521b0726d884ff05 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 24 Oct 2012 18:23:04 +1100
Subject: [PATCH 15/42] dbwrap: use talloc_stackframe() in db_tdb_log_key()

We can not be sure that there is already a talloc_stackframe() in place
so we must create one.

Andrew Bartlett
---
 lib/dbwrap/dbwrap_tdb.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/dbwrap/dbwrap_tdb.c b/lib/dbwrap/dbwrap_tdb.c
index 80d41b4..a3a6c87 100644
--- a/lib/dbwrap/dbwrap_tdb.c
+++ b/lib/dbwrap/dbwrap_tdb.c
@@ -42,10 +42,11 @@ static void db_tdb_log_key(const char *prefix, TDB_DATA key)
 {
 	size_t len;
 	char *keystr;
-
+	TALLOC_CTX *frame;
 	if (DEBUGLEVEL < 10) {
 		return;
 	}
+	frame = talloc_stackframe();
 	len = key.dsize;
 	if (DEBUGLEVEL == 10) {
 		/*
@@ -53,10 +54,10 @@ static void db_tdb_log_key(const char *prefix, TDB_DATA key)
 		 */
 		len = MIN(10, key.dsize);
 	}
-	keystr = hex_encode_talloc(talloc_tos(), (unsigned char *)(key.dptr),
+	keystr = hex_encode_talloc(frame, (unsigned char *)(key.dptr),
 				   len);
 	DEBUG(10, ("%s key %s\n", prefix, keystr));
-	TALLOC_FREE(keystr);
+	TALLOC_FREE(frame);
 }
 
 static int db_tdb_record_destr(struct db_record* data)
-- 
1.7.11.7


From 3e067b56309b57a3b572bff484d473114bfee0b8 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 24 Oct 2012 18:24:12 +1100
Subject: [PATCH 16/42] python-ntacls: Cope with ACL revision 4

This is the new revision with the hash of the posix or system ACL.

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Oct 25 15:04:39 CEST 2012 on sn-devel-104
---
 source4/scripting/python/samba/ntacls.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/source4/scripting/python/samba/ntacls.py b/source4/scripting/python/samba/ntacls.py
index 44cbbe9..f304047 100644
--- a/source4/scripting/python/samba/ntacls.py
+++ b/source4/scripting/python/samba/ntacls.py
@@ -78,6 +78,8 @@ def getntacl(lp, file, backend=None, eadbfile=None, direct_db_access=True):
             return ntacl.info.sd
         elif ntacl.version == 3:
             return ntacl.info.sd
+        elif ntacl.version == 4:
+            return ntacl.info.sd
     else:
         return smbd.get_nt_acl(file, security.SECINFO_OWNER | security.SECINFO_GROUP | security.SECINFO_DACL | security.SECINFO_SACL)
 
-- 
1.7.11.7


From 055ee4cdc970b0ced32daab76ebfca560dbf2e08 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Fri, 26 Oct 2012 17:25:53 +1100
Subject: [PATCH 17/42] pysmbd: Add hook for unlink() so python scripts can
 remove xattr.tdb entries

If we do not provide a way to remove files from xattr.tdb, we can re-use the inode.

Andrew Bartlett
---
 source3/smbd/pysmbd.c                            | 68 ++++++++++++++++++++++++
 source4/scripting/python/samba/tests/posixacl.py | 40 +++++++-------
 2 files changed, 88 insertions(+), 20 deletions(-)

diff --git a/source3/smbd/pysmbd.c b/source3/smbd/pysmbd.c
index 5035bda..832eaeb 100644
--- a/source3/smbd/pysmbd.c
+++ b/source3/smbd/pysmbd.c
@@ -330,6 +330,71 @@ static PyObject *py_smbd_chown(PyObject *self, PyObject *args)
 }
 
 /*
+  chown a file
+ */
+static PyObject *py_smbd_unlink(PyObject *self, PyObject *args)
+{
+	connection_struct *conn;
+	NTSTATUS status = NT_STATUS_OK;
+	int ret;
+	struct smb_filename *smb_fname = NULL;
+	char *fname;
+	int uid, gid;
+	TALLOC_CTX *frame;
+	mode_t saved_umask;
+
+	if (!PyArg_ParseTuple(args, "s", &fname))
+		return NULL;
+
+	frame = talloc_stackframe();
+
+	conn = talloc_zero(frame, connection_struct);
+	if (conn == NULL) {
+		PyErr_NoMemory();
+		return NULL;
+	}
+
+	if (!(conn->params = talloc(conn, struct share_params))) {
+		PyErr_NoMemory();
+		return NULL;
+	}
+
+	/* we want total control over the permissions on created files,
+	   so set our umask to 0 */
+	saved_umask = umask(0);
+
+	conn->params->service = -1;
+
+	set_conn_connectpath(conn, "/");
+
+	smbd_vfs_init(conn);
+
+	status = create_synthetic_smb_fname_split(frame, fname, NULL,
+						  &smb_fname);
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(frame);
+		umask(saved_umask);
+		PyErr_NTSTATUS_IS_ERR_RAISE(status);
+	}
+
+	ret = SMB_VFS_UNLINK(conn, smb_fname);
+	if (ret != 0) {
+		status = map_nt_error_from_unix_common(errno);
+		DEBUG(0,("unlink returned failure: %s\n", strerror(errno)));
+	}
+
+	umask(saved_umask);
+
+	conn_free(conn);
+
+	TALLOC_FREE(frame);
+
+	PyErr_NTSTATUS_IS_ERR_RAISE(status);
+
+	Py_RETURN_NONE;
+}
+
+/*
   check if we have ACL support
  */
 static PyObject *py_smbd_have_posix_acls(PyObject *self, PyObject *args)
@@ -494,6 +559,9 @@ static PyMethodDef py_smbd_methods[] = {
 	{ "chown",
 		(PyCFunction)py_smbd_chown, METH_VARARGS,
 		NULL },
+	{ "unlink",
+		(PyCFunction)py_smbd_unlink, METH_VARARGS,
+		NULL },
 	{ NULL }
 };
 
diff --git a/source4/scripting/python/samba/tests/posixacl.py b/source4/scripting/python/samba/tests/posixacl.py
index 482b48b..2450470 100644
--- a/source4/scripting/python/samba/tests/posixacl.py
+++ b/source4/scripting/python/samba/tests/posixacl.py
@@ -45,7 +45,7 @@ class PosixAclMappingTests(TestCase):
         tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
         open(tempf, 'w').write("empty")
         setntacl(lp, tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_smbd_getntacl(self):
         random.seed()
@@ -59,7 +59,7 @@ class PosixAclMappingTests(TestCase):
         facl = getntacl(lp,tempf, direct_db_access=True)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_smbd_setposixacl_getntacl(self):
         random.seed()
@@ -80,7 +80,7 @@ class PosixAclMappingTests(TestCase):
             self.assertTrue(False)
         except TypeError:
             pass
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_invalidate_getntacl(self):
         random.seed()
@@ -101,7 +101,7 @@ class PosixAclMappingTests(TestCase):
         facl = getntacl(lp,tempf, direct_db_access=True)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_invalidate_getntacl_smbd(self):
         random.seed()
@@ -122,7 +122,7 @@ class PosixAclMappingTests(TestCase):
         facl = getntacl(lp,tempf)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_smbd_invalidate_getntacl_smbd(self):
         random.seed()
@@ -145,7 +145,7 @@ class PosixAclMappingTests(TestCase):
         facl = getntacl(lp,tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_getntacl_smbd(self):
         random.seed()
@@ -159,7 +159,7 @@ class PosixAclMappingTests(TestCase):
         facl = getntacl(lp,tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_smbd_getntacl_smbd(self):
         random.seed()
@@ -173,7 +173,7 @@ class PosixAclMappingTests(TestCase):
         facl = getntacl(lp,tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
         random.seed()
@@ -190,7 +190,7 @@ class PosixAclMappingTests(TestCase):
         facl = getntacl(lp,tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
         random.seed()
@@ -213,7 +213,7 @@ class PosixAclMappingTests(TestCase):
         facl = getntacl(lp,tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_smbd_getntacl_smbd_gpo(self):
         random.seed()
@@ -227,7 +227,7 @@ class PosixAclMappingTests(TestCase):
         facl = getntacl(lp,tempf, direct_db_access=False)
         domsid = security.dom_sid("S-1-5-21-2212615479-2695158682-2101375467")
         self.assertEquals(facl.as_sddl(domsid),acl)
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_getposixacl(self):
         random.seed()
@@ -242,7 +242,7 @@ class PosixAclMappingTests(TestCase):
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
         posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setposixacl_getposixacl(self):
         random.seed()
@@ -266,7 +266,7 @@ class PosixAclMappingTests(TestCase):
 
         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
         self.assertEquals(posix_acl.acl[3].a_perm, 6)
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setposixacl_getntacl(self):
         random.seed()
@@ -282,7 +282,7 @@ class PosixAclMappingTests(TestCase):
         except TypeError:
             # We don't expect the xattr to be filled in in this case
             pass
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setposixacl_getntacl_smbd(self):
         random.seed()
@@ -299,7 +299,7 @@ class PosixAclMappingTests(TestCase):
         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setposixacl_group_getntacl_smbd(self):
         random.seed()
@@ -320,7 +320,7 @@ class PosixAclMappingTests(TestCase):
         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setposixacl_getposixacl(self):
         random.seed()
@@ -343,7 +343,7 @@ class PosixAclMappingTests(TestCase):
 
         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
         self.assertEquals(posix_acl.acl[3].a_perm, 6)
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setposixacl_group_getposixacl(self):
         random.seed()
@@ -376,7 +376,7 @@ class PosixAclMappingTests(TestCase):
 
         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_MASK)
         self.assertEquals(posix_acl.acl[4].a_perm, 6)
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_sysvol_check_getposixacl(self):
         random.seed()
@@ -502,7 +502,7 @@ class PosixAclMappingTests(TestCase):
 
 #
 
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def test_setntacl_policies_check_getposixacl(self):
         random.seed()
@@ -640,7 +640,7 @@ class PosixAclMappingTests(TestCase):
 
 #
 
-        os.unlink(tempf)
+        smbd.unlink(tempf)
 
     def setUp(self):
         super(PosixAclMappingTests, self).setUp()
-- 
1.7.11.7


From 603eacecb04f85601c06b48abc4c2453d7305fcc Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Fri, 26 Oct 2012 10:07:02 +1100
Subject: [PATCH 18/42] pysmbd: Remember to close files after setting the NT
 ACL

---
 source3/smbd/pysmbd.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/source3/smbd/pysmbd.c b/source3/smbd/pysmbd.c
index 832eaeb..a6a09d4 100644
--- a/source3/smbd/pysmbd.c
+++ b/source3/smbd/pysmbd.c
@@ -100,6 +100,9 @@ static NTSTATUS set_nt_acl_no_snum(const char *fname,
 	set_conn_connectpath(conn, "/");
 
 	smbd_vfs_init(conn);
+	if (!posix_locking_init(false)) {
+		return NT_STATUS_NO_MEMORY;
+	}
 
 	fsp = talloc_zero(frame, struct files_struct);
 	if (fsp == NULL) {
@@ -144,6 +147,8 @@ static NTSTATUS set_nt_acl_no_snum(const char *fname,
 		DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
 	}
 
+	SMB_VFS_CLOSE(fsp);
+
 	conn_free(conn);
 	TALLOC_FREE(frame);
 
-- 
1.7.11.7


From 7d77715a8883d83d72d179036fb8e4ca9729632f Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Fri, 26 Oct 2012 14:22:07 +1100
Subject: [PATCH 19/42] pysmbd: Set umask to 0 during smbd operations

---
 source3/smbd/pysmbd.c | 43 ++++++++++++++++++++++++++++++++++---------
 1 file changed, 34 insertions(+), 9 deletions(-)

diff --git a/source3/smbd/pysmbd.c b/source3/smbd/pysmbd.c
index a6a09d4..0c8e859 100644
--- a/source3/smbd/pysmbd.c
+++ b/source3/smbd/pysmbd.c
@@ -43,6 +43,7 @@ static NTSTATUS set_sys_acl_no_snum(const char *fname,
 	connection_struct *conn;
 	NTSTATUS status = NT_STATUS_OK;
 	int ret;
+	mode_t saved_umask;
 
 	conn = talloc_zero(NULL, connection_struct);
 	if (conn == NULL) {
@@ -56,6 +57,10 @@ static NTSTATUS set_sys_acl_no_snum(const char *fname,
 		return NT_STATUS_NO_MEMORY;
 	}
 
+	/* we want total control over the permissions on created files,
+	   so set our umask to 0 */
+	saved_umask = umask(0);
+
 	conn->params->service = -1;
 
 	set_conn_connectpath(conn, "/");
@@ -68,6 +73,8 @@ static NTSTATUS set_sys_acl_no_snum(const char *fname,
 		DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned zero.\n"));
 	}
 
+	umask(saved_umask);
+
 	conn_free(conn);
 
 	return status;
@@ -82,9 +89,16 @@ static NTSTATUS set_nt_acl_no_snum(const char *fname,
 	files_struct *fsp;
 	struct smb_filename *smb_fname = NULL;
 	int flags;
+	mode_t saved_umask;
+
+	if (!posix_locking_init(false)) {
+		TALLOC_FREE(frame);
+		return NT_STATUS_NO_MEMORY;
+	}
 
 	conn = talloc_zero(frame, connection_struct);
 	if (conn == NULL) {
+		TALLOC_FREE(frame);
 		DEBUG(0, ("talloc failed\n"));
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -95,15 +109,6 @@ static NTSTATUS set_nt_acl_no_snum(const char *fname,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	conn->params->service = -1;
-
-	set_conn_connectpath(conn, "/");
-
-	smbd_vfs_init(conn);
-	if (!posix_locking_init(false)) {
-		return NT_STATUS_NO_MEMORY;
-	}
-
 	fsp = talloc_zero(frame, struct files_struct);
 	if (fsp == NULL) {
 		TALLOC_FREE(frame);
@@ -116,10 +121,21 @@ static NTSTATUS set_nt_acl_no_snum(const char *fname,
 	}
 	fsp->conn = conn;
 
+	/* we want total control over the permissions on created files,
+	   so set our umask to 0 */
+	saved_umask = umask(0);
+
+	conn->params->service = -1;
+
+	set_conn_connectpath(conn, "/");
+
+	smbd_vfs_init(conn);
+
 	status = create_synthetic_smb_fname_split(fsp, fname, NULL,
 						  &smb_fname);
 	if (!NT_STATUS_IS_OK(status)) {
 		TALLOC_FREE(frame);
+		umask(saved_umask);
 		return status;
 	}
 
@@ -139,6 +155,7 @@ static NTSTATUS set_nt_acl_no_snum(const char *fname,
 	if (fsp->fh->fd == -1) {
 		printf("open: error=%d (%s)\n", errno, strerror(errno));
 		TALLOC_FREE(frame);
+		umask(saved_umask);
 		return NT_STATUS_UNSUCCESSFUL;
 	}
 
@@ -152,6 +169,7 @@ static NTSTATUS set_nt_acl_no_snum(const char *fname,
 	conn_free(conn);
 	TALLOC_FREE(frame);
 
+	umask(saved_umask);
 	return status;
 }
 
@@ -296,6 +314,7 @@ static PyObject *py_smbd_chown(PyObject *self, PyObject *args)
 	char *fname;
 	int uid, gid;
 	TALLOC_CTX *frame;
+	mode_t saved_umask;
 
 	if (!PyArg_ParseTuple(args, "sii", &fname, &uid, &gid))
 		return NULL;
@@ -313,6 +332,10 @@ static PyObject *py_smbd_chown(PyObject *self, PyObject *args)
 		return NULL;
 	}
 
+	/* we want total control over the permissions on created files,
+	   so set our umask to 0 */
+	saved_umask = umask(0);
+
 	conn->params->service = -1;
 
 	set_conn_connectpath(conn, "/");
@@ -325,6 +348,8 @@ static PyObject *py_smbd_chown(PyObject *self, PyObject *args)
 		DEBUG(0,("chown returned failure: %s\n", strerror(errno)));
 	}
 
+	umask(saved_umask);
+
 	conn_free(conn);
 
 	TALLOC_FREE(frame);
-- 
1.7.11.7


From 5f1392b14f2dd7ca246ff8677ac57ea2634c9fe4 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Fri, 26 Oct 2012 14:23:39 +1100
Subject: [PATCH 20/42] vfstest: set umask(0) in vfstest

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Oct 26 10:07:03 CEST 2012 on sn-devel-104
---
 source3/torture/vfstest.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/source3/torture/vfstest.c b/source3/torture/vfstest.c
index 72156a5..dd3787b 100644
--- a/source3/torture/vfstest.c
+++ b/source3/torture/vfstest.c
@@ -34,6 +34,7 @@
 #include "messages.h"
 #include "libcli/security/security.h"
 #include "lib/smbd_shim.h"
+#include "system/filesys.h"
 
 /* List to hold groups of commands */
 static struct cmd_list {
@@ -483,6 +484,10 @@ int main(int argc, char *argv[])
 
 	poptFreeContext(pc);
 
+	/* we want total control over the permissions on created files,
+	   so set our umask to 0 */
+	umask(0);
+
 	lp_load_initial_only(get_dyn_CONFIGFILE());
 
 	/* TODO: check output */
-- 
1.7.11.7


From 5bf5a0639d1cf553d46e641e6e1dfa37fd600ba9 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sat, 27 Oct 2012 09:20:52 +1100
Subject: [PATCH 21/42] provision: Fix comments in checksysvolacl

---
 source4/scripting/python/samba/provision/__init__.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/source4/scripting/python/samba/provision/__init__.py b/source4/scripting/python/samba/provision/__init__.py
index 03d9bca..0ee621e 100644
--- a/source4/scripting/python/samba/provision/__init__.py
+++ b/source4/scripting/python/samba/provision/__init__.py
@@ -1568,8 +1568,9 @@ def checksysvolacl(samdb, netlogon, sysvol, domainsid, dnsdomain, domaindn,
     if domain_info["dns_domain"].upper() != dnsdomain.upper():
         raise ProvisioningError('Realm as seen by pdb_samba_dsdb [%s] does not match Realm as seen by the provision script [%s]!' % (domain_info["dns_domain"].upper(), dnsdomain.upper()))
 
-    # Set the SYSVOL_ACL on the sysvol folder and subfolder (first level)
+    # Ensure we can read this directly, and via the smbd VFS
     for direct_db_access in [True, False]:
+        # Check the SYSVOL_ACL on the sysvol folder and subfolder (first level)
         for dir_path in [os.path.join(sysvol, dnsdomain), netlogon]:
             fsacl = getntacl(lp, dir_path, direct_db_access=direct_db_access)
             if fsacl is None:
-- 
1.7.11.7


From 25ff02b1341e0de4d2a776695cabbea7b8d1796c Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sat, 27 Oct 2012 10:59:43 +1100
Subject: [PATCH 22/42] sefltest: use TestCaseInTempDir and setUp/tearDown for
 posixacl.py temp file

This manages the temp file more reliably, and reduces the repeated
code in each test case.

Pair-Programmed-With: Jelmer Vernooij <jelmer@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Oct 27 04:37:58 CEST 2012 on sn-devel-104
---
 source4/scripting/python/samba/tests/posixacl.py | 232 ++++++-----------------
 1 file changed, 62 insertions(+), 170 deletions(-)

diff --git a/source4/scripting/python/samba/tests/posixacl.py b/source4/scripting/python/samba/tests/posixacl.py
index 2450470..5e10f8d 100644
--- a/source4/scripting/python/samba/tests/posixacl.py
+++ b/source4/scripting/python/samba/tests/posixacl.py
@@ -21,7 +21,7 @@
 from samba.ntacls import setntacl, getntacl, checkset_backend
 from samba.dcerpc import xattr, security, smb_acl, idmap
 from samba.param import LoadParm
-from samba.tests import TestCase
+from samba.tests import TestCaseInTempDir
 from samba import provision
 import random
 import os
@@ -35,224 +35,148 @@ from samba.samba3 import param as s3param
 #            print "uid: %d" % entry.uid
 #            print "gid: %d" % entry.gid
 
-class PosixAclMappingTests(TestCase):
+class PosixAclMappingTests(TestCaseInTempDir):
 
     def test_setntacl(self):
-        random.seed()
         lp = LoadParm()
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp, tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
-        smbd.unlink(tempf)
+        setntacl(lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 
     def test_setntacl_smbd_getntacl(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
-        facl = getntacl(lp,tempf, direct_db_access=True)
+        setntacl(lp,self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+        facl = getntacl(lp,self.tempf, direct_db_access=True)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
-        smbd.unlink(tempf)
 
     def test_setntacl_smbd_setposixacl_getntacl(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+        setntacl(lp,self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
 
         # This will invalidate the ACL, as we have a hook!
-        smbd.set_simple_acl(tempf, 0640)
+        smbd.set_simple_acl(self.tempf, 0640)
 
         # However, this only asks the xattr
         try:
-            facl = getntacl(lp,tempf, direct_db_access=True)
+            facl = getntacl(lp, self.tempf, direct_db_access=True)
             self.assertTrue(False)
         except TypeError:
             pass
-        smbd.unlink(tempf)
 
     def test_setntacl_invalidate_getntacl(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
 
         # This should invalidate the ACL, as we include the posix ACL in the hash
         (backend_obj, dbname) = checkset_backend(lp, None, None)
         backend_obj.wrap_setxattr(dbname,
-                                  tempf, "system.fake_access_acl", "")
+                                  self.tempf, "system.fake_access_acl", "")
 
         #however, as this is direct DB access, we do not notice it
-        facl = getntacl(lp,tempf, direct_db_access=True)
+        facl = getntacl(lp, self.tempf, direct_db_access=True)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
-        smbd.unlink(tempf)
 
     def test_setntacl_invalidate_getntacl_smbd(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 
         # This should invalidate the ACL, as we include the posix ACL in the hash
         (backend_obj, dbname) = checkset_backend(lp, None, None)
         backend_obj.wrap_setxattr(dbname,
-                                  tempf, "system.fake_access_acl", "")
+                                  self.tempf, "system.fake_access_acl", "")
 
         #the hash would break, and we return an ACL based only on the mode, except we set the ACL using the 'ntvfs' mode that doesn't include a hash
-        facl = getntacl(lp,tempf)
+        facl = getntacl(lp, self.tempf)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
-        smbd.unlink(tempf)
 
     def test_setntacl_smbd_invalidate_getntacl_smbd(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x001200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        os.chmod(tempf, 0750)
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        os.chmod(self.tempf, 0750)
+        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 
         # This should invalidate the ACL, as we include the posix ACL in the hash
         (backend_obj, dbname) = checkset_backend(lp, None, None)
         backend_obj.wrap_setxattr(dbname,
-                                  tempf, "system.fake_access_acl", "")
+                                  self.tempf, "system.fake_access_acl", "")
 
         #the hash will break, and we return an ACL based only on the mode
-        facl = getntacl(lp,tempf, direct_db_access=False)
+        facl = getntacl(lp, self.tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
-        smbd.unlink(tempf)
 
     def test_setntacl_getntacl_smbd(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
-        facl = getntacl(lp,tempf, direct_db_access=False)
+        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+        facl = getntacl(lp, self.tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
-        smbd.unlink(tempf)
 
     def test_setntacl_smbd_getntacl_smbd(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
-        facl = getntacl(lp,tempf, direct_db_access=False)
+        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        facl = getntacl(lp, self.tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
-        smbd.unlink(tempf)
 
     def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
-        smbd.set_simple_acl(tempf, 0640)
-        facl = getntacl(lp,tempf, direct_db_access=False)
+        smbd.set_simple_acl(self.tempf, 0640)
+        facl = getntacl(lp, self.tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
-        smbd.unlink(tempf)
 
     def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;BA)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        setntacl(lp,self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
         s3conf = s3param.get_context()
         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
-        smbd.set_simple_acl(tempf, 0640, BA_gid)
+        smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 
         # This should re-calculate an ACL based on the posix details
-        facl = getntacl(lp,tempf, direct_db_access=False)
+        facl = getntacl(lp,self.tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
-        smbd.unlink(tempf)
 
     def test_setntacl_smbd_getntacl_smbd_gpo(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:DAG:DUD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
-        facl = getntacl(lp,tempf, direct_db_access=False)
+        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        facl = getntacl(lp, self.tempf, direct_db_access=False)
         domsid = security.dom_sid("S-1-5-21-2212615479-2695158682-2101375467")
         self.assertEquals(facl.as_sddl(domsid),acl)
-        smbd.unlink(tempf)
 
     def test_setntacl_getposixacl(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
-        facl = getntacl(lp,tempf)
+        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        facl = getntacl(lp, self.tempf)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
-        posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
-        smbd.unlink(tempf)
+        posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 
     def test_setposixacl_getposixacl(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        smbd.set_simple_acl(tempf, 0640)
-        posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
+        smbd.set_simple_acl(self.tempf, 0640)
+        posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
         self.assertEquals(posix_acl.count, 4)
 
         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
@@ -266,70 +190,50 @@ class PosixAclMappingTests(TestCase):
 
         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
         self.assertEquals(posix_acl.acl[3].a_perm, 6)
-        smbd.unlink(tempf)
 
     def test_setposixacl_getntacl(self):
-        random.seed()
         lp = LoadParm()
         acl = ""
-        path = os.environ['SELFTEST_PREFIX']
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        smbd.set_simple_acl(tempf, 0750)
+        smbd.set_simple_acl(self.tempf, 0750)
         try:
-            facl = getntacl(lp,tempf)
+            facl = getntacl(lp, self.tempf)
             self.assertTrue(False)
         except TypeError:
             # We don't expect the xattr to be filled in in this case
             pass
-        smbd.unlink(tempf)
 
     def test_setposixacl_getntacl_smbd(self):
-        random.seed()
         lp = LoadParm()
-        path = os.environ['SELFTEST_PREFIX']
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
         s3conf = s3param.get_context()
         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
-        group_SID = s4_passdb.gid_to_sid(os.stat(tempf).st_gid)
-        user_SID = s4_passdb.uid_to_sid(os.stat(tempf).st_uid)
-        smbd.set_simple_acl(tempf, 0640)
-        facl = getntacl(lp, tempf, direct_db_access=False)
+        group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
+        user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
+        smbd.set_simple_acl(self.tempf, 0640)
+        facl = getntacl(lp, self.tempf, direct_db_access=False)
         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
-        smbd.unlink(tempf)
 
     def test_setposixacl_group_getntacl_smbd(self):
-        random.seed()
         lp = LoadParm()
-        path = os.environ['SELFTEST_PREFIX']
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
         s3conf = s3param.get_context()
         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
-        group_SID = s4_passdb.gid_to_sid(os.stat(tempf).st_gid)
-        user_SID = s4_passdb.uid_to_sid(os.stat(tempf).st_uid)
+        group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
+        user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
-        smbd.set_simple_acl(tempf, 0640, BA_gid)
-        facl = getntacl(lp, tempf, direct_db_access=False)
+        smbd.set_simple_acl(self.tempf, 0640, BA_gid)
+        facl = getntacl(lp, self.tempf, direct_db_access=False)
         domsid = passdb.get_global_sam_sid()
         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
-        smbd.unlink(tempf)
 
     def test_setposixacl_getposixacl(self):
-        random.seed()
         lp = LoadParm()
-        path = os.environ['SELFTEST_PREFIX']
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        smbd.set_simple_acl(tempf, 0640)
-        posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
+        smbd.set_simple_acl(self.tempf, 0640)
+        posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
         self.assertEquals(posix_acl.count, 4)
 
         self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
@@ -343,21 +247,16 @@ class PosixAclMappingTests(TestCase):
 
         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
         self.assertEquals(posix_acl.acl[3].a_perm, 6)
-        smbd.unlink(tempf)
 
     def test_setposixacl_group_getposixacl(self):
-        random.seed()
         lp = LoadParm()
-        path = os.environ['SELFTEST_PREFIX']
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
         s3conf = s3param.get_context()
         s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
-        smbd.set_simple_acl(tempf, 0670, BA_gid)
-        posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
+        smbd.set_simple_acl(self.tempf, 0670, BA_gid)
+        posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 
         self.assertEquals(posix_acl.count, 5)
 
@@ -376,22 +275,16 @@ class PosixAclMappingTests(TestCase):
 
         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_MASK)
         self.assertEquals(posix_acl.acl[4].a_perm, 6)
-        smbd.unlink(tempf)
 
     def test_setntacl_sysvol_check_getposixacl(self):
-        random.seed()
         lp = LoadParm()
         s3conf = s3param.get_context()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = provision.SYSVOL_ACL
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
         domsid = passdb.get_global_sam_sid()
-        setntacl(lp,tempf,acl,str(domsid), use_ntvfs=False)
-        facl = getntacl(lp,tempf)
+        setntacl(lp, self.tempf,acl,str(domsid), use_ntvfs=False)
+        facl = getntacl(lp, self.tempf)
         self.assertEquals(facl.as_sddl(domsid),acl)
-        posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
+        posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 
         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
@@ -502,22 +395,17 @@ class PosixAclMappingTests(TestCase):
 
 #
 
-        smbd.unlink(tempf)
 
     def test_setntacl_policies_check_getposixacl(self):
-        random.seed()
         lp = LoadParm()
         s3conf = s3param.get_context()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = provision.POLICIES_ACL
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
+
         domsid = passdb.get_global_sam_sid()
-        setntacl(lp,tempf,acl,str(domsid), use_ntvfs=False)
-        facl = getntacl(lp,tempf)
+        setntacl(lp, self.tempf,acl,str(domsid), use_ntvfs=False)
+        facl = getntacl(lp, self.tempf)
         self.assertEquals(facl.as_sddl(domsid),acl)
-        posix_acl = smbd.get_sys_acl(tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
+        posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 
         LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
@@ -640,9 +528,13 @@ class PosixAclMappingTests(TestCase):
 
 #
 
-        smbd.unlink(tempf)
-
     def setUp(self):
         super(PosixAclMappingTests, self).setUp()
         s3conf = s3param.get_context()
         s3conf.load(self.get_loadparm().configfile)
+        self.tempf = os.path.join(self.tempdir, "test")
+        open(self.tempf, 'w').write("empty")
+
+    def tearDown(self):
+        smbd.unlink(self.tempf)
+        super(PosixAclMappingTests, self).tearDown()
-- 
1.7.11.7


From a41aad222eb613d3469e500fcc7f85dcbe8fd6a3 Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Fri, 26 Oct 2012 15:58:06 -0800
Subject: [PATCH 23/42] TestCaseInTempDir: Use addCleanup rather than
 tearDown.

---
 source4/scripting/python/samba/tests/__init__.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/source4/scripting/python/samba/tests/__init__.py b/source4/scripting/python/samba/tests/__init__.py
index b13bcab..2df30a6 100644
--- a/source4/scripting/python/samba/tests/__init__.py
+++ b/source4/scripting/python/samba/tests/__init__.py
@@ -76,11 +76,12 @@ class TestCaseInTempDir(TestCase):
     def setUp(self):
         super(TestCaseInTempDir, self).setUp()
         self.tempdir = tempfile.mkdtemp()
+        self.addCleanup(self._remove_tempdir)
 
-    def tearDown(self):
-        super(TestCaseInTempDir, self).tearDown()
+    def _remove_tempdir(self):
         self.assertEquals([], os.listdir(self.tempdir))
         os.rmdir(self.tempdir)
+        self.tempdir = None
 
 
 def env_loadparm():
-- 
1.7.11.7


From 07b599389a9184c219d05dc04ce4a2cd52e1cd72 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Thu, 1 Nov 2012 09:51:28 +1100
Subject: [PATCH 24/42] vfs_acl_common: In
 add_directory_inheritable_components allocate on psd
 as parent

When we add a new DACL to the security descriptor, we need to use the
SD as the memory context, so we can talloc_move() it as a tree to a
new parent.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Nov  2 22:16:14 CET 2012 on sn-devel-104
---
 source3/modules/vfs_acl_common.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/source3/modules/vfs_acl_common.c b/source3/modules/vfs_acl_common.c
index ef2dda1..59ced29 100644
--- a/source3/modules/vfs_acl_common.c
+++ b/source3/modules/vfs_acl_common.c
@@ -195,9 +195,21 @@ static NTSTATUS add_directory_inheritable_components(vfs_handle_struct *handle,
 	mode_t dir_mode;
 	mode_t file_mode;
 	mode_t mode;
-	struct security_ace *new_ace_list = talloc_zero_array(talloc_tos(),
-						struct security_ace,
-						num_aces + 3);
+	struct security_ace *new_ace_list;
+
+	if (psd->dacl) {
+		new_ace_list = talloc_zero_array(psd->dacl,
+						 struct security_ace,
+						 num_aces + 3);
+	} else {
+		/*
+		 * make_sec_acl() at the bottom of this function
+		 * dupliates new_ace_list
+		 */
+		new_ace_list = talloc_zero_array(talloc_tos(),
+						 struct security_ace,
+						 num_aces + 3);
+	}
 
 	if (new_ace_list == NULL) {
 		return NT_STATUS_NO_MEMORY;
@@ -256,7 +268,7 @@ static NTSTATUS add_directory_inheritable_components(vfs_handle_struct *handle,
 		psd->dacl->aces = new_ace_list;
 		psd->dacl->num_aces += 3;
 	} else {
-		psd->dacl = make_sec_acl(talloc_tos(),
+		psd->dacl = make_sec_acl(psd,
 				NT4_ACL_REVISION,
 				3,
 				new_ace_list);
-- 
1.7.11.7


From dedafd24ebb17d4f686109e07e13ef61d771d28a Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 5 Nov 2012 12:57:17 +1100
Subject: [PATCH 25/42] selftest: check that samba-tool gpo works for basic
 operations

Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 selftest/target/Samba4.pm                          |  2 +-
 .../scripting/python/samba/tests/samba_tool/gpo.py | 57 ++++++++++++++++++++++
 source4/selftest/tests.py                          |  7 +++
 3 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 source4/scripting/python/samba/tests/samba_tool/gpo.py

diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index fbc8117..20114c9 100644
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -799,7 +799,7 @@ sub provision($$$$$$$$$)
 
 [sysvol]
 	path = $ctx->{statedir}/sysvol
-	read only = yes
+	read only = no
 
 [netlogon]
 	path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
diff --git a/source4/scripting/python/samba/tests/samba_tool/gpo.py b/source4/scripting/python/samba/tests/samba_tool/gpo.py
new file mode 100644
index 0000000..84154f5
--- /dev/null
+++ b/source4/scripting/python/samba/tests/samba_tool/gpo.py
@@ -0,0 +1,57 @@
+# Unix SMB/CIFS implementation.
+# Copyright (C) Andrew Bartlett 2012
+#
+# based on time.py:
+# Copyright (C) Sean Dague <sdague@linux.vnet.ibm.com> 2011
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import os
+from samba.tests.samba_tool.base import SambaToolCmdTest
+
+class GpoCmdTestCase(SambaToolCmdTest):
+    """Tests for samba-tool time subcommands"""
+
+    gpo_name = "testgpo"
+
+    def test_gpo_list(self):
+        """Run gpo list against the server and make sure it looks accurate"""
+        (result, out, err) = self.runsubcmd("gpo", "listall", "-H", "ldap://%s" % os.environ["SERVER"])
+        self.assertCmdSuccess(result, "Ensuring gpo listall ran successfully")
+
+    def test_fetchfail(self):
+        """Run against a non-existent GPO, and make sure it fails (this hard-coded UUID is very unlikely to exist"""
+        (result, out, err) = self.runsubcmd("gpo", "fetch", "c25cac17-a02a-4151-835d-fae17446ee43", "-H", "ldap://%s" %
+os.environ["SERVER"])
+        self.assertEquals(result, -1, "check for result code")
+
+    def test_fetch(self):
+        """Run against a real GPO, and make sure it passes"""
+        (result, out, err) = self.runsubcmd("gpo", "fetch", self.gpo_guid, "-H", "ldap://%s" % os.environ["SERVER"], "--tmpdir", os.environ['SELFTEST_PREFIX'])
+        self.assertCmdSuccess(result, "Ensuring gpo fetched successfully")
+
+    def setUp(self):
+        """set up a temporary GPO to work with"""
+        super(GpoCmdTestCase, self).setUp()
+        (result, out, err) = self.runsubcmd("gpo", "create", self.gpo_name, "-H", "ldap://%s" % os.environ["SERVER"], "-U%s%%%s" % (os.environ["USERNAME"], os.environ["PASSWORD"]))
+        self.gpo_guid = "{%s}" % out.split("{")[1].split("}")[0]
+
+        self.assertCmdSuccess(result, "Ensuring gpo created successfully")
+
+    def tearDown(self):
+        """remove the temporary GPO to work with"""
+        (result, out, err) = self.runsubcmd("gpo", "del", self.gpo_guid, "-H", "ldap://%s" % os.environ["SERVER"], "-U%s%%%s" % (os.environ["USERNAME"], os.environ["PASSWORD"]))
+        self.assertCmdSuccess(result, "Ensuring gpo deleted successfully")
+        super(GpoCmdTestCase, self).tearDown()
diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index ea09071..2173807 100755
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -405,6 +405,13 @@ planpythontestsuite("dc:local", "samba.tests.dcerpc.bare")
 planpythontestsuite("dc:local", "samba.tests.dcerpc.unix")
 planpythontestsuite("dc:local", "samba.tests.dcerpc.srvsvc")
 planpythontestsuite("dc:local", "samba.tests.samba_tool.timecmd")
+
+# We run this test against both AD DC implemetnations because it is
+# the only test we have of GPO get/set behaviour, and this involves
+# the file server as well as the LDAP server.
+planpythontestsuite("dc:local", "samba.tests.samba_tool.gpo")
+planpythontestsuite("plugin_s4_dc:local", "samba.tests.samba_tool.gpo")
+
 planpythontestsuite("dc:local", "samba.tests.samba_tool.user")
 planpythontestsuite("dc:local", "samba.tests.samba_tool.group")
 planpythontestsuite("plugin_s4_dc:local", "samba.tests.samba_tool.ntacl")
-- 
1.7.11.7


From 6cdc28ff3273a9c8dc54e1e7a32615c124012498 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 5 Nov 2012 15:22:02 +1100
Subject: [PATCH 26/42] provision: Also walk directories checking ACLs

The directory walk was missed due to a cut-and-paste error.

Andrew Bartlett

Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
---
 source4/scripting/python/samba/provision/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source4/scripting/python/samba/provision/__init__.py b/source4/scripting/python/samba/provision/__init__.py
index 0ee621e..e2bb1b9 100644
--- a/source4/scripting/python/samba/provision/__init__.py
+++ b/source4/scripting/python/samba/provision/__init__.py
@@ -1493,7 +1493,7 @@ def check_dir_acl(path, acl, lp, domainsid, direct_db_access):
             if fsacl_sddl != acl:
                 raise ProvisioningError('%s ACL on GPO file %s %s does not match expected value %s from GPO object' % (acl_type(direct_db_access), os.path.join(root, name), fsacl_sddl, acl))
 
-        for name in files:
+        for name in dirs:
             fsacl = getntacl(lp, os.path.join(root, name), direct_db_access=direct_db_access)
             if fsacl is None:
                 raise ProvisioningError('%s ACL on GPO directory %s %s not found!' % (acl_type(direct_db_access), os.path.join(root, name)))
-- 
1.7.11.7


From 65756a64ce22f6460988f8a7e27fcd298e645546 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 5 Nov 2012 20:44:14 +1100
Subject: [PATCH 27/42] provision: Make dsacl2fsacl() take a security.dom_sid,
 not str

Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Nov  6 00:12:43 CET 2012 on sn-devel-104
---
 source4/scripting/python/samba/netcmd/gpo.py         | 4 ++--
 source4/scripting/python/samba/ntacls.py             | 3 +--
 source4/scripting/python/samba/provision/__init__.py | 4 ++--
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/source4/scripting/python/samba/netcmd/gpo.py b/source4/scripting/python/samba/netcmd/gpo.py
index 53bfcaa..347231b 100644
--- a/source4/scripting/python/samba/netcmd/gpo.py
+++ b/source4/scripting/python/samba/netcmd/gpo.py
@@ -975,9 +975,9 @@ class cmd_create(Command):
             ds_sd = ndr_unpack(security.descriptor, ds_sd_ndr).as_sddl()
 
             # Create a file system security descriptor
-            domain_sid = self.samdb.get_domain_sid()
+            domain_sid = security.dom_sid(self.samdb.get_domain_sid())
             sddl = dsacl2fsacl(ds_sd, domain_sid)
-            fs_sd = security.descriptor.from_sddl(sddl, security.dom_sid(domain_sid))
+            fs_sd = security.descriptor.from_sddl(sddl, domain_sid)
 
             # Set ACL
             sio = ( security.SECINFO_OWNER |
diff --git a/source4/scripting/python/samba/ntacls.py b/source4/scripting/python/samba/ntacls.py
index f304047..89d450a 100644
--- a/source4/scripting/python/samba/ntacls.py
+++ b/source4/scripting/python/samba/ntacls.py
@@ -198,14 +198,13 @@ def ldapmask2filemask(ldm):
     return filemask
 
 
-def dsacl2fsacl(dssddl, domsid):
+def dsacl2fsacl(dssddl, sid):
     """
 
     This function takes an the SDDL representation of a DS
     ACL and return the SDDL representation of this ACL adapted
     for files. It's used for Policy object provision
     """
-    sid = security.dom_sid(domsid)
     ref = security.descriptor.from_sddl(dssddl, sid)
     fdescr = security.descriptor()
     fdescr.owner_sid = ref.owner_sid
diff --git a/source4/scripting/python/samba/provision/__init__.py b/source4/scripting/python/samba/provision/__init__.py
index e2bb1b9..10afda0 100644
--- a/source4/scripting/python/samba/provision/__init__.py
+++ b/source4/scripting/python/samba/provision/__init__.py
@@ -1404,7 +1404,7 @@ def set_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp, use_ntvfs, p
         acl = ndr_unpack(security.descriptor,
                          str(policy["nTSecurityDescriptor"])).as_sddl()
         policy_path = getpolicypath(sysvol, dnsdomain, str(policy["cn"]))
-        set_dir_acl(policy_path, dsacl2fsacl(acl, str(domainsid)), lp,
+        set_dir_acl(policy_path, dsacl2fsacl(acl, domainsid), lp,
                     str(domainsid), use_ntvfs,
                     passdb=passdb)
 
@@ -1531,7 +1531,7 @@ def check_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp,
         acl = ndr_unpack(security.descriptor,
                          str(policy["nTSecurityDescriptor"])).as_sddl()
         policy_path = getpolicypath(sysvol, dnsdomain, str(policy["cn"]))
-        check_dir_acl(policy_path, dsacl2fsacl(acl, str(domainsid)), lp,
+        check_dir_acl(policy_path, dsacl2fsacl(acl, domainsid), lp,
                       domainsid, direct_db_access)
 
 
-- 
1.7.11.7


From a147660a556a0264db11d07e0ec7a7c7ce571873 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sun, 11 Nov 2012 11:35:02 +1100
Subject: [PATCH 28/42] samba-tool: Rework ldap attribute fetch in
 classicupgrade for missing attributes

Is is not required that these additional attributes be filled in, so
catch KeyError in both the nsswitch and ldap backend case.

We rework get_posix_attr_from_ldap_backend() so it raises KeyError
rather than trying to return None, and does not ignore other errors.

Andrew Bartlett

Tested-by: Chirana Gheorghita Eugeniu Theodor <office@adaptcom.ro>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
---
 source4/scripting/python/samba/upgrade.py | 41 ++++++++++++++++++-------------
 1 file changed, 24 insertions(+), 17 deletions(-)

diff --git a/source4/scripting/python/samba/upgrade.py b/source4/scripting/python/samba/upgrade.py
index 786bb65..13d33c1 100644
--- a/source4/scripting/python/samba/upgrade.py
+++ b/source4/scripting/python/samba/upgrade.py
@@ -539,13 +539,14 @@ def get_posix_attr_from_ldap_backend(logger, ldb_object, base_dn, user, attr):
                         expression=("(&(objectClass=posixAccount)(uid=%s))"
                         % (user)), attrs=[attr])
     except ldb.LdbError, e:
-        logger.warning("Failed to retrieve attribute %s for user %s, the error is: %s", attr, user, e)
+        raise ProvisioningError("Failed to retrieve attribute %s for user %s, the error is: %s", attr, user, e)
     else:
-        if msg.count == 1:
+        if msg.count <= 1:
+            # This will raise KeyError (which is what we want) if there isn't a entry for this user
             return msg[0][attr][0]
         else:
             logger.warning("LDAP entry for user %s contains more than one %s", user, attr)
-            return None
+            raise KeyError
 
 
 def upgrade_from_samba3(samba3, logger, targetdir, session_info=None,
@@ -794,23 +795,29 @@ Please fix this account before attempting to upgrade again
     for entry in userlist:
         username = entry['account_name']
         if username in uids.keys():
-            if ldap:
-                homes[username] = get_posix_attr_from_ldap_backend(logger, ldb_object, base_dn, username, "homeDirectory")
-                shells[username] = get_posix_attr_from_ldap_backend(logger, ldb_object, base_dn, username, "loginShell")
-                pgids[username] = get_posix_attr_from_ldap_backend(logger, ldb_object, base_dn, username, "gidNumber")
-            else:
-                try:
+            try:
+                if ldap:
+                    homes[username] = get_posix_attr_from_ldap_backend(logger, ldb_object, base_dn, username, "homeDirectory")
+                else:
                     homes[username] = pwd.getpwnam(username).pw_dir
-                except KeyError:
-                    pass
-                try:
+            except KeyError:
+                pass
+
+            try:
+                if ldap:
+                    shells[username] = get_posix_attr_from_ldap_backend(logger, ldb_object, base_dn, username, "loginShell")
+                else:
                     shells[username] = pwd.getpwnam(username).pw_shell
-                except KeyError:
-                    pass
-                try:
+            except KeyError:
+                pass
+
+            try:
+                if ldap:
+                    pgids[username] = get_posix_attr_from_ldap_backend(logger, ldb_object, base_dn, username, "gidNumber")
+                else:
                     pgids[username] = pwd.getpwnam(username).pw_gid
-                except KeyError:
-                    pass
+            except KeyError:
+                pass
 
     logger.info("Reading WINS database")
     samba3_winsdb = None
-- 
1.7.11.7


From 9c14d375f1a80fee24a5a608f8dd8f92e15ceafb Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sun, 11 Nov 2012 14:01:44 +1100
Subject: [PATCH 29/42] selftest: Make samba.tests.ntacl also use
 TestCaseInTempDir

This follows on from the successful conversion of samba.tests.posixacl.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---
 source4/scripting/python/samba/tests/ntacls.py | 68 ++++++++++++--------------
 1 file changed, 31 insertions(+), 37 deletions(-)

diff --git a/source4/scripting/python/samba/tests/ntacls.py b/source4/scripting/python/samba/tests/ntacls.py
index 8cdf613..aa9ef68 100644
--- a/source4/scripting/python/samba/tests/ntacls.py
+++ b/source4/scripting/python/samba/tests/ntacls.py
@@ -1,5 +1,6 @@
 # Unix SMB/CIFS implementation. Tests for ntacls manipulation
 # Copyright (C) Matthieu Patou <mat@matws.net> 2009-2010
+# Copyright (C) Andrew Bartlett 2012
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -20,70 +21,63 @@
 from samba.ntacls import setntacl, getntacl, XattrBackendError
 from samba.dcerpc import xattr, security
 from samba.param import LoadParm
-from samba.tests import TestCase, TestSkipped
+from samba.tests import TestCaseInTempDir, TestSkipped
 import random
 import os
 
-class NtaclsTests(TestCase):
+class NtaclsTests(TestCaseInTempDir):
 
     def test_setntacl(self):
-        random.seed()
         lp = LoadParm()
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        lp.set("posix:eadb",os.path.join(path,"eadbtest.tdb"))
-        setntacl(lp, tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467")
-        os.unlink(tempf)
+        open(self.tempf, 'w').write("empty")
+        lp.set("posix:eadb",os.path.join(self.tempdir,"eadbtest.tdb"))
+        setntacl(lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467")
+        os.unlink(os.path.join(self.tempdir,"eadbtest.tdb"))
 
     def test_setntacl_getntacl(self):
-        random.seed()
         lp = LoadParm()
-        path = None
-        path = os.environ['SELFTEST_PREFIX']
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        lp.set("posix:eadb",os.path.join(path,"eadbtest.tdb"))
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467")
-        facl = getntacl(lp,tempf)
+        open(self.tempf, 'w').write("empty")
+        lp.set("posix:eadb",os.path.join(self.tempdir,"eadbtest.tdb"))
+        setntacl(lp,self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467")
+        facl = getntacl(lp,self.tempf)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
-        os.unlink(tempf)
+        os.unlink(os.path.join(self.tempdir,"eadbtest.tdb"))
 
     def test_setntacl_getntacl_param(self):
-        random.seed()
         lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        path = os.environ['SELFTEST_PREFIX']
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        setntacl(lp,tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467","tdb",os.path.join(path,"eadbtest.tdb"))
-        facl=getntacl(lp,tempf,"tdb",os.path.join(path,"eadbtest.tdb"))
+        open(self.tempf, 'w').write("empty")
+        setntacl(lp,self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467","tdb",os.path.join(self.tempdir,"eadbtest.tdb"))
+        facl=getntacl(lp,self.tempf,"tdb",os.path.join(self.tempdir,"eadbtest.tdb"))
         domsid=security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(domsid),acl)
-        os.unlink(tempf)
+        os.unlink(os.path.join(self.tempdir,"eadbtest.tdb"))
 
     def test_setntacl_invalidbackend(self):
-        random.seed()
         lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        path = os.environ['SELFTEST_PREFIX']
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        self.assertRaises(XattrBackendError, setntacl, lp, tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467","ttdb", os.path.join(path,"eadbtest.tdb"))
+        open(self.tempf, 'w').write("empty")
+        self.assertRaises(XattrBackendError, setntacl, lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467","ttdb", os.path.join(self.tempdir,"eadbtest.tdb"))
 
     def test_setntacl_forcenative(self):
         if os.getuid() == 0:
             raise TestSkipped("Running test as root, test skipped")
-        random.seed()
         lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        path = os.environ['SELFTEST_PREFIX']
-        tempf = os.path.join(path,"pytests"+str(int(100000*random.random())))
-        open(tempf, 'w').write("empty")
-        lp.set("posix:eadb", os.path.join(path,"eadbtest.tdb"))
-        self.assertRaises(Exception, setntacl, lp, tempf ,acl,
+        open(self.tempf, 'w').write("empty")
+        lp.set("posix:eadb", os.path.join(self.tempdir,"eadbtest.tdb"))
+        self.assertRaises(Exception, setntacl, lp, self.tempf ,acl,
             "S-1-5-21-2212615479-2695158682-2101375467","native")
-        os.unlink(tempf)
+
+
+    def setUp(self):
+        super(NtaclsTests, self).setUp()
+        self.tempf = os.path.join(self.tempdir, "test")
+        open(self.tempf, 'w').write("empty")
+
+    def tearDown(self):
+        os.unlink(self.tempf)
+        super(NtaclsTests, self).tearDown()
-- 
1.7.11.7


From 683b230fddb8b84f7731949ddacc87e1347d85a4 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sun, 11 Nov 2012 22:07:49 +1100
Subject: [PATCH 30/42] pysmbd: Add SMB_ACL_EXECUTE to the mask set by
 make_simple_acl()

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Jelmer Vernooij <jelmer@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---
 source3/smbd/pysmbd.c                            | 2 +-
 source4/scripting/python/samba/tests/posixacl.py | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/source3/smbd/pysmbd.c b/source3/smbd/pysmbd.c
index 0c8e859..1489355 100644
--- a/source3/smbd/pysmbd.c
+++ b/source3/smbd/pysmbd.c
@@ -178,7 +178,7 @@ static SMB_ACL_T make_simple_acl(gid_t gid, mode_t chmod_mode)
 {
 	TALLOC_CTX *frame = talloc_stackframe();
 
-	mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE;
+	mode_t mode = SMB_ACL_READ|SMB_ACL_WRITE|SMB_ACL_EXECUTE;
 
 	mode_t mode_user = (chmod_mode & 0700) >> 6;
 	mode_t mode_group = (chmod_mode & 070) >> 3;
diff --git a/source4/scripting/python/samba/tests/posixacl.py b/source4/scripting/python/samba/tests/posixacl.py
index 5e10f8d..50518f0 100644
--- a/source4/scripting/python/samba/tests/posixacl.py
+++ b/source4/scripting/python/samba/tests/posixacl.py
@@ -246,7 +246,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
         self.assertEquals(posix_acl.acl[2].a_perm, 0)
 
         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
-        self.assertEquals(posix_acl.acl[3].a_perm, 6)
+        self.assertEquals(posix_acl.acl[3].a_perm, 7)
 
     def test_setposixacl_group_getposixacl(self):
         lp = LoadParm()
@@ -274,7 +274,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
         self.assertEquals(posix_acl.acl[3].info.gid, BA_gid)
 
         self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_MASK)
-        self.assertEquals(posix_acl.acl[4].a_perm, 6)
+        self.assertEquals(posix_acl.acl[4].a_perm, 7)
 
     def test_setntacl_sysvol_check_getposixacl(self):
         lp = LoadParm()
-- 
1.7.11.7


From dac0e4479055bda72fc162844471665025c84875 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Sun, 11 Nov 2012 21:33:41 +1100
Subject: [PATCH 31/42] selftest: Add tests for expected behaviour on
 directories as well as files

This is important because it covers the codepath which had the talloc
error fixed by commit 60cf4cb5a630506747431ecbf00d890509baf2f3
(vfs_acl_common: In add_directory_inheritable_components allocate on
psd as parent)

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sun Nov 11 15:48:10 CET 2012 on sn-devel-104
---
 source4/scripting/python/samba/tests/posixacl.py | 197 +++++++++++++++++++++++
 1 file changed, 197 insertions(+)

diff --git a/source4/scripting/python/samba/tests/posixacl.py b/source4/scripting/python/samba/tests/posixacl.py
index 50518f0..9df904b 100644
--- a/source4/scripting/python/samba/tests/posixacl.py
+++ b/source4/scripting/python/samba/tests/posixacl.py
@@ -214,6 +214,18 @@ class PosixAclMappingTests(TestCaseInTempDir):
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
 
+    def test_setposixacl_dir_getntacl_smbd(self):
+        lp = LoadParm()
+        s3conf = s3param.get_context()
+        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        user_SID = s4_passdb.uid_to_sid(os.stat(self.tempdir).st_uid)
+        smbd.set_simple_acl(self.tempdir, 0750)
+        facl = getntacl(lp, self.tempdir, direct_db_access=False)
+        acl = "O:%sG:BAD:(A;;0x001f01ff;;;%s)(A;;0x001200a9;;;BA)(A;;WO;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001f01ff;;;CG)(A;OICIIO;0x001f01ff;;;WD)" % (user_SID, user_SID)
+
+        anysid = security.dom_sid(security.SID_NT_SELF)
+        self.assertEquals(acl, facl.as_sddl(anysid))
+
     def test_setposixacl_group_getntacl_smbd(self):
         lp = LoadParm()
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
@@ -248,6 +260,24 @@ class PosixAclMappingTests(TestCaseInTempDir):
         self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 
+    def test_setposixacl_dir_getposixacl(self):
+        lp = LoadParm()
+        smbd.set_simple_acl(self.tempdir, 0750)
+        posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
+        self.assertEquals(posix_acl.count, 4)
+
+        self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_USER_OBJ)
+        self.assertEquals(posix_acl.acl[0].a_perm, 7)
+
+        self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+        self.assertEquals(posix_acl.acl[1].a_perm, 5)
+
+        self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
+        self.assertEquals(posix_acl.acl[2].a_perm, 0)
+
+        self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_MASK)
+        self.assertEquals(posix_acl.acl[3].a_perm, 7)
+
     def test_setposixacl_group_getposixacl(self):
         lp = LoadParm()
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
@@ -396,6 +426,173 @@ class PosixAclMappingTests(TestCaseInTempDir):
 #
 
 
+    def test_setntacl_sysvol_dir_check_getposixacl(self):
+        lp = LoadParm()
+        s3conf = s3param.get_context()
+        acl = provision.SYSVOL_ACL
+        domsid = passdb.get_global_sam_sid()
+        setntacl(lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
+        facl = getntacl(lp, self.tempdir)
+        self.assertEquals(facl.as_sddl(domsid),acl)
+        posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
+
+        LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
+        BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
+        SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
+        SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
+        AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
+
+        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+
+        # These assertions correct for current plugin_s4_dc selftest
+        # configuration.  When other environments have a broad range of
+        # groups mapped via passdb, we can relax some of these checks
+        (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
+        self.assertEquals(LA_type, idmap.ID_TYPE_UID)
+        (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
+        self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
+        (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
+        self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
+        (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
+        self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
+        (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
+        self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
+
+        self.assertEquals(posix_acl.count, 9)
+
+        self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[0].a_perm, 7)
+        self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
+
+        self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
+        self.assertEquals(posix_acl.acl[1].a_perm, 7)
+        self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
+
+        self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
+        self.assertEquals(posix_acl.acl[2].a_perm, 0)
+
+        self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
+        self.assertEquals(posix_acl.acl[3].a_perm, 7)
+
+        self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+        self.assertEquals(posix_acl.acl[4].a_perm, 7)
+
+        self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[5].a_perm, 5)
+        self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
+
+        self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[6].a_perm, 7)
+        self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
+
+        self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[7].a_perm, 5)
+        self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
+
+        self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_MASK)
+        self.assertEquals(posix_acl.acl[8].a_perm, 7)
+
+
+# check that it matches:
+# user::rwx
+# user:root:rwx (selftest user actually)
+# group::rwx
+# group:3000000:rwx
+# group:3000001:r-x
+# group:3000002:rwx
+# group:3000003:r-x
+# mask::rwx
+# other::---
+
+
+    def test_setntacl_policies_dir_check_getposixacl(self):
+        lp = LoadParm()
+        s3conf = s3param.get_context()
+        acl = provision.POLICIES_ACL
+        domsid = passdb.get_global_sam_sid()
+        setntacl(lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
+        facl = getntacl(lp, self.tempdir)
+        self.assertEquals(facl.as_sddl(domsid),acl)
+        posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
+
+        LA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_ADMINISTRATOR))
+        BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
+        SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
+        SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
+        AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
+        PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
+
+        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+
+        # These assertions correct for current plugin_s4_dc selftest
+        # configuration.  When other environments have a broad range of
+        # groups mapped via passdb, we can relax some of these checks
+        (LA_uid,LA_type) = s4_passdb.sid_to_id(LA_sid)
+        self.assertEquals(LA_type, idmap.ID_TYPE_UID)
+        (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
+        self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
+        (SO_gid,SO_type) = s4_passdb.sid_to_id(SO_sid)
+        self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
+        (SY_gid,SY_type) = s4_passdb.sid_to_id(SY_sid)
+        self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
+        (AU_gid,AU_type) = s4_passdb.sid_to_id(AU_sid)
+        self.assertEquals(AU_type, idmap.ID_TYPE_BOTH)
+        (PA_gid,PA_type) = s4_passdb.sid_to_id(PA_sid)
+        self.assertEquals(PA_type, idmap.ID_TYPE_BOTH)
+
+        self.assertEquals(posix_acl.count, 10)
+
+        self.assertEquals(posix_acl.acl[0].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[0].a_perm, 7)
+        self.assertEquals(posix_acl.acl[0].info.gid, BA_gid)
+
+        self.assertEquals(posix_acl.acl[1].a_type, smb_acl.SMB_ACL_USER)
+        self.assertEquals(posix_acl.acl[1].a_perm, 7)
+        self.assertEquals(posix_acl.acl[1].info.uid, LA_uid)
+
+        self.assertEquals(posix_acl.acl[2].a_type, smb_acl.SMB_ACL_OTHER)
+        self.assertEquals(posix_acl.acl[2].a_perm, 0)
+
+        self.assertEquals(posix_acl.acl[3].a_type, smb_acl.SMB_ACL_USER_OBJ)
+        self.assertEquals(posix_acl.acl[3].a_perm, 7)
+
+        self.assertEquals(posix_acl.acl[4].a_type, smb_acl.SMB_ACL_GROUP_OBJ)
+        self.assertEquals(posix_acl.acl[4].a_perm, 7)
+
+        self.assertEquals(posix_acl.acl[5].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[5].a_perm, 5)
+        self.assertEquals(posix_acl.acl[5].info.gid, SO_gid)
+
+        self.assertEquals(posix_acl.acl[6].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[6].a_perm, 7)
+        self.assertEquals(posix_acl.acl[6].info.gid, SY_gid)
+
+        self.assertEquals(posix_acl.acl[7].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[7].a_perm, 5)
+        self.assertEquals(posix_acl.acl[7].info.gid, AU_gid)
+
+        self.assertEquals(posix_acl.acl[8].a_type, smb_acl.SMB_ACL_GROUP)
+        self.assertEquals(posix_acl.acl[8].a_perm, 7)
+        self.assertEquals(posix_acl.acl[8].info.gid, PA_gid)
+
+        self.assertEquals(posix_acl.acl[9].a_type, smb_acl.SMB_ACL_MASK)
+        self.assertEquals(posix_acl.acl[9].a_perm, 7)
+
+
+# check that it matches:
+# user::rwx
+# user:root:rwx  (selftest user actually)
+# group::rwx
+# group:3000000:rwx
+# group:3000001:r-x
+# group:3000002:rwx
+# group:3000003:r-x
+# group:3000004:rwx
+# mask::rwx
+# other::---
+
+
+
     def test_setntacl_policies_check_getposixacl(self):
         lp = LoadParm()
         s3conf = s3param.get_context()
-- 
1.7.11.7


From 4bc0ffc4044af46ae3fb270913a2231a7bacfed6 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 12 Nov 2012 07:53:40 +1100
Subject: [PATCH 32/42] selftest: Avoid test cross-contamination in
 samba.tests.posixacl

This creates a new xattr.tdb per unit test, which avoids once and for all
the issue of dev/inode reuse.

For test_setposixacl_dir_getntacl_smbd the file ownership also set specifically.

Andrew Bartlett

Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
---
 source4/scripting/python/samba/tests/posixacl.py | 140 ++++++++++-------------
 1 file changed, 59 insertions(+), 81 deletions(-)

diff --git a/source4/scripting/python/samba/tests/posixacl.py b/source4/scripting/python/samba/tests/posixacl.py
index 9df904b..f949ab4 100644
--- a/source4/scripting/python/samba/tests/posixacl.py
+++ b/source4/scripting/python/samba/tests/posixacl.py
@@ -38,143 +38,129 @@ from samba.samba3 import param as s3param
 class PosixAclMappingTests(TestCaseInTempDir):
 
     def test_setntacl(self):
-        lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        setntacl(lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 
     def test_setntacl_smbd_getntacl(self):
-        lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        setntacl(lp,self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
-        facl = getntacl(lp,self.tempf, direct_db_access=True)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+        facl = getntacl(self.lp, self.tempf, direct_db_access=True)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
 
     def test_setntacl_smbd_setposixacl_getntacl(self):
-        lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        setntacl(lp,self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
 
         # This will invalidate the ACL, as we have a hook!
         smbd.set_simple_acl(self.tempf, 0640)
 
         # However, this only asks the xattr
         try:
-            facl = getntacl(lp, self.tempf, direct_db_access=True)
+            facl = getntacl(self.lp, self.tempf, direct_db_access=True)
             self.assertTrue(False)
         except TypeError:
             pass
 
     def test_setntacl_invalidate_getntacl(self):
-        lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
 
         # This should invalidate the ACL, as we include the posix ACL in the hash
-        (backend_obj, dbname) = checkset_backend(lp, None, None)
+        (backend_obj, dbname) = checkset_backend(self.lp, None, None)
         backend_obj.wrap_setxattr(dbname,
                                   self.tempf, "system.fake_access_acl", "")
 
         #however, as this is direct DB access, we do not notice it
-        facl = getntacl(lp, self.tempf, direct_db_access=True)
+        facl = getntacl(self.lp, self.tempf, direct_db_access=True)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
 
     def test_setntacl_invalidate_getntacl_smbd(self):
-        lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 
         # This should invalidate the ACL, as we include the posix ACL in the hash
-        (backend_obj, dbname) = checkset_backend(lp, None, None)
+        (backend_obj, dbname) = checkset_backend(self.lp, None, None)
         backend_obj.wrap_setxattr(dbname,
                                   self.tempf, "system.fake_access_acl", "")
 
         #the hash would break, and we return an ACL based only on the mode, except we set the ACL using the 'ntvfs' mode that doesn't include a hash
-        facl = getntacl(lp, self.tempf)
+        facl = getntacl(self.lp, self.tempf)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
 
     def test_setntacl_smbd_invalidate_getntacl_smbd(self):
-        lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x001200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
         os.chmod(self.tempf, 0750)
-        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 
         # This should invalidate the ACL, as we include the posix ACL in the hash
-        (backend_obj, dbname) = checkset_backend(lp, None, None)
+        (backend_obj, dbname) = checkset_backend(self.lp, None, None)
         backend_obj.wrap_setxattr(dbname,
                                   self.tempf, "system.fake_access_acl", "")
 
         #the hash will break, and we return an ACL based only on the mode
-        facl = getntacl(lp, self.tempf, direct_db_access=False)
+        facl = getntacl(self.lp, self.tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 
     def test_setntacl_getntacl_smbd(self):
-        lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
-        facl = getntacl(lp, self.tempf, direct_db_access=False)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=True)
+        facl = getntacl(self.lp, self.tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
 
     def test_setntacl_smbd_getntacl_smbd(self):
-        lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
-        facl = getntacl(lp, self.tempf, direct_db_access=False)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        facl = getntacl(self.lp, self.tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
 
     def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
-        lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
-        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
         smbd.set_simple_acl(self.tempf, 0640)
-        facl = getntacl(lp, self.tempf, direct_db_access=False)
+        facl = getntacl(self.lp, self.tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 
     def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
-        lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
         simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;BA)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
-        setntacl(lp,self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
-        s3conf = s3param.get_context()
-        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
 
         # This should re-calculate an ACL based on the posix details
-        facl = getntacl(lp,self.tempf, direct_db_access=False)
+        facl = getntacl(self.lp,self.tempf, direct_db_access=False)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(simple_acl_from_posix, facl.as_sddl(anysid))
 
     def test_setntacl_smbd_getntacl_smbd_gpo(self):
-        lp = LoadParm()
         acl = "O:DAG:DUD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)S:AI(OU;CIIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)"
-        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
-        facl = getntacl(lp, self.tempf, direct_db_access=False)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        facl = getntacl(self.lp, self.tempf, direct_db_access=False)
         domsid = security.dom_sid("S-1-5-21-2212615479-2695158682-2101375467")
         self.assertEquals(facl.as_sddl(domsid),acl)
 
     def test_setntacl_getposixacl(self):
-        lp = LoadParm()
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        setntacl(lp, self.tempf,acl,"S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
-        facl = getntacl(lp, self.tempf)
+        setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
+        facl = getntacl(self.lp, self.tempf)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(facl.as_sddl(anysid),acl)
         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 
     def test_setposixacl_getposixacl(self):
-        lp = LoadParm()
         smbd.set_simple_acl(self.tempf, 0640)
         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
         self.assertEquals(posix_acl.count, 4)
@@ -192,58 +178,58 @@ class PosixAclMappingTests(TestCaseInTempDir):
         self.assertEquals(posix_acl.acl[3].a_perm, 6)
 
     def test_setposixacl_getntacl(self):
-        lp = LoadParm()
         acl = ""
         smbd.set_simple_acl(self.tempf, 0750)
         try:
-            facl = getntacl(lp, self.tempf)
+            facl = getntacl(self.lp, self.tempf)
             self.assertTrue(False)
         except TypeError:
             # We don't expect the xattr to be filled in in this case
             pass
 
     def test_setposixacl_getntacl_smbd(self):
-        lp = LoadParm()
-        s3conf = s3param.get_context()
-        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
         smbd.set_simple_acl(self.tempf, 0640)
-        facl = getntacl(lp, self.tempf, direct_db_access=False)
+        facl = getntacl(self.lp, self.tempf, direct_db_access=False)
         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
 
     def test_setposixacl_dir_getntacl_smbd(self):
-        lp = LoadParm()
-        s3conf = s3param.get_context()
-        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempdir).st_uid)
+        BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
+        s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
+        (BA_id,BA_type) = s4_passdb.sid_to_id(BA_sid)
+        self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
+        SO_sid = security.dom_sid(security.SID_BUILTIN_SERVER_OPERATORS)
+        (SO_id,SO_type) = s4_passdb.sid_to_id(SO_sid)
+        self.assertEquals(SO_type, idmap.ID_TYPE_BOTH)
+        smbd.chown(self.tempdir, BA_id, SO_id)
         smbd.set_simple_acl(self.tempdir, 0750)
-        facl = getntacl(lp, self.tempdir, direct_db_access=False)
-        acl = "O:%sG:BAD:(A;;0x001f01ff;;;%s)(A;;0x001200a9;;;BA)(A;;WO;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001f01ff;;;CG)(A;OICIIO;0x001f01ff;;;WD)" % (user_SID, user_SID)
+        facl = getntacl(self.lp, self.tempdir, direct_db_access=False)
+        acl = "O:BAG:SOD:(A;;0x001f01ff;;;BA)(A;;0x001200a9;;;SO)(A;;WO;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001f01ff;;;CG)(A;OICIIO;0x001f01ff;;;WD)"
 
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
 
     def test_setposixacl_group_getntacl_smbd(self):
-        lp = LoadParm()
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
-        s3conf = s3param.get_context()
-        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
         group_SID = s4_passdb.gid_to_sid(os.stat(self.tempf).st_gid)
         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
-        facl = getntacl(lp, self.tempf, direct_db_access=False)
+        facl = getntacl(self.lp, self.tempf, direct_db_access=False)
         domsid = passdb.get_global_sam_sid()
         acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
 
     def test_setposixacl_getposixacl(self):
-        lp = LoadParm()
         smbd.set_simple_acl(self.tempf, 0640)
         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
         self.assertEquals(posix_acl.count, 4)
@@ -261,7 +247,6 @@ class PosixAclMappingTests(TestCaseInTempDir):
         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 
     def test_setposixacl_dir_getposixacl(self):
-        lp = LoadParm()
         smbd.set_simple_acl(self.tempdir, 0750)
         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
         self.assertEquals(posix_acl.count, 4)
@@ -279,10 +264,8 @@ class PosixAclMappingTests(TestCaseInTempDir):
         self.assertEquals(posix_acl.acl[3].a_perm, 7)
 
     def test_setposixacl_group_getposixacl(self):
-        lp = LoadParm()
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
-        s3conf = s3param.get_context()
-        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
         (BA_gid,BA_type) = s4_passdb.sid_to_id(BA_sid)
         self.assertEquals(BA_type, idmap.ID_TYPE_BOTH)
         smbd.set_simple_acl(self.tempf, 0670, BA_gid)
@@ -307,12 +290,10 @@ class PosixAclMappingTests(TestCaseInTempDir):
         self.assertEquals(posix_acl.acl[4].a_perm, 7)
 
     def test_setntacl_sysvol_check_getposixacl(self):
-        lp = LoadParm()
-        s3conf = s3param.get_context()
         acl = provision.SYSVOL_ACL
         domsid = passdb.get_global_sam_sid()
-        setntacl(lp, self.tempf,acl,str(domsid), use_ntvfs=False)
-        facl = getntacl(lp, self.tempf)
+        setntacl(self.lp, self.tempf,acl,str(domsid), use_ntvfs=False)
+        facl = getntacl(self.lp, self.tempf)
         self.assertEquals(facl.as_sddl(domsid),acl)
         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 
@@ -322,7 +303,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 
-        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 
         # These assertions correct for current plugin_s4_dc selftest
         # configuration.  When other environments have a broad range of
@@ -427,12 +408,10 @@ class PosixAclMappingTests(TestCaseInTempDir):
 
 
     def test_setntacl_sysvol_dir_check_getposixacl(self):
-        lp = LoadParm()
-        s3conf = s3param.get_context()
         acl = provision.SYSVOL_ACL
         domsid = passdb.get_global_sam_sid()
-        setntacl(lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
-        facl = getntacl(lp, self.tempdir)
+        setntacl(self.lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
+        facl = getntacl(self.lp, self.tempdir)
         self.assertEquals(facl.as_sddl(domsid),acl)
         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 
@@ -442,7 +421,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
         SY_sid = security.dom_sid(security.SID_NT_SYSTEM)
         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
 
-        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 
         # These assertions correct for current plugin_s4_dc selftest
         # configuration.  When other environments have a broad range of
@@ -506,12 +485,10 @@ class PosixAclMappingTests(TestCaseInTempDir):
 
 
     def test_setntacl_policies_dir_check_getposixacl(self):
-        lp = LoadParm()
-        s3conf = s3param.get_context()
         acl = provision.POLICIES_ACL
         domsid = passdb.get_global_sam_sid()
-        setntacl(lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
-        facl = getntacl(lp, self.tempdir)
+        setntacl(self.lp, self.tempdir,acl,str(domsid), use_ntvfs=False)
+        facl = getntacl(self.lp, self.tempdir)
         self.assertEquals(facl.as_sddl(domsid),acl)
         posix_acl = smbd.get_sys_acl(self.tempdir, smb_acl.SMB_ACL_TYPE_ACCESS)
 
@@ -522,7 +499,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 
-        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 
         # These assertions correct for current plugin_s4_dc selftest
         # configuration.  When other environments have a broad range of
@@ -594,13 +571,11 @@ class PosixAclMappingTests(TestCaseInTempDir):
 
 
     def test_setntacl_policies_check_getposixacl(self):
-        lp = LoadParm()
-        s3conf = s3param.get_context()
         acl = provision.POLICIES_ACL
 
         domsid = passdb.get_global_sam_sid()
-        setntacl(lp, self.tempf,acl,str(domsid), use_ntvfs=False)
-        facl = getntacl(lp, self.tempf)
+        setntacl(self.lp, self.tempf, acl, str(domsid), use_ntvfs=False)
+        facl = getntacl(self.lp, self.tempf)
         self.assertEquals(facl.as_sddl(domsid),acl)
         posix_acl = smbd.get_sys_acl(self.tempf, smb_acl.SMB_ACL_TYPE_ACCESS)
 
@@ -611,7 +586,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
         AU_sid = security.dom_sid(security.SID_NT_AUTHENTICATED_USERS)
         PA_sid = security.dom_sid(str(domsid)+"-"+str(security.DOMAIN_RID_POLICY_ADMINS))
 
-        s4_passdb = passdb.PDB(s3conf.get("passdb backend"))
+        s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
 
         # These assertions correct for current plugin_s4_dc selftest
         # configuration.  When other environments have a broad range of
@@ -729,9 +704,12 @@ class PosixAclMappingTests(TestCaseInTempDir):
         super(PosixAclMappingTests, self).setUp()
         s3conf = s3param.get_context()
         s3conf.load(self.get_loadparm().configfile)
+        s3conf.set("xattr_tdb:file", os.path.join(self.tempdir,"xattr.tdb"))
+        self.lp = s3conf
         self.tempf = os.path.join(self.tempdir, "test")
         open(self.tempf, 'w').write("empty")
 
     def tearDown(self):
         smbd.unlink(self.tempf)
+        os.unlink(os.path.join(self.tempdir,"xattr.tdb"))
         super(PosixAclMappingTests, self).tearDown()
-- 
1.7.11.7


From 9a49ca5a889cdfc5baddabaaec4cfc88eb45a1ce Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 12 Nov 2012 21:48:46 +1100
Subject: [PATCH 33/42] selftest: Avoid returning errors (rather than
 failures) in gpo test

This should help find the real cause of the flakey test, if it ever returns.

Andrew Bartlett

Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
---
 source4/scripting/python/samba/tests/samba_tool/gpo.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/source4/scripting/python/samba/tests/samba_tool/gpo.py b/source4/scripting/python/samba/tests/samba_tool/gpo.py
index 84154f5..c2e069d 100644
--- a/source4/scripting/python/samba/tests/samba_tool/gpo.py
+++ b/source4/scripting/python/samba/tests/samba_tool/gpo.py
@@ -46,9 +46,11 @@ os.environ["SERVER"])
         """set up a temporary GPO to work with"""
         super(GpoCmdTestCase, self).setUp()
         (result, out, err) = self.runsubcmd("gpo", "create", self.gpo_name, "-H", "ldap://%s" % os.environ["SERVER"], "-U%s%%%s" % (os.environ["USERNAME"], os.environ["PASSWORD"]))
-        self.gpo_guid = "{%s}" % out.split("{")[1].split("}")[0]
-
         self.assertCmdSuccess(result, "Ensuring gpo created successfully")
+        try:
+            self.gpo_guid = "{%s}" % out.split("{")[1].split("}")[0]
+        except IndexError:
+            self.fail("Failed to find GUID in output: %s" % out)
 
     def tearDown(self):
         """remove the temporary GPO to work with"""
-- 
1.7.11.7


From 09e4b863095edcaf3ed739ba0e34d537a9b9783e Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 13 Nov 2012 13:31:53 +1100
Subject: [PATCH 34/42] selftest: Add --tmpdir to 'samba-tool gpo create' test

This was the cause of the flakey test, and was only noticed when
multiple different users ran autobuild at the same time on the same
server.

We use shutil.rmtree to wipe the directory before the tests finishes
as required by the TestCaseInTempDir class.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Nov 13 10:50:56 CET 2012 on sn-devel-104
---
 source4/scripting/python/samba/tests/samba_tool/base.py |  2 +-
 source4/scripting/python/samba/tests/samba_tool/gpo.py  | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/source4/scripting/python/samba/tests/samba_tool/base.py b/source4/scripting/python/samba/tests/samba_tool/base.py
index 489d6b5..96f0ddc 100644
--- a/source4/scripting/python/samba/tests/samba_tool/base.py
+++ b/source4/scripting/python/samba/tests/samba_tool/base.py
@@ -29,7 +29,7 @@ from cStringIO import StringIO
 from samba.netcmd.main import cmd_sambatool
 import samba.tests
 
-class SambaToolCmdTest(samba.tests.TestCase):
+class SambaToolCmdTest(samba.tests.TestCaseInTempDir):
 
     def getSamDB(self, *argv):
         """a convenience function to get a samdb instance so that we can query it"""
diff --git a/source4/scripting/python/samba/tests/samba_tool/gpo.py b/source4/scripting/python/samba/tests/samba_tool/gpo.py
index c2e069d..7ada91f 100644
--- a/source4/scripting/python/samba/tests/samba_tool/gpo.py
+++ b/source4/scripting/python/samba/tests/samba_tool/gpo.py
@@ -20,6 +20,7 @@
 
 import os
 from samba.tests.samba_tool.base import SambaToolCmdTest
+import shutil
 
 class GpoCmdTestCase(SambaToolCmdTest):
     """Tests for samba-tool time subcommands"""
@@ -39,13 +40,18 @@ os.environ["SERVER"])
 
     def test_fetch(self):
         """Run against a real GPO, and make sure it passes"""
-        (result, out, err) = self.runsubcmd("gpo", "fetch", self.gpo_guid, "-H", "ldap://%s" % os.environ["SERVER"], "--tmpdir", os.environ['SELFTEST_PREFIX'])
+        (result, out, err) = self.runsubcmd("gpo", "fetch", self.gpo_guid, "-H", "ldap://%s" % os.environ["SERVER"], "--tmpdir", self.tempdir)
         self.assertCmdSuccess(result, "Ensuring gpo fetched successfully")
+        shutil.rmtree(os.path.join(self.tempdir, "policy"))
 
     def setUp(self):
         """set up a temporary GPO to work with"""
         super(GpoCmdTestCase, self).setUp()
-        (result, out, err) = self.runsubcmd("gpo", "create", self.gpo_name, "-H", "ldap://%s" % os.environ["SERVER"], "-U%s%%%s" % (os.environ["USERNAME"], os.environ["PASSWORD"]))
+        (result, out, err) = self.runsubcmd("gpo", "create", self.gpo_name,
+                                            "-H", "ldap://%s" % os.environ["SERVER"],
+                                            "-U%s%%%s" % (os.environ["USERNAME"], os.environ["PASSWORD"]),
+                                            "--tmpdir", self.tempdir)
+        shutil.rmtree(os.path.join(self.tempdir, "policy"))
         self.assertCmdSuccess(result, "Ensuring gpo created successfully")
         try:
             self.gpo_guid = "{%s}" % out.split("{")[1].split("}")[0]
-- 
1.7.11.7


From d61e13ac5e89eee3188bb50bf70b82fd9bb452d0 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 13 Nov 2012 12:21:45 -0800
Subject: [PATCH 35/42] Ensure we Correctly set fsp->is_directory before
 dealing with ACLs.

Reviewed by: Jeremy Allison <jra@samba.org>
---
 source3/torture/cmd_vfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source3/torture/cmd_vfs.c b/source3/torture/cmd_vfs.c
index a37c9fc..64b1b50 100644
--- a/source3/torture/cmd_vfs.c
+++ b/source3/torture/cmd_vfs.c
@@ -1524,7 +1524,7 @@ static NTSTATUS cmd_set_nt_acl(struct vfs_state *vfs, TALLOC_CTX *mem_ctx, int a
 	fsp->print_file = NULL;
 	fsp->modified = False;
 	fsp->sent_oplock_break = NO_BREAK_SENT;
-	fsp->is_directory = False;
+	fsp->is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
 
 
 	sd = sddl_decode(talloc_tos(), argv[2], get_global_sam_sid());
-- 
1.7.11.7


From b117cce0eb356890f416c984a3f3451673a56977 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 13 Nov 2012 12:34:35 -0800
Subject: [PATCH 36/42] smbd: Correctly set fsp->is_directory before dealing
 with ACLs

Change set_nt_acl_no_snum() to correctly set up the fsp.
This does a stat on a real fsp in set_nt_acl_no_snum.

Reviewed by: Jeremy Allison <jra@samba.org>
---
 source3/smbd/pysmbd.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/source3/smbd/pysmbd.c b/source3/smbd/pysmbd.c
index 1489355..78c2bcb 100644
--- a/source3/smbd/pysmbd.c
+++ b/source3/smbd/pysmbd.c
@@ -88,7 +88,7 @@ static NTSTATUS set_nt_acl_no_snum(const char *fname,
 	NTSTATUS status = NT_STATUS_OK;
 	files_struct *fsp;
 	struct smb_filename *smb_fname = NULL;
-	int flags;
+	int flags, ret;
 	mode_t saved_umask;
 
 	if (!posix_locking_init(false)) {
@@ -159,6 +159,29 @@ static NTSTATUS set_nt_acl_no_snum(const char *fname,
 		return NT_STATUS_UNSUCCESSFUL;
 	}
 
+	ret = SMB_VFS_FSTAT(fsp, &smb_fname->st);
+	if (ret == -1) {
+		/* If we have an fd, this stat should succeed. */
+		DEBUG(0,("Error doing fstat on open file %s "
+			"(%s)\n",
+			smb_fname_str_dbg(smb_fname),
+			strerror(errno) ));
+		TALLOC_FREE(frame);
+		umask(saved_umask);
+		return map_nt_error_from_unix(errno);
+	}
+
+	fsp->file_id = vfs_file_id_from_sbuf(conn, &smb_fname->st);
+	fsp->vuid = UID_FIELD_INVALID;
+	fsp->file_pid = 0;
+	fsp->can_lock = True;
+	fsp->can_read = True;
+	fsp->can_write = True;
+	fsp->print_file = NULL;
+	fsp->modified = False;
+	fsp->sent_oplock_break = NO_BREAK_SENT;
+	fsp->is_directory = S_ISDIR(smb_fname->st.st_ex_mode);
+
 	status = SMB_VFS_FSET_NT_ACL( fsp, security_info_sent, sd);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(0,("set_nt_acl_no_snum: fset_nt_acl returned %s.\n", nt_errstr(status)));
-- 
1.7.11.7


From b673855131b9181701c60b75da92aa191947b5ce Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 12 Nov 2012 17:11:34 +1100
Subject: [PATCH 37/42] smbd: Remove NT4 compatability handling in posix -> NT
 ACL conversion

NT4 is long dead, and we should not change which ACL we return based
on what we think the client is.  The reason we should not do this, is
that if we are using vfs_acl_xattr then the hash will break if we do.
Additionally, it would require that the python VFS interface set the
global remote_arch to fake up being a modern client.

This instead seems cleaner and removes untested code (the tests are
updated to then handle the results of the modern codepath).

The supporting 'acl compatability' parameter is also removed.

Andrew Bartlett

Reviewed by: Jeremy Allison <jra@samba.org>
---
 docs-xml/smbdotconf/vfs/aclcompatibility.xml     |  17 ----
 lib/param/param_functions.c                      |   1 -
 lib/param/param_table.c                          |  19 ----
 source3/include/proto.h                          |   1 -
 source3/smbd/posix_acls.c                        | 108 +----------------------
 source3/smbd/proto.h                             |   1 -
 source4/libcli/pysmb.c                           |   7 +-
 source4/scripting/python/samba/tests/posixacl.py |  12 +--
 8 files changed, 11 insertions(+), 155 deletions(-)
 delete mode 100644 docs-xml/smbdotconf/vfs/aclcompatibility.xml

diff --git a/docs-xml/smbdotconf/vfs/aclcompatibility.xml b/docs-xml/smbdotconf/vfs/aclcompatibility.xml
deleted file mode 100644
index 95f42cf..0000000
--- a/docs-xml/smbdotconf/vfs/aclcompatibility.xml
+++ /dev/null
@@ -1,17 +0,0 @@
-<samba:parameter name="acl compatibility"
-                 context="G"
-				 type="enum"
-                 advanced="1" developer="1"
-                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
-<description>
-	<para>This parameter specifies what OS ACL semantics should 
-	be compatible with. Possible values are <emphasis>winnt</emphasis> for Windows NT 4, 
-	<emphasis>win2k</emphasis> for Windows 2000 and above and <emphasis>auto</emphasis>.
-	If you specify <emphasis>auto</emphasis>, the value for this parameter 
-	will be based upon the version of the client. There should 
-	be no reason to change this parameter from the default.</para>
-</description>
-
-<value type="default">Auto</value>
-<value type="example">win2k</value>
-</samba:parameter>
diff --git a/lib/param/param_functions.c b/lib/param/param_functions.c
index d5cd018..94652fa 100644
--- a/lib/param/param_functions.c
+++ b/lib/param/param_functions.c
@@ -266,7 +266,6 @@ FN_GLOBAL_CONST_STRING(winbindd_socket_directory, szWinbinddSocketDirectory)
 FN_GLOBAL_CONST_STRING(winbind_separator, szWinbindSeparator)
 FN_GLOBAL_CONST_STRING(workgroup, szWorkgroup)
 FN_GLOBAL_CONST_STRING(wtmpdir, szWtmpDir)
-FN_GLOBAL_INTEGER(acl_compatibility, iAclCompat)
 FN_GLOBAL_INTEGER(afs_token_lifetime, iAfsTokenLifetime)
 FN_GLOBAL_INTEGER(algorithmic_rid_base, AlgorithmicRidBase)
 FN_GLOBAL_INTEGER(allow_dns_updates, allow_dns_updates)
diff --git a/lib/param/param_table.c b/lib/param/param_table.c
index 01f65fe..a73cd96 100644
--- a/lib/param/param_table.c
+++ b/lib/param/param_table.c
@@ -180,16 +180,6 @@ static const struct enum_list enum_kerberos_method[] = {
 	{-1, NULL}
 };
 
-
-/* ACL compatibility options. */
-static const struct enum_list enum_acl_compat_vals[] = {
-    { ACL_COMPAT_AUTO, "auto" },
-    { ACL_COMPAT_WINNT, "winnt" },
-    { ACL_COMPAT_WIN2K, "win2k" },
-    { -1, NULL}
-};
-
-
 static const struct enum_list enum_printing[] = {
 	{PRINT_SYSV, "sysv"},
 	{PRINT_AIX, "aix"},
@@ -1459,15 +1449,6 @@ static struct parm_struct parm_table[] = {
 		.flags		= FLAG_ADVANCED,
 	},
 	{
-		.label		= "acl compatibility",
-		.type		= P_ENUM,
-		.p_class	= P_GLOBAL,
-		.offset		= GLOBAL_VAR(iAclCompat),
-		.special	= NULL,
-		.enum_list	= enum_acl_compat_vals,
-		.flags		= FLAG_ADVANCED | FLAG_SHARE | FLAG_GLOBAL,
-	},
-	{
 		.label		= "defer sharing violations",
 		.type		= P_BOOL,
 		.p_class	= P_GLOBAL,
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 7c5a5a7..5f3d937 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1068,7 +1068,6 @@ char *lp_wins_hook(TALLOC_CTX *ctx);
 const char *lp_template_homedir(void);
 const char *lp_template_shell(void);
 const char *lp_winbind_separator(void);
-int lp_acl_compatibility(void);
 bool lp_winbind_enum_users(void);
 bool lp_winbind_enum_groups(void);
 bool lp_winbind_use_default_domain(void);
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 7f12f4b..4e93fef 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -1058,24 +1058,6 @@ static void merge_aces( canon_ace **pp_list_head, bool dir_acl)
 }
 
 /****************************************************************************
- Check if we need to return NT4.x compatible ACL entries.
-****************************************************************************/
-
-bool nt4_compatible_acls(void)
-{
-	int compat = lp_acl_compatibility();
-
-	if (compat == ACL_COMPAT_AUTO) {
-		enum remote_arch_types ra_type = get_remote_arch();
-
-		/* Automatically adapt to client */
-		return (ra_type <= RA_WINNT);
-	} else
-		return (compat == ACL_COMPAT_WINNT);
-}
-
-
-/****************************************************************************
  Map canon_ace perms to permission bits NT.
  The attr element is not used here - we only process deny entries on set,
  not get. Deny entries are implicit on get with ace->perms = 0.
@@ -1106,10 +1088,7 @@ uint32_t map_canon_ace_perms(int snum,
 		 * to be changed in the future.
 		 */
 
-		if (nt4_compatible_acls())
-			nt_mask = UNIX_ACCESS_NONE;
-		else
-			nt_mask = 0;
+		nt_mask = 0;
 	} else {
 		if (directory_ace) {
 			nt_mask |= ((perms & S_IRUSR) ? UNIX_DIRECTORY_ACCESS_R : 0 );
@@ -1972,26 +1951,6 @@ static bool create_canon_ace_lists(files_struct *fsp,
 			DEBUG(3,("create_canon_ace_lists: unable to set anything but an ALLOW or DENY ACE.\n"));
 			return False;
 		}
-
-		if (nt4_compatible_acls()) {
-			/*
-			 * The security mask may be UNIX_ACCESS_NONE which should map into
-			 * no permissions (we overload the WRITE_OWNER bit for this) or it
-			 * should be one of the ALL/EXECUTE/READ/WRITE bits. Arrange for this
-			 * to be so. Any other bits override the UNIX_ACCESS_NONE bit.
-			 */
-
-			/*
-			 * Convert GENERIC bits to specific bits.
-			 */
- 
-			se_map_generic(&psa->access_mask, &file_generic_mapping);
-
-			psa->access_mask &= (UNIX_ACCESS_NONE|FILE_ALL_ACCESS);
-
-			if(psa->access_mask != UNIX_ACCESS_NONE)
-				psa->access_mask &= ~UNIX_ACCESS_NONE;
-		}
 	}
 
 	/*
@@ -3182,22 +3141,6 @@ static bool set_canon_ace_list(files_struct *fsp,
 }
 
 /****************************************************************************
- Find a particular canon_ace entry.
-****************************************************************************/
-
-static struct canon_ace *canon_ace_entry_for(struct canon_ace *list, SMB_ACL_TAG_T type, struct unixid *id)
-{
-	while (list) {
-		if (list->type == type && ((type != SMB_ACL_USER && type != SMB_ACL_GROUP) ||
-				(type == SMB_ACL_USER  && id && id->id == list->unix_ug.id) ||
-				(type == SMB_ACL_GROUP && id && id->id == list->unix_ug.id)))
-			break;
-		list = list->next;
-	}
-	return list;
-}
-
-/****************************************************************************
  
 ****************************************************************************/
 
@@ -3479,55 +3422,6 @@ static NTSTATUS posix_get_nt_acl_common(struct connection_struct *conn,
 			canon_ace *ace;
 			enum security_ace_type nt_acl_type;
 
-			if (nt4_compatible_acls() && dir_ace) {
-				/*
-				 * NT 4 chokes if an ACL contains an INHERIT_ONLY entry
-				 * but no non-INHERIT_ONLY entry for one SID. So we only
-				 * remove entries from the Access ACL if the
-				 * corresponding Default ACL entries have also been
-				 * removed. ACEs for CREATOR-OWNER and CREATOR-GROUP
-				 * are exceptions. We can do nothing
-				 * intelligent if the Default ACL contains entries that
-				 * are not also contained in the Access ACL, so this
-				 * case will still fail under NT 4.
-				 */
-
-				ace = canon_ace_entry_for(dir_ace, SMB_ACL_OTHER, NULL);
-				if (ace && !ace->perms) {
-					DLIST_REMOVE(dir_ace, ace);
-					TALLOC_FREE(ace);
-
-					ace = canon_ace_entry_for(file_ace, SMB_ACL_OTHER, NULL);
-					if (ace && !ace->perms) {
-						DLIST_REMOVE(file_ace, ace);
-						TALLOC_FREE(ace);
-					}
-				}
-
-				/*
-				 * WinNT doesn't usually have Creator Group
-				 * in browse lists, so we send this entry to
-				 * WinNT even if it contains no relevant
-				 * permissions. Once we can add
-				 * Creator Group to browse lists we can
-				 * re-enable this.
-				 */
-
-#if 0
-				ace = canon_ace_entry_for(dir_ace, SMB_ACL_GROUP_OBJ, NULL);
-				if (ace && !ace->perms) {
-					DLIST_REMOVE(dir_ace, ace);
-					TALLOC_FREE(ace);
-				}
-#endif
-
-				ace = canon_ace_entry_for(file_ace, SMB_ACL_GROUP_OBJ, NULL);
-				if (ace && !ace->perms) {
-					DLIST_REMOVE(file_ace, ace);
-					TALLOC_FREE(ace);
-				}
-			}
-
 			num_acls = count_canon_ace_list(file_ace);
 			num_def_acls = count_canon_ace_list(dir_ace);
 
diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h
index 2e53a87..b48cf44 100644
--- a/source3/smbd/proto.h
+++ b/source3/smbd/proto.h
@@ -702,7 +702,6 @@ void reply_pipe_read_and_X(struct smb_request *req);
 /* The following definitions come from smbd/posix_acls.c  */
 
 void create_file_sids(const SMB_STRUCT_STAT *psbuf, struct dom_sid *powner_sid, struct dom_sid *pgroup_sid);
-bool nt4_compatible_acls(void);
 uint32_t map_canon_ace_perms(int snum,
                                 enum security_ace_type *pacl_type,
                                 mode_t perms,
diff --git a/source4/libcli/pysmb.c b/source4/libcli/pysmb.c
index 1122305..fb981c7 100644
--- a/source4/libcli/pysmb.c
+++ b/source4/libcli/pysmb.c
@@ -317,10 +317,11 @@ static PyObject *py_smb_getacl(pytalloc_Object *self, PyObject *args, PyObject *
 	union smb_fileinfo fio;
 	struct smb_private_data *spdata;
 	const char *filename;
-	int sinfo = 0;
+	uint32_t sinfo = 0;
+	int access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 	int fnum;
 
-	if (!PyArg_ParseTuple(args, "s|i:get_acl", &filename, &sinfo)) {
+	if (!PyArg_ParseTuple(args, "s|Ii:get_acl", &filename, &sinfo, &access_mask)) {
 		return NULL;
 	}
 
@@ -331,7 +332,7 @@ static PyObject *py_smb_getacl(pytalloc_Object *self, PyObject *args, PyObject *
 	io.generic.level = RAW_OPEN_NTCREATEX;
 	io.ntcreatex.in.root_fid.fnum = 0;
 	io.ntcreatex.in.flags = 0;
-	io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
+	io.ntcreatex.in.access_mask = access_mask;
 	io.ntcreatex.in.create_options = 0;
 	io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 	io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ | 
diff --git a/source4/scripting/python/samba/tests/posixacl.py b/source4/scripting/python/samba/tests/posixacl.py
index f949ab4..652721f 100644
--- a/source4/scripting/python/samba/tests/posixacl.py
+++ b/source4/scripting/python/samba/tests/posixacl.py
@@ -92,7 +92,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
 
     def test_setntacl_smbd_invalidate_getntacl_smbd(self):
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x001200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
+        simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x001200a9;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
         os.chmod(self.tempf, 0750)
         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
 
@@ -122,7 +122,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
 
     def test_setntacl_smbd_setposixacl_getntacl_smbd(self):
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
-        simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
+        simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
         smbd.set_simple_acl(self.tempf, 0640)
@@ -133,7 +133,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
     def test_setntacl_smbd_setposixacl_group_getntacl_smbd(self):
         acl = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;OICI;0x001f01ff;;;S-1-5-21-2212615479-2695158682-2101375467-512)"
         BA_sid = security.dom_sid(security.SID_BUILTIN_ADMINISTRATORS)
-        simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;BA)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;WO;;;WD)"
+        simple_acl_from_posix = "O:S-1-5-21-2212615479-2695158682-2101375467-512G:S-1-5-21-2212615479-2695158682-2101375467-513D:(A;;0x001f019f;;;S-1-5-21-2212615479-2695158682-2101375467-512)(A;;0x00120089;;;BA)(A;;0x00120089;;;S-1-5-21-2212615479-2695158682-2101375467-513)(A;;;;;WD)"
         setntacl(self.lp, self.tempf, acl, "S-1-5-21-2212615479-2695158682-2101375467", use_ntvfs=False)
         # This invalidates the hash of the NT acl just set because there is a hook in the posix ACL set code
         s4_passdb = passdb.PDB(self.lp.get("passdb backend"))
@@ -193,7 +193,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
         user_SID = s4_passdb.uid_to_sid(os.stat(self.tempf).st_uid)
         smbd.set_simple_acl(self.tempf, 0640)
         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
-        acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
+        acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
 
@@ -210,7 +210,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
         smbd.chown(self.tempdir, BA_id, SO_id)
         smbd.set_simple_acl(self.tempdir, 0750)
         facl = getntacl(self.lp, self.tempdir, direct_db_access=False)
-        acl = "O:BAG:SOD:(A;;0x001f01ff;;;BA)(A;;0x001200a9;;;SO)(A;;WO;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001f01ff;;;CG)(A;OICIIO;0x001f01ff;;;WD)"
+        acl = "O:BAG:SOD:(A;;0x001f01ff;;;BA)(A;;0x001200a9;;;SO)(A;;;;;WD)(A;OICIIO;0x001f01ff;;;CO)(A;OICIIO;0x001f01ff;;;CG)(A;OICIIO;0x001f01ff;;;WD)"
 
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
@@ -225,7 +225,7 @@ class PosixAclMappingTests(TestCaseInTempDir):
         smbd.set_simple_acl(self.tempf, 0640, BA_gid)
         facl = getntacl(self.lp, self.tempf, direct_db_access=False)
         domsid = passdb.get_global_sam_sid()
-        acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;WO;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
+        acl = "O:%sG:%sD:(A;;0x001f019f;;;%s)(A;;0x00120089;;;BA)(A;;0x00120089;;;%s)(A;;;;;WD)" % (user_SID, group_SID, user_SID, group_SID)
         anysid = security.dom_sid(security.SID_NT_SELF)
         self.assertEquals(acl, facl.as_sddl(anysid))
 
-- 
1.7.11.7


From 7ff8a467730a5913c57680683c6887aef3feb010 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 13 Nov 2012 16:45:03 +1100
Subject: [PATCH 38/42] ntvfs: Fill in sd->type based on the new ACL being
 added

Previously we would not change the type field, and just relied on what
was in the original ACL based on the default SD.

This is required to ensure the SEC_DESC_DACL_PROTECTED is set
which is in turn required for GPOs to be set correctly
to match what windows does.

Andrew Bartlett

Reviewed by: Jeremy Allison <jra@samba.org>
---
 source4/ntvfs/posix/pvfs_acl.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/source4/ntvfs/posix/pvfs_acl.c b/source4/ntvfs/posix/pvfs_acl.c
index 1519631..4e9c1ac 100644
--- a/source4/ntvfs/posix/pvfs_acl.c
+++ b/source4/ntvfs/posix/pvfs_acl.c
@@ -330,6 +330,7 @@ NTSTATUS pvfs_acl_set(struct pvfs_state *pvfs,
 		}
 		sd->owner_sid = new_sd->owner_sid;
 	}
+
 	if (secinfo_flags & SECINFO_GROUP) {
 		if (!(access_mask & SEC_STD_WRITE_OWNER)) {
 			return NT_STATUS_ACCESS_DENIED;
@@ -349,19 +350,39 @@ NTSTATUS pvfs_acl_set(struct pvfs_state *pvfs,
 		}
 		sd->group_sid = new_sd->group_sid;
 	}
+
 	if (secinfo_flags & SECINFO_DACL) {
 		if (!(access_mask & SEC_STD_WRITE_DAC)) {
 			return NT_STATUS_ACCESS_DENIED;
 		}
 		sd->dacl = new_sd->dacl;
 		pvfs_translate_generic_bits(sd->dacl);
+		sd->type |= SEC_DESC_DACL_PRESENT;
 	}
+
 	if (secinfo_flags & SECINFO_SACL) {
 		if (!(access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
 			return NT_STATUS_ACCESS_DENIED;
 		}
 		sd->sacl = new_sd->sacl;
 		pvfs_translate_generic_bits(sd->sacl);
+		sd->type |= SEC_DESC_SACL_PRESENT;
+	}
+
+	if (secinfo_flags & SECINFO_PROTECTED_DACL) {
+		if (new_sd->type & SEC_DESC_DACL_PROTECTED) {
+			sd->type |= SEC_DESC_DACL_PROTECTED;
+		} else {
+			sd->type &= ~SEC_DESC_DACL_PROTECTED;
+		}
+	}
+
+	if (secinfo_flags & SECINFO_PROTECTED_SACL) {
+		if (new_sd->type & SEC_DESC_SACL_PROTECTED) {
+			sd->type |= SEC_DESC_SACL_PROTECTED;
+		} else {
+			sd->type &= ~SEC_DESC_SACL_PROTECTED;
+		}
 	}
 
 	if (new_uid == old_uid) {
-- 
1.7.11.7


From fb423e2907365ea64f5d26960a47722c06cc75f4 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 13 Nov 2012 16:03:27 +1100
Subject: [PATCH 39/42] scripting ntacls: Do not place a SACL in the GPO
 filesystem ACL

On a new GPO created on windows, the SACL is not used.

Andrew Bartlett

Reviewed by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Nov 14 00:34:50 CET 2012 on sn-devel-104
---
 source4/scripting/python/samba/ntacls.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/source4/scripting/python/samba/ntacls.py b/source4/scripting/python/samba/ntacls.py
index 89d450a..8992b61 100644
--- a/source4/scripting/python/samba/ntacls.py
+++ b/source4/scripting/python/samba/ntacls.py
@@ -211,7 +211,6 @@ def dsacl2fsacl(dssddl, sid):
     fdescr.group_sid = ref.group_sid
     fdescr.type = ref.type
     fdescr.revision = ref.revision
-    fdescr.sacl = ref.sacl
     aces = ref.dacl.aces
     for i in range(0, len(aces)):
         ace = aces[i]
-- 
1.7.11.7


From 6bc511f02fba7b00fe4087f7570f8a064119f333 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 5 Nov 2012 19:36:28 +1100
Subject: [PATCH 40/42] samba-tool: Add new samba-tool gpo aclcheck and test

Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
---
 source4/scripting/python/samba/netcmd/gpo.py       | 63 ++++++++++++++++++++++
 .../scripting/python/samba/tests/samba_tool/gpo.py | 10 ++++
 2 files changed, 73 insertions(+)

diff --git a/source4/scripting/python/samba/netcmd/gpo.py b/source4/scripting/python/samba/netcmd/gpo.py
index 347231b..f70317a 100644
--- a/source4/scripting/python/samba/netcmd/gpo.py
+++ b/source4/scripting/python/samba/netcmd/gpo.py
@@ -1072,6 +1072,68 @@ class cmd_del(Command):
         self.outf.write("GPO %s deleted.\n" % gpo)
 
 
+class cmd_aclcheck(Command):
+    """Check all GPOs have matching LDAP and DS ACLs."""
+
+    synopsis = "%prog [options]"
+
+    takes_optiongroups = {
+        "sambaopts": options.SambaOptions,
+        "versionopts": options.VersionOptions,
+        "credopts": options.CredentialsOptions,
+    }
+
+    takes_options = [
+        Option("-H", "--URL", help="LDB URL for database or target server", type=str,
+               metavar="URL", dest="H")
+        ]
+
+    def run(self, H=None, sambaopts=None, credopts=None, versionopts=None):
+
+        self.lp = sambaopts.get_loadparm()
+        self.creds = credopts.get_credentials(self.lp, fallback_machine=True)
+
+        self.url = dc_url(self.lp, self.creds, H)
+
+        # We need to know writable DC to setup SMB connection
+        if H and H.startswith('ldap://'):
+            dc_hostname = H[7:]
+            self.url = H
+        else:
+            dc_hostname = netcmd_finddc(self.lp, self.creds)
+            self.url = dc_url(self.lp, self.creds, dc=dc_hostname)
+
+        samdb_connect(self)
+
+        msg = get_gpo_info(self.samdb, None)
+
+        for m in msg:
+            # verify UNC path
+            unc = m['gPCFileSysPath'][0]
+            try:
+                [dom_name, service, sharepath] = parse_unc(unc)
+            except ValueError:
+                raise CommandError("Invalid GPO path (%s)" % unc)
+
+            # SMB connect to DC
+            try:
+                conn = smb.SMB(dc_hostname, service, lp=self.lp, creds=self.creds)
+            except Exception:
+                raise CommandError("Error connecting to '%s' using SMB" % dc_hostname)
+
+            fs_sd = conn.get_acl(sharepath, security.SECINFO_OWNER | security.SECINFO_GROUP | security.SECINFO_DACL, security.SEC_FLAG_MAXIMUM_ALLOWED)
+
+            ds_sd_ndr = m['ntSecurityDescriptor'][0]
+            ds_sd = ndr_unpack(security.descriptor, ds_sd_ndr).as_sddl()
+
+            # Create a file system security descriptor
+            domain_sid = security.dom_sid(self.samdb.get_domain_sid())
+            expected_fs_sddl = dsacl2fsacl(ds_sd, domain_sid)
+
+            if (fs_sd.as_sddl(domain_sid) != expected_fs_sddl):
+                raise CommandError("Invalid GPO ACL %s on path (%s), should be %s" % (fs_sd.as_sddl(domain_sid), sharepath, expected_fs_sddl))
+
+
 class cmd_gpo(SuperCommand):
     """Group Policy Object (GPO) management."""
 
@@ -1088,3 +1150,4 @@ class cmd_gpo(SuperCommand):
     subcommands["fetch"] = cmd_fetch()
     subcommands["create"] = cmd_create()
     subcommands["del"] = cmd_del()
+    subcommands["aclcheck"] = cmd_aclcheck()
diff --git a/source4/scripting/python/samba/tests/samba_tool/gpo.py b/source4/scripting/python/samba/tests/samba_tool/gpo.py
index 7ada91f..82e7268 100644
--- a/source4/scripting/python/samba/tests/samba_tool/gpo.py
+++ b/source4/scripting/python/samba/tests/samba_tool/gpo.py
@@ -44,6 +44,16 @@ os.environ["SERVER"])
         self.assertCmdSuccess(result, "Ensuring gpo fetched successfully")
         shutil.rmtree(os.path.join(self.tempdir, "policy"))
 
+    def test_show(self):
+        """Show a real GPO, and make sure it passes"""
+        (result, out, err) = self.runsubcmd("gpo", "show", self.gpo_guid, "-H", "ldap://%s" % os.environ["SERVER"])
+        self.assertCmdSuccess(result, "Ensuring gpo fetched successfully")
+
+    def test_aclcheck(self):
+        """Check all the GPOs on the remote server have correct ACLs"""
+        (result, out, err) = self.runsubcmd("gpo", "aclcheck", "-H", "ldap://%s" % os.environ["SERVER"], "-U%s%%%s" % (os.environ["USERNAME"], os.environ["PASSWORD"]))
+        self.assertCmdSuccess(result, "Ensuring gpo checked successfully")
+
     def setUp(self):
         """set up a temporary GPO to work with"""
         super(GpoCmdTestCase, self).setUp()
-- 
1.7.11.7


From 33ac0cc41dab9cc995f23f78d66a8a766e283193 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Fri, 16 Nov 2012 10:30:44 +1100
Subject: [PATCH 41/42] s3-param: Handle setting default AD DC per-share
 settings in init_locals()

This function is helpfully called between when we finish processing
the globals and when we start processing the individual shares.  This
means that the "vfs objects" and other per-share settings we specify
here become the defaults for (eg) [netlogon] and [sysvol] but the
admin can override these on a per-share basis or (as we must in make
test) for the whole server.

This broke setting and fetching of group policy objects from Windows
clients, since this setting was moved from fileserver.conf in
8518dd6406c0132dfd8c44e084c2b39792974f2c, and wasn't found in 'make
test' because we have to override the vfs objects to insert the
xattr_tdb and fake_acl modules.

Andrew Bartlett

Reviewed-by: Michael Adam <obnox@samba.org>
---
 source3/param/loadparm.c | 56 ++++++++++++++++++++++++++++++++----------------
 1 file changed, 37 insertions(+), 19 deletions(-)

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 12cb8db..5229a54 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -3469,12 +3469,41 @@ static bool equal_parameter(parm_type type, void *ptr1, void *ptr2)
 }
 
 /***************************************************************************
- Initialize any local varients in the sDefault table.
+ Initialize any local variables in the sDefault table, after parsing a
+ [globals] section.
 ***************************************************************************/
 
 void init_locals(void)
 {
-	/* None as yet. */
+	/*
+	 * We run this check once the [globals] is parsed, to force
+	 * the VFS objects and other per-share settings we need for
+	 * the standard way a AD DC is operated.  We may change these
+	 * as our code evolves, which is why we force these settings.
+	 *
+	 * We can't do this at the end of lp_load_ex(), as by that
+	 * point the services have been loaded and they will already
+	 * have "" as their vfs objects.
+	 */
+	if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC) {
+		const char **vfs_objects = lp_vfs_objects(-1);
+		if (!vfs_objects || !vfs_objects[0]) {
+			if (lp_parm_const_string(-1, "xattr_tdb", "file", NULL)) {
+				lp_do_parameter(-1, "vfs objects", "dfs_samba4 acl_xattr xattr_tdb");
+			} else if (lp_parm_const_string(-1, "posix", "eadb", NULL)) {
+				lp_do_parameter(-1, "vfs objects", "dfs_samba4 acl_xattr posix_eadb");
+			} else {
+				lp_do_parameter(-1, "vfs objects", "dfs_samba4 acl_xattr");
+			}
+		}
+
+		lp_do_parameter(-1, "map hidden", "no");
+		lp_do_parameter(-1, "map system", "no");
+		lp_do_parameter(-1, "map readonly", "no");
+		lp_do_parameter(-1, "store dos attributes", "yes");
+		lp_do_parameter(-1, "create mask", "0777");
+		lp_do_parameter(-1, "directory mask", "0777");
+	}
 }
 
 /***************************************************************************
@@ -4887,17 +4916,13 @@ static bool lp_load_ex(const char *pszFname,
 
 	fault_configure(smb_panic_s3);
 
+	/*
+	 * We run this check once the whole smb.conf is parsed, to
+	 * force some settings for the standard way a AD DC is
+	 * operated.  We may changed these as our code evolves, which
+	 * is why we force these settings.
+	 */
 	if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC) {
-		const char **vfs_objects = lp_vfs_objects(-1);
-		if (!vfs_objects || !vfs_objects[0]) {
-			if (lp_parm_const_string(-1, "xattr_tdb", "file", NULL)) {
-				lp_do_parameter(-1, "vfs objects", "dfs_samba4 acl_xattr xattr_tdb");
-			} else if (lp_parm_const_string(-1, "posix", "eadb", NULL)) {
-				lp_do_parameter(-1, "vfs objects", "dfs_samba4 acl_xattr posix_eadb");
-			} else {
-				lp_do_parameter(-1, "vfs objects", "dfs_samba4 acl_xattr");
-			}
-		}
 		lp_do_parameter(-1, "passdb backend", "samba_dsdb");
 
 		lp_do_parameter(-1, "rpc_server:default", "external");
@@ -4909,13 +4934,6 @@ static bool lp_load_ex(const char *pszFname,
 		lp_do_parameter(-1, "rpc_server:spoolss", "embedded");
 		lp_do_parameter(-1, "rpc_daemon:spoolssd", "embedded");
 		lp_do_parameter(-1, "rpc_server:tcpip", "no");
-
-		lp_do_parameter(-1, "map hidden", "no");
-		lp_do_parameter(-1, "map system", "no");
-		lp_do_parameter(-1, "map readonly", "no");
-		lp_do_parameter(-1, "store dos attributes", "yes");
-		lp_do_parameter(-1, "create mask", "0777");
-		lp_do_parameter(-1, "directory mask", "0777");
 	}
 
 	bAllowIncludeRegistry = true;
-- 
1.7.11.7


From 80b9f48c05e6a643da7694627dbd7d2055f2d0db Mon Sep 17 00:00:00 2001
From: Michael Adam <obnox@samba.org>
Date: Fri, 16 Nov 2012 01:00:21 +0100
Subject: [PATCH 42/42] s3:param: make init_locals() static.

it is only used in loadparm.c

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Nov 16 03:33:34 CET 2012 on sn-devel-104
---
 source3/include/proto.h  | 1 -
 source3/param/loadparm.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 5f3d937..bcecde9 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1408,7 +1408,6 @@ void *lp_local_ptr_by_snum(int snum, struct parm_struct *parm);
 bool lp_do_parameter(int snum, const char *pszParmName, const char *pszParmValue);
 bool lp_set_cmdline(const char *pszParmName, const char *pszParmValue);
 bool lp_set_option(const char *option);
-void init_locals(void);
 bool lp_is_default(int snum, struct parm_struct *parm);
 bool dump_a_parameter(int snum, char *parm_name, FILE * f, bool isGlobal);
 struct parm_struct *lp_get_parameter(const char *param_name);
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 5229a54..8ad0fc9 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -3473,7 +3473,7 @@ static bool equal_parameter(parm_type type, void *ptr1, void *ptr2)
  [globals] section.
 ***************************************************************************/
 
-void init_locals(void)
+static void init_locals(void)
 {
 	/*
 	 * We run this check once the [globals] is parsed, to force
-- 
1.7.11.7