CVE-2020-25722 selftest: Adapt sam.py test to userAccountControl/objectclass restrictions

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

diff --git a/selftest/knownfail.d/uac_objectclass_restrict b/selftest/knownfail.d/uac_objectclass_restrict
index 295818d6a1bfbdb8b9495fefa9c1399a76313879..0971c13c2f03cc7432032f572f21bde04b0010a1 100644 (file)
--- a/selftest/knownfail.d/uac_objectclass_restrict
+++ b/selftest/knownfail.d/uac_objectclass_restrict
@@ -3,8 +3,6 @@
 #
 # All these tests need to be fixed and the entries here removed
 
-^samba4.sam.python\(.*\).__main__.SamTests.test_userAccountControl_computer_modify
-^samba4.sam.python\(.*\).__main__.SamTests.test_userAccountControl_user_modify
 ^samba4.sam.python\(fl2008r2dc\).__main__.SamTests.test_users_groups\(fl2008r2dc\)
 ^samba4.ldap.python\(ad_dc_default\).__main__.BasicTests.test_all\(ad_dc_default\)
 ^samba4.sam.python\(ad_dc_default\).__main__.SamTests.test_users_groups\(ad_dc_default\)

diff --git a/source4/dsdb/tests/python/sam.py b/source4/dsdb/tests/python/sam.py
index 7ac2319dd49cd0f76a30c3dbc5e34b475ef148df..e50e25adbe379e70296861e37687ad65f57e8488 100755 (executable)
--- a/source4/dsdb/tests/python/sam.py
+++ b/source4/dsdb/tests/python/sam.py
@@ -2135,7 +2135,7 @@ class SamTests(samba.tests.TestCase):
             self.fail()
         except LdbError as e67:
             (num, _) = e67.args
-            self.assertEqual(num, ERR_UNWILLING_TO_PERFORM)
+            self.assertEqual(num, ERR_OBJECT_CLASS_VIOLATION)
 
         m = Message()
         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
@@ -2154,7 +2154,7 @@ class SamTests(samba.tests.TestCase):
             self.fail()
         except LdbError as e68:
             (num, _) = e68.args
-            self.assertEqual(num, ERR_UNWILLING_TO_PERFORM)
+            self.assertEqual(num, ERR_OBJECT_CLASS_VIOLATION)
 
         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
@@ -2502,7 +2502,7 @@ class SamTests(samba.tests.TestCase):
             self.fail()
         except LdbError as e76:
             (num, _) = e76.args
-            self.assertEqual(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
+            self.assertEqual(num, ERR_OBJECT_CLASS_VIOLATION)
 
         # "primaryGroupID" does not change if account type remains the same