From: Volker Lendecke <vl@samba.org>
Date: Fri, 29 May 2026 15:00:56 +0000 (+0200)
Subject: tests: Add test making sure we can parse an ACL broken by Samba < 4.19
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=780ef525d1dc7a44fb754f627d761f98dea31009;p=thirdparty%2Fsamba.git

tests: Add test making sure we can parse an ACL broken by Samba < 4.19

The nice base64 blob you find here was retrieved from the
security.NTACL xattr when running the test from the previous patch
against a 4.18 server. The test has to be modified with a breakpoint()
right after the set_acl() call, because it cleans up the file after
the test, and it has to be run with a user that has the
SeSecurityPrivilege, i.e. typically and administrator. The resulting
security.NTACL xattr is broken.

I haven't found an easy way to inject this ACL into a running xattr
tdb file such that the posix hash function would make this survive a
get_nt_acl. A simple ndrdump should show the point.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=16096
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---

diff --git a/python/samba/tests/ntacl_resource_attr_ace.py b/python/samba/tests/ntacl_resource_attr_ace.py
index 721807db246..b33c81cc072 100644
--- a/python/samba/tests/ntacl_resource_attr_ace.py
+++ b/python/samba/tests/ntacl_resource_attr_ace.py
@@ -38,6 +38,7 @@ from samba.samba3 import libsmb_samba_internal as libsmb
 from samba import NTSTATUSError
 import samba.tests
 import samba.tests.libsmb
+from samba.tests import BlackboxTestCase
 
 
 class NtaclResourceAttrAceTests(samba.tests.libsmb.LibsmbTests):
@@ -98,3 +99,21 @@ class NtaclResourceAttrAceTests(samba.tests.libsmb.LibsmbTests):
         # Assert we don't lose anything
         sd_out = self.conn.get_acl(self.test_file, security.SECINFO_SACL|security.SECINFO_DACL)
         self.assertEqual(sd_out.as_sddl(), 'D:(A;;FA;;;SY)S:(RA;;;;;WD;("Secret",TU,0x0,+42))')
+
+class NtaclCheckBrokenXattr(BlackboxTestCase):
+    def test_broken_4_18_sd(self):
+        """Test that we can ndr-parse a broken ACL written by Samba before 4.19
+        """
+        try:
+            self.check_run("ndrdump --input=BAAEAAAAAgAEAAIAAQDTUqgmaU3l3XQ" \
+                           "iIvhobT/RmQ8qA1P4Ao5OARKbhEkaqQAAAAAAAAAAAAAAAA" \
+                           "AAAAAAAAAAAAAAAAAAAAAAAAAAcG9zaXhfYWNsAG6gQRFE7" \
+                           "9wBuX0c98dZv+qO/cof92D0EaIkn1cf3JUJ8jckslpjE5IA" \
+                           "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAFIC" \
+                           "0AAAA0AAAAOwAAAAIAQAAAQUAAAAAAAUVAAAAGzK0UbnSA4" \
+                           "sRk/P16AMAAAEFAAAAAAAFFQAAABsytFG50gOLEZPz9QECA" \
+                           "AAEABwAAQAAABIAFAAAAAAAAQEAAAAAAAEAAAAABAAcAAEA" \
+                           "AAAAABQA/wEfAAEBAAAAAAAFEgAAAA== " \
+                           "--base64-input xattr xattr_NTACL struct")
+        except:
+            self.fail()
diff --git a/selftest/knownfail.d/ntacl_broken_418 b/selftest/knownfail.d/ntacl_broken_418
new file mode 100644
index 00000000000..a1d4ae5dab6
--- /dev/null
+++ b/selftest/knownfail.d/ntacl_broken_418
@@ -0,0 +1 @@
+^samba.tests.ntacl_resource_attr_ace.samba.tests.ntacl_resource_attr_ace.NtaclCheckBrokenXattr.test_broken_4_18_sd*