Bug 55103 - Kelvin API writes broken ACL's
Summary: Kelvin API writes broken ACL's
Status: CLOSED FIXED
Alias: None
Product: UCS@school
Classification: Unclassified
Component: HTTP-API (Kelvin)
Version: UCS@school 5.0
Hardware: Other Linux
: P5 normal
Target Milestone: ---
Assignee: Tobias Wenzel
QA Contact: Daniel Tröder
URL: https://git.knut.univention.de/univen...
Keywords:
Depends on:
Blocks:
 
Reported: 2022-08-16 11:57 CEST by Florian Best
Modified: 2023-05-26 11:12 CEST (History)
4 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 4: Minor Usability: Impairs usability in secondary scenarios
Who will be affected by this bug?: 4: Will affect most installed domains
How will those affected feel about the bug?: 2: A Pain – users won’t like this once they notice it
User Pain: 0.183
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Best univentionstaff 2022-08-16 11:57:14 CEST
A customer environment has ACLs containing python bytestring representations in UCS@school (UCS4.4):

univentionShareSambaBaseDirAppendACL: (D;OICI;WOWD;;;*b'*S-1-5-21-1445483585-882151808-2549572616-11235*'*)
univentionShareSambaBaseDirAppendACL: (A;OICI;0x001f01ff;;;*b'*S-1-5-21-1445483585-882151808-2549572616-11233*'*)
univentionShareSambaBaseDirAppendACL: (A;OICI;0x001f01ff;;;*b'*S-1-5-21-1445483585-882151808-2549572616-12591*'*)

The origin seems to be the KELVIN API which is executed with Python 3 but partly the Python 2 code of UCS@school 4.4.
Comment 2 Daniel Tröder univentionstaff 2022-08-16 12:27:06 CEST
Thanks for the MR!

We also need to write a script to be called in the Kelvin Apps join script ("inst"), that fixes existing univentionShareSambaBaseDirAppendACL entries.
Comment 3 Erik Damrose univentionstaff 2022-08-16 12:32:29 CEST
(In reply to Daniel Tröder from comment #2)
> We also need to write a script to be called in the Kelvin Apps join script
> ("inst"), that fixes existing univentionShareSambaBaseDirAppendACL entries.

ucs-school-metapackage/set_nt_acl_on_shares did wrote the ACL initially
Comment 5 Tobias Wenzel univentionstaff 2022-08-29 09:25:23 CEST
Kelvin 1.6.0 was released last week and everything as been merged to the branch release160 as well as main (for later releases).

Next to the fix I wrote the script fix_nt_acl_on_shares, which fixes existing shares. It is automatically executed in the joinscript. Existing custom NT ACL, which are written are preserved.

It can also be executed (on the host, not inside the docker container) by running

$ /var/lib/univention-appcenter/apps/ucsschool-kelvin-rest-api/data/scripts/fix_nt_acl_on_shares
$ univention-directory-listener-ctrl resync samba-shares
Comment 6 Daniel Tröder univentionstaff 2022-08-29 12:36:12 CEST
Was released.