source4/torture/raw/acls.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test security descriptor operations
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "torture/torture.h"
  24 #include "libcli/raw/libcliraw.h"
  25 #include "libcli/libcli.h"
  26 #include "librpc/gen_ndr/lsa.h"
  27 #include "libcli/util/clilsa.h"
  28 #include "libcli/security/security.h"
  29 #include "torture/util.h"
  30 #include "librpc/gen_ndr/ndr_security.h"
  31 #include "torture/raw/proto.h"
  32
  33 #define BASEDIR "\\testsd"
  34
  35 #define CHECK_STATUS(status, correct) do { \
  36         if (!NT_STATUS_EQUAL(status, correct)) { \
  37                 ret = false; \
  38                 torture_result(tctx, TORTURE_FAIL, "(%s) Incorrect status %s - should be %s\n", \
  39                        __location__, nt_errstr(status), nt_errstr(correct)); \
  40                 goto done; \
  41         }} while (0)
  42
  43 #define FAIL_UNLESS(__cond)                                     \
  44         do {                                                    \
  45                 if (__cond) {} else {                           \
  46                         ret = false; \
  47                         torture_result(tctx, TORTURE_FAIL, "%s) condition violated: %s\n", \
  48                             __location__, #__cond); \
  49                         goto done; \
  50                 }                                               \
  51         } while(0)
  52
  53 #define CHECK_SECURITY_DESCRIPTOR(_sd1, _sd2) do { \
  54         if (!security_descriptor_equal(_sd1, _sd2)) { \
  55                 torture_warning(tctx, "%s: security descriptors don't match!\n", __location__); \
  56                 torture_warning(tctx, "got:\n"); \
  57                 NDR_PRINT_DEBUG(security_descriptor, _sd1); \
  58                 torture_warning(tctx, "expected:\n"); \
  59                 NDR_PRINT_DEBUG(security_descriptor, _sd2); \
  60                 ret = false; \
  61         } \
  62 } while (0)
  63
  64 /*
  65  * Helper function to verify a security descriptor, by querying
  66  * and comparing against the passed in sd.
  67  * Copied to smb2_util_verify_sd() for SMB2.
  68  */
  69 static bool verify_sd(TALLOC_CTX *tctx, struct smbcli_state *cli,
  70     int fnum, struct security_descriptor *sd)
  71 {
  72         NTSTATUS status;
  73         bool ret = true;
  74         union smb_fileinfo q = {};
  75
  76         if (sd) {
  77                 q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
  78                 q.query_secdesc.in.file.fnum = fnum;
  79                 q.query_secdesc.in.secinfo_flags =
  80                     SECINFO_OWNER |
  81                     SECINFO_GROUP |
  82                     SECINFO_DACL;
  83                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
  84                 CHECK_STATUS(status, NT_STATUS_OK);
  85
  86                 /* More work is needed if we're going to check this bit. */
  87                 sd->type &= ~SEC_DESC_DACL_AUTO_INHERITED;
  88
  89                 CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd);
  90         }
  91
  92  done:
  93         return ret;
  94 }
  95
  96 /*
  97  * Helper function to verify attributes, by querying
  98  * and comparing against the passed attrib.
  99  * Copied to smb2_util_verify_attrib() for SMB2.
 100  */
 101 static bool verify_attrib(TALLOC_CTX *tctx, struct smbcli_state *cli,
 102     int fnum, uint32_t attrib)
 103 {
 104         NTSTATUS status;
 105         bool ret = true;
 106         union smb_fileinfo q2 = {};
 107
 108         if (attrib) {
 109                 q2.standard.level = RAW_FILEINFO_STANDARD;
 110                 q2.standard.in.file.fnum = fnum;
 111                 status = smb_raw_fileinfo(cli->tree, tctx, &q2);
 112                 CHECK_STATUS(status, NT_STATUS_OK);
 113
 114                 q2.standard.out.attrib &= ~FILE_ATTRIBUTE_ARCHIVE;
 115
 116                 if (q2.standard.out.attrib != attrib) {
 117                         torture_warning(tctx, "%s: attributes don't match! "
 118                             "got %x, expected %x\n", __location__,
 119                             (uint32_t)q2.standard.out.attrib,
 120                             (uint32_t)attrib);
 121                         ret = false;
 122                 }
 123         }
 124
 125  done:
 126         return ret;
 127 }
 128
 129 /**
 130  * Test setting and removing a DACL.
 131  * Test copied to torture_smb2_setinfo() for SMB2.
 132  */
 133 static bool test_sd(struct torture_context *tctx, struct smbcli_state *cli)
 134 {
 135         NTSTATUS status;
 136         union smb_open io;
 137         const char *fname = BASEDIR "\\sd.txt";
 138         bool ret = true;
 139         int fnum = -1;
 140         union smb_fileinfo q;
 141         union smb_setfileinfo set;
 142         struct security_ace ace;
 143         struct security_descriptor *sd;
 144         struct dom_sid *test_sid;
 145
 146         if (!torture_setup_dir(cli, BASEDIR))
 147                 return false;
 148
 149         torture_comment(tctx, "TESTING SETFILEINFO EA_SET\n");
 150
 151         io.generic.level = RAW_OPEN_NTCREATEX;
 152         io.ntcreatex.in.root_fid.fnum = 0;
 153         io.ntcreatex.in.flags = 0;
 154         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 155         io.ntcreatex.in.create_options = 0;
 156         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 157         io.ntcreatex.in.share_access =
 158                 NTCREATEX_SHARE_ACCESS_READ |
 159                 NTCREATEX_SHARE_ACCESS_WRITE;
 160         io.ntcreatex.in.alloc_size = 0;
 161         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
 162         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 163         io.ntcreatex.in.security_flags = 0;
 164         io.ntcreatex.in.fname = fname;
 165         status = smb_raw_open(cli->tree, tctx, &io);
 166         CHECK_STATUS(status, NT_STATUS_OK);
 167         fnum = io.ntcreatex.out.file.fnum;
 168
 169         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 170         q.query_secdesc.in.file.fnum = fnum;
 171         q.query_secdesc.in.secinfo_flags =
 172                 SECINFO_OWNER |
 173                 SECINFO_GROUP |
 174                 SECINFO_DACL;
 175         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 176         CHECK_STATUS(status, NT_STATUS_OK);
 177         sd = q.query_secdesc.out.sd;
 178
 179         torture_comment(tctx, "add a new ACE to the DACL\n");
 180
 181         test_sid = dom_sid_parse_talloc(tctx, SID_NT_AUTHENTICATED_USERS);
 182
 183         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
 184         ace.flags = 0;
 185         ace.access_mask = SEC_STD_ALL;
 186         ace.trustee = *test_sid;
 187
 188         status = security_descriptor_dacl_add(sd, &ace);
 189         CHECK_STATUS(status, NT_STATUS_OK);
 190
 191         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 192         set.set_secdesc.in.file.fnum = fnum;
 193         set.set_secdesc.in.secinfo_flags = q.query_secdesc.in.secinfo_flags;
 194         set.set_secdesc.in.sd = sd;
 195
 196         status = smb_raw_setfileinfo(cli->tree, &set);
 197         CHECK_STATUS(status, NT_STATUS_OK);
 198         FAIL_UNLESS(verify_sd(tctx, cli, fnum, sd));
 199
 200         torture_comment(tctx, "remove it again\n");
 201
 202         status = security_descriptor_dacl_del(sd, test_sid);
 203         CHECK_STATUS(status, NT_STATUS_OK);
 204
 205         status = smb_raw_setfileinfo(cli->tree, &set);
 206         CHECK_STATUS(status, NT_STATUS_OK);
 207         FAIL_UNLESS(verify_sd(tctx, cli, fnum, sd));
 208
 209 done:
 210         smbcli_close(cli->tree, fnum);
 211         smb_raw_exit(cli->session);
 212         smbcli_deltree(cli->tree, BASEDIR);
 213
 214         return ret;
 215 }
 216
 217
 218 /*
 219   test using nttrans create to create a file with an initial acl set
 220   Test copied to test_create_acl() for SMB2.
 221 */
 222 static bool test_nttrans_create_ext(struct torture_context *tctx,
 223                                     struct smbcli_state *cli, bool test_dir)
 224 {
 225         NTSTATUS status;
 226         union smb_open io;
 227         const char *fname = BASEDIR "\\acl2.txt";
 228         bool ret = true;
 229         int fnum = -1;
 230         union smb_fileinfo q = {};
 231         struct security_ace ace;
 232         struct security_descriptor *sd;
 233         struct dom_sid *test_sid;
 234         uint32_t attrib =
 235             FILE_ATTRIBUTE_HIDDEN |
 236             FILE_ATTRIBUTE_SYSTEM |
 237             (test_dir ? FILE_ATTRIBUTE_DIRECTORY : 0);
 238         NTSTATUS (*delete_func)(struct smbcli_tree *, const char *) =
 239             test_dir ? smbcli_rmdir : smbcli_unlink;
 240
 241         ZERO_STRUCT(ace);
 242
 243         if (!torture_setup_dir(cli, BASEDIR))
 244                 return false;
 245
 246         io.generic.level = RAW_OPEN_NTTRANS_CREATE;
 247         io.ntcreatex.in.root_fid.fnum = 0;
 248         io.ntcreatex.in.flags = 0;
 249         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 250         io.ntcreatex.in.create_options =
 251             test_dir ? NTCREATEX_OPTIONS_DIRECTORY : 0;
 252         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 253         io.ntcreatex.in.share_access =
 254                 NTCREATEX_SHARE_ACCESS_READ |
 255                 NTCREATEX_SHARE_ACCESS_WRITE;
 256         io.ntcreatex.in.alloc_size = 0;
 257         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
 258         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 259         io.ntcreatex.in.security_flags = 0;
 260         io.ntcreatex.in.fname = fname;
 261         io.ntcreatex.in.sec_desc = NULL;
 262         io.ntcreatex.in.ea_list = NULL;
 263
 264         torture_comment(tctx, "basic create\n");
 265
 266         status = smb_raw_open(cli->tree, tctx, &io);
 267         CHECK_STATUS(status, NT_STATUS_OK);
 268         fnum = io.ntcreatex.out.file.fnum;
 269
 270         torture_comment(tctx, "querying ACL\n");
 271
 272         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 273         q.query_secdesc.in.file.fnum = fnum;
 274         q.query_secdesc.in.secinfo_flags =
 275                 SECINFO_OWNER |
 276                 SECINFO_GROUP |
 277                 SECINFO_DACL;
 278         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 279         CHECK_STATUS(status, NT_STATUS_OK);
 280         sd = q.query_secdesc.out.sd;
 281
 282         status = smbcli_close(cli->tree, fnum);
 283         CHECK_STATUS(status, NT_STATUS_OK);
 284
 285         status = delete_func(cli->tree, fname);
 286         CHECK_STATUS(status, NT_STATUS_OK);
 287
 288         torture_comment(tctx, "adding a new ACE\n");
 289         test_sid = dom_sid_parse_talloc(tctx, SID_NT_AUTHENTICATED_USERS);
 290
 291         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
 292         ace.flags = 0;
 293         ace.access_mask = SEC_STD_ALL;
 294         ace.trustee = *test_sid;
 295
 296         status = security_descriptor_dacl_add(sd, &ace);
 297         CHECK_STATUS(status, NT_STATUS_OK);
 298
 299         torture_comment(tctx, "creating with an initial ACL\n");
 300
 301         io.ntcreatex.in.sec_desc = sd;
 302         status = smb_raw_open(cli->tree, tctx, &io);
 303         CHECK_STATUS(status, NT_STATUS_OK);
 304         fnum = io.ntcreatex.out.file.fnum;
 305
 306         FAIL_UNLESS(verify_sd(tctx, cli, fnum, sd));
 307
 308         status = smbcli_close(cli->tree, fnum);
 309         CHECK_STATUS(status, NT_STATUS_OK);
 310         status = delete_func(cli->tree, fname);
 311         CHECK_STATUS(status, NT_STATUS_OK);
 312
 313         torture_comment(tctx, "creating with attributes\n");
 314
 315         io.ntcreatex.in.sec_desc = NULL;
 316         io.ntcreatex.in.file_attr = attrib;
 317         status = smb_raw_open(cli->tree, tctx, &io);
 318         CHECK_STATUS(status, NT_STATUS_OK);
 319         fnum = io.ntcreatex.out.file.fnum;
 320
 321         FAIL_UNLESS(verify_attrib(tctx, cli, fnum, attrib));
 322
 323         status = smbcli_close(cli->tree, fnum);
 324         CHECK_STATUS(status, NT_STATUS_OK);
 325
 326         status = delete_func(cli->tree, fname);
 327         CHECK_STATUS(status, NT_STATUS_OK);
 328
 329         torture_comment(tctx, "creating with attributes and ACL\n");
 330
 331         io.ntcreatex.in.sec_desc = sd;
 332         io.ntcreatex.in.file_attr = attrib;
 333         status = smb_raw_open(cli->tree, tctx, &io);
 334         CHECK_STATUS(status, NT_STATUS_OK);
 335         fnum = io.ntcreatex.out.file.fnum;
 336
 337         FAIL_UNLESS(verify_sd(tctx, cli, fnum, sd));
 338         FAIL_UNLESS(verify_attrib(tctx, cli, fnum, attrib));
 339
 340         status = smbcli_close(cli->tree, fnum);
 341         CHECK_STATUS(status, NT_STATUS_OK);
 342         status = delete_func(cli->tree, fname);
 343         CHECK_STATUS(status, NT_STATUS_OK);
 344
 345  done:
 346         smbcli_close(cli->tree, fnum);
 347         smb_raw_exit(cli->session);
 348         smbcli_deltree(cli->tree, BASEDIR);
 349         return ret;
 350 }
 351
 352 /*
 353   test using nttrans create to create a file and directory with an initial acl
 354   and owner.
 355 */
 356 static bool test_nttrans_create_ext_owner(
 357         struct torture_context *tctx,
 358         struct smbcli_state *cli, bool test_dir)
 359 {
 360         NTSTATUS status;
 361         union smb_open io;
 362         const char *fname = BASEDIR "\\foo.txt";
 363         bool ret = true;
 364         int fnum = -1;
 365         struct security_ace ace;
 366         struct security_descriptor *sd;
 367         uint32_t attrib =
 368             FILE_ATTRIBUTE_HIDDEN |
 369             FILE_ATTRIBUTE_SYSTEM |
 370             (test_dir ? FILE_ATTRIBUTE_DIRECTORY : 0);
 371         NTSTATUS (*delete_func)(struct smbcli_tree *, const char *) =
 372             test_dir ? smbcli_rmdir : smbcli_unlink;
 373
 374         ZERO_STRUCT(ace);
 375
 376         smbcli_deltree(cli->tree, BASEDIR);
 377
 378         if (!torture_setup_dir(cli, BASEDIR))
 379                 return false;
 380
 381         io.generic.level = RAW_OPEN_NTTRANS_CREATE;
 382         io.ntcreatex.in.root_fid.fnum = 0;
 383         io.ntcreatex.in.flags = 0;
 384         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 385         io.ntcreatex.in.create_options =
 386             test_dir ? NTCREATEX_OPTIONS_DIRECTORY : 0;
 387         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 388         io.ntcreatex.in.share_access =
 389                 NTCREATEX_SHARE_ACCESS_READ |
 390                 NTCREATEX_SHARE_ACCESS_WRITE;
 391         io.ntcreatex.in.alloc_size = 0;
 392         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
 393         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 394         io.ntcreatex.in.security_flags = 0;
 395         io.ntcreatex.in.fname = fname;
 396         io.ntcreatex.in.sec_desc = NULL;
 397         io.ntcreatex.in.ea_list = NULL;
 398
 399         torture_comment(tctx, "creating with attributes, ACL and owner\n");
 400
 401         sd = security_descriptor_dacl_create(tctx,
 402                                         0, SID_WORLD, SID_BUILTIN_USERS,
 403                                         SID_WORLD,
 404                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 405                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 406                                         0,
 407                                         NULL);
 408
 409         io.ntcreatex.in.sec_desc = sd;
 410         io.ntcreatex.in.file_attr = attrib;
 411         status = smb_raw_open(cli->tree, tctx, &io);
 412         CHECK_STATUS(status, NT_STATUS_OK);
 413         fnum = io.ntcreatex.out.file.fnum;
 414
 415         FAIL_UNLESS(verify_sd(tctx, cli, fnum, sd));
 416         FAIL_UNLESS(verify_attrib(tctx, cli, fnum, attrib));
 417
 418         status = smbcli_close(cli->tree, fnum);
 419         CHECK_STATUS(status, NT_STATUS_OK);
 420         status = delete_func(cli->tree, fname);
 421         CHECK_STATUS(status, NT_STATUS_OK);
 422
 423  done:
 424         smbcli_close(cli->tree, fnum);
 425         smb_raw_exit(cli->session);
 426         smbcli_deltree(cli->tree, BASEDIR);
 427         return ret;
 428 }
 429
 430 static bool test_nttrans_create_file(struct torture_context *tctx,
 431     struct smbcli_state *cli)
 432 {
 433         torture_comment(tctx, "Testing nttrans create with sec_desc on files\n");
 434
 435         return test_nttrans_create_ext(tctx, cli, false);
 436 }
 437
 438 static bool test_nttrans_create_dir(struct torture_context *tctx,
 439     struct smbcli_state *cli)
 440 {
 441         torture_comment(tctx, "Testing nttrans create with sec_desc on directories\n");
 442
 443         return test_nttrans_create_ext(tctx, cli, true);
 444 }
 445
 446 static bool test_nttrans_create_owner_file(struct torture_context *tctx,
 447     struct smbcli_state *cli)
 448 {
 449         torture_comment(tctx, "Testing nttrans create with sec_desc with owner on file\n");
 450
 451         return test_nttrans_create_ext_owner(tctx, cli, false);
 452 }
 453
 454 static bool test_nttrans_create_owner_dir(struct torture_context *tctx,
 455     struct smbcli_state *cli)
 456 {
 457         torture_comment(tctx, "Testing nttrans create with sec_desc with owner on directory\n");
 458
 459         return test_nttrans_create_ext_owner(tctx, cli, true);
 460 }
 461
 462 #define CHECK_ACCESS_FLAGS(_fnum, flags) do { \
 463         union smb_fileinfo _q; \
 464         _q.access_information.level = RAW_FILEINFO_ACCESS_INFORMATION; \
 465         _q.access_information.in.file.fnum = (_fnum); \
 466         status = smb_raw_fileinfo(cli->tree, tctx, &_q); \
 467         CHECK_STATUS(status, NT_STATUS_OK); \
 468         if (_q.access_information.out.access_flags != (flags)) { \
 469                 ret = false; \
 470                 torture_result(tctx, TORTURE_FAIL, "(%s) Incorrect access_flags 0x%08x - should be 0x%08x\n", \
 471                        __location__, _q.access_information.out.access_flags, (flags)); \
 472                 goto done; \
 473         } \
 474 } while (0)
 475
 476 /*
 477   test using NTTRANS CREATE to create a file with a null ACL set
 478   Test copied to test_create_null_dacl() for SMB2.
 479 */
 480 static bool test_nttrans_create_null_dacl(struct torture_context *tctx,
 481                                           struct smbcli_state *cli)
 482 {
 483         NTSTATUS status;
 484         union smb_open io;
 485         const char *fname = BASEDIR "\\nulldacl.txt";
 486         bool ret = true;
 487         int fnum = -1;
 488         union smb_fileinfo q;
 489         union smb_setfileinfo s;
 490         struct security_descriptor *sd = security_descriptor_initialise(tctx);
 491         struct security_acl dacl;
 492
 493         if (!torture_setup_dir(cli, BASEDIR))
 494                 return false;
 495
 496         torture_comment(tctx, "TESTING SEC_DESC WITH A NULL DACL\n");
 497
 498         io.generic.level = RAW_OPEN_NTTRANS_CREATE;
 499         io.ntcreatex.in.root_fid.fnum = 0;
 500         io.ntcreatex.in.flags = 0;
 501         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC
 502                 | SEC_STD_WRITE_OWNER;
 503         io.ntcreatex.in.create_options = 0;
 504         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 505         io.ntcreatex.in.share_access =
 506                 NTCREATEX_SHARE_ACCESS_READ | NTCREATEX_SHARE_ACCESS_WRITE;
 507         io.ntcreatex.in.alloc_size = 0;
 508         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 509         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 510         io.ntcreatex.in.security_flags = 0;
 511         io.ntcreatex.in.fname = fname;
 512         io.ntcreatex.in.sec_desc = sd;
 513         io.ntcreatex.in.ea_list = NULL;
 514
 515         torture_comment(tctx, "creating a file with a empty sd\n");
 516         status = smb_raw_open(cli->tree, tctx, &io);
 517         CHECK_STATUS(status, NT_STATUS_OK);
 518         fnum = io.ntcreatex.out.file.fnum;
 519
 520         torture_comment(tctx, "get the original sd\n");
 521         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 522         q.query_secdesc.in.file.fnum = fnum;
 523         q.query_secdesc.in.secinfo_flags =
 524                 SECINFO_OWNER |
 525                 SECINFO_GROUP |
 526                 SECINFO_DACL;
 527         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 528         CHECK_STATUS(status, NT_STATUS_OK);
 529
 530         /*
 531          * Testing the created DACL,
 532          * the server should add the inherited DACL
 533          * when SEC_DESC_DACL_PRESENT isn't specified
 534          */
 535         if (!(q.query_secdesc.out.sd->type & SEC_DESC_DACL_PRESENT)) {
 536                 ret = false;
 537                 torture_result(tctx, TORTURE_FAIL, "DACL_PRESENT flag not set by the server!\n");
 538                 goto done;
 539         }
 540         if (q.query_secdesc.out.sd->dacl == NULL) {
 541                 ret = false;
 542                 torture_result(tctx, TORTURE_FAIL, "no DACL has been created on the server!\n");
 543                 goto done;
 544         }
 545
 546         torture_comment(tctx, "set NULL DACL\n");
 547         sd->type |= SEC_DESC_DACL_PRESENT;
 548
 549         s.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 550         s.set_secdesc.in.file.fnum = fnum;
 551         s.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 552         s.set_secdesc.in.sd = sd;
 553         status = smb_raw_setfileinfo(cli->tree, &s);
 554         CHECK_STATUS(status, NT_STATUS_OK);
 555
 556         torture_comment(tctx, "get the sd\n");
 557         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 558         q.query_secdesc.in.file.fnum = fnum;
 559         q.query_secdesc.in.secinfo_flags =
 560                 SECINFO_OWNER |
 561                 SECINFO_GROUP |
 562                 SECINFO_DACL;
 563         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 564         CHECK_STATUS(status, NT_STATUS_OK);
 565
 566         /* Testing the modified DACL */
 567         if (!(q.query_secdesc.out.sd->type & SEC_DESC_DACL_PRESENT)) {
 568                 ret = false;
 569                 torture_result(tctx, TORTURE_FAIL, "DACL_PRESENT flag not set by the server!\n");
 570                 goto done;
 571         }
 572         if (q.query_secdesc.out.sd->dacl != NULL) {
 573                 ret = false;
 574                 torture_result(tctx, TORTURE_FAIL, "DACL has been created on the server!\n");
 575                 goto done;
 576         }
 577
 578         torture_comment(tctx, "try open for read control\n");
 579         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL;
 580         status = smb_raw_open(cli->tree, tctx, &io);
 581         CHECK_STATUS(status, NT_STATUS_OK);
 582         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 583                 SEC_STD_READ_CONTROL | SEC_FILE_READ_ATTRIBUTE);
 584         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 585
 586         torture_comment(tctx, "try open for write\n");
 587         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 588         status = smb_raw_open(cli->tree, tctx, &io);
 589         CHECK_STATUS(status, NT_STATUS_OK);
 590         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 591                 SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE);
 592         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 593
 594         torture_comment(tctx, "try open for read\n");
 595         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 596         status = smb_raw_open(cli->tree, tctx, &io);
 597         CHECK_STATUS(status, NT_STATUS_OK);
 598         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 599                 SEC_FILE_READ_DATA | SEC_FILE_READ_ATTRIBUTE);
 600         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 601
 602         torture_comment(tctx, "try open for generic write\n");
 603         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 604         status = smb_raw_open(cli->tree, tctx, &io);
 605         CHECK_STATUS(status, NT_STATUS_OK);
 606         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 607                 SEC_RIGHTS_FILE_WRITE | SEC_FILE_READ_ATTRIBUTE);
 608         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 609
 610         torture_comment(tctx, "try open for generic read\n");
 611         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 612         status = smb_raw_open(cli->tree, tctx, &io);
 613         CHECK_STATUS(status, NT_STATUS_OK);
 614         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 615                 SEC_RIGHTS_FILE_READ | SEC_FILE_READ_ATTRIBUTE);
 616         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 617
 618         torture_comment(tctx, "set DACL with 0 aces\n");
 619         ZERO_STRUCT(dacl);
 620         dacl.revision = SECURITY_ACL_REVISION_NT4;
 621         dacl.num_aces = 0;
 622         sd->dacl = &dacl;
 623
 624         s.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 625         s.set_secdesc.in.file.fnum = fnum;
 626         s.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 627         s.set_secdesc.in.sd = sd;
 628         status = smb_raw_setfileinfo(cli->tree, &s);
 629         CHECK_STATUS(status, NT_STATUS_OK);
 630
 631         torture_comment(tctx, "get the sd\n");
 632         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 633         q.query_secdesc.in.file.fnum = fnum;
 634         q.query_secdesc.in.secinfo_flags =
 635                 SECINFO_OWNER |
 636                 SECINFO_GROUP |
 637                 SECINFO_DACL;
 638         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 639         CHECK_STATUS(status, NT_STATUS_OK);
 640
 641         /* Testing the modified DACL */
 642         if (!(q.query_secdesc.out.sd->type & SEC_DESC_DACL_PRESENT)) {
 643                 ret = false;
 644                 torture_result(tctx, TORTURE_FAIL, "DACL_PRESENT flag not set by the server!\n");
 645                 goto done;
 646         }
 647         if (q.query_secdesc.out.sd->dacl == NULL) {
 648                 ret = false;
 649                 torture_result(tctx, TORTURE_FAIL, "no DACL has been created on the server!\n");
 650                 goto done;
 651         }
 652         if (q.query_secdesc.out.sd->dacl->num_aces != 0) {
 653                 ret = false;
 654                 torture_result(tctx, TORTURE_FAIL, "DACL has %u aces!\n",
 655                        q.query_secdesc.out.sd->dacl->num_aces);
 656                 goto done;
 657         }
 658
 659         torture_comment(tctx, "try open for read control\n");
 660         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL;
 661         status = smb_raw_open(cli->tree, tctx, &io);
 662         CHECK_STATUS(status, NT_STATUS_OK);
 663         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 664                 SEC_STD_READ_CONTROL | SEC_FILE_READ_ATTRIBUTE);
 665         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 666
 667         torture_comment(tctx, "try open for write => access_denied\n");
 668         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 669         status = smb_raw_open(cli->tree, tctx, &io);
 670         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 671
 672         torture_comment(tctx, "try open for read => access_denied\n");
 673         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 674         status = smb_raw_open(cli->tree, tctx, &io);
 675         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 676
 677         torture_comment(tctx, "try open for generic write => access_denied\n");
 678         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 679         status = smb_raw_open(cli->tree, tctx, &io);
 680         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 681
 682         torture_comment(tctx, "try open for generic read => access_denied\n");
 683         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 684         status = smb_raw_open(cli->tree, tctx, &io);
 685         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 686
 687         torture_comment(tctx, "set empty sd\n");
 688         sd->type &= ~SEC_DESC_DACL_PRESENT;
 689         sd->dacl = NULL;
 690
 691         s.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 692         s.set_secdesc.in.file.fnum = fnum;
 693         s.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 694         s.set_secdesc.in.sd = sd;
 695         status = smb_raw_setfileinfo(cli->tree, &s);
 696         CHECK_STATUS(status, NT_STATUS_OK);
 697
 698         torture_comment(tctx, "get the sd\n");
 699         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 700         q.query_secdesc.in.file.fnum = fnum;
 701         q.query_secdesc.in.secinfo_flags =
 702                 SECINFO_OWNER |
 703                 SECINFO_GROUP |
 704                 SECINFO_DACL;
 705         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 706         CHECK_STATUS(status, NT_STATUS_OK);
 707
 708         /* Testing the modified DACL */
 709         if (!(q.query_secdesc.out.sd->type & SEC_DESC_DACL_PRESENT)) {
 710                 ret = false;
 711                 torture_result(tctx, TORTURE_FAIL, "DACL_PRESENT flag not set by the server!\n");
 712                 goto done;
 713         }
 714         if (q.query_secdesc.out.sd->dacl != NULL) {
 715                 ret = false;
 716                 torture_result(tctx, TORTURE_FAIL, "DACL has been created on the server!\n");
 717                 goto done;
 718         }
 719 done:
 720         smbcli_close(cli->tree, fnum);
 721         smb_raw_exit(cli->session);
 722         smbcli_deltree(cli->tree, BASEDIR);
 723         return ret;
 724 }
 725
 726 /*
 727   test the behaviour of the well known SID_CREATOR_OWNER sid, and some generic
 728   mapping bits
 729   Test copied to smb2/acls.c for SMB2.
 730 */
 731 static bool test_creator_sid(struct torture_context *tctx,
 732                                                          struct smbcli_state *cli)
 733 {
 734         NTSTATUS status;
 735         union smb_open io;
 736         const char *fname = BASEDIR "\\creator.txt";
 737         bool ret = true;
 738         int fnum = -1;
 739         union smb_fileinfo q;
 740         union smb_setfileinfo set;
 741         struct security_descriptor *sd, *sd_orig, *sd2;
 742         const char *owner_sid;
 743
 744         if (!torture_setup_dir(cli, BASEDIR))
 745                 return false;
 746
 747         torture_comment(tctx, "TESTING SID_CREATOR_OWNER\n");
 748
 749         io.generic.level = RAW_OPEN_NTCREATEX;
 750         io.ntcreatex.in.root_fid.fnum = 0;
 751         io.ntcreatex.in.flags = 0;
 752         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC | SEC_STD_WRITE_OWNER;
 753         io.ntcreatex.in.create_options = 0;
 754         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 755         io.ntcreatex.in.share_access =
 756                 NTCREATEX_SHARE_ACCESS_READ |
 757                 NTCREATEX_SHARE_ACCESS_WRITE;
 758         io.ntcreatex.in.alloc_size = 0;
 759         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 760         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 761         io.ntcreatex.in.security_flags = 0;
 762         io.ntcreatex.in.fname = fname;
 763         status = smb_raw_open(cli->tree, tctx, &io);
 764         CHECK_STATUS(status, NT_STATUS_OK);
 765         fnum = io.ntcreatex.out.file.fnum;
 766
 767         torture_comment(tctx, "get the original sd\n");
 768         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 769         q.query_secdesc.in.file.fnum = fnum;
 770         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 771         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 772         CHECK_STATUS(status, NT_STATUS_OK);
 773         sd_orig = q.query_secdesc.out.sd;
 774
 775         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
 776
 777         torture_comment(tctx, "set a sec desc allowing no write by CREATOR_OWNER\n");
 778         sd = security_descriptor_dacl_create(tctx,
 779                                         0, NULL, NULL,
 780                                         SID_CREATOR_OWNER,
 781                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 782                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 783                                         0,
 784                                         NULL);
 785
 786         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 787         set.set_secdesc.in.file.fnum = fnum;
 788         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 789         set.set_secdesc.in.sd = sd;
 790
 791         status = smb_raw_setfileinfo(cli->tree, &set);
 792         CHECK_STATUS(status, NT_STATUS_OK);
 793
 794         torture_comment(tctx, "try open for write\n");
 795         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 796         status = smb_raw_open(cli->tree, tctx, &io);
 797         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 798
 799         torture_comment(tctx, "try open for read\n");
 800         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 801         status = smb_raw_open(cli->tree, tctx, &io);
 802         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 803
 804         torture_comment(tctx, "try open for generic write\n");
 805         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 806         status = smb_raw_open(cli->tree, tctx, &io);
 807         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 808
 809         torture_comment(tctx, "try open for generic read\n");
 810         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 811         status = smb_raw_open(cli->tree, tctx, &io);
 812         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 813
 814         torture_comment(tctx, "set a sec desc allowing no write by owner\n");
 815         sd = security_descriptor_dacl_create(tctx,
 816                                         0, owner_sid, NULL,
 817                                         owner_sid,
 818                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 819                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 820                                         0,
 821                                         NULL);
 822
 823         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 824         set.set_secdesc.in.file.fnum = fnum;
 825         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 826         set.set_secdesc.in.sd = sd;
 827         status = smb_raw_setfileinfo(cli->tree, &set);
 828         CHECK_STATUS(status, NT_STATUS_OK);
 829
 830         torture_comment(tctx, "check that sd has been mapped correctly\n");
 831         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 832         CHECK_STATUS(status, NT_STATUS_OK);
 833         CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd);
 834
 835         torture_comment(tctx, "try open for write\n");
 836         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 837         status = smb_raw_open(cli->tree, tctx, &io);
 838         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 839
 840         torture_comment(tctx, "try open for read\n");
 841         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 842         status = smb_raw_open(cli->tree, tctx, &io);
 843         CHECK_STATUS(status, NT_STATUS_OK);
 844         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 845                            SEC_FILE_READ_DATA|
 846                            SEC_FILE_READ_ATTRIBUTE);
 847         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 848
 849         torture_comment(tctx, "try open for generic write\n");
 850         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 851         status = smb_raw_open(cli->tree, tctx, &io);
 852         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 853
 854         torture_comment(tctx, "try open for generic read\n");
 855         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 856         status = smb_raw_open(cli->tree, tctx, &io);
 857         CHECK_STATUS(status, NT_STATUS_OK);
 858         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 859                            SEC_RIGHTS_FILE_READ);
 860         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 861
 862         torture_comment(tctx, "set a sec desc allowing generic read by owner\n");
 863         sd = security_descriptor_dacl_create(tctx,
 864                                         0, NULL, NULL,
 865                                         owner_sid,
 866                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 867                                         SEC_GENERIC_READ | SEC_STD_ALL,
 868                                         0,
 869                                         NULL);
 870
 871         set.set_secdesc.in.sd = sd;
 872         status = smb_raw_setfileinfo(cli->tree, &set);
 873         CHECK_STATUS(status, NT_STATUS_OK);
 874
 875         torture_comment(tctx, "check that generic read has been mapped correctly\n");
 876         sd2 = security_descriptor_dacl_create(tctx,
 877                                          0, owner_sid, NULL,
 878                                          owner_sid,
 879                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
 880                                          SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 881                                          0,
 882                                          NULL);
 883
 884         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 885         CHECK_STATUS(status, NT_STATUS_OK);
 886         CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd2);
 887
 888         torture_comment(tctx, "try open for write\n");
 889         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 890         status = smb_raw_open(cli->tree, tctx, &io);
 891         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 892
 893         torture_comment(tctx, "try open for read\n");
 894         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 895         status = smb_raw_open(cli->tree, tctx, &io);
 896         CHECK_STATUS(status, NT_STATUS_OK);
 897         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 898                            SEC_FILE_READ_DATA |
 899                            SEC_FILE_READ_ATTRIBUTE);
 900         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 901
 902         torture_comment(tctx, "try open for generic write\n");
 903         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 904         status = smb_raw_open(cli->tree, tctx, &io);
 905         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 906
 907         torture_comment(tctx, "try open for generic read\n");
 908         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 909         status = smb_raw_open(cli->tree, tctx, &io);
 910         CHECK_STATUS(status, NT_STATUS_OK);
 911         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum, SEC_RIGHTS_FILE_READ);
 912         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 913
 914
 915         torture_comment(tctx, "put back original sd\n");
 916         set.set_secdesc.in.sd = sd_orig;
 917         status = smb_raw_setfileinfo(cli->tree, &set);
 918         CHECK_STATUS(status, NT_STATUS_OK);
 919
 920
 921 done:
 922         smbcli_close(cli->tree, fnum);
 923         smb_raw_exit(cli->session);
 924         smbcli_deltree(cli->tree, BASEDIR);
 925         return ret;
 926 }
 927
 928
 929 /*
 930   test the mapping of the SEC_GENERIC_xx bits to SEC_STD_xx and
 931   SEC_FILE_xx bits
 932   Test copied to smb2/acls.c for SMB2.
 933 */
 934 static bool test_generic_bits(struct torture_context *tctx,
 935                                                           struct smbcli_state *cli)
 936 {
 937         NTSTATUS status;
 938         union smb_open io;
 939         const char *fname = BASEDIR "\\generic.txt";
 940         bool ret = true;
 941         int fnum = -1, i;
 942         union smb_fileinfo q;
 943         union smb_setfileinfo set;
 944         struct security_descriptor *sd, *sd_orig, *sd2;
 945         const char *owner_sid;
 946         const struct {
 947                 uint32_t gen_bits;
 948                 uint32_t specific_bits;
 949         } file_mappings[] = {
 950                 { 0,                       0 },
 951                 { SEC_GENERIC_READ,        SEC_RIGHTS_FILE_READ },
 952                 { SEC_GENERIC_WRITE,       SEC_RIGHTS_FILE_WRITE },
 953                 { SEC_GENERIC_EXECUTE,     SEC_RIGHTS_FILE_EXECUTE },
 954                 { SEC_GENERIC_ALL,         SEC_RIGHTS_FILE_ALL },
 955                 { SEC_FILE_READ_DATA,      SEC_FILE_READ_DATA },
 956                 { SEC_FILE_READ_ATTRIBUTE, SEC_FILE_READ_ATTRIBUTE }
 957         };
 958         const struct {
 959                 uint32_t gen_bits;
 960                 uint32_t specific_bits;
 961         } dir_mappings[] = {
 962                 { 0,                   0 },
 963                 { SEC_GENERIC_READ,    SEC_RIGHTS_DIR_READ },
 964                 { SEC_GENERIC_WRITE,   SEC_RIGHTS_DIR_WRITE },
 965                 { SEC_GENERIC_EXECUTE, SEC_RIGHTS_DIR_EXECUTE },
 966                 { SEC_GENERIC_ALL,     SEC_RIGHTS_DIR_ALL }
 967         };
 968         bool has_restore_privilege;
 969         bool has_take_ownership_privilege;
 970
 971         if (!torture_setup_dir(cli, BASEDIR))
 972                 return false;
 973
 974         torture_comment(tctx, "TESTING FILE GENERIC BITS\n");
 975
 976         io.generic.level = RAW_OPEN_NTCREATEX;
 977         io.ntcreatex.in.root_fid.fnum = 0;
 978         io.ntcreatex.in.flags = 0;
 979         io.ntcreatex.in.access_mask =
 980                 SEC_STD_READ_CONTROL |
 981                 SEC_STD_WRITE_DAC |
 982                 SEC_STD_WRITE_OWNER;
 983         io.ntcreatex.in.create_options = 0;
 984         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 985         io.ntcreatex.in.share_access =
 986                 NTCREATEX_SHARE_ACCESS_READ |
 987                 NTCREATEX_SHARE_ACCESS_WRITE;
 988         io.ntcreatex.in.alloc_size = 0;
 989         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 990         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 991         io.ntcreatex.in.security_flags = 0;
 992         io.ntcreatex.in.fname = fname;
 993         status = smb_raw_open(cli->tree, tctx, &io);
 994         CHECK_STATUS(status, NT_STATUS_OK);
 995         fnum = io.ntcreatex.out.file.fnum;
 996
 997         torture_comment(tctx, "get the original sd\n");
 998         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 999         q.query_secdesc.in.file.fnum = fnum;
1000         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1001         status = smb_raw_fileinfo(cli->tree, tctx, &q);
1002         CHECK_STATUS(status, NT_STATUS_OK);
1003         sd_orig = q.query_secdesc.out.sd;
1004
1005         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
1006
1007         status = torture_check_privilege(cli,
1008                                             owner_sid,
1009                                             sec_privilege_name(SEC_PRIV_RESTORE));
1010         has_restore_privilege = NT_STATUS_IS_OK(status);
1011         if (!NT_STATUS_IS_OK(status)) {
1012                 torture_warning(tctx, "torture_check_privilege - %s\n",
1013                     nt_errstr(status));
1014         }
1015         torture_comment(tctx, "SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
1016
1017         status = torture_check_privilege(cli,
1018                                             owner_sid,
1019                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
1020         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
1021         if (!NT_STATUS_IS_OK(status)) {
1022                 torture_warning(tctx, "torture_check_privilege - %s\n",
1023                     nt_errstr(status));
1024         }
1025         torture_comment(tctx, "SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_take_ownership_privilege?"Yes":"No");
1026
1027         for (i=0;i<ARRAY_SIZE(file_mappings);i++) {
1028                 uint32_t expected_mask =
1029                         SEC_STD_WRITE_DAC |
1030                         SEC_STD_READ_CONTROL |
1031                         SEC_FILE_READ_ATTRIBUTE |
1032                         SEC_STD_DELETE;
1033                 uint32_t expected_mask_anon = SEC_FILE_READ_ATTRIBUTE;
1034
1035                 if (has_restore_privilege) {
1036                         expected_mask_anon |= SEC_STD_DELETE;
1037                 }
1038
1039                 torture_comment(tctx, "Testing generic bits 0x%08x\n",
1040                        file_mappings[i].gen_bits);
1041                 sd = security_descriptor_dacl_create(tctx,
1042                                                 0, owner_sid, NULL,
1043                                                 owner_sid,
1044                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1045                                                 file_mappings[i].gen_bits,
1046                                                 0,
1047                                                 NULL);
1048
1049                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1050                 set.set_secdesc.in.file.fnum = fnum;
1051                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1052                 set.set_secdesc.in.sd = sd;
1053
1054                 status = smb_raw_setfileinfo(cli->tree, &set);
1055                 CHECK_STATUS(status, NT_STATUS_OK);
1056
1057                 sd2 = security_descriptor_dacl_create(tctx,
1058                                                  0, owner_sid, NULL,
1059                                                  owner_sid,
1060                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
1061                                                  file_mappings[i].specific_bits,
1062                                                  0,
1063                                                  NULL);
1064
1065                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
1066                 CHECK_STATUS(status, NT_STATUS_OK);
1067                 CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd2);
1068
1069                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1070                 status = smb_raw_open(cli->tree, tctx, &io);
1071                 CHECK_STATUS(status, NT_STATUS_OK);
1072                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
1073                                    expected_mask | file_mappings[i].specific_bits);
1074                 smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
1075
1076                 if (!has_take_ownership_privilege) {
1077                         continue;
1078                 }
1079
1080                 torture_comment(tctx, "Testing generic bits 0x%08x (anonymous)\n",
1081                        file_mappings[i].gen_bits);
1082                 sd = security_descriptor_dacl_create(tctx,
1083                                                 0, SID_NT_ANONYMOUS, NULL,
1084                                                 owner_sid,
1085                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1086                                                 file_mappings[i].gen_bits,
1087                                                 0,
1088                                                 NULL);
1089
1090                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1091                 set.set_secdesc.in.file.fnum = fnum;
1092                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1093                 set.set_secdesc.in.sd = sd;
1094
1095                 status = smb_raw_setfileinfo(cli->tree, &set);
1096                 CHECK_STATUS(status, NT_STATUS_OK);
1097
1098                 sd2 = security_descriptor_dacl_create(tctx,
1099                                                  0, SID_NT_ANONYMOUS, NULL,
1100                                                  owner_sid,
1101                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
1102                                                  file_mappings[i].specific_bits,
1103                                                  0,
1104                                                  NULL);
1105
1106                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
1107                 CHECK_STATUS(status, NT_STATUS_OK);
1108                 CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd2);
1109
1110                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1111                 status = smb_raw_open(cli->tree, tctx, &io);
1112                 CHECK_STATUS(status, NT_STATUS_OK);
1113                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
1114                                    expected_mask_anon | file_mappings[i].specific_bits);
1115                 smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
1116         }
1117
1118         torture_comment(tctx, "put back original sd\n");
1119         set.set_secdesc.in.sd = sd_orig;
1120         status = smb_raw_setfileinfo(cli->tree, &set);
1121         CHECK_STATUS(status, NT_STATUS_OK);
1122
1123         smbcli_close(cli->tree, fnum);
1124         smbcli_unlink(cli->tree, fname);
1125
1126
1127         torture_comment(tctx, "TESTING DIR GENERIC BITS\n");
1128
1129         io.generic.level = RAW_OPEN_NTCREATEX;
1130         io.ntcreatex.in.root_fid.fnum = 0;
1131         io.ntcreatex.in.flags = 0;
1132         io.ntcreatex.in.access_mask =
1133                 SEC_STD_READ_CONTROL |
1134                 SEC_STD_WRITE_DAC |
1135                 SEC_STD_WRITE_OWNER;
1136         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1137         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
1138         io.ntcreatex.in.share_access =
1139                 NTCREATEX_SHARE_ACCESS_READ |
1140                 NTCREATEX_SHARE_ACCESS_WRITE;
1141         io.ntcreatex.in.alloc_size = 0;
1142         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
1143         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
1144         io.ntcreatex.in.security_flags = 0;
1145         io.ntcreatex.in.fname = fname;
1146         status = smb_raw_open(cli->tree, tctx, &io);
1147         CHECK_STATUS(status, NT_STATUS_OK);
1148         fnum = io.ntcreatex.out.file.fnum;
1149
1150         torture_comment(tctx, "get the original sd\n");
1151         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
1152         q.query_secdesc.in.file.fnum = fnum;
1153         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1154         status = smb_raw_fileinfo(cli->tree, tctx, &q);
1155         CHECK_STATUS(status, NT_STATUS_OK);
1156         sd_orig = q.query_secdesc.out.sd;
1157
1158         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
1159
1160         status = torture_check_privilege(cli,
1161                                             owner_sid,
1162                                             sec_privilege_name(SEC_PRIV_RESTORE));
1163         has_restore_privilege = NT_STATUS_IS_OK(status);
1164         if (!NT_STATUS_IS_OK(status)) {
1165                 torture_warning(tctx, "torture_check_privilege - %s\n",
1166                     nt_errstr(status));
1167         }
1168         torture_comment(tctx, "SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
1169
1170         status = torture_check_privilege(cli,
1171                                             owner_sid,
1172                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
1173         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
1174         if (!NT_STATUS_IS_OK(status)) {
1175                 torture_warning(tctx, "torture_check_privilege - %s\n",
1176                     nt_errstr(status));
1177         }
1178         torture_comment(tctx, "SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_take_ownership_privilege?"Yes":"No");
1179
1180         for (i=0;i<ARRAY_SIZE(dir_mappings);i++) {
1181                 uint32_t expected_mask =
1182                         SEC_STD_WRITE_DAC |
1183                         SEC_STD_READ_CONTROL |
1184                         SEC_FILE_READ_ATTRIBUTE |
1185                         SEC_STD_DELETE;
1186                 uint32_t expected_mask_anon = SEC_FILE_READ_ATTRIBUTE;
1187
1188                 if (has_restore_privilege) {
1189                         expected_mask_anon |= SEC_STD_DELETE;
1190                 }
1191
1192                 torture_comment(tctx, "Testing generic bits 0x%08x\n",
1193                        file_mappings[i].gen_bits);
1194                 sd = security_descriptor_dacl_create(tctx,
1195                                                 0, owner_sid, NULL,
1196                                                 owner_sid,
1197                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1198                                                 dir_mappings[i].gen_bits,
1199                                                 0,
1200                                                 NULL);
1201
1202                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1203                 set.set_secdesc.in.file.fnum = fnum;
1204                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1205                 set.set_secdesc.in.sd = sd;
1206
1207                 status = smb_raw_setfileinfo(cli->tree, &set);
1208                 CHECK_STATUS(status, NT_STATUS_OK);
1209
1210                 sd2 = security_descriptor_dacl_create(tctx,
1211                                                  0, owner_sid, NULL,
1212                                                  owner_sid,
1213                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
1214                                                  dir_mappings[i].specific_bits,
1215                                                  0,
1216                                                  NULL);
1217
1218                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
1219                 CHECK_STATUS(status, NT_STATUS_OK);
1220                 CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd2);
1221
1222                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1223                 status = smb_raw_open(cli->tree, tctx, &io);
1224                 CHECK_STATUS(status, NT_STATUS_OK);
1225                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
1226                                    expected_mask | dir_mappings[i].specific_bits);
1227                 smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
1228
1229                 if (!has_take_ownership_privilege) {
1230                         continue;
1231                 }
1232
1233                 torture_comment(tctx, "Testing generic bits 0x%08x (anonymous)\n",
1234                        file_mappings[i].gen_bits);
1235                 sd = security_descriptor_dacl_create(tctx,
1236                                                 0, SID_NT_ANONYMOUS, NULL,
1237                                                 owner_sid,
1238                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1239                                                 file_mappings[i].gen_bits,
1240                                                 0,
1241                                                 NULL);
1242
1243                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1244                 set.set_secdesc.in.file.fnum = fnum;
1245                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1246                 set.set_secdesc.in.sd = sd;
1247
1248                 status = smb_raw_setfileinfo(cli->tree, &set);
1249                 CHECK_STATUS(status, NT_STATUS_OK);
1250
1251                 sd2 = security_descriptor_dacl_create(tctx,
1252                                                  0, SID_NT_ANONYMOUS, NULL,
1253                                                  owner_sid,
1254                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
1255                                                  file_mappings[i].specific_bits,
1256                                                  0,
1257                                                  NULL);
1258
1259                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
1260                 CHECK_STATUS(status, NT_STATUS_OK);
1261                 CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd2);
1262
1263                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1264                 status = smb_raw_open(cli->tree, tctx, &io);
1265                 CHECK_STATUS(status, NT_STATUS_OK);
1266                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
1267                                    expected_mask_anon | dir_mappings[i].specific_bits);
1268                 smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
1269         }
1270
1271         torture_comment(tctx, "put back original sd\n");
1272         set.set_secdesc.in.sd = sd_orig;
1273         status = smb_raw_setfileinfo(cli->tree, &set);
1274         CHECK_STATUS(status, NT_STATUS_OK);
1275
1276         smbcli_close(cli->tree, fnum);
1277         smbcli_unlink(cli->tree, fname);
1278
1279 done:
1280         smbcli_close(cli->tree, fnum);
1281         smb_raw_exit(cli->session);
1282         smbcli_deltree(cli->tree, BASEDIR);
1283         return ret;
1284 }
1285
1286
1287 /*
1288   see what access bits the owner of a file always gets
1289   Test copied to smb2/acls.c for SMB2.
1290 */
1291 static bool test_owner_bits(struct torture_context *tctx,
1292                                                         struct smbcli_state *cli)
1293 {
1294         NTSTATUS status;
1295         union smb_open io;
1296         const char *fname = BASEDIR "\\test_owner_bits.txt";
1297         bool ret = true;
1298         int fnum = -1, i;
1299         union smb_fileinfo q;
1300         union smb_setfileinfo set;
1301         struct security_descriptor *sd, *sd_orig;
1302         const char *owner_sid;
1303         bool has_restore_privilege;
1304         bool has_take_ownership_privilege;
1305         uint32_t expected_bits;
1306
1307         if (!torture_setup_dir(cli, BASEDIR))
1308                 return false;
1309
1310         torture_comment(tctx, "TESTING FILE OWNER BITS\n");
1311
1312         io.generic.level = RAW_OPEN_NTCREATEX;
1313         io.ntcreatex.in.root_fid.fnum = 0;
1314         io.ntcreatex.in.flags = 0;
1315         io.ntcreatex.in.access_mask =
1316                 SEC_STD_READ_CONTROL |
1317                 SEC_STD_WRITE_DAC |
1318                 SEC_STD_WRITE_OWNER;
1319         io.ntcreatex.in.create_options = 0;
1320         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
1321         io.ntcreatex.in.share_access =
1322                 NTCREATEX_SHARE_ACCESS_READ |
1323                 NTCREATEX_SHARE_ACCESS_WRITE;
1324         io.ntcreatex.in.alloc_size = 0;
1325         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
1326         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
1327         io.ntcreatex.in.security_flags = 0;
1328         io.ntcreatex.in.fname = fname;
1329         status = smb_raw_open(cli->tree, tctx, &io);
1330         CHECK_STATUS(status, NT_STATUS_OK);
1331         fnum = io.ntcreatex.out.file.fnum;
1332
1333         torture_comment(tctx, "get the original sd\n");
1334         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
1335         q.query_secdesc.in.file.fnum = fnum;
1336         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1337         status = smb_raw_fileinfo(cli->tree, tctx, &q);
1338         CHECK_STATUS(status, NT_STATUS_OK);
1339         sd_orig = q.query_secdesc.out.sd;
1340
1341         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
1342
1343         status = torture_check_privilege(cli,
1344                                             owner_sid,
1345                                             sec_privilege_name(SEC_PRIV_RESTORE));
1346         has_restore_privilege = NT_STATUS_IS_OK(status);
1347         if (!NT_STATUS_IS_OK(status)) {
1348                 torture_warning(tctx, "torture_check_privilege - %s\n", nt_errstr(status));
1349         }
1350         torture_comment(tctx, "SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
1351
1352         status = torture_check_privilege(cli,
1353                                             owner_sid,
1354                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
1355         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
1356         if (!NT_STATUS_IS_OK(status)) {
1357                 torture_warning(tctx, "torture_check_privilege - %s\n", nt_errstr(status));
1358         }
1359         torture_comment(tctx, "SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_take_ownership_privilege?"Yes":"No");
1360
1361         sd = security_descriptor_dacl_create(tctx,
1362                                         0, NULL, NULL,
1363                                         owner_sid,
1364                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1365                                         SEC_FILE_WRITE_DATA,
1366                                         0,
1367                                         NULL);
1368
1369         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1370         set.set_secdesc.in.file.fnum = fnum;
1371         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1372         set.set_secdesc.in.sd = sd;
1373
1374         status = smb_raw_setfileinfo(cli->tree, &set);
1375         CHECK_STATUS(status, NT_STATUS_OK);
1376
1377         expected_bits = SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE;
1378
1379         for (i=0;i<16;i++) {
1380                 uint32_t bit = (1<<i);
1381                 io.ntcreatex.in.access_mask = bit;
1382                 status = smb_raw_open(cli->tree, tctx, &io);
1383                 if (expected_bits & bit) {
1384                         if (!NT_STATUS_IS_OK(status)) {
1385                                 torture_warning(tctx, "failed with access mask 0x%08x of expected 0x%08x\n",
1386                                        bit, expected_bits);
1387                         }
1388                         CHECK_STATUS(status, NT_STATUS_OK);
1389                         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum, bit | SEC_FILE_READ_ATTRIBUTE);
1390                         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
1391                 } else {
1392                         if (NT_STATUS_IS_OK(status)) {
1393                                 torture_warning(tctx, "open succeeded with access mask 0x%08x of "
1394                                         "expected 0x%08x - should fail\n",
1395                                        bit, expected_bits);
1396                         }
1397                         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1398                 }
1399         }
1400
1401         torture_comment(tctx, "put back original sd\n");
1402         set.set_secdesc.in.sd = sd_orig;
1403         status = smb_raw_setfileinfo(cli->tree, &set);
1404         CHECK_STATUS(status, NT_STATUS_OK);
1405
1406 done:
1407         smbcli_close(cli->tree, fnum);
1408         smbcli_unlink(cli->tree, fname);
1409         smb_raw_exit(cli->session);
1410         smbcli_deltree(cli->tree, BASEDIR);
1411         return ret;
1412 }
1413
1414
1415
1416 /*
1417   test the inheritance of ACL flags onto new files and directories
1418   Test copied to smb2/acls.c for SMB2.
1419 */
1420 static bool test_inheritance(struct torture_context *tctx,
1421                                                          struct smbcli_state *cli)
1422 {
1423         NTSTATUS status;
1424         union smb_open io;
1425         const char *dname = BASEDIR "\\inheritance";
1426         const char *fname1 = BASEDIR "\\inheritance\\testfile";
1427         const char *fname2 = BASEDIR "\\inheritance\\testdir";
1428         bool ret = true;
1429         int fnum=0, fnum2, i;
1430         union smb_fileinfo q;
1431         union smb_setfileinfo set;
1432         struct security_descriptor *sd, *sd2, *sd_orig=NULL, *sd_def1, *sd_def2;
1433         const char *owner_sid, *group_sid;
1434         const struct dom_sid *creator_owner;
1435         const struct {
1436                 uint32_t parent_flags;
1437                 uint32_t file_flags;
1438                 uint32_t dir_flags;
1439         } test_flags[] = {
1440                 {
1441                         0,
1442                         0,
1443                         0
1444                 },
1445                 {
1446                         SEC_ACE_FLAG_OBJECT_INHERIT,
1447                         0,
1448                         SEC_ACE_FLAG_OBJECT_INHERIT |
1449                         SEC_ACE_FLAG_INHERIT_ONLY,
1450                 },
1451                 {
1452                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1453                         0,
1454                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1455                 },
1456                 {
1457                         SEC_ACE_FLAG_OBJECT_INHERIT |
1458                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1459                         0,
1460                         SEC_ACE_FLAG_OBJECT_INHERIT |
1461                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1462                 },
1463                 {
1464                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
1465                         0,
1466                         0,
1467                 },
1468                 {
1469                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1470                         SEC_ACE_FLAG_OBJECT_INHERIT,
1471                         0,
1472                         0,
1473                 },
1474                 {
1475                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1476                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1477                         0,
1478                         0,
1479                 },
1480                 {
1481                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1482                         SEC_ACE_FLAG_CONTAINER_INHERIT |
1483                         SEC_ACE_FLAG_OBJECT_INHERIT,
1484                         0,
1485                         0,
1486                 },
1487                 {
1488                         SEC_ACE_FLAG_INHERIT_ONLY,
1489                         0,
1490                         0,
1491                 },
1492                 {
1493                         SEC_ACE_FLAG_INHERIT_ONLY |
1494                         SEC_ACE_FLAG_OBJECT_INHERIT,
1495                         0,
1496                         SEC_ACE_FLAG_OBJECT_INHERIT |
1497                         SEC_ACE_FLAG_INHERIT_ONLY,
1498                 },
1499                 {
1500                         SEC_ACE_FLAG_INHERIT_ONLY |
1501                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1502                         0,
1503                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1504                 },
1505                 {
1506                         SEC_ACE_FLAG_INHERIT_ONLY |
1507                         SEC_ACE_FLAG_CONTAINER_INHERIT |
1508                         SEC_ACE_FLAG_OBJECT_INHERIT,
1509                         0,
1510                         SEC_ACE_FLAG_CONTAINER_INHERIT |
1511                         SEC_ACE_FLAG_OBJECT_INHERIT,
1512                 },
1513                 {
1514                         SEC_ACE_FLAG_INHERIT_ONLY |
1515                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
1516                         0,
1517                         0,
1518                 },
1519                 {
1520                         SEC_ACE_FLAG_INHERIT_ONLY |
1521                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1522                         SEC_ACE_FLAG_OBJECT_INHERIT,
1523                         0,
1524                         0,
1525                 },
1526                 {
1527                         SEC_ACE_FLAG_INHERIT_ONLY |
1528                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1529                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1530                         0,
1531                         0,
1532                 },
1533                 {
1534                         SEC_ACE_FLAG_INHERIT_ONLY |
1535                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1536                         SEC_ACE_FLAG_CONTAINER_INHERIT |
1537                         SEC_ACE_FLAG_OBJECT_INHERIT,
1538                         0,
1539                         0,
1540                 }
1541         };
1542
1543         if (!torture_setup_dir(cli, BASEDIR))
1544                 return false;
1545
1546         torture_comment(tctx, "TESTING ACL INHERITANCE\n");
1547
1548         io.generic.level = RAW_OPEN_NTCREATEX;
1549         io.ntcreatex.in.root_fid.fnum = 0;
1550         io.ntcreatex.in.flags = 0;
1551         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1552         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1553         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
1554         io.ntcreatex.in.share_access = 0;
1555         io.ntcreatex.in.alloc_size = 0;
1556         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1557         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
1558         io.ntcreatex.in.security_flags = 0;
1559         io.ntcreatex.in.fname = dname;
1560
1561         status = smb_raw_open(cli->tree, tctx, &io);
1562         CHECK_STATUS(status, NT_STATUS_OK);
1563         fnum = io.ntcreatex.out.file.fnum;
1564
1565         torture_comment(tctx, "get the original sd\n");
1566         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
1567         q.query_secdesc.in.file.fnum = fnum;
1568         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER | SECINFO_GROUP;
1569         status = smb_raw_fileinfo(cli->tree, tctx, &q);
1570         CHECK_STATUS(status, NT_STATUS_OK);
1571         sd_orig = q.query_secdesc.out.sd;
1572
1573         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
1574         group_sid = dom_sid_string(tctx, sd_orig->group_sid);
1575
1576         torture_comment(tctx, "owner_sid is %s\n", owner_sid);
1577         torture_comment(tctx, "group_sid is %s\n", group_sid);
1578
1579         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1580
1581         if (torture_setting_bool(tctx, "samba4", false)) {
1582                 /* the default ACL in Samba4 includes the group and
1583                    other permissions */
1584                 sd_def1 = security_descriptor_dacl_create(tctx,
1585                                                          0, owner_sid, NULL,
1586                                                          owner_sid,
1587                                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
1588                                                          SEC_RIGHTS_FILE_ALL,
1589                                                          0,
1590                                                          group_sid,
1591                                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
1592                                                          SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE,
1593                                                          0,
1594                                                          SID_WORLD,
1595                                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
1596                                                          SEC_RIGHTS_FILE_READ | SEC_FILE_EXECUTE,
1597                                                          0,
1598                                                          SID_NT_SYSTEM,
1599                                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
1600                                                          SEC_RIGHTS_FILE_ALL,
1601                                                          0,
1602                                                          NULL);
1603         } else {
1604                 /*
1605                  * The Windows Default ACL for a new file, when there is no ACL to be
1606                  * inherited: FullControl for the owner and SYSTEM.
1607                  */
1608                 sd_def1 = security_descriptor_dacl_create(tctx,
1609                                                          0, owner_sid, NULL,
1610                                                          owner_sid,
1611                                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
1612                                                          SEC_RIGHTS_FILE_ALL,
1613                                                          0,
1614                                                          SID_NT_SYSTEM,
1615                                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
1616                                                          SEC_RIGHTS_FILE_ALL,
1617                                                          0,
1618                                                          NULL);
1619         }
1620
1621         /*
1622          * Use this in the case the system being tested does not add an ACE for
1623          * the SYSTEM SID.
1624          */
1625         sd_def2 = security_descriptor_dacl_create(tctx,
1626                                             0, owner_sid, NULL,
1627                                             owner_sid,
1628                                             SEC_ACE_TYPE_ACCESS_ALLOWED,
1629                                             SEC_RIGHTS_FILE_ALL,
1630                                             0,
1631                                             NULL);
1632
1633         creator_owner = dom_sid_parse_talloc(tctx, SID_CREATOR_OWNER);
1634
1635         for (i=0;i<ARRAY_SIZE(test_flags);i++) {
1636                 sd = security_descriptor_dacl_create(tctx,
1637                                                 0, NULL, NULL,
1638                                                 SID_CREATOR_OWNER,
1639                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1640                                                 SEC_FILE_WRITE_DATA,
1641                                                 test_flags[i].parent_flags,
1642                                                 SID_WORLD,
1643                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1644                                                 SEC_FILE_ALL | SEC_STD_ALL,
1645                                                 0,
1646                                                 NULL);
1647                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1648                 set.set_secdesc.in.file.fnum = fnum;
1649                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1650                 set.set_secdesc.in.sd = sd;
1651                 status = smb_raw_setfileinfo(cli->tree, &set);
1652                 CHECK_STATUS(status, NT_STATUS_OK);
1653
1654                 io.ntcreatex.in.fname = fname1;
1655                 io.ntcreatex.in.create_options = 0;
1656                 status = smb_raw_open(cli->tree, tctx, &io);
1657                 CHECK_STATUS(status, NT_STATUS_OK);
1658                 fnum2 = io.ntcreatex.out.file.fnum;
1659
1660                 q.query_secdesc.in.file.fnum = fnum2;
1661                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
1662                 CHECK_STATUS(status, NT_STATUS_OK);
1663
1664                 smbcli_close(cli->tree, fnum2);
1665                 smbcli_unlink(cli->tree, fname1);
1666
1667                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
1668                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def1) &&
1669                             !security_descriptor_equal(q.query_secdesc.out.sd, sd_def2)) {
1670                                 torture_warning(tctx, "Expected default sd "
1671                                     "for i=%d:\n", i);
1672                                 NDR_PRINT_DEBUG(security_descriptor, sd_def1);
1673                                 torture_warning(tctx, "at %d - got:\n", i);
1674                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1675                         }
1676                         goto check_dir;
1677                 }
1678
1679                 if (q.query_secdesc.out.sd->dacl == NULL ||
1680                     q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1681                     q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1682                     !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1683                                    sd_orig->owner_sid)) {
1684                         ret = false;
1685                         torture_warning(tctx, "Bad sd in child file at %d\n", i);
1686                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1687                         goto check_dir;
1688                 }
1689
1690                 if (q.query_secdesc.out.sd->dacl->aces[0].flags !=
1691                     test_flags[i].file_flags) {
1692                         torture_warning(tctx, "incorrect file_flags 0x%x - expected 0x%x for parent 0x%x with (i=%d)\n",
1693                                q.query_secdesc.out.sd->dacl->aces[0].flags,
1694                                test_flags[i].file_flags,
1695                                test_flags[i].parent_flags,
1696                                i);
1697                         ret = false;
1698                 }
1699
1700         check_dir:
1701                 io.ntcreatex.in.fname = fname2;
1702                 io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1703                 status = smb_raw_open(cli->tree, tctx, &io);
1704                 CHECK_STATUS(status, NT_STATUS_OK);
1705                 fnum2 = io.ntcreatex.out.file.fnum;
1706
1707                 q.query_secdesc.in.file.fnum = fnum2;
1708                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
1709                 CHECK_STATUS(status, NT_STATUS_OK);
1710
1711                 smbcli_close(cli->tree, fnum2);
1712                 smbcli_rmdir(cli->tree, fname2);
1713
1714                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) &&
1715                     (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT) ||
1716                      (test_flags[i].parent_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT))) {
1717                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def1) &&
1718                             !security_descriptor_equal(q.query_secdesc.out.sd, sd_def2)) {
1719                                 torture_warning(tctx, "Expected default sd for dir at %d:\n", i);
1720                                 NDR_PRINT_DEBUG(security_descriptor, sd_def1);
1721                                 torture_warning(tctx, "got:\n");
1722                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1723                         }
1724                         continue;
1725                 }
1726
1727                 if ((test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) &&
1728                     (test_flags[i].parent_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)) {
1729                         if (q.query_secdesc.out.sd->dacl == NULL ||
1730                             q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1731                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1732                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1733                                            sd_orig->owner_sid) ||
1734                             q.query_secdesc.out.sd->dacl->aces[0].flags != test_flags[i].dir_flags) {
1735                                 torture_warning(tctx, "(CI & NP) Bad sd in child dir - expected 0x%x for parent 0x%x (i=%d)\n",
1736                                        test_flags[i].dir_flags,
1737                                        test_flags[i].parent_flags, i);
1738                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1739                                 torture_comment(tctx, "FYI, here is the parent sd:\n");
1740                                 NDR_PRINT_DEBUG(security_descriptor, sd);
1741                                 ret = false;
1742                                 continue;
1743                         }
1744                 } else if (test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
1745                         if (q.query_secdesc.out.sd->dacl == NULL ||
1746                             q.query_secdesc.out.sd->dacl->num_aces != 2 ||
1747                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1748                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1749                                            sd_orig->owner_sid) ||
1750                             q.query_secdesc.out.sd->dacl->aces[1].access_mask != SEC_FILE_WRITE_DATA ||
1751                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[1].trustee,
1752                                            creator_owner) ||
1753                             q.query_secdesc.out.sd->dacl->aces[0].flags != 0 ||
1754                             q.query_secdesc.out.sd->dacl->aces[1].flags !=
1755                             (test_flags[i].dir_flags | SEC_ACE_FLAG_INHERIT_ONLY)) {
1756                                 torture_warning(tctx, "(CI) Bad sd in child dir - expected 0x%x for parent 0x%x (i=%d)\n",
1757                                        test_flags[i].dir_flags,
1758                                        test_flags[i].parent_flags, i);
1759                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1760                                 torture_comment(tctx, "FYI, here is the parent sd:\n");
1761                                 NDR_PRINT_DEBUG(security_descriptor, sd);
1762                                 ret = false;
1763                                 continue;
1764                         }
1765                 } else {
1766                         if (q.query_secdesc.out.sd->dacl == NULL ||
1767                             q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1768                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1769                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1770                                            creator_owner) ||
1771                             q.query_secdesc.out.sd->dacl->aces[0].flags != test_flags[i].dir_flags) {
1772                                 torture_warning(tctx, "(0) Bad sd in child dir - expected 0x%x for parent 0x%x (i=%d)\n",
1773                                        test_flags[i].dir_flags,
1774                                        test_flags[i].parent_flags, i);
1775                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1776                                 torture_comment(tctx, "FYI, here is the parent sd:\n");
1777                                 NDR_PRINT_DEBUG(security_descriptor, sd);
1778                                 ret = false;
1779                                 continue;
1780                         }
1781                 }
1782         }
1783
1784         torture_comment(tctx, "Testing access checks on inherited create with %s\n", fname1);
1785         sd = security_descriptor_dacl_create(tctx,
1786                                         0, NULL, NULL,
1787                                         owner_sid,
1788                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1789                                         SEC_FILE_WRITE_DATA | SEC_STD_WRITE_DAC,
1790                                         SEC_ACE_FLAG_OBJECT_INHERIT,
1791                                         SID_WORLD,
1792                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1793                                         SEC_FILE_ALL | SEC_STD_ALL,
1794                                         0,
1795                                         NULL);
1796         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1797         set.set_secdesc.in.file.fnum = fnum;
1798         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1799         set.set_secdesc.in.sd = sd;
1800         status = smb_raw_setfileinfo(cli->tree, &set);
1801         CHECK_STATUS(status, NT_STATUS_OK);
1802
1803         /* Check DACL we just set. */
1804         torture_comment(tctx, "checking new sd\n");
1805         q.query_secdesc.in.file.fnum = fnum;
1806         q.query_secdesc.in.secinfo_flags = SECINFO_DACL;
1807         status = smb_raw_fileinfo(cli->tree, tctx, &q);
1808         CHECK_STATUS(status, NT_STATUS_OK);
1809         CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd);
1810
1811         io.ntcreatex.in.fname = fname1;
1812         io.ntcreatex.in.create_options = 0;
1813         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1814         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1815         status = smb_raw_open(cli->tree, tctx, &io);
1816         CHECK_STATUS(status, NT_STATUS_OK);
1817         fnum2 = io.ntcreatex.out.file.fnum;
1818         CHECK_ACCESS_FLAGS(fnum2, SEC_RIGHTS_FILE_ALL);
1819
1820         q.query_secdesc.in.file.fnum = fnum2;
1821         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1822         status = smb_raw_fileinfo(cli->tree, tctx, &q);
1823         CHECK_STATUS(status, NT_STATUS_OK);
1824         smbcli_close(cli->tree, fnum2);
1825
1826         sd2 = security_descriptor_dacl_create(tctx,
1827                                          0, owner_sid, NULL,
1828                                          owner_sid,
1829                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
1830                                          SEC_FILE_WRITE_DATA | SEC_STD_WRITE_DAC,
1831                                          0,
1832                                          NULL);
1833         CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd2);
1834
1835         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1836         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1837         status = smb_raw_open(cli->tree, tctx, &io);
1838         if (NT_STATUS_IS_OK(status)) {
1839                 torture_warning(tctx, "failed: w2k3 ACL bug (allowed open when ACL should deny)\n");
1840                 ret = false;
1841                 fnum2 = io.ntcreatex.out.file.fnum;
1842                 CHECK_ACCESS_FLAGS(fnum2, SEC_RIGHTS_FILE_ALL);
1843                 smbcli_close(cli->tree, fnum2);
1844         } else {
1845                 if (TARGET_IS_WIN7(tctx)) {
1846                         CHECK_STATUS(status, NT_STATUS_OBJECT_NAME_NOT_FOUND);
1847                 } else {
1848                         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1849                 }
1850         }
1851
1852         torture_comment(tctx, "trying without execute\n");
1853         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1854         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL & ~SEC_FILE_EXECUTE;
1855         status = smb_raw_open(cli->tree, tctx, &io);
1856         if (TARGET_IS_WIN7(tctx)) {
1857                 CHECK_STATUS(status, NT_STATUS_OBJECT_NAME_NOT_FOUND);
1858         } else {
1859                 CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1860         }
1861
1862         torture_comment(tctx, "and with full permissions again\n");
1863         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1864         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1865         status = smb_raw_open(cli->tree, tctx, &io);
1866         if (TARGET_IS_WIN7(tctx)) {
1867                 CHECK_STATUS(status, NT_STATUS_OBJECT_NAME_NOT_FOUND);
1868         } else {
1869                 CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1870         }
1871
1872         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1873         status = smb_raw_open(cli->tree, tctx, &io);
1874         CHECK_STATUS(status, NT_STATUS_OK);
1875         fnum2 = io.ntcreatex.out.file.fnum;
1876         CHECK_ACCESS_FLAGS(fnum2, SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE);
1877         smbcli_close(cli->tree, fnum2);
1878
1879         torture_comment(tctx, "put back original sd\n");
1880         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1881         set.set_secdesc.in.file.fnum = fnum;
1882         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1883         set.set_secdesc.in.sd = sd_orig;
1884         status = smb_raw_setfileinfo(cli->tree, &set);
1885         CHECK_STATUS(status, NT_STATUS_OK);
1886
1887         smbcli_close(cli->tree, fnum);
1888
1889         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1890         status = smb_raw_open(cli->tree, tctx, &io);
1891         if (TARGET_IS_WIN7(tctx)) {
1892                 CHECK_STATUS(status, NT_STATUS_OBJECT_NAME_NOT_FOUND);
1893         } else {
1894                 CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1895         }
1896
1897         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1898         status = smb_raw_open(cli->tree, tctx, &io);
1899         CHECK_STATUS(status, NT_STATUS_OK);
1900         fnum2 = io.ntcreatex.out.file.fnum;
1901         CHECK_ACCESS_FLAGS(fnum2, SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE);
1902         smbcli_close(cli->tree, fnum2);
1903
1904 done:
1905         if (sd_orig != NULL) {
1906                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1907                 set.set_secdesc.in.file.fnum = fnum;
1908                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1909                 set.set_secdesc.in.sd = sd_orig;
1910                 status = smb_raw_setfileinfo(cli->tree, &set);
1911         }
1912
1913         smbcli_close(cli->tree, fnum);
1914         smbcli_unlink(cli->tree, fname1);
1915         smbcli_rmdir(cli->tree, dname);
1916         smb_raw_exit(cli->session);
1917         smbcli_deltree(cli->tree, BASEDIR);
1918
1919         if (!ret) {
1920                 torture_result(tctx,
1921                         TORTURE_FAIL, "(%s) test_inheritance\n",
1922                         __location__);
1923         }
1924
1925         return ret;
1926 }
1927
1928 static bool test_inheritance_flags(struct torture_context *tctx,
1929     struct smbcli_state *cli)
1930 {
1931         NTSTATUS status;
1932         union smb_open io;
1933         const char *dname = BASEDIR "\\inheritance";
1934         const char *fname1 = BASEDIR "\\inheritance\\testfile";
1935         bool ret = true;
1936         int fnum=0, fnum2, i, j;
1937         union smb_fileinfo q;
1938         union smb_setfileinfo set;
1939         struct security_descriptor *sd, *sd2, *sd_orig=NULL;
1940         const char *owner_sid;
1941         struct {
1942                 uint32_t parent_set_sd_type; /* 3 options */
1943                 uint32_t parent_set_ace_inherit; /* 1 option */
1944                 uint32_t parent_get_sd_type;
1945                 uint32_t parent_get_ace_inherit;
1946                 uint32_t child_get_sd_type;
1947                 uint32_t child_get_ace_inherit;
1948         } tflags[16] = {{0}}; /* 2^4 */
1949
1950         for (i = 0; i < 15; i++) {
1951                 torture_comment(tctx, "i=%d:", i);
1952
1953                 ZERO_STRUCT(tflags[i]);
1954
1955                 if (i & 1) {
1956                         tflags[i].parent_set_sd_type |=
1957                             SEC_DESC_DACL_AUTO_INHERITED;
1958                         torture_comment(tctx, "AUTO_INHERITED, ");
1959                 }
1960                 if (i & 2) {
1961                         tflags[i].parent_set_sd_type |=
1962                             SEC_DESC_DACL_AUTO_INHERIT_REQ;
1963                         torture_comment(tctx, "AUTO_INHERIT_REQ, ");
1964                 }
1965                 if (i & 4) {
1966                         tflags[i].parent_set_sd_type |=
1967                             SEC_DESC_DACL_PROTECTED;
1968                         tflags[i].parent_get_sd_type |=
1969                             SEC_DESC_DACL_PROTECTED;
1970                         torture_comment(tctx, "PROTECTED, ");
1971                 }
1972                 if (i & 8) {
1973                         tflags[i].parent_set_ace_inherit |=
1974                             SEC_ACE_FLAG_INHERITED_ACE;
1975                         tflags[i].parent_get_ace_inherit |=
1976                             SEC_ACE_FLAG_INHERITED_ACE;
1977                         torture_comment(tctx, "INHERITED, ");
1978                 }
1979
1980                 if ((tflags[i].parent_set_sd_type &
1981                     (SEC_DESC_DACL_AUTO_INHERITED | SEC_DESC_DACL_AUTO_INHERIT_REQ)) ==
1982                     (SEC_DESC_DACL_AUTO_INHERITED | SEC_DESC_DACL_AUTO_INHERIT_REQ)) {
1983                         tflags[i].parent_get_sd_type |=
1984                             SEC_DESC_DACL_AUTO_INHERITED;
1985                         tflags[i].child_get_sd_type |=
1986                             SEC_DESC_DACL_AUTO_INHERITED;
1987                         tflags[i].child_get_ace_inherit |=
1988                             SEC_ACE_FLAG_INHERITED_ACE;
1989                         torture_comment(tctx, "  ... parent is AUTO INHERITED");
1990                 }
1991
1992                 if (tflags[i].parent_set_ace_inherit &
1993                     SEC_ACE_FLAG_INHERITED_ACE) {
1994                         tflags[i].parent_get_ace_inherit =
1995                             SEC_ACE_FLAG_INHERITED_ACE;
1996                         torture_comment(tctx, "  ... parent ACE is INHERITED");
1997                 }
1998
1999                 torture_comment(tctx, "\n");
2000         }
2001
2002         if (!torture_setup_dir(cli, BASEDIR))
2003                 return false;
2004
2005         torture_comment(tctx, "TESTING ACL INHERITANCE FLAGS\n");
2006
2007         ZERO_STRUCT(io);
2008
2009         io.generic.level = RAW_OPEN_NTCREATEX;
2010         io.ntcreatex.in.root_fid.fnum = 0;
2011         io.ntcreatex.in.flags = 0;
2012         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
2013         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
2014         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
2015         io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_MASK;
2016         io.ntcreatex.in.alloc_size = 0;
2017         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
2018         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
2019         io.ntcreatex.in.security_flags = 0;
2020         io.ntcreatex.in.fname = dname;
2021
2022         torture_comment(tctx, "creating initial directory %s\n", dname);
2023         status = smb_raw_open(cli->tree, tctx, &io);
2024         CHECK_STATUS(status, NT_STATUS_OK);
2025         fnum = io.ntcreatex.out.file.fnum;
2026
2027         torture_comment(tctx, "getting original sd\n");
2028         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
2029         q.query_secdesc.in.file.fnum = fnum;
2030         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
2031         status = smb_raw_fileinfo(cli->tree, tctx, &q);
2032         CHECK_STATUS(status, NT_STATUS_OK);
2033         sd_orig = q.query_secdesc.out.sd;
2034
2035         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
2036         torture_comment(tctx, "owner_sid is %s\n", owner_sid);
2037
2038         for (i=0; i < ARRAY_SIZE(tflags); i++) {
2039                 torture_comment(tctx, "setting a new sd on directory, pass #%d\n", i);
2040
2041                 sd = security_descriptor_dacl_create(tctx,
2042                                                 tflags[i].parent_set_sd_type,
2043                                                 NULL, NULL,
2044                                                 owner_sid,
2045                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
2046                                                 SEC_FILE_WRITE_DATA | SEC_STD_WRITE_DAC,
2047                                                 SEC_ACE_FLAG_OBJECT_INHERIT |
2048                                                 SEC_ACE_FLAG_CONTAINER_INHERIT |
2049                                                 tflags[i].parent_set_ace_inherit,
2050                                                 SID_WORLD,
2051                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
2052                                                 SEC_FILE_ALL | SEC_STD_ALL,
2053                                                 0,
2054                                                 NULL);
2055                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
2056                 set.set_secdesc.in.file.fnum = fnum;
2057                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
2058                 set.set_secdesc.in.sd = sd;
2059                 status = smb_raw_setfileinfo(cli->tree, &set);
2060                 CHECK_STATUS(status, NT_STATUS_OK);
2061
2062                 /*
2063                  * Check DACL we just set, except change the bits to what they
2064                  * should be.
2065                  */
2066                 torture_comment(tctx, "  checking new sd\n");
2067
2068                 /* REQ bit should always be false. */
2069                 sd->type &= ~SEC_DESC_DACL_AUTO_INHERIT_REQ;
2070
2071                 if ((tflags[i].parent_get_sd_type & SEC_DESC_DACL_AUTO_INHERITED) == 0)
2072                         sd->type &= ~SEC_DESC_DACL_AUTO_INHERITED;
2073
2074                 q.query_secdesc.in.file.fnum = fnum;
2075                 q.query_secdesc.in.secinfo_flags = SECINFO_DACL;
2076                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
2077                 CHECK_STATUS(status, NT_STATUS_OK);
2078                 CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd);
2079
2080                 /* Create file. */
2081                 torture_comment(tctx, "  creating file %s\n", fname1);
2082                 io.ntcreatex.in.fname = fname1;
2083                 io.ntcreatex.in.create_options = 0;
2084                 io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
2085                 io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
2086                 io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
2087                 status = smb_raw_open(cli->tree, tctx, &io);
2088                 CHECK_STATUS(status, NT_STATUS_OK);
2089                 fnum2 = io.ntcreatex.out.file.fnum;
2090                 CHECK_ACCESS_FLAGS(fnum2, SEC_RIGHTS_FILE_ALL);
2091
2092                 q.query_secdesc.in.file.fnum = fnum2;
2093                 q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
2094                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
2095                 CHECK_STATUS(status, NT_STATUS_OK);
2096
2097                 torture_comment(tctx, "  checking sd on file %s\n", fname1);
2098                 sd2 = security_descriptor_dacl_create(tctx,
2099                                                  tflags[i].child_get_sd_type,
2100                                                  owner_sid, NULL,
2101                                                  owner_sid,
2102                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
2103                                                  SEC_FILE_WRITE_DATA | SEC_STD_WRITE_DAC,
2104                                                  tflags[i].child_get_ace_inherit,
2105                                                  NULL);
2106                 CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd2);
2107
2108                 /*
2109                  * Set new sd on file ... prove that the bits have nothing to
2110                  * do with the parents bits when manually setting an ACL. The
2111                  * _AUTO_INHERITED bit comes directly from the ACL set.
2112                  */
2113                 for (j = 0; j < ARRAY_SIZE(tflags); j++) {
2114                         torture_comment(tctx, "  setting new file sd, pass #%d\n", j);
2115
2116                         /* Change sd type. */
2117                         sd2->type &= ~(SEC_DESC_DACL_AUTO_INHERITED |
2118                             SEC_DESC_DACL_AUTO_INHERIT_REQ |
2119                             SEC_DESC_DACL_PROTECTED);
2120                         sd2->type |= tflags[j].parent_set_sd_type;
2121
2122                         sd2->dacl->aces[0].flags &=
2123                             ~SEC_ACE_FLAG_INHERITED_ACE;
2124                         sd2->dacl->aces[0].flags |=
2125                             tflags[j].parent_set_ace_inherit;
2126
2127                         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
2128                         set.set_secdesc.in.file.fnum = fnum2;
2129                         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
2130                         set.set_secdesc.in.sd = sd2;
2131                         status = smb_raw_setfileinfo(cli->tree, &set);
2132                         CHECK_STATUS(status, NT_STATUS_OK);
2133
2134                         /* Check DACL we just set. */
2135                         sd2->type &= ~SEC_DESC_DACL_AUTO_INHERIT_REQ;
2136                         if ((tflags[j].parent_get_sd_type & SEC_DESC_DACL_AUTO_INHERITED) == 0)
2137                                 sd2->type &= ~SEC_DESC_DACL_AUTO_INHERITED;
2138
2139                         q.query_secdesc.in.file.fnum = fnum2;
2140                         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
2141                         status = smb_raw_fileinfo(cli->tree, tctx, &q);
2142                         CHECK_STATUS(status, NT_STATUS_OK);
2143
2144                         CHECK_SECURITY_DESCRIPTOR(q.query_secdesc.out.sd, sd2);
2145                 }
2146
2147                 smbcli_close(cli->tree, fnum2);
2148                 smbcli_unlink(cli->tree, fname1);
2149         }
2150
2151 done:
2152         smbcli_close(cli->tree, fnum);
2153         smb_raw_exit(cli->session);
2154         smbcli_deltree(cli->tree, BASEDIR);
2155
2156         if (!ret) {
2157                 torture_result(tctx,
2158                         TORTURE_FAIL, "(%s) test_inheritance_flags\n",
2159                         __location__);
2160         }
2161
2162         return ret;
2163 }
2164
2165 /*
2166   test dynamic acl inheritance
2167   Test copied to smb2/acls.c for SMB2.
2168 */
2169 static bool test_inheritance_dynamic(struct torture_context *tctx,
2170                                                                          struct smbcli_state *cli)
2171 {
2172         NTSTATUS status;
2173         union smb_open io;
2174         const char *dname = BASEDIR "\\inheritance2";
2175         const char *fname1 = BASEDIR "\\inheritance2\\testfile";
2176         bool ret = true;
2177         int fnum=0, fnum2;
2178         union smb_fileinfo q;
2179         union smb_setfileinfo set;
2180         struct security_descriptor *sd, *sd_orig=NULL;
2181         const char *owner_sid;
2182
2183         torture_comment(tctx, "TESTING DYNAMIC ACL INHERITANCE\n");
2184
2185         if (!torture_setup_dir(cli, BASEDIR))
2186                 return false;
2187
2188         io.generic.level = RAW_OPEN_NTCREATEX;
2189         io.ntcreatex.in.root_fid.fnum = 0;
2190         io.ntcreatex.in.flags = 0;
2191         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
2192         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
2193         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
2194         io.ntcreatex.in.share_access = 0;
2195         io.ntcreatex.in.alloc_size = 0;
2196         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
2197         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
2198         io.ntcreatex.in.security_flags = 0;
2199         io.ntcreatex.in.fname = dname;
2200
2201         status = smb_raw_open(cli->tree, tctx, &io);
2202         CHECK_STATUS(status, NT_STATUS_OK);
2203         fnum = io.ntcreatex.out.file.fnum;
2204
2205         torture_comment(tctx, "get the original sd\n");
2206         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
2207         q.query_secdesc.in.file.fnum = fnum;
2208         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
2209         status = smb_raw_fileinfo(cli->tree, tctx, &q);
2210         CHECK_STATUS(status, NT_STATUS_OK);
2211         sd_orig = q.query_secdesc.out.sd;
2212
2213         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
2214
2215         torture_comment(tctx, "owner_sid is %s\n", owner_sid);
2216
2217         sd = security_descriptor_dacl_create(tctx,
2218                                         0, NULL, NULL,
2219                                         owner_sid,
2220                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
2221                                         SEC_FILE_WRITE_DATA | SEC_STD_DELETE | SEC_FILE_READ_ATTRIBUTE,
2222                                         SEC_ACE_FLAG_OBJECT_INHERIT,
2223                                         NULL);
2224         sd->type |= SEC_DESC_DACL_AUTO_INHERITED | SEC_DESC_DACL_AUTO_INHERIT_REQ;
2225
2226         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
2227         set.set_secdesc.in.file.fnum = fnum;
2228         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
2229         set.set_secdesc.in.sd = sd;
2230         status = smb_raw_setfileinfo(cli->tree, &set);
2231         CHECK_STATUS(status, NT_STATUS_OK);
2232
2233         torture_comment(tctx, "create a file with an inherited acl\n");
2234         io.ntcreatex.in.fname = fname1;
2235         io.ntcreatex.in.create_options = 0;
2236         io.ntcreatex.in.access_mask = SEC_FILE_READ_ATTRIBUTE;
2237         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
2238         status = smb_raw_open(cli->tree, tctx, &io);
2239         CHECK_STATUS(status, NT_STATUS_OK);
2240         fnum2 = io.ntcreatex.out.file.fnum;
2241         smbcli_close(cli->tree, fnum2);
2242
2243         torture_comment(tctx, "try and access file with base rights - should be OK\n");
2244         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
2245         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
2246         status = smb_raw_open(cli->tree, tctx, &io);
2247         CHECK_STATUS(status, NT_STATUS_OK);
2248         fnum2 = io.ntcreatex.out.file.fnum;
2249         smbcli_close(cli->tree, fnum2);
2250
2251         torture_comment(tctx, "try and access file with extra rights - should be denied\n");
2252         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA | SEC_FILE_EXECUTE;
2253         status = smb_raw_open(cli->tree, tctx, &io);
2254         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
2255
2256         torture_comment(tctx, "update parent sd\n");
2257         sd = security_descriptor_dacl_create(tctx,
2258                                         0, NULL, NULL,
2259                                         owner_sid,
2260                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
2261                                         SEC_FILE_WRITE_DATA | SEC_STD_DELETE | SEC_FILE_READ_ATTRIBUTE | SEC_FILE_EXECUTE,
2262                                         SEC_ACE_FLAG_OBJECT_INHERIT,
2263                                         NULL);
2264         sd->type |= SEC_DESC_DACL_AUTO_INHERITED | SEC_DESC_DACL_AUTO_INHERIT_REQ;
2265
2266         set.set_secdesc.in.sd = sd;
2267         status = smb_raw_setfileinfo(cli->tree, &set);
2268         CHECK_STATUS(status, NT_STATUS_OK);
2269
2270         torture_comment(tctx, "try and access file with base rights - should be OK\n");
2271         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
2272         status = smb_raw_open(cli->tree, tctx, &io);
2273         CHECK_STATUS(status, NT_STATUS_OK);
2274         fnum2 = io.ntcreatex.out.file.fnum;
2275         smbcli_close(cli->tree, fnum2);
2276
2277
2278         torture_comment(tctx, "try and access now - should be OK if dynamic inheritance works\n");
2279         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA | SEC_FILE_EXECUTE;
2280         status = smb_raw_open(cli->tree, tctx, &io);
2281         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
2282                 torture_comment(tctx, "Server does not have dynamic inheritance\n");
2283         }
2284         if (NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
2285                 torture_comment(tctx, "Server does have dynamic inheritance\n");
2286         }
2287         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
2288
2289         smbcli_unlink(cli->tree, fname1);
2290
2291 done:
2292         if (sd_orig != NULL) {
2293                 torture_comment(tctx, "put back original sd\n");
2294                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
2295                 set.set_secdesc.in.file.fnum = fnum;
2296                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
2297                 set.set_secdesc.in.sd = sd_orig;
2298                 status = smb_raw_setfileinfo(cli->tree, &set);
2299         }
2300         smbcli_close(cli->tree, fnum);
2301         smbcli_rmdir(cli->tree, dname);
2302         smb_raw_exit(cli->session);
2303         smbcli_deltree(cli->tree, BASEDIR);
2304
2305         return ret;
2306 }
2307
2308 #define CHECK_STATUS_FOR_BIT_ACTION(status, bits, action) do { \
2309         if (!(bits & desired_64)) {\
2310                 CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED); \
2311                 action; \
2312         } else { \
2313                 CHECK_STATUS(status, NT_STATUS_OK); \
2314         } \
2315 } while (0)
2316
2317 #define CHECK_STATUS_FOR_BIT(status, bits, access) do { \
2318         if (NT_STATUS_IS_OK(status)) { \
2319                 if (!(granted & access)) {\
2320                         ret = false; \
2321                         torture_result(tctx, TORTURE_FAIL, "(%s) %s but flags 0x%08X are not granted! granted[0x%08X] desired[0x%08X]\n", \
2322                                __location__, nt_errstr(status), access, granted, desired); \
2323                         goto done; \
2324                 } \
2325         } else { \
2326                 if (granted & access) {\
2327                         ret = false; \
2328                         torture_result(tctx, TORTURE_FAIL, "(%s) %s but flags 0x%08X are granted! granted[0x%08X] desired[0x%08X]\n", \
2329                                __location__, nt_errstr(status), access, granted, desired); \
2330                         goto done; \
2331                 } \
2332         } \
2333         CHECK_STATUS_FOR_BIT_ACTION(status, bits, do {} while (0)); \
2334 } while (0)
2335
2336 #if 0
2337
2338 /* test what access mask is needed for getting and setting security_descriptors
2339   Test copied to smb2/acls.c for SMB2. */
2340 static bool test_sd_get_set(struct torture_context *tctx,
2341                                                         struct smbcli_state *cli)
2342 {
2343         NTSTATUS status;
2344         bool ret = true;
2345         union smb_open io;
2346         union smb_fileinfo fi;
2347         union smb_setfileinfo si;
2348         struct security_descriptor *sd;
2349         struct security_descriptor *sd_owner = NULL;
2350         struct security_descriptor *sd_group = NULL;
2351         struct security_descriptor *sd_dacl = NULL;
2352         struct security_descriptor *sd_sacl = NULL;
2353         int fnum=0;
2354         const char *fname = BASEDIR "\\sd_get_set.txt";
2355         uint64_t desired_64;
2356         uint32_t desired = 0, granted;
2357         int i = 0;
2358 #define NO_BITS_HACK (((uint64_t)1)<<32)
2359         uint64_t open_bits =
2360                 SEC_MASK_GENERIC |
2361                 SEC_FLAG_SYSTEM_SECURITY |
2362                 SEC_FLAG_MAXIMUM_ALLOWED |
2363                 SEC_STD_ALL |
2364                 SEC_FILE_ALL |
2365                 NO_BITS_HACK;
2366         uint64_t get_owner_bits = SEC_MASK_GENERIC | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_READ_CONTROL;
2367         uint64_t set_owner_bits = SEC_GENERIC_ALL  | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_WRITE_OWNER;
2368         uint64_t get_group_bits = SEC_MASK_GENERIC | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_READ_CONTROL;
2369         uint64_t set_group_bits = SEC_GENERIC_ALL  | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_WRITE_OWNER;
2370         uint64_t get_dacl_bits  = SEC_MASK_GENERIC | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_READ_CONTROL;
2371         uint64_t set_dacl_bits  = SEC_GENERIC_ALL  | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_WRITE_DAC;
2372         uint64_t get_sacl_bits  = SEC_FLAG_SYSTEM_SECURITY;
2373         uint64_t set_sacl_bits  = SEC_FLAG_SYSTEM_SECURITY;
2374
2375         if (!torture_setup_dir(cli, BASEDIR))
2376                 return false;
2377
2378         torture_comment(tctx, "TESTING ACCESS MASKS FOR SD GET/SET\n");
2379
2380         /* first create a file with full access for everyone */
2381         sd = security_descriptor_dacl_create(tctx,
2382                                         0, SID_NT_ANONYMOUS, SID_BUILTIN_USERS,
2383                                         SID_WORLD,
2384                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
2385                                         SEC_GENERIC_ALL,
2386                                         0,
2387                                         NULL);
2388         sd->type |= SEC_DESC_SACL_PRESENT;
2389         sd->sacl = NULL;
2390         io.ntcreatex.level = RAW_OPEN_NTTRANS_CREATE;
2391         io.ntcreatex.in.root_fid.fnum = 0;
2392         io.ntcreatex.in.flags = 0;
2393         io.ntcreatex.in.access_mask = SEC_GENERIC_ALL;
2394         io.ntcreatex.in.create_options = 0;
2395         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
2396         io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ | NTCREATEX_SHARE_ACCESS_WRITE;
2397         io.ntcreatex.in.alloc_size = 0;
2398         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OVERWRITE_IF;
2399         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
2400         io.ntcreatex.in.security_flags = 0;
2401         io.ntcreatex.in.fname = fname;
2402         io.ntcreatex.in.sec_desc = sd;
2403         io.ntcreatex.in.ea_list = NULL;
2404         status = smb_raw_open(cli->tree, tctx, &io);
2405         CHECK_STATUS(status, NT_STATUS_OK);
2406         fnum = io.ntcreatex.out.file.fnum;
2407
2408         status = smbcli_close(cli->tree, fnum);
2409         CHECK_STATUS(status, NT_STATUS_OK);
2410
2411         /*
2412          * now try each access_mask bit and no bit at all in a loop
2413          * and see what's allowed
2414          * NOTE: if i == 32 it means access_mask = 0 (see NO_BITS_HACK above)
2415          */
2416         for (i=0; i <= 32; i++) {
2417                 desired_64 = ((uint64_t)1) << i;
2418                 desired = (uint32_t)desired_64;
2419
2420                 /* first open the file with the desired access */
2421                 io.ntcreatex.level = RAW_OPEN_NTCREATEX;
2422                 io.ntcreatex.in.access_mask = desired;
2423                 io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
2424                 status = smb_raw_open(cli->tree, tctx, &io);
2425                 CHECK_STATUS_FOR_BIT_ACTION(status, open_bits, goto next);
2426                 fnum = io.ntcreatex.out.file.fnum;
2427
2428                 /* then check what access was granted */
2429                 fi.access_information.level             = RAW_FILEINFO_ACCESS_INFORMATION;
2430                 fi.access_information.in.file.fnum      = fnum;
2431                 status = smb_raw_fileinfo(cli->tree, tctx, &fi);
2432                 CHECK_STATUS(status, NT_STATUS_OK);
2433                 granted = fi.access_information.out.access_flags;
2434
2435                 /* test the owner */
2436                 ZERO_STRUCT(fi);
2437                 fi.query_secdesc.level                  = RAW_FILEINFO_SEC_DESC;
2438                 fi.query_secdesc.in.file.fnum           = fnum;
2439                 fi.query_secdesc.in.secinfo_flags       = SECINFO_OWNER;
2440                 status = smb_raw_fileinfo(cli->tree, tctx, &fi);
2441                 CHECK_STATUS_FOR_BIT(status, get_owner_bits, SEC_STD_READ_CONTROL);
2442                 if (fi.query_secdesc.out.sd) {
2443                         sd_owner = fi.query_secdesc.out.sd;
2444                 } else if (!sd_owner) {
2445                         sd_owner = sd;
2446                 }
2447                 si.set_secdesc.level                    = RAW_SFILEINFO_SEC_DESC;
2448                 si.set_secdesc.in.file.fnum             = fnum;
2449                 si.set_secdesc.in.secinfo_flags         = SECINFO_OWNER;
2450                 si.set_secdesc.in.sd                    = sd_owner;
2451                 status = smb_raw_setfileinfo(cli->tree, &si);
2452                 CHECK_STATUS_FOR_BIT(status, set_owner_bits, SEC_STD_WRITE_OWNER);
2453
2454                 /* test the group */
2455                 ZERO_STRUCT(fi);
2456                 fi.query_secdesc.level                  = RAW_FILEINFO_SEC_DESC;
2457                 fi.query_secdesc.in.file.fnum           = fnum;
2458                 fi.query_secdesc.in.secinfo_flags       = SECINFO_GROUP;
2459                 status = smb_raw_fileinfo(cli->tree, tctx, &fi);
2460                 CHECK_STATUS_FOR_BIT(status, get_group_bits, SEC_STD_READ_CONTROL);
2461                 if (fi.query_secdesc.out.sd) {
2462                         sd_group = fi.query_secdesc.out.sd;
2463                 } else if (!sd_group) {
2464                         sd_group = sd;
2465                 }
2466                 si.set_secdesc.level                    = RAW_SFILEINFO_SEC_DESC;
2467                 si.set_secdesc.in.file.fnum             = fnum;
2468                 si.set_secdesc.in.secinfo_flags         = SECINFO_GROUP;
2469                 si.set_secdesc.in.sd                    = sd_group;
2470                 status = smb_raw_setfileinfo(cli->tree, &si);
2471                 CHECK_STATUS_FOR_BIT(status, set_group_bits, SEC_STD_WRITE_OWNER);
2472
2473                 /* test the DACL */
2474                 ZERO_STRUCT(fi);
2475                 fi.query_secdesc.level                  = RAW_FILEINFO_SEC_DESC;
2476                 fi.query_secdesc.in.file.fnum           = fnum;
2477                 fi.query_secdesc.in.secinfo_flags       = SECINFO_DACL;
2478                 status = smb_raw_fileinfo(cli->tree, tctx, &fi);
2479                 CHECK_STATUS_FOR_BIT(status, get_dacl_bits, SEC_STD_READ_CONTROL);
2480                 if (fi.query_secdesc.out.sd) {
2481                         sd_dacl = fi.query_secdesc.out.sd;
2482                 } else if (!sd_dacl) {
2483                         sd_dacl = sd;
2484                 }
2485                 si.set_secdesc.level                    = RAW_SFILEINFO_SEC_DESC;
2486                 si.set_secdesc.in.file.fnum             = fnum;
2487                 si.set_secdesc.in.secinfo_flags         = SECINFO_DACL;
2488                 si.set_secdesc.in.sd                    = sd_dacl;
2489                 status = smb_raw_setfileinfo(cli->tree, &si);
2490                 CHECK_STATUS_FOR_BIT(status, set_dacl_bits, SEC_STD_WRITE_DAC);
2491
2492                 /* test the SACL */
2493                 ZERO_STRUCT(fi);
2494                 fi.query_secdesc.level                  = RAW_FILEINFO_SEC_DESC;
2495                 fi.query_secdesc.in.file.fnum           = fnum;
2496                 fi.query_secdesc.in.secinfo_flags       = SECINFO_SACL;
2497                 status = smb_raw_fileinfo(cli->tree, tctx, &fi);
2498                 CHECK_STATUS_FOR_BIT(status, get_sacl_bits, SEC_FLAG_SYSTEM_SECURITY);
2499                 if (fi.query_secdesc.out.sd) {
2500                         sd_sacl = fi.query_secdesc.out.sd;
2501                 } else if (!sd_sacl) {
2502                         sd_sacl = sd;
2503                 }
2504                 si.set_secdesc.level                    = RAW_SFILEINFO_SEC_DESC;
2505                 si.set_secdesc.in.file.fnum             = fnum;
2506                 si.set_secdesc.in.secinfo_flags         = SECINFO_SACL;
2507                 si.set_secdesc.in.sd                    = sd_sacl;
2508                 status = smb_raw_setfileinfo(cli->tree, &si);
2509                 CHECK_STATUS_FOR_BIT(status, set_sacl_bits, SEC_FLAG_SYSTEM_SECURITY);
2510
2511                 /* close the handle */
2512                 status = smbcli_close(cli->tree, fnum);
2513                 CHECK_STATUS(status, NT_STATUS_OK);
2514 next:
2515                 continue;
2516         }
2517
2518 done:
2519         smbcli_close(cli->tree, fnum);
2520         smbcli_unlink(cli->tree, fname);
2521         smb_raw_exit(cli->session);
2522         smbcli_deltree(cli->tree, BASEDIR);
2523
2524         return ret;
2525 }
2526
2527 #endif
2528
2529 /*
2530    basic testing of security descriptor calls
2531 */
2532 struct torture_suite *torture_raw_acls(TALLOC_CTX *mem_ctx)
2533 {
2534         struct torture_suite *suite = torture_suite_create(mem_ctx, "acls");
2535
2536         torture_suite_add_1smb_test(suite, "sd", test_sd);
2537         torture_suite_add_1smb_test(suite, "create_file", test_nttrans_create_file);
2538         torture_suite_add_1smb_test(suite, "create_dir", test_nttrans_create_dir);
2539         torture_suite_add_1smb_test(suite, "create_owner_file", test_nttrans_create_owner_file);
2540         torture_suite_add_1smb_test(suite, "create_owner_dir", test_nttrans_create_owner_dir);
2541         torture_suite_add_1smb_test(suite, "nulldacl", test_nttrans_create_null_dacl);
2542         torture_suite_add_1smb_test(suite, "creator", test_creator_sid);
2543         torture_suite_add_1smb_test(suite, "generic", test_generic_bits);
2544         torture_suite_add_1smb_test(suite, "owner", test_owner_bits);
2545         torture_suite_add_1smb_test(suite, "inheritance", test_inheritance);
2546
2547         torture_suite_add_1smb_test(suite, "INHERITFLAGS", test_inheritance_flags);
2548         torture_suite_add_1smb_test(suite, "dynamic", test_inheritance_dynamic);
2549 #if 0
2550         /* XXX This test does not work against XP or Vista. */
2551         torture_suite_add_1smb_test(suite, "GETSET", test_sd_get_set);
2552 #endif
2553
2554         return suite;
2555 }