source/torture/raw/acls.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test security descriptor operations
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/raw/libcliraw.h"
  25 #include "librpc/gen_ndr/ndr_security.h"
  26
  27 #define BASEDIR "\\testsd"
  28
  29 #define CHECK_STATUS(status, correct) do { \
  30         if (!NT_STATUS_EQUAL(status, correct)) { \
  31                 printf("(%s) Incorrect status %s - should be %s\n", \
  32                        __location__, nt_errstr(status), nt_errstr(correct)); \
  33                 ret = False; \
  34                 goto done; \
  35         }} while (0)
  36
  37
  38 static BOOL test_sd(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
  39 {
  40         NTSTATUS status;
  41         union smb_open io;
  42         const char *fname = BASEDIR "\\sd.txt";
  43         BOOL ret = True;
  44         int fnum = -1;
  45         union smb_fileinfo q;
  46         union smb_setfileinfo set;
  47         struct security_ace ace;
  48         struct security_descriptor *sd;
  49         struct dom_sid *test_sid;
  50
  51         printf("TESTING SETFILEINFO EA_SET\n");
  52
  53         io.generic.level = RAW_OPEN_NTCREATEX;
  54         io.ntcreatex.in.root_fid = 0;
  55         io.ntcreatex.in.flags = 0;
  56         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  57         io.ntcreatex.in.create_options = 0;
  58         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
  59         io.ntcreatex.in.share_access =
  60                 NTCREATEX_SHARE_ACCESS_READ |
  61                 NTCREATEX_SHARE_ACCESS_WRITE;
  62         io.ntcreatex.in.alloc_size = 0;
  63         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
  64         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
  65         io.ntcreatex.in.security_flags = 0;
  66         io.ntcreatex.in.fname = fname;
  67         status = smb_raw_open(cli->tree, mem_ctx, &io);
  68         CHECK_STATUS(status, NT_STATUS_OK);
  69         fnum = io.ntcreatex.out.fnum;
  70
  71         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
  72         q.query_secdesc.in.fnum = fnum;
  73         q.query_secdesc.in.secinfo_flags =
  74                 SECINFO_OWNER |
  75                 SECINFO_GROUP |
  76                 SECINFO_DACL;
  77         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
  78         CHECK_STATUS(status, NT_STATUS_OK);
  79         sd = q.query_secdesc.out.sd;
  80
  81         printf("add a new ACE to the DACL\n");
  82
  83         test_sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-1234-5432");
  84
  85         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
  86         ace.flags = 0;
  87         ace.access_mask = SEC_STD_ALL;
  88         ace.trustee = *test_sid;
  89
  90         status = security_descriptor_dacl_add(sd, &ace);
  91         CHECK_STATUS(status, NT_STATUS_OK);
  92
  93         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
  94         set.set_secdesc.file.fnum = fnum;
  95         set.set_secdesc.in.secinfo_flags = q.query_secdesc.in.secinfo_flags;
  96         set.set_secdesc.in.sd = sd;
  97
  98         status = smb_raw_setfileinfo(cli->tree, &set);
  99         CHECK_STATUS(status, NT_STATUS_OK);
 100
 101         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 102         CHECK_STATUS(status, NT_STATUS_OK);
 103
 104         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd)) {
 105                 printf("security descriptors don't match!\n");
 106                 printf("got:\n");
 107                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 108                 printf("expected:\n");
 109                 NDR_PRINT_DEBUG(security_descriptor, sd);
 110         }
 111
 112         printf("remove it again\n");
 113
 114         status = security_descriptor_dacl_del(sd, test_sid);
 115         CHECK_STATUS(status, NT_STATUS_OK);
 116
 117         status = smb_raw_setfileinfo(cli->tree, &set);
 118         CHECK_STATUS(status, NT_STATUS_OK);
 119
 120         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 121         CHECK_STATUS(status, NT_STATUS_OK);
 122
 123         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd)) {
 124                 printf("security descriptors don't match!\n");
 125                 printf("got:\n");
 126                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 127                 printf("expected:\n");
 128                 NDR_PRINT_DEBUG(security_descriptor, sd);
 129         }
 130
 131 done:
 132         smbcli_close(cli->tree, fnum);
 133         return ret;
 134 }
 135
 136
 137 /*
 138   test using NTTRANS CREATE to create a file with an initial ACL set
 139 */
 140 static BOOL test_nttrans_create(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 141 {
 142         NTSTATUS status;
 143         union smb_open io;
 144         const char *fname = BASEDIR "\\acl2.txt";
 145         BOOL ret = True;
 146         int fnum = -1;
 147         union smb_fileinfo q;
 148         struct security_ace ace;
 149         struct security_descriptor *sd;
 150         struct dom_sid *test_sid;
 151
 152         printf("TESTING NTTRANS CREATE WITH SEC_DESC\n");
 153
 154         io.generic.level = RAW_OPEN_NTTRANS_CREATE;
 155         io.ntcreatex.in.root_fid = 0;
 156         io.ntcreatex.in.flags = 0;
 157         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 158         io.ntcreatex.in.create_options = 0;
 159         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 160         io.ntcreatex.in.share_access =
 161                 NTCREATEX_SHARE_ACCESS_READ |
 162                 NTCREATEX_SHARE_ACCESS_WRITE;
 163         io.ntcreatex.in.alloc_size = 0;
 164         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
 165         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 166         io.ntcreatex.in.security_flags = 0;
 167         io.ntcreatex.in.fname = fname;
 168         io.ntcreatex.in.sec_desc = NULL;
 169         io.ntcreatex.in.ea_list = NULL;
 170
 171         printf("creating normal file\n");
 172
 173         status = smb_raw_open(cli->tree, mem_ctx, &io);
 174         CHECK_STATUS(status, NT_STATUS_OK);
 175         fnum = io.ntcreatex.out.fnum;
 176
 177         printf("querying ACL\n");
 178
 179         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 180         q.query_secdesc.in.fnum = fnum;
 181         q.query_secdesc.in.secinfo_flags =
 182                 SECINFO_OWNER |
 183                 SECINFO_GROUP |
 184                 SECINFO_DACL;
 185         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 186         CHECK_STATUS(status, NT_STATUS_OK);
 187         sd = q.query_secdesc.out.sd;
 188
 189         smbcli_close(cli->tree, fnum);
 190         smbcli_unlink(cli->tree, fname);
 191
 192         printf("adding a new ACE\n");
 193         test_sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-1234-54321");
 194
 195         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
 196         ace.flags = 0;
 197         ace.access_mask = SEC_STD_ALL;
 198         ace.trustee = *test_sid;
 199
 200         status = security_descriptor_dacl_add(sd, &ace);
 201         CHECK_STATUS(status, NT_STATUS_OK);
 202
 203         printf("creating a file with an initial ACL\n");
 204
 205         io.ntcreatex.in.sec_desc = sd;
 206         status = smb_raw_open(cli->tree, mem_ctx, &io);
 207         CHECK_STATUS(status, NT_STATUS_OK);
 208         fnum = io.ntcreatex.out.fnum;
 209
 210         q.query_secdesc.in.fnum = fnum;
 211         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 212         CHECK_STATUS(status, NT_STATUS_OK);
 213
 214         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd)) {
 215                 printf("security descriptors don't match!\n");
 216                 printf("got:\n");
 217                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 218                 printf("expected:\n");
 219                 NDR_PRINT_DEBUG(security_descriptor, sd);
 220         }
 221
 222 done:
 223         smbcli_close(cli->tree, fnum);
 224         return ret;
 225 }
 226
 227 #define CHECK_ACCESS_FLAGS(_fnum, flags) do { \
 228         union smb_fileinfo _q; \
 229         _q.access_information.level = RAW_FILEINFO_ACCESS_INFORMATION; \
 230         _q.access_information.in.fnum = (_fnum); \
 231         status = smb_raw_fileinfo(cli->tree, mem_ctx, &_q); \
 232         CHECK_STATUS(status, NT_STATUS_OK); \
 233         if (_q.access_information.out.access_flags != (flags)) { \
 234                 printf("(%s) Incorrect access_flags 0x%08x - should be 0x%08x\n", \
 235                        __location__, _q.access_information.out.access_flags, (flags)); \
 236                 ret = False; \
 237                 goto done; \
 238         } \
 239 } while (0)
 240
 241
 242 /*
 243   test the behaviour of the well known SID_CREATOR_OWNER sid, and some generic
 244   mapping bits
 245 */
 246 static BOOL test_creator_sid(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 247 {
 248         NTSTATUS status;
 249         union smb_open io;
 250         const char *fname = BASEDIR "\\creator.txt";
 251         BOOL ret = True;
 252         int fnum = -1;
 253         union smb_fileinfo q;
 254         union smb_setfileinfo set;
 255         struct security_descriptor *sd, *sd_orig, *sd2;
 256         const char *owner_sid;
 257
 258         printf("TESTING SID_CREATOR_OWNER\n");
 259
 260         io.generic.level = RAW_OPEN_NTCREATEX;
 261         io.ntcreatex.in.root_fid = 0;
 262         io.ntcreatex.in.flags = 0;
 263         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC | SEC_STD_WRITE_OWNER;
 264         io.ntcreatex.in.create_options = 0;
 265         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 266         io.ntcreatex.in.share_access =
 267                 NTCREATEX_SHARE_ACCESS_READ |
 268                 NTCREATEX_SHARE_ACCESS_WRITE;
 269         io.ntcreatex.in.alloc_size = 0;
 270         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 271         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 272         io.ntcreatex.in.security_flags = 0;
 273         io.ntcreatex.in.fname = fname;
 274         status = smb_raw_open(cli->tree, mem_ctx, &io);
 275         CHECK_STATUS(status, NT_STATUS_OK);
 276         fnum = io.ntcreatex.out.fnum;
 277
 278         printf("get the original sd\n");
 279         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 280         q.query_secdesc.in.fnum = fnum;
 281         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 282         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 283         CHECK_STATUS(status, NT_STATUS_OK);
 284         sd_orig = q.query_secdesc.out.sd;
 285
 286         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 287
 288         printf("set a sec desc allowing no write by CREATOR_OWNER\n");
 289         sd = security_descriptor_create(mem_ctx,
 290                                         NULL, NULL,
 291                                         SID_CREATOR_OWNER,
 292                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 293                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 294                                         0,
 295                                         NULL);
 296
 297         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 298         set.set_secdesc.file.fnum = fnum;
 299         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 300         set.set_secdesc.in.sd = sd;
 301
 302         status = smb_raw_setfileinfo(cli->tree, &set);
 303         CHECK_STATUS(status, NT_STATUS_OK);
 304
 305         printf("try open for write\n");
 306         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 307         status = smb_raw_open(cli->tree, mem_ctx, &io);
 308         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 309
 310         printf("try open for read\n");
 311         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 312         status = smb_raw_open(cli->tree, mem_ctx, &io);
 313         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 314
 315         printf("try open for generic write\n");
 316         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 317         status = smb_raw_open(cli->tree, mem_ctx, &io);
 318         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 319
 320         printf("try open for generic read\n");
 321         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 322         status = smb_raw_open(cli->tree, mem_ctx, &io);
 323         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 324
 325         printf("set a sec desc allowing no write by owner\n");
 326         sd = security_descriptor_create(mem_ctx,
 327                                         owner_sid, NULL,
 328                                         owner_sid,
 329                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 330                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 331                                         0,
 332                                         NULL);
 333
 334         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 335         set.set_secdesc.file.fnum = fnum;
 336         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 337         set.set_secdesc.in.sd = sd;
 338         status = smb_raw_setfileinfo(cli->tree, &set);
 339         CHECK_STATUS(status, NT_STATUS_OK);
 340
 341         printf("check that sd has been mapped correctly\n");
 342         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 343         CHECK_STATUS(status, NT_STATUS_OK);
 344         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd)) {
 345                 printf("security descriptors don't match!\n");
 346                 printf("got:\n");
 347                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 348                 printf("expected:\n");
 349                 NDR_PRINT_DEBUG(security_descriptor, sd);
 350         }
 351
 352         printf("try open for write\n");
 353         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 354         status = smb_raw_open(cli->tree, mem_ctx, &io);
 355         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 356
 357         printf("try open for read\n");
 358         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 359         status = smb_raw_open(cli->tree, mem_ctx, &io);
 360         CHECK_STATUS(status, NT_STATUS_OK);
 361         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 362                            SEC_FILE_READ_DATA|
 363                            SEC_FILE_READ_ATTRIBUTE);
 364         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 365
 366         printf("try open for generic write\n");
 367         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 368         status = smb_raw_open(cli->tree, mem_ctx, &io);
 369         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 370
 371         printf("try open for generic read\n");
 372         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 373         status = smb_raw_open(cli->tree, mem_ctx, &io);
 374         CHECK_STATUS(status, NT_STATUS_OK);
 375         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 376                            SEC_RIGHTS_FILE_READ);
 377         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 378
 379         printf("set a sec desc allowing generic read by owner\n");
 380         sd = security_descriptor_create(mem_ctx,
 381                                         NULL, NULL,
 382                                         owner_sid,
 383                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 384                                         SEC_GENERIC_READ | SEC_STD_ALL,
 385                                         0,
 386                                         NULL);
 387
 388         set.set_secdesc.in.sd = sd;
 389         status = smb_raw_setfileinfo(cli->tree, &set);
 390         CHECK_STATUS(status, NT_STATUS_OK);
 391
 392         printf("check that generic read has been mapped correctly\n");
 393         sd2 = security_descriptor_create(mem_ctx,
 394                                          owner_sid, NULL,
 395                                          owner_sid,
 396                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
 397                                          SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 398                                          0,
 399                                          NULL);
 400
 401         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 402         CHECK_STATUS(status, NT_STATUS_OK);
 403         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 404                 printf("security descriptors don't match!\n");
 405                 printf("got:\n");
 406                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 407                 printf("expected:\n");
 408                 NDR_PRINT_DEBUG(security_descriptor, sd2);
 409         }
 410
 411
 412         printf("try open for write\n");
 413         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 414         status = smb_raw_open(cli->tree, mem_ctx, &io);
 415         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 416
 417         printf("try open for read\n");
 418         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 419         status = smb_raw_open(cli->tree, mem_ctx, &io);
 420         CHECK_STATUS(status, NT_STATUS_OK);
 421         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 422                            SEC_FILE_READ_DATA |
 423                            SEC_FILE_READ_ATTRIBUTE);
 424         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 425
 426         printf("try open for generic write\n");
 427         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 428         status = smb_raw_open(cli->tree, mem_ctx, &io);
 429         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 430
 431         printf("try open for generic read\n");
 432         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 433         status = smb_raw_open(cli->tree, mem_ctx, &io);
 434         CHECK_STATUS(status, NT_STATUS_OK);
 435         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum, SEC_RIGHTS_FILE_READ);
 436         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 437
 438
 439         printf("put back original sd\n");
 440         set.set_secdesc.in.sd = sd_orig;
 441         status = smb_raw_setfileinfo(cli->tree, &set);
 442         CHECK_STATUS(status, NT_STATUS_OK);
 443
 444
 445 done:
 446         smbcli_close(cli->tree, fnum);
 447         return ret;
 448 }
 449
 450
 451 /*
 452   test the mapping of the SEC_GENERIC_xx bits to SEC_STD_xx and
 453   SEC_FILE_xx bits
 454 */
 455 static BOOL test_generic_bits(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 456 {
 457         NTSTATUS status;
 458         union smb_open io;
 459         const char *fname = BASEDIR "\\generic.txt";
 460         BOOL ret = True;
 461         int fnum = -1, i;
 462         union smb_fileinfo q;
 463         union smb_setfileinfo set;
 464         struct security_descriptor *sd, *sd_orig, *sd2;
 465         const char *owner_sid;
 466         const struct {
 467                 uint32_t gen_bits;
 468                 uint32_t specific_bits;
 469         } file_mappings[] = {
 470                 { 0,                       0 },
 471                 { SEC_GENERIC_READ,        SEC_RIGHTS_FILE_READ },
 472                 { SEC_GENERIC_WRITE,       SEC_RIGHTS_FILE_WRITE },
 473                 { SEC_GENERIC_EXECUTE,     SEC_RIGHTS_FILE_EXECUTE },
 474                 { SEC_GENERIC_ALL,         SEC_RIGHTS_FILE_ALL },
 475                 { SEC_FILE_READ_DATA,      SEC_FILE_READ_DATA },
 476                 { SEC_FILE_READ_ATTRIBUTE, SEC_FILE_READ_ATTRIBUTE }
 477         };
 478         const struct {
 479                 uint32_t gen_bits;
 480                 uint32_t specific_bits;
 481         } dir_mappings[] = {
 482                 { 0,                   0 },
 483                 { SEC_GENERIC_READ,    SEC_RIGHTS_DIR_READ },
 484                 { SEC_GENERIC_WRITE,   SEC_RIGHTS_DIR_WRITE },
 485                 { SEC_GENERIC_EXECUTE, SEC_RIGHTS_DIR_EXECUTE },
 486                 { SEC_GENERIC_ALL,     SEC_RIGHTS_DIR_ALL }
 487         };
 488         BOOL has_restore_privilege;
 489         BOOL has_take_ownership_privilege;
 490
 491         printf("TESTING FILE GENERIC BITS\n");
 492
 493         io.generic.level = RAW_OPEN_NTCREATEX;
 494         io.ntcreatex.in.root_fid = 0;
 495         io.ntcreatex.in.flags = 0;
 496         io.ntcreatex.in.access_mask =
 497                 SEC_STD_READ_CONTROL |
 498                 SEC_STD_WRITE_DAC |
 499                 SEC_STD_WRITE_OWNER;
 500         io.ntcreatex.in.create_options = 0;
 501         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 502         io.ntcreatex.in.share_access =
 503                 NTCREATEX_SHARE_ACCESS_READ |
 504                 NTCREATEX_SHARE_ACCESS_WRITE;
 505         io.ntcreatex.in.alloc_size = 0;
 506         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 507         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 508         io.ntcreatex.in.security_flags = 0;
 509         io.ntcreatex.in.fname = fname;
 510         status = smb_raw_open(cli->tree, mem_ctx, &io);
 511         CHECK_STATUS(status, NT_STATUS_OK);
 512         fnum = io.ntcreatex.out.fnum;
 513
 514         printf("get the original sd\n");
 515         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 516         q.query_secdesc.in.fnum = fnum;
 517         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 518         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 519         CHECK_STATUS(status, NT_STATUS_OK);
 520         sd_orig = q.query_secdesc.out.sd;
 521
 522         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 523
 524         status = smblsa_sid_check_privilege(cli,
 525                                             owner_sid,
 526                                             sec_privilege_name(SEC_PRIV_RESTORE));
 527         has_restore_privilege = NT_STATUS_IS_OK(status);
 528         if (!NT_STATUS_IS_OK(status)) {
 529                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 530         }
 531         printf("SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
 532
 533         status = smblsa_sid_check_privilege(cli,
 534                                             owner_sid,
 535                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
 536         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
 537         if (!NT_STATUS_IS_OK(status)) {
 538                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 539         }
 540         printf("SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_restore_privilege?"Yes":"No");
 541
 542         for (i=0;i<ARRAY_SIZE(file_mappings);i++) {
 543                 uint32_t expected_mask =
 544                         SEC_STD_WRITE_DAC |
 545                         SEC_STD_READ_CONTROL |
 546                         SEC_FILE_READ_ATTRIBUTE |
 547                         SEC_STD_DELETE;
 548                 uint32_t expected_mask_anon = SEC_FILE_READ_ATTRIBUTE;
 549
 550                 if (has_restore_privilege) {
 551                         expected_mask_anon |= SEC_STD_DELETE;
 552                 }
 553
 554                 printf("testing generic bits 0x%08x\n",
 555                        file_mappings[i].gen_bits);
 556                 sd = security_descriptor_create(mem_ctx,
 557                                                 owner_sid, NULL,
 558                                                 owner_sid,
 559                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 560                                                 file_mappings[i].gen_bits,
 561                                                 0,
 562                                                 NULL);
 563
 564                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 565                 set.set_secdesc.file.fnum = fnum;
 566                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 567                 set.set_secdesc.in.sd = sd;
 568
 569                 status = smb_raw_setfileinfo(cli->tree, &set);
 570                 CHECK_STATUS(status, NT_STATUS_OK);
 571
 572                 sd2 = security_descriptor_create(mem_ctx,
 573                                                  owner_sid, NULL,
 574                                                  owner_sid,
 575                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 576                                                  file_mappings[i].specific_bits,
 577                                                  0,
 578                                                  NULL);
 579
 580                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 581                 CHECK_STATUS(status, NT_STATUS_OK);
 582                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 583                         printf("security descriptors don't match!\n");
 584                         printf("got:\n");
 585                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 586                         printf("expected:\n");
 587                         NDR_PRINT_DEBUG(security_descriptor, sd2);
 588                 }
 589
 590                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 591                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 592                 CHECK_STATUS(status, NT_STATUS_OK);
 593                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 594                                    expected_mask | file_mappings[i].specific_bits);
 595                 smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 596
 597                 if (!has_take_ownership_privilege) {
 598                         continue;
 599                 }
 600
 601                 printf("testing generic bits 0x%08x (anonymous)\n",
 602                        file_mappings[i].gen_bits);
 603                 sd = security_descriptor_create(mem_ctx,
 604                                                 SID_NT_ANONYMOUS, NULL,
 605                                                 owner_sid,
 606                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 607                                                 file_mappings[i].gen_bits,
 608                                                 0,
 609                                                 NULL);
 610
 611                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 612                 set.set_secdesc.file.fnum = fnum;
 613                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 614                 set.set_secdesc.in.sd = sd;
 615
 616                 status = smb_raw_setfileinfo(cli->tree, &set);
 617                 CHECK_STATUS(status, NT_STATUS_OK);
 618
 619                 sd2 = security_descriptor_create(mem_ctx,
 620                                                  SID_NT_ANONYMOUS, NULL,
 621                                                  owner_sid,
 622                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 623                                                  file_mappings[i].specific_bits,
 624                                                  0,
 625                                                  NULL);
 626
 627                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 628                 CHECK_STATUS(status, NT_STATUS_OK);
 629                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 630                         printf("security descriptors don't match!\n");
 631                         printf("got:\n");
 632                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 633                         printf("expected:\n");
 634                         NDR_PRINT_DEBUG(security_descriptor, sd2);
 635                 }
 636
 637                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 638                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 639                 CHECK_STATUS(status, NT_STATUS_OK);
 640                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 641                                    expected_mask_anon | file_mappings[i].specific_bits);
 642                 smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 643         }
 644
 645         printf("put back original sd\n");
 646         set.set_secdesc.in.sd = sd_orig;
 647         status = smb_raw_setfileinfo(cli->tree, &set);
 648         CHECK_STATUS(status, NT_STATUS_OK);
 649
 650         smbcli_close(cli->tree, fnum);
 651         smbcli_unlink(cli->tree, fname);
 652
 653
 654         printf("TESTING DIR GENERIC BITS\n");
 655
 656         io.generic.level = RAW_OPEN_NTCREATEX;
 657         io.ntcreatex.in.root_fid = 0;
 658         io.ntcreatex.in.flags = 0;
 659         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC;
 660         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
 661         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
 662         io.ntcreatex.in.share_access =
 663                 NTCREATEX_SHARE_ACCESS_READ |
 664                 NTCREATEX_SHARE_ACCESS_WRITE;
 665         io.ntcreatex.in.alloc_size = 0;
 666         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 667         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 668         io.ntcreatex.in.security_flags = 0;
 669         io.ntcreatex.in.fname = fname;
 670         status = smb_raw_open(cli->tree, mem_ctx, &io);
 671         CHECK_STATUS(status, NT_STATUS_OK);
 672         fnum = io.ntcreatex.out.fnum;
 673
 674         printf("get the original sd\n");
 675         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 676         q.query_secdesc.in.fnum = fnum;
 677         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 678         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 679         CHECK_STATUS(status, NT_STATUS_OK);
 680         sd_orig = q.query_secdesc.out.sd;
 681
 682         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 683
 684
 685         for (i=0;i<ARRAY_SIZE(dir_mappings);i++) {
 686                 uint32_t expected_mask =
 687                         SEC_STD_WRITE_DAC |
 688                         SEC_STD_READ_CONTROL |
 689                         SEC_FILE_READ_ATTRIBUTE |
 690                         SEC_STD_DELETE;
 691
 692                 printf("testing generic bits 0x%08x\n",
 693                        file_mappings[i].gen_bits);
 694                 sd = security_descriptor_create(mem_ctx,
 695                                                 NULL, NULL,
 696                                                 owner_sid,
 697                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 698                                                 dir_mappings[i].gen_bits,
 699                                                 0,
 700                                                 NULL);
 701
 702                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 703                 set.set_secdesc.file.fnum = fnum;
 704                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 705                 set.set_secdesc.in.sd = sd;
 706
 707                 status = smb_raw_setfileinfo(cli->tree, &set);
 708                 CHECK_STATUS(status, NT_STATUS_OK);
 709
 710                 sd2 = security_descriptor_create(mem_ctx,
 711                                                  owner_sid, NULL,
 712                                                  owner_sid,
 713                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 714                                                  dir_mappings[i].specific_bits,
 715                                                  0,
 716                                                  NULL);
 717
 718                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 719                 CHECK_STATUS(status, NT_STATUS_OK);
 720                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 721                         printf("security descriptors don't match!\n");
 722                         printf("got:\n");
 723                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 724                         printf("expected:\n");
 725                         NDR_PRINT_DEBUG(security_descriptor, sd2);
 726                 }
 727
 728                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 729                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 730                 CHECK_STATUS(status, NT_STATUS_OK);
 731                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 732                                    expected_mask | dir_mappings[i].specific_bits);
 733                 smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 734         }
 735
 736         printf("put back original sd\n");
 737         set.set_secdesc.in.sd = sd_orig;
 738         status = smb_raw_setfileinfo(cli->tree, &set);
 739         CHECK_STATUS(status, NT_STATUS_OK);
 740
 741         smbcli_close(cli->tree, fnum);
 742         smbcli_unlink(cli->tree, fname);
 743
 744 done:
 745         smbcli_close(cli->tree, fnum);
 746         return ret;
 747 }
 748
 749
 750
 751 /*
 752   test the inheritance of ACL flags onto new files and directories
 753 */
 754 static BOOL test_inheritance(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 755 {
 756         NTSTATUS status;
 757         union smb_open io;
 758         const char *dname = BASEDIR "\\inheritance";
 759         const char *fname1 = BASEDIR "\\inheritance\\testfile";
 760         const char *fname2 = BASEDIR "\\inheritance\\testdir";
 761         BOOL ret = True;
 762         int fnum, fnum2, i;
 763         union smb_fileinfo q;
 764         union smb_setfileinfo set;
 765         struct security_descriptor *sd, *sd_orig, *sd_def;
 766         const char *owner_sid;
 767         const struct {
 768                 uint32_t parent_flags;
 769                 uint32_t file_flags;
 770                 uint32_t dir_flags;
 771         } test_flags[] = {
 772                 {
 773                         0,
 774                         0,
 775                         0
 776                 },
 777                 {
 778                         SEC_ACE_FLAG_OBJECT_INHERIT,
 779                         0,
 780                         SEC_ACE_FLAG_OBJECT_INHERIT |
 781                         SEC_ACE_FLAG_INHERIT_ONLY,
 782                 },
 783                 {
 784                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 785                         0,
 786                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 787                 },
 788                 {
 789                         SEC_ACE_FLAG_OBJECT_INHERIT |
 790                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 791                         0,
 792                         SEC_ACE_FLAG_OBJECT_INHERIT |
 793                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 794                 },
 795                 {
 796                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
 797                         0,
 798                         0,
 799                 },
 800                 {
 801                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 802                         SEC_ACE_FLAG_OBJECT_INHERIT,
 803                         0,
 804                         0,
 805                 },
 806                 {
 807                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 808                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 809                         0,
 810                         0,
 811                 },
 812                 {
 813                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 814                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 815                         SEC_ACE_FLAG_OBJECT_INHERIT,
 816                         0,
 817                         0,
 818                 },
 819                 {
 820                         SEC_ACE_FLAG_INHERIT_ONLY,
 821                         0,
 822                         0,
 823                 },
 824                 {
 825                         SEC_ACE_FLAG_INHERIT_ONLY |
 826                         SEC_ACE_FLAG_OBJECT_INHERIT,
 827                         0,
 828                         SEC_ACE_FLAG_OBJECT_INHERIT |
 829                         SEC_ACE_FLAG_INHERIT_ONLY,
 830                 },
 831                 {
 832                         SEC_ACE_FLAG_INHERIT_ONLY |
 833                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 834                         0,
 835                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 836                 },
 837                 {
 838                         SEC_ACE_FLAG_INHERIT_ONLY |
 839                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 840                         SEC_ACE_FLAG_OBJECT_INHERIT,
 841                         0,
 842                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 843                         SEC_ACE_FLAG_OBJECT_INHERIT,
 844                 },
 845                 {
 846                         SEC_ACE_FLAG_INHERIT_ONLY |
 847                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
 848                         0,
 849                         0,
 850                 },
 851                 {
 852                         SEC_ACE_FLAG_INHERIT_ONLY |
 853                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 854                         SEC_ACE_FLAG_OBJECT_INHERIT,
 855                         0,
 856                         0,
 857                 },
 858                 {
 859                         SEC_ACE_FLAG_INHERIT_ONLY |
 860                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 861                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 862                         0,
 863                         0,
 864                 },
 865                 {
 866                         SEC_ACE_FLAG_INHERIT_ONLY |
 867                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 868                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 869                         SEC_ACE_FLAG_OBJECT_INHERIT,
 870                         0,
 871                         0,
 872                 }
 873         };
 874
 875         printf("TESTING ACL INHERITANCE\n");
 876
 877         io.generic.level = RAW_OPEN_NTCREATEX;
 878         io.ntcreatex.in.root_fid = 0;
 879         io.ntcreatex.in.flags = 0;
 880         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
 881         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
 882         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
 883         io.ntcreatex.in.share_access = 0;
 884         io.ntcreatex.in.alloc_size = 0;
 885         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
 886         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 887         io.ntcreatex.in.security_flags = 0;
 888         io.ntcreatex.in.fname = dname;
 889
 890         status = smb_raw_open(cli->tree, mem_ctx, &io);
 891         CHECK_STATUS(status, NT_STATUS_OK);
 892         fnum = io.ntcreatex.out.fnum;
 893
 894         printf("get the original sd\n");
 895         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 896         q.query_secdesc.in.fnum = fnum;
 897         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 898         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 899         CHECK_STATUS(status, NT_STATUS_OK);
 900         sd_orig = q.query_secdesc.out.sd;
 901
 902         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 903
 904         sd_def = security_descriptor_create(mem_ctx,
 905                                             owner_sid, NULL,
 906                                             owner_sid,
 907                                             SEC_ACE_TYPE_ACCESS_ALLOWED,
 908                                             SEC_RIGHTS_FILE_ALL,
 909                                             0,
 910                                             SID_NT_SYSTEM,
 911                                             SEC_ACE_TYPE_ACCESS_ALLOWED,
 912                                             SEC_RIGHTS_FILE_ALL,
 913                                             0,
 914                                             NULL);
 915
 916         for (i=0;i<ARRAY_SIZE(test_flags);i++) {
 917                 sd = security_descriptor_create(mem_ctx,
 918                                                 NULL, NULL,
 919                                                 owner_sid,
 920                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 921                                                 SEC_FILE_WRITE_DATA,
 922                                                 test_flags[i].parent_flags,
 923                                                 SID_WORLD,
 924                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 925                                                 SEC_FILE_ALL | SEC_STD_ALL,
 926                                                 0,
 927                                                 NULL);
 928                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 929                 set.set_secdesc.file.fnum = fnum;
 930                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 931                 set.set_secdesc.in.sd = sd;
 932                 status = smb_raw_setfileinfo(cli->tree, &set);
 933                 CHECK_STATUS(status, NT_STATUS_OK);
 934
 935                 io.ntcreatex.in.fname = fname1;
 936                 io.ntcreatex.in.create_options = 0;
 937                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 938                 CHECK_STATUS(status, NT_STATUS_OK);
 939                 fnum2 = io.ntcreatex.out.fnum;
 940
 941                 q.query_secdesc.in.fnum = fnum2;
 942                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 943                 CHECK_STATUS(status, NT_STATUS_OK);
 944
 945                 smbcli_close(cli->tree, fnum2);
 946                 smbcli_unlink(cli->tree, fname1);
 947
 948                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
 949                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def)) {
 950                                 printf("Expected default sd at %d - got:\n", i);
 951                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 952                         }
 953                         goto check_dir;
 954                 }
 955
 956                 if (q.query_secdesc.out.sd->dacl == NULL ||
 957                     q.query_secdesc.out.sd->dacl->num_aces != 1 ||
 958                     q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
 959                     !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
 960                                    sd_orig->owner_sid)) {
 961                         printf("Bad sd in child file at %d\n", i);
 962                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 963                         ret = False;
 964                         goto check_dir;
 965                 }
 966
 967                 if (q.query_secdesc.out.sd->dacl->aces[0].flags !=
 968                     test_flags[i].file_flags) {
 969                         printf("incorrect file_flags 0x%x - expected 0x%x for parent 0x%x with (i=%d)\n",
 970                                q.query_secdesc.out.sd->dacl->aces[0].flags,
 971                                test_flags[i].file_flags,
 972                                test_flags[i].parent_flags,
 973                                i);
 974                         ret = False;
 975                 }
 976
 977         check_dir:
 978                 io.ntcreatex.in.fname = fname2;
 979                 io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
 980                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 981                 CHECK_STATUS(status, NT_STATUS_OK);
 982                 fnum2 = io.ntcreatex.out.fnum;
 983
 984                 q.query_secdesc.in.fnum = fnum2;
 985                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 986                 CHECK_STATUS(status, NT_STATUS_OK);
 987
 988                 smbcli_close(cli->tree, fnum2);
 989                 smbcli_rmdir(cli->tree, fname2);
 990
 991                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) &&
 992                     (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT) ||
 993                      (test_flags[i].parent_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT))) {
 994                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def)) {
 995                                 printf("Expected default sd for dir at %d - got:\n", i);
 996                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 997                         }
 998                         continue;
 999                 }
1000
1001                 if (q.query_secdesc.out.sd->dacl == NULL ||
1002                     q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1003                     q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1004                     !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1005                                    sd_orig->owner_sid)) {
1006                         printf("Bad sd in child dir at %d (parent 0x%x)\n",
1007                                i, test_flags[i].parent_flags);
1008                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1009                         ret = False;
1010                         continue;
1011                 }
1012
1013                 if (q.query_secdesc.out.sd->dacl->aces[0].flags !=
1014                     test_flags[i].dir_flags) {
1015                         printf("incorrect dir_flags 0x%x - expected 0x%x for parent 0x%x with (i=%d)\n",
1016                                q.query_secdesc.out.sd->dacl->aces[0].flags,
1017                                test_flags[i].dir_flags,
1018                                test_flags[i].parent_flags,
1019                                i);
1020                         ret = False;
1021                 }
1022         }
1023
1024         printf("put back original sd\n");
1025         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1026         set.set_secdesc.file.fnum = fnum;
1027         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1028         set.set_secdesc.in.sd = sd_orig;
1029         status = smb_raw_setfileinfo(cli->tree, &set);
1030         CHECK_STATUS(status, NT_STATUS_OK);
1031
1032         smbcli_close(cli->tree, fnum);
1033         smbcli_rmdir(cli->tree, dname);
1034
1035
1036 done:
1037         smbcli_close(cli->tree, fnum);
1038         return ret;
1039 }
1040
1041
1042 /*
1043    basic testing of security descriptor calls
1044 */
1045 BOOL torture_raw_acls(void)
1046 {
1047         struct smbcli_state *cli;
1048         BOOL ret = True;
1049         TALLOC_CTX *mem_ctx;
1050
1051         if (!torture_open_connection(&cli)) {
1052                 return False;
1053         }
1054
1055         mem_ctx = talloc_init("torture_raw_acls");
1056
1057         if (!torture_setup_dir(cli, BASEDIR)) {
1058                 return False;
1059         }
1060
1061         ret &= test_sd(cli, mem_ctx);
1062         ret &= test_nttrans_create(cli, mem_ctx);
1063         ret &= test_creator_sid(cli, mem_ctx);
1064         ret &= test_generic_bits(cli, mem_ctx);
1065         ret &= test_inheritance(cli, mem_ctx);
1066
1067         smb_raw_exit(cli->session);
1068         smbcli_deltree(cli->tree, BASEDIR);
1069
1070         torture_close_connection(cli);
1071         talloc_destroy(mem_ctx);
1072         return ret;
1073 }