r4389: added checking for the default inherited ACL, which is used when no ACEs
[samba.git] / source4 / torture / raw / acls.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    test security descriptor operations
5
6    Copyright (C) Andrew Tridgell 2004
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 2 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program; if not, write to the Free Software
20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21 */
22
23 #include "includes.h"
24 #include "libcli/raw/libcliraw.h"
25 #include "librpc/gen_ndr/ndr_security.h"
26
27 #define BASEDIR "\\testsd"
28
29 #define CHECK_STATUS(status, correct) do { \
30         if (!NT_STATUS_EQUAL(status, correct)) { \
31                 printf("(%s) Incorrect status %s - should be %s\n", \
32                        __location__, nt_errstr(status), nt_errstr(correct)); \
33                 ret = False; \
34                 goto done; \
35         }} while (0)
36
37
38 static BOOL test_sd(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
39 {
40         NTSTATUS status;
41         union smb_open io;
42         const char *fname = BASEDIR "\\sd.txt";
43         BOOL ret = True;
44         int fnum = -1;
45         union smb_fileinfo q;
46         union smb_setfileinfo set;
47         struct security_ace ace;
48         struct security_descriptor *sd;
49         struct dom_sid *test_sid;
50
51         printf("TESTING SETFILEINFO EA_SET\n");
52
53         io.generic.level = RAW_OPEN_NTCREATEX;
54         io.ntcreatex.in.root_fid = 0;
55         io.ntcreatex.in.flags = 0;
56         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
57         io.ntcreatex.in.create_options = 0;
58         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
59         io.ntcreatex.in.share_access = 
60                 NTCREATEX_SHARE_ACCESS_READ | 
61                 NTCREATEX_SHARE_ACCESS_WRITE;
62         io.ntcreatex.in.alloc_size = 0;
63         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
64         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
65         io.ntcreatex.in.security_flags = 0;
66         io.ntcreatex.in.fname = fname;
67         status = smb_raw_open(cli->tree, mem_ctx, &io);
68         CHECK_STATUS(status, NT_STATUS_OK);
69         fnum = io.ntcreatex.out.fnum;
70         
71         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
72         q.query_secdesc.in.fnum = fnum;
73         q.query_secdesc.in.secinfo_flags = 
74                 SECINFO_OWNER |
75                 SECINFO_GROUP |
76                 SECINFO_DACL;
77         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
78         CHECK_STATUS(status, NT_STATUS_OK);
79         sd = q.query_secdesc.out.sd;
80
81         printf("add a new ACE to the DACL\n");
82
83         test_sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-1234-5432");
84
85         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
86         ace.flags = 0;
87         ace.access_mask = SEC_STD_ALL;
88         ace.trustee = *test_sid;
89
90         status = security_descriptor_dacl_add(sd, &ace);
91         CHECK_STATUS(status, NT_STATUS_OK);
92
93         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
94         set.set_secdesc.file.fnum = fnum;
95         set.set_secdesc.in.secinfo_flags = q.query_secdesc.in.secinfo_flags;
96         set.set_secdesc.in.sd = sd;
97
98         status = smb_raw_setfileinfo(cli->tree, &set);
99         CHECK_STATUS(status, NT_STATUS_OK);
100
101         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
102         CHECK_STATUS(status, NT_STATUS_OK);
103
104         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd)) {
105                 printf("security descriptors don't match!\n");
106                 printf("got:\n");
107                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
108                 printf("expected:\n");
109                 NDR_PRINT_DEBUG(security_descriptor, sd);
110         }
111
112         printf("remove it again\n");
113
114         status = security_descriptor_dacl_del(sd, test_sid);
115         CHECK_STATUS(status, NT_STATUS_OK);
116
117         status = smb_raw_setfileinfo(cli->tree, &set);
118         CHECK_STATUS(status, NT_STATUS_OK);
119
120         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
121         CHECK_STATUS(status, NT_STATUS_OK);
122
123         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd)) {
124                 printf("security descriptors don't match!\n");
125                 printf("got:\n");
126                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
127                 printf("expected:\n");
128                 NDR_PRINT_DEBUG(security_descriptor, sd);
129         }
130
131 done:
132         smbcli_close(cli->tree, fnum);
133         return ret;
134 }
135
136
137 /*
138   test using NTTRANS CREATE to create a file with an initial ACL set
139 */
140 static BOOL test_nttrans_create(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
141 {
142         NTSTATUS status;
143         union smb_open io;
144         const char *fname = BASEDIR "\\acl2.txt";
145         BOOL ret = True;
146         int fnum = -1;
147         union smb_fileinfo q;
148         struct security_ace ace;
149         struct security_descriptor *sd;
150         struct dom_sid *test_sid;
151
152         printf("TESTING NTTRANS CREATE WITH SEC_DESC\n");
153
154         io.generic.level = RAW_OPEN_NTTRANS_CREATE;
155         io.ntcreatex.in.root_fid = 0;
156         io.ntcreatex.in.flags = 0;
157         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
158         io.ntcreatex.in.create_options = 0;
159         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
160         io.ntcreatex.in.share_access = 
161                 NTCREATEX_SHARE_ACCESS_READ | 
162                 NTCREATEX_SHARE_ACCESS_WRITE;
163         io.ntcreatex.in.alloc_size = 0;
164         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
165         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
166         io.ntcreatex.in.security_flags = 0;
167         io.ntcreatex.in.fname = fname;
168         io.ntcreatex.in.sec_desc = NULL;
169         io.ntcreatex.in.ea_list = NULL;
170
171         printf("creating normal file\n");
172
173         status = smb_raw_open(cli->tree, mem_ctx, &io);
174         CHECK_STATUS(status, NT_STATUS_OK);
175         fnum = io.ntcreatex.out.fnum;
176
177         printf("querying ACL\n");
178
179         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
180         q.query_secdesc.in.fnum = fnum;
181         q.query_secdesc.in.secinfo_flags = 
182                 SECINFO_OWNER |
183                 SECINFO_GROUP |
184                 SECINFO_DACL;
185         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
186         CHECK_STATUS(status, NT_STATUS_OK);
187         sd = q.query_secdesc.out.sd;
188
189         smbcli_close(cli->tree, fnum);
190         smbcli_unlink(cli->tree, fname);
191
192         printf("adding a new ACE\n");
193         test_sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-1234-54321");
194
195         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
196         ace.flags = 0;
197         ace.access_mask = SEC_STD_ALL;
198         ace.trustee = *test_sid;
199
200         status = security_descriptor_dacl_add(sd, &ace);
201         CHECK_STATUS(status, NT_STATUS_OK);
202         
203         printf("creating a file with an initial ACL\n");
204
205         io.ntcreatex.in.sec_desc = sd;
206         status = smb_raw_open(cli->tree, mem_ctx, &io);
207         CHECK_STATUS(status, NT_STATUS_OK);
208         fnum = io.ntcreatex.out.fnum;
209         
210         q.query_secdesc.in.fnum = fnum;
211         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
212         CHECK_STATUS(status, NT_STATUS_OK);
213
214         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd)) {
215                 printf("security descriptors don't match!\n");
216                 printf("got:\n");
217                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
218                 printf("expected:\n");
219                 NDR_PRINT_DEBUG(security_descriptor, sd);
220         }
221
222 done:
223         smbcli_close(cli->tree, fnum);
224         return ret;
225 }
226
227 #define CHECK_ACCESS_FLAGS(_fnum, flags) do { \
228         union smb_fileinfo _q; \
229         _q.access_information.level = RAW_FILEINFO_ACCESS_INFORMATION; \
230         _q.access_information.in.fnum = (_fnum); \
231         status = smb_raw_fileinfo(cli->tree, mem_ctx, &_q); \
232         CHECK_STATUS(status, NT_STATUS_OK); \
233         if (_q.access_information.out.access_flags != (flags)) { \
234                 printf("(%s) Incorrect access_flags 0x%08x - should be 0x%08x\n", \
235                        __location__, _q.access_information.out.access_flags, (flags)); \
236                 ret = False; \
237                 goto done; \
238         } \
239 } while (0)
240
241
242 /*
243   test the behaviour of the well known SID_CREATOR_OWNER sid, and some generic
244   mapping bits
245 */
246 static BOOL test_creator_sid(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
247 {
248         NTSTATUS status;
249         union smb_open io;
250         const char *fname = BASEDIR "\\creator.txt";
251         BOOL ret = True;
252         int fnum = -1;
253         union smb_fileinfo q;
254         union smb_setfileinfo set;
255         struct security_descriptor *sd, *sd_orig, *sd2;
256         const char *owner_sid;
257
258         printf("TESTING SID_CREATOR_OWNER\n");
259
260         io.generic.level = RAW_OPEN_NTCREATEX;
261         io.ntcreatex.in.root_fid = 0;
262         io.ntcreatex.in.flags = 0;
263         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC | SEC_STD_WRITE_OWNER;
264         io.ntcreatex.in.create_options = 0;
265         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
266         io.ntcreatex.in.share_access = 
267                 NTCREATEX_SHARE_ACCESS_READ | 
268                 NTCREATEX_SHARE_ACCESS_WRITE;
269         io.ntcreatex.in.alloc_size = 0;
270         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
271         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
272         io.ntcreatex.in.security_flags = 0;
273         io.ntcreatex.in.fname = fname;
274         status = smb_raw_open(cli->tree, mem_ctx, &io);
275         CHECK_STATUS(status, NT_STATUS_OK);
276         fnum = io.ntcreatex.out.fnum;
277
278         printf("get the original sd\n");
279         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
280         q.query_secdesc.in.fnum = fnum;
281         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
282         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
283         CHECK_STATUS(status, NT_STATUS_OK);
284         sd_orig = q.query_secdesc.out.sd;
285
286         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
287
288         printf("set a sec desc allowing no write by CREATOR_OWNER\n");
289         sd = security_descriptor_create(mem_ctx,
290                                         NULL, NULL,
291                                         SID_CREATOR_OWNER,
292                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
293                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
294                                         0,
295                                         NULL);
296
297         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
298         set.set_secdesc.file.fnum = fnum;
299         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
300         set.set_secdesc.in.sd = sd;
301
302         status = smb_raw_setfileinfo(cli->tree, &set);
303         CHECK_STATUS(status, NT_STATUS_OK);
304
305         printf("try open for write\n");
306         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
307         status = smb_raw_open(cli->tree, mem_ctx, &io);
308         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
309
310         printf("try open for read\n");
311         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
312         status = smb_raw_open(cli->tree, mem_ctx, &io);
313         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
314
315         printf("try open for generic write\n");
316         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
317         status = smb_raw_open(cli->tree, mem_ctx, &io);
318         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
319
320         printf("try open for generic read\n");
321         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
322         status = smb_raw_open(cli->tree, mem_ctx, &io);
323         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
324
325         printf("set a sec desc allowing no write by owner\n");
326         sd = security_descriptor_create(mem_ctx,
327                                         owner_sid, NULL,
328                                         owner_sid,
329                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
330                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
331                                         0,
332                                         NULL);
333
334         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
335         set.set_secdesc.file.fnum = fnum;
336         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
337         set.set_secdesc.in.sd = sd;
338         status = smb_raw_setfileinfo(cli->tree, &set);
339         CHECK_STATUS(status, NT_STATUS_OK);
340
341         printf("check that sd has been mapped correctly\n");
342         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
343         CHECK_STATUS(status, NT_STATUS_OK);
344         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd)) {
345                 printf("security descriptors don't match!\n");
346                 printf("got:\n");
347                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
348                 printf("expected:\n");
349                 NDR_PRINT_DEBUG(security_descriptor, sd);
350         }
351
352         printf("try open for write\n");
353         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
354         status = smb_raw_open(cli->tree, mem_ctx, &io);
355         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
356
357         printf("try open for read\n");
358         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
359         status = smb_raw_open(cli->tree, mem_ctx, &io);
360         CHECK_STATUS(status, NT_STATUS_OK);
361         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum, 
362                            SEC_FILE_READ_DATA|
363                            SEC_FILE_READ_ATTRIBUTE);
364         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
365
366         printf("try open for generic write\n");
367         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
368         status = smb_raw_open(cli->tree, mem_ctx, &io);
369         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
370
371         printf("try open for generic read\n");
372         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
373         status = smb_raw_open(cli->tree, mem_ctx, &io);
374         CHECK_STATUS(status, NT_STATUS_OK);
375         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum, 
376                            SEC_RIGHTS_FILE_READ);
377         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
378
379         printf("set a sec desc allowing generic read by owner\n");
380         sd = security_descriptor_create(mem_ctx,
381                                         NULL, NULL,
382                                         owner_sid,
383                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
384                                         SEC_GENERIC_READ | SEC_STD_ALL,
385                                         0,
386                                         NULL);
387
388         set.set_secdesc.in.sd = sd;
389         status = smb_raw_setfileinfo(cli->tree, &set);
390         CHECK_STATUS(status, NT_STATUS_OK);
391
392         printf("check that generic read has been mapped correctly\n");
393         sd2 = security_descriptor_create(mem_ctx,
394                                          owner_sid, NULL,
395                                          owner_sid,
396                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
397                                          SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
398                                          0,
399                                          NULL);
400
401         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
402         CHECK_STATUS(status, NT_STATUS_OK);
403         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
404                 printf("security descriptors don't match!\n");
405                 printf("got:\n");
406                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
407                 printf("expected:\n");
408                 NDR_PRINT_DEBUG(security_descriptor, sd2);
409         }
410         
411
412         printf("try open for write\n");
413         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
414         status = smb_raw_open(cli->tree, mem_ctx, &io);
415         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
416
417         printf("try open for read\n");
418         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
419         status = smb_raw_open(cli->tree, mem_ctx, &io);
420         CHECK_STATUS(status, NT_STATUS_OK);
421         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum, 
422                            SEC_FILE_READ_DATA | 
423                            SEC_FILE_READ_ATTRIBUTE);
424         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
425
426         printf("try open for generic write\n");
427         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
428         status = smb_raw_open(cli->tree, mem_ctx, &io);
429         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
430
431         printf("try open for generic read\n");
432         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
433         status = smb_raw_open(cli->tree, mem_ctx, &io);
434         CHECK_STATUS(status, NT_STATUS_OK);
435         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum, SEC_RIGHTS_FILE_READ);
436         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
437
438
439         printf("put back original sd\n");
440         set.set_secdesc.in.sd = sd_orig;
441         status = smb_raw_setfileinfo(cli->tree, &set);
442         CHECK_STATUS(status, NT_STATUS_OK);
443
444
445 done:
446         smbcli_close(cli->tree, fnum);
447         return ret;
448 }
449
450
451 /*
452   test the mapping of the SEC_GENERIC_xx bits to SEC_STD_xx and
453   SEC_FILE_xx bits
454 */
455 static BOOL test_generic_bits(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
456 {
457         NTSTATUS status;
458         union smb_open io;
459         const char *fname = BASEDIR "\\generic.txt";
460         BOOL ret = True;
461         int fnum = -1, i;
462         union smb_fileinfo q;
463         union smb_setfileinfo set;
464         struct security_descriptor *sd, *sd_orig, *sd2;
465         const char *owner_sid;
466         const struct {
467                 uint32_t gen_bits;
468                 uint32_t specific_bits;
469         } file_mappings[] = {
470                 { 0,                       0 },
471                 { SEC_GENERIC_READ,        SEC_RIGHTS_FILE_READ },
472                 { SEC_GENERIC_WRITE,       SEC_RIGHTS_FILE_WRITE },
473                 { SEC_GENERIC_EXECUTE,     SEC_RIGHTS_FILE_EXECUTE },
474                 { SEC_GENERIC_ALL,         SEC_RIGHTS_FILE_ALL },
475                 { SEC_FILE_READ_DATA,      SEC_FILE_READ_DATA },
476                 { SEC_FILE_READ_ATTRIBUTE, SEC_FILE_READ_ATTRIBUTE }
477         };
478         const struct {
479                 uint32_t gen_bits;
480                 uint32_t specific_bits;
481         } dir_mappings[] = {
482                 { 0,                   0 },
483                 { SEC_GENERIC_READ,    SEC_RIGHTS_DIR_READ },
484                 { SEC_GENERIC_WRITE,   SEC_RIGHTS_DIR_WRITE },
485                 { SEC_GENERIC_EXECUTE, SEC_RIGHTS_DIR_EXECUTE },
486                 { SEC_GENERIC_ALL,     SEC_RIGHTS_DIR_ALL }
487         };
488         BOOL has_restore_privilege;
489         BOOL has_take_ownership_privilege;
490
491         printf("TESTING FILE GENERIC BITS\n");
492
493         io.generic.level = RAW_OPEN_NTCREATEX;
494         io.ntcreatex.in.root_fid = 0;
495         io.ntcreatex.in.flags = 0;
496         io.ntcreatex.in.access_mask = 
497                 SEC_STD_READ_CONTROL | 
498                 SEC_STD_WRITE_DAC | 
499                 SEC_STD_WRITE_OWNER;
500         io.ntcreatex.in.create_options = 0;
501         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
502         io.ntcreatex.in.share_access = 
503                 NTCREATEX_SHARE_ACCESS_READ | 
504                 NTCREATEX_SHARE_ACCESS_WRITE;
505         io.ntcreatex.in.alloc_size = 0;
506         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
507         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
508         io.ntcreatex.in.security_flags = 0;
509         io.ntcreatex.in.fname = fname;
510         status = smb_raw_open(cli->tree, mem_ctx, &io);
511         CHECK_STATUS(status, NT_STATUS_OK);
512         fnum = io.ntcreatex.out.fnum;
513
514         printf("get the original sd\n");
515         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
516         q.query_secdesc.in.fnum = fnum;
517         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
518         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
519         CHECK_STATUS(status, NT_STATUS_OK);
520         sd_orig = q.query_secdesc.out.sd;
521
522         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
523
524         status = smblsa_sid_check_privilege(cli, 
525                                             owner_sid, 
526                                             sec_privilege_name(SEC_PRIV_RESTORE));
527         has_restore_privilege = NT_STATUS_IS_OK(status);
528         if (!NT_STATUS_IS_OK(status)) {
529                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
530         }
531         printf("SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
532
533         status = smblsa_sid_check_privilege(cli, 
534                                             owner_sid, 
535                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
536         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
537         if (!NT_STATUS_IS_OK(status)) {
538                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
539         }
540         printf("SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_restore_privilege?"Yes":"No");
541
542         for (i=0;i<ARRAY_SIZE(file_mappings);i++) {
543                 uint32_t expected_mask = 
544                         SEC_STD_WRITE_DAC | 
545                         SEC_STD_READ_CONTROL | 
546                         SEC_FILE_READ_ATTRIBUTE |
547                         SEC_STD_DELETE;
548                 uint32_t expected_mask_anon = SEC_FILE_READ_ATTRIBUTE;
549
550                 if (has_restore_privilege) {
551                         expected_mask_anon |= SEC_STD_DELETE;
552                 }
553
554                 printf("testing generic bits 0x%08x\n", 
555                        file_mappings[i].gen_bits);
556                 sd = security_descriptor_create(mem_ctx,
557                                                 owner_sid, NULL,
558                                                 owner_sid,
559                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
560                                                 file_mappings[i].gen_bits,
561                                                 0,
562                                                 NULL);
563
564                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
565                 set.set_secdesc.file.fnum = fnum;
566                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
567                 set.set_secdesc.in.sd = sd;
568
569                 status = smb_raw_setfileinfo(cli->tree, &set);
570                 CHECK_STATUS(status, NT_STATUS_OK);
571
572                 sd2 = security_descriptor_create(mem_ctx,
573                                                  owner_sid, NULL,
574                                                  owner_sid,
575                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
576                                                  file_mappings[i].specific_bits,
577                                                  0,
578                                                  NULL);
579
580                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
581                 CHECK_STATUS(status, NT_STATUS_OK);
582                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
583                         printf("security descriptors don't match!\n");
584                         printf("got:\n");
585                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
586                         printf("expected:\n");
587                         NDR_PRINT_DEBUG(security_descriptor, sd2);
588                 }
589
590                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
591                 status = smb_raw_open(cli->tree, mem_ctx, &io);
592                 CHECK_STATUS(status, NT_STATUS_OK);
593                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum, 
594                                    expected_mask | file_mappings[i].specific_bits);
595                 smbcli_close(cli->tree, io.ntcreatex.out.fnum);
596
597                 if (!has_take_ownership_privilege) {
598                         continue;
599                 }
600
601                 printf("testing generic bits 0x%08x (anonymous)\n", 
602                        file_mappings[i].gen_bits);
603                 sd = security_descriptor_create(mem_ctx,
604                                                 SID_NT_ANONYMOUS, NULL,
605                                                 owner_sid,
606                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
607                                                 file_mappings[i].gen_bits,
608                                                 0,
609                                                 NULL);
610
611                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
612                 set.set_secdesc.file.fnum = fnum;
613                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
614                 set.set_secdesc.in.sd = sd;
615
616                 status = smb_raw_setfileinfo(cli->tree, &set);
617                 CHECK_STATUS(status, NT_STATUS_OK);
618
619                 sd2 = security_descriptor_create(mem_ctx,
620                                                  SID_NT_ANONYMOUS, NULL,
621                                                  owner_sid,
622                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
623                                                  file_mappings[i].specific_bits,
624                                                  0,
625                                                  NULL);
626
627                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
628                 CHECK_STATUS(status, NT_STATUS_OK);
629                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
630                         printf("security descriptors don't match!\n");
631                         printf("got:\n");
632                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
633                         printf("expected:\n");
634                         NDR_PRINT_DEBUG(security_descriptor, sd2);
635                 }
636
637                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
638                 status = smb_raw_open(cli->tree, mem_ctx, &io);
639                 CHECK_STATUS(status, NT_STATUS_OK);
640                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum, 
641                                    expected_mask_anon | file_mappings[i].specific_bits);
642                 smbcli_close(cli->tree, io.ntcreatex.out.fnum);
643         }
644
645         printf("put back original sd\n");
646         set.set_secdesc.in.sd = sd_orig;
647         status = smb_raw_setfileinfo(cli->tree, &set);
648         CHECK_STATUS(status, NT_STATUS_OK);
649
650         smbcli_close(cli->tree, fnum);
651         smbcli_unlink(cli->tree, fname);
652
653
654         printf("TESTING DIR GENERIC BITS\n");
655
656         io.generic.level = RAW_OPEN_NTCREATEX;
657         io.ntcreatex.in.root_fid = 0;
658         io.ntcreatex.in.flags = 0;
659         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC;
660         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
661         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
662         io.ntcreatex.in.share_access = 
663                 NTCREATEX_SHARE_ACCESS_READ | 
664                 NTCREATEX_SHARE_ACCESS_WRITE;
665         io.ntcreatex.in.alloc_size = 0;
666         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
667         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
668         io.ntcreatex.in.security_flags = 0;
669         io.ntcreatex.in.fname = fname;
670         status = smb_raw_open(cli->tree, mem_ctx, &io);
671         CHECK_STATUS(status, NT_STATUS_OK);
672         fnum = io.ntcreatex.out.fnum;
673
674         printf("get the original sd\n");
675         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
676         q.query_secdesc.in.fnum = fnum;
677         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
678         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
679         CHECK_STATUS(status, NT_STATUS_OK);
680         sd_orig = q.query_secdesc.out.sd;
681
682         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
683
684
685         for (i=0;i<ARRAY_SIZE(dir_mappings);i++) {
686                 uint32_t expected_mask = 
687                         SEC_STD_WRITE_DAC | 
688                         SEC_STD_READ_CONTROL | 
689                         SEC_FILE_READ_ATTRIBUTE |
690                         SEC_STD_DELETE;
691
692                 printf("testing generic bits 0x%08x\n", 
693                        file_mappings[i].gen_bits);
694                 sd = security_descriptor_create(mem_ctx,
695                                                 NULL, NULL,
696                                                 owner_sid,
697                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
698                                                 dir_mappings[i].gen_bits,
699                                                 0,
700                                                 NULL);
701
702                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
703                 set.set_secdesc.file.fnum = fnum;
704                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
705                 set.set_secdesc.in.sd = sd;
706
707                 status = smb_raw_setfileinfo(cli->tree, &set);
708                 CHECK_STATUS(status, NT_STATUS_OK);
709
710                 sd2 = security_descriptor_create(mem_ctx,
711                                                  owner_sid, NULL,
712                                                  owner_sid,
713                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
714                                                  dir_mappings[i].specific_bits,
715                                                  0,
716                                                  NULL);
717
718                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
719                 CHECK_STATUS(status, NT_STATUS_OK);
720                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
721                         printf("security descriptors don't match!\n");
722                         printf("got:\n");
723                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
724                         printf("expected:\n");
725                         NDR_PRINT_DEBUG(security_descriptor, sd2);
726                 }
727
728                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
729                 status = smb_raw_open(cli->tree, mem_ctx, &io);
730                 CHECK_STATUS(status, NT_STATUS_OK);
731                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum, 
732                                    expected_mask | dir_mappings[i].specific_bits);
733                 smbcli_close(cli->tree, io.ntcreatex.out.fnum);
734         }
735
736         printf("put back original sd\n");
737         set.set_secdesc.in.sd = sd_orig;
738         status = smb_raw_setfileinfo(cli->tree, &set);
739         CHECK_STATUS(status, NT_STATUS_OK);
740
741         smbcli_close(cli->tree, fnum);
742         smbcli_unlink(cli->tree, fname);
743
744 done:
745         smbcli_close(cli->tree, fnum);
746         return ret;
747 }
748
749
750
751 /*
752   test the inheritance of ACL flags onto new files and directories
753 */
754 static BOOL test_inheritance(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
755 {
756         NTSTATUS status;
757         union smb_open io;
758         const char *dname = BASEDIR "\\inheritance";
759         const char *fname1 = BASEDIR "\\inheritance\\testfile";
760         const char *fname2 = BASEDIR "\\inheritance\\testdir";
761         BOOL ret = True;
762         int fnum, fnum2, i;
763         union smb_fileinfo q;
764         union smb_setfileinfo set;
765         struct security_descriptor *sd, *sd_orig, *sd_def;
766         const char *owner_sid;
767         const struct {
768                 uint32_t parent_flags;
769                 uint32_t file_flags;
770                 uint32_t dir_flags;
771         } test_flags[] = {
772                 {
773                         0, 
774                         0,
775                         0
776                 },
777                 {
778                         SEC_ACE_FLAG_OBJECT_INHERIT,
779                         0,
780                         SEC_ACE_FLAG_OBJECT_INHERIT | 
781                         SEC_ACE_FLAG_INHERIT_ONLY,
782                 },
783                 {
784                         SEC_ACE_FLAG_CONTAINER_INHERIT,
785                         0,
786                         SEC_ACE_FLAG_CONTAINER_INHERIT,
787                 },
788                 {
789                         SEC_ACE_FLAG_OBJECT_INHERIT | 
790                         SEC_ACE_FLAG_CONTAINER_INHERIT,
791                         0,
792                         SEC_ACE_FLAG_OBJECT_INHERIT | 
793                         SEC_ACE_FLAG_CONTAINER_INHERIT,
794                 },
795                 {
796                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
797                         0,
798                         0,
799                 },
800                 {
801                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT | 
802                         SEC_ACE_FLAG_OBJECT_INHERIT,
803                         0,
804                         0,
805                 },
806                 {
807                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT | 
808                         SEC_ACE_FLAG_CONTAINER_INHERIT,
809                         0,
810                         0,
811                 },
812                 {
813                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT | 
814                         SEC_ACE_FLAG_CONTAINER_INHERIT | 
815                         SEC_ACE_FLAG_OBJECT_INHERIT,
816                         0,
817                         0,
818                 },
819                 {
820                         SEC_ACE_FLAG_INHERIT_ONLY,
821                         0,
822                         0,
823                 },
824                 {
825                         SEC_ACE_FLAG_INHERIT_ONLY | 
826                         SEC_ACE_FLAG_OBJECT_INHERIT,
827                         0,
828                         SEC_ACE_FLAG_OBJECT_INHERIT | 
829                         SEC_ACE_FLAG_INHERIT_ONLY,
830                 },
831                 {
832                         SEC_ACE_FLAG_INHERIT_ONLY | 
833                         SEC_ACE_FLAG_CONTAINER_INHERIT,
834                         0,
835                         SEC_ACE_FLAG_CONTAINER_INHERIT,
836                 },
837                 {
838                         SEC_ACE_FLAG_INHERIT_ONLY | 
839                         SEC_ACE_FLAG_CONTAINER_INHERIT | 
840                         SEC_ACE_FLAG_OBJECT_INHERIT,
841                         0,
842                         SEC_ACE_FLAG_CONTAINER_INHERIT | 
843                         SEC_ACE_FLAG_OBJECT_INHERIT,
844                 },
845                 {
846                         SEC_ACE_FLAG_INHERIT_ONLY | 
847                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
848                         0,
849                         0,
850                 },
851                 {
852                         SEC_ACE_FLAG_INHERIT_ONLY | 
853                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT | 
854                         SEC_ACE_FLAG_OBJECT_INHERIT,
855                         0,
856                         0,
857                 },
858                 {
859                         SEC_ACE_FLAG_INHERIT_ONLY | 
860                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT | 
861                         SEC_ACE_FLAG_CONTAINER_INHERIT,
862                         0,
863                         0,
864                 },
865                 {
866                         SEC_ACE_FLAG_INHERIT_ONLY | 
867                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT | 
868                         SEC_ACE_FLAG_CONTAINER_INHERIT | 
869                         SEC_ACE_FLAG_OBJECT_INHERIT,
870                         0,
871                         0,
872                 }
873         };
874
875         printf("TESTING ACL INHERITANCE\n");
876
877         io.generic.level = RAW_OPEN_NTCREATEX;
878         io.ntcreatex.in.root_fid = 0;
879         io.ntcreatex.in.flags = 0;
880         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
881         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
882         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
883         io.ntcreatex.in.share_access = 0;
884         io.ntcreatex.in.alloc_size = 0;
885         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
886         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
887         io.ntcreatex.in.security_flags = 0;
888         io.ntcreatex.in.fname = dname;
889
890         status = smb_raw_open(cli->tree, mem_ctx, &io);
891         CHECK_STATUS(status, NT_STATUS_OK);
892         fnum = io.ntcreatex.out.fnum;
893
894         printf("get the original sd\n");
895         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
896         q.query_secdesc.in.fnum = fnum;
897         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
898         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
899         CHECK_STATUS(status, NT_STATUS_OK);
900         sd_orig = q.query_secdesc.out.sd;
901
902         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
903
904         sd_def = security_descriptor_create(mem_ctx,
905                                             owner_sid, NULL,
906                                             owner_sid,
907                                             SEC_ACE_TYPE_ACCESS_ALLOWED,
908                                             SEC_RIGHTS_FILE_ALL,
909                                             0,
910                                             SID_NT_SYSTEM,
911                                             SEC_ACE_TYPE_ACCESS_ALLOWED,
912                                             SEC_RIGHTS_FILE_ALL,
913                                             0,
914                                             NULL);
915
916         for (i=0;i<ARRAY_SIZE(test_flags);i++) {
917                 sd = security_descriptor_create(mem_ctx,
918                                                 NULL, NULL,
919                                                 owner_sid,
920                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
921                                                 SEC_FILE_WRITE_DATA,
922                                                 test_flags[i].parent_flags,
923                                                 SID_WORLD,
924                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
925                                                 SEC_FILE_ALL | SEC_STD_ALL,
926                                                 0,
927                                                 NULL);
928                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
929                 set.set_secdesc.file.fnum = fnum;
930                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
931                 set.set_secdesc.in.sd = sd;
932                 status = smb_raw_setfileinfo(cli->tree, &set);
933                 CHECK_STATUS(status, NT_STATUS_OK);
934
935                 io.ntcreatex.in.fname = fname1;
936                 io.ntcreatex.in.create_options = 0;
937                 status = smb_raw_open(cli->tree, mem_ctx, &io);
938                 CHECK_STATUS(status, NT_STATUS_OK);
939                 fnum2 = io.ntcreatex.out.fnum;
940
941                 q.query_secdesc.in.fnum = fnum2;
942                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
943                 CHECK_STATUS(status, NT_STATUS_OK);
944
945                 smbcli_close(cli->tree, fnum2);
946                 smbcli_unlink(cli->tree, fname1);
947
948                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
949                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def)) {
950                                 printf("Expected default sd at %d - got:\n", i);
951                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
952                         }
953                         goto check_dir;
954                 }
955
956                 if (q.query_secdesc.out.sd->dacl == NULL ||
957                     q.query_secdesc.out.sd->dacl->num_aces < 1 ||
958                     q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
959                     !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
960                                    sd_orig->owner_sid)) {
961                         printf("Bad sd in child file at %d\n", i);
962                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
963                         ret = False;
964                         goto check_dir;
965                 }
966
967                 if (q.query_secdesc.out.sd->dacl->aces[0].flags != 
968                     test_flags[i].file_flags) {
969                         printf("incorrect file_flags 0x%x - expected 0x%x for parent 0x%x with (i=%d)\n",
970                                q.query_secdesc.out.sd->dacl->aces[0].flags,
971                                test_flags[i].file_flags,
972                                test_flags[i].parent_flags,
973                                i);
974                         ret = False;
975                 }
976
977         check_dir:
978                 io.ntcreatex.in.fname = fname2;
979                 io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
980                 status = smb_raw_open(cli->tree, mem_ctx, &io);
981                 CHECK_STATUS(status, NT_STATUS_OK);
982                 fnum2 = io.ntcreatex.out.fnum;
983
984                 q.query_secdesc.in.fnum = fnum2;
985                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
986                 CHECK_STATUS(status, NT_STATUS_OK);
987
988                 smbcli_close(cli->tree, fnum2);
989                 smbcli_rmdir(cli->tree, fname2);
990
991                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) &&
992                     (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT) ||
993                      (test_flags[i].parent_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT))) {
994                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def)) {
995                                 printf("Expected default sd for dir at %d - got:\n", i);
996                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
997                         }
998                         continue;
999                 }
1000
1001                 if (q.query_secdesc.out.sd->dacl == NULL ||
1002                     q.query_secdesc.out.sd->dacl->num_aces < 1 ||
1003                     q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1004                     !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1005                                    sd_orig->owner_sid)) {
1006                         printf("Bad sd in child dir at %d (parent 0x%x)\n", 
1007                                i, test_flags[i].parent_flags);
1008                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1009                         ret = False;
1010                         continue;
1011                 }
1012
1013                 if (q.query_secdesc.out.sd->dacl->aces[0].flags != 
1014                     test_flags[i].dir_flags) {
1015                         printf("incorrect dir_flags 0x%x - expected 0x%x for parent 0x%x with (i=%d)\n",
1016                                q.query_secdesc.out.sd->dacl->aces[0].flags,
1017                                test_flags[i].dir_flags,
1018                                test_flags[i].parent_flags,
1019                                i);
1020                         ret = False;
1021                 }
1022         }
1023
1024         printf("put back original sd\n");
1025         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1026         set.set_secdesc.file.fnum = fnum;
1027         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1028         set.set_secdesc.in.sd = sd_orig;
1029         status = smb_raw_setfileinfo(cli->tree, &set);
1030         CHECK_STATUS(status, NT_STATUS_OK);
1031
1032         smbcli_close(cli->tree, fnum);
1033         smbcli_rmdir(cli->tree, dname);
1034
1035
1036 done:
1037         smbcli_close(cli->tree, fnum);
1038         return ret;
1039 }
1040
1041
1042 /* 
1043    basic testing of security descriptor calls
1044 */
1045 BOOL torture_raw_acls(void)
1046 {
1047         struct smbcli_state *cli;
1048         BOOL ret = True;
1049         TALLOC_CTX *mem_ctx;
1050
1051         if (!torture_open_connection(&cli)) {
1052                 return False;
1053         }
1054
1055         mem_ctx = talloc_init("torture_raw_acls");
1056
1057         if (!torture_setup_dir(cli, BASEDIR)) {
1058                 return False;
1059         }
1060
1061         ret &= test_sd(cli, mem_ctx);
1062         ret &= test_nttrans_create(cli, mem_ctx);
1063         ret &= test_creator_sid(cli, mem_ctx);
1064         ret &= test_generic_bits(cli, mem_ctx);
1065         ret &= test_inheritance(cli, mem_ctx);
1066
1067         smb_raw_exit(cli->session);
1068         smbcli_deltree(cli->tree, BASEDIR);
1069
1070         torture_close_connection(cli);
1071         talloc_destroy(mem_ctx);
1072         return ret;
1073 }