s3: torture: Adds regression test case for se_access_check() owner rights issue.

This test passes against Win2K12 but fails against smbd
without the previous commit.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12466

Signed-off-by: Jeremy Allison <jra@samba.org>
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Dec 10 10:11:10 CET 2016 on sn-devel-144

diff --git a/selftest/skip b/selftest/skip
index 0893962be0ff4d96e5d789772ac44e1aef3e4cb2..1e6d311f3c1139ebb0d9510c59dcf9bad82feee9 100644 (file)
--- a/selftest/skip
+++ b/selftest/skip
@@ -49,6 +49,7 @@
 ^samba3.smbtorture_s3.plain\(ad_dc_ntvfs\).POSIX-OFD-LOCK # Fails against the s4 ntvfs server
 ^samba3.smbtorture_s3.plain\(ad_dc_ntvfs\).POSIX-STREAM-DELETE # Fails against the s4 ntvfs server
 ^samba3.smbtorture_s3.plain\(ad_dc_ntvfs\).RENAME-ACCESS # Fails against the s4 ntvfs server
+^samba3.smbtorture_s3.plain\(ad_dc_ntvfs\).OWNER-RIGHTS # Don't test against the s4 ntvfs server anymore
 ^samba3.smbtorture_s3.plain\(ad_dc_ntvfs\).PIDHIGH # Fails against the s4 ntvfs server
 ^samba3.smbtorture_s3.plain\(ad_dc_ntvfs\).NTTRANS-FSCTL # Fails against the s4 ntvfs server
 ^samba3.smbtorture_s3.plain\(ad_dc_ntvfs\).SMB2-NEGPROT # Fails against the s4 ntvfs server

diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index a678c77251bc4bc4204f3a31fc233819a05d131c..d9d32cce10e9b14a3115994483787b4cfd0ac5fb 100755 (executable)
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -49,7 +49,7 @@ tests = ["FDPASS", "LOCK1", "LOCK2", "LOCK3", "LOCK4", "LOCK5", "LOCK6", "LOCK7"
         "OPLOCK1", "OPLOCK2", "OPLOCK4", "STREAMERROR",
         "DIR", "DIR1", "DIR-CREATETIME", "TCON", "TCONDEV", "RW1", "RW2", "RW3", "LARGE_READX", "RW-SIGNING",
         "OPEN", "XCOPY", "RENAME", "DELETE", "DELETE-LN", "WILDDELETE", "PROPERTIES", "W2K",
-        "TCON2", "IOCTL", "CHKPATH", "FDSESS", "CHAIN1", "CHAIN2",
+        "TCON2", "IOCTL", "CHKPATH", "FDSESS", "CHAIN1", "CHAIN2", "OWNER-RIGHTS",
         "CHAIN3", "PIDHIGH",
         "GETADDRINFO", "UID-REGRESSION-TEST", "SHORTNAME-TEST",
         "CASE-INSENSITIVE-CREATE", "SMB2-BASIC", "NTTRANS-FSCTL", "SMB2-NEGPROT",

diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 09e8b93abee28dfd0ae007dcc526c20c06972ef4..8f0f13676a0e347742320cb92c83743aba19b88d 100644 (file)
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -5092,6 +5092,391 @@ static bool run_rename_access(int dummy)
        return false;
 }
 
+/*
+  Test owner rights ACE.
+ */
+static bool run_owner_rights(int dummy)
+{
+       static struct cli_state *cli = NULL;
+       const char *fname = "owner_rights.txt";
+       uint16_t fnum = (uint16_t)-1;
+       struct security_descriptor *sd = NULL;
+       struct security_descriptor *newsd = NULL;
+       NTSTATUS status;
+       TALLOC_CTX *frame = NULL;
+
+       frame = talloc_stackframe();
+       printf("starting owner rights test\n");
+
+       /* Windows connection. */
+       if (!torture_open_connection(&cli, 0)) {
+               goto fail;
+       }
+
+       smbXcli_conn_set_sockopt(cli->conn, sockops);
+
+       /* Start with a clean slate. */
+       cli_unlink(cli, fname, FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);
+
+       /* Create the test file. */
+       /* Now try and open for read and write-dac. */
+       status = cli_ntcreate(cli,
+                               fname,
+                               0,
+                               GENERIC_ALL_ACCESS,
+                               FILE_ATTRIBUTE_NORMAL,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE|
+                                       FILE_SHARE_DELETE,
+                               FILE_CREATE,
+                               0,
+                               0,
+                               &fnum,
+                               NULL);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("Create of %s - %s\n", fname, nt_errstr(status));
+               goto fail;
+       }
+
+       /* Get the original SD. */
+       status = cli_query_secdesc(cli,
+                               fnum,
+                               frame,
+                               &sd);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("cli_query_secdesc failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+
+       /*
+        * Add an "owner-rights" ACE denying WRITE_DATA,
+        * and an "owner-rights" ACE allowing READ_DATA.
+        */
+
+       newsd = security_descriptor_dacl_create(frame,
+                                       0,
+                                       NULL,
+                                       NULL,
+                                       SID_OWNER_RIGHTS,
+                                       SEC_ACE_TYPE_ACCESS_DENIED,
+                                       FILE_WRITE_DATA,
+                                       0,
+                                       SID_OWNER_RIGHTS,
+                                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                       FILE_READ_DATA,
+                                       0,
+                                       NULL);
+       if (newsd == NULL) {
+               goto fail;
+       }
+       sd->dacl = security_acl_concatenate(frame,
+                                       newsd->dacl,
+                                       sd->dacl);
+       if (sd->dacl == NULL) {
+               goto fail;
+       }
+       status = cli_set_secdesc(cli, fnum, sd);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("cli_set_secdesc failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+       status = cli_close(cli, fnum);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("close failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+       fnum = (uint16_t)-1;
+
+       /* Try and open for FILE_WRITE_DATA */
+       status = cli_ntcreate(cli,
+                               fname,
+                               0,
+                               FILE_WRITE_DATA,
+                               FILE_ATTRIBUTE_NORMAL,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE|
+                                       FILE_SHARE_DELETE,
+                               FILE_OPEN,
+                               0,
+                               0,
+                               &fnum,
+                               NULL);
+       if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
+               printf("Open of %s - %s\n", fname, nt_errstr(status));
+               goto fail;
+       }
+
+       /* Now try and open for FILE_READ_DATA */
+       status = cli_ntcreate(cli,
+                               fname,
+                               0,
+                               FILE_READ_DATA,
+                               FILE_ATTRIBUTE_NORMAL,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE|
+                                       FILE_SHARE_DELETE,
+                               FILE_OPEN,
+                               0,
+                               0,
+                               &fnum,
+                               NULL);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("Open of %s - %s\n", fname, nt_errstr(status));
+               goto fail;
+       }
+
+       status = cli_close(cli, fnum);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("close failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+
+       /* Restore clean slate. */
+       TALLOC_FREE(sd);
+       cli_unlink(cli, fname, FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);
+
+       /* Create the test file. */
+       status = cli_ntcreate(cli,
+                               fname,
+                               0,
+                               GENERIC_ALL_ACCESS,
+                               FILE_ATTRIBUTE_NORMAL,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE|
+                                       FILE_SHARE_DELETE,
+                               FILE_CREATE,
+                               0,
+                               0,
+                               &fnum,
+                               NULL);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("Create of %s - %s\n", fname, nt_errstr(status));
+               goto fail;
+       }
+
+       /* Get the original SD. */
+       status = cli_query_secdesc(cli,
+                               fnum,
+                               frame,
+                               &sd);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("cli_query_secdesc failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+
+       /*
+        * Add an "owner-rights ACE denying WRITE_DATA,
+        * and an "owner-rights ACE allowing READ_DATA|WRITE_DATA.
+        */
+
+       newsd = security_descriptor_dacl_create(frame,
+                                       0,
+                                       NULL,
+                                       NULL,
+                                       SID_OWNER_RIGHTS,
+                                       SEC_ACE_TYPE_ACCESS_DENIED,
+                                       FILE_WRITE_DATA,
+                                       0,
+                                       SID_OWNER_RIGHTS,
+                                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                       FILE_READ_DATA|FILE_WRITE_DATA,
+                                       0,
+                                       NULL);
+       if (newsd == NULL) {
+               goto fail;
+       }
+       sd->dacl = security_acl_concatenate(frame,
+                                       newsd->dacl,
+                                       sd->dacl);
+       if (sd->dacl == NULL) {
+               goto fail;
+       }
+       status = cli_set_secdesc(cli, fnum, sd);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("cli_set_secdesc failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+       status = cli_close(cli, fnum);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("close failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+       fnum = (uint16_t)-1;
+
+       /* Try and open for FILE_WRITE_DATA */
+       status = cli_ntcreate(cli,
+                               fname,
+                               0,
+                               FILE_WRITE_DATA,
+                               FILE_ATTRIBUTE_NORMAL,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE|
+                                       FILE_SHARE_DELETE,
+                               FILE_OPEN,
+                               0,
+                               0,
+                               &fnum,
+                               NULL);
+       if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
+               printf("Open of %s - %s\n", fname, nt_errstr(status));
+               goto fail;
+       }
+
+       /* Now try and open for FILE_READ_DATA */
+       status = cli_ntcreate(cli,
+                               fname,
+                               0,
+                               FILE_READ_DATA,
+                               FILE_ATTRIBUTE_NORMAL,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE|
+                                       FILE_SHARE_DELETE,
+                               FILE_OPEN,
+                               0,
+                               0,
+                               &fnum,
+                               NULL);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("Open of %s - %s\n", fname, nt_errstr(status));
+               goto fail;
+       }
+
+       status = cli_close(cli, fnum);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("close failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+
+       /* Restore clean slate. */
+       TALLOC_FREE(sd);
+       cli_unlink(cli, fname, FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);
+
+
+       /* Create the test file. */
+       status = cli_ntcreate(cli,
+                               fname,
+                               0,
+                               GENERIC_ALL_ACCESS,
+                               FILE_ATTRIBUTE_NORMAL,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE|
+                                       FILE_SHARE_DELETE,
+                               FILE_CREATE,
+                               0,
+                               0,
+                               &fnum,
+                               NULL);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("Create of %s - %s\n", fname, nt_errstr(status));
+               goto fail;
+       }
+
+       /* Get the original SD. */
+       status = cli_query_secdesc(cli,
+                               fnum,
+                               frame,
+                               &sd);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("cli_query_secdesc failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+
+       /*
+        * Add an "authenticated users" ACE allowing READ_DATA,
+        * add an "owner-rights" denying READ_DATA,
+        * and an "authenticated users" ACE allowing WRITE_DATA.
+        */
+
+       newsd = security_descriptor_dacl_create(frame,
+                                       0,
+                                       NULL,
+                                       NULL,
+                                       SID_NT_AUTHENTICATED_USERS,
+                                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                       FILE_READ_DATA,
+                                       0,
+                                       SID_OWNER_RIGHTS,
+                                       SEC_ACE_TYPE_ACCESS_DENIED,
+                                       FILE_READ_DATA,
+                                       0,
+                                       SID_NT_AUTHENTICATED_USERS,
+                                       SEC_ACE_TYPE_ACCESS_ALLOWED,
+                                       FILE_WRITE_DATA,
+                                       0,
+                                       NULL);
+       if (newsd == NULL) {
+               printf("newsd == NULL\n");
+               goto fail;
+       }
+       sd->dacl = security_acl_concatenate(frame,
+                                       newsd->dacl,
+                                       sd->dacl);
+       if (sd->dacl == NULL) {
+               printf("sd->dacl == NULL\n");
+               goto fail;
+       }
+       status = cli_set_secdesc(cli, fnum, sd);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("cli_set_secdesc failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+       status = cli_close(cli, fnum);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("close failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+       fnum = (uint16_t)-1;
+
+       /* Now try and open for FILE_READ_DATA|FILE_WRITE_DATA */
+       status = cli_ntcreate(cli,
+                               fname,
+                               0,
+                               FILE_READ_DATA|FILE_WRITE_DATA,
+                               FILE_ATTRIBUTE_NORMAL,
+                               FILE_SHARE_READ|FILE_SHARE_WRITE|
+                                       FILE_SHARE_DELETE,
+                               FILE_OPEN,
+                               0,
+                               0,
+                               &fnum,
+                               NULL);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("Open of %s - %s\n", fname, nt_errstr(status));
+               goto fail;
+       }
+
+       status = cli_close(cli, fnum);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("close failed for %s (%s)\n",
+                       fname, nt_errstr(status));
+               goto fail;
+       }
+
+       cli_unlink(cli, fname,
+               FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);
+
+       TALLOC_FREE(frame);
+       return true;
+
+  fail:
+
+       if (cli) {
+               if (fnum != -1) {
+                       cli_close(cli, fnum);
+               }
+               cli_unlink(cli, fname,
+                       FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);
+               torture_close_connection(cli);
+       }
+
+       TALLOC_FREE(frame);
+       return false;
+}
+
 static bool run_pipe_number(int dummy)
 {
        struct cli_state *cli1;
@@ -10650,6 +11035,7 @@ static struct {
        {"XCOPY", run_xcopy, 0},
        {"RENAME", run_rename, 0},
        {"RENAME-ACCESS", run_rename_access, 0},
+       {"OWNER-RIGHTS", run_owner_rights, 0},
        {"DELETE", run_deletetest, 0},
        {"WILDDELETE", run_wild_deletetest, 0},
        {"DELETE-LN", run_deletetest_ln, 0},