source4/torture/raw/acls.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test security descriptor operations
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "torture/torture.h"
  25 #include "libcli/raw/libcliraw.h"
  26 #include "libcli/libcli.h"
  27
  28 #define BASEDIR "\\testsd"
  29
  30 #define CHECK_STATUS(status, correct) do { \
  31         if (!NT_STATUS_EQUAL(status, correct)) { \
  32                 printf("(%s) Incorrect status %s - should be %s\n", \
  33                        __location__, nt_errstr(status), nt_errstr(correct)); \
  34                 ret = False; \
  35                 goto done; \
  36         }} while (0)
  37
  38
  39 static BOOL test_sd(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
  40 {
  41         NTSTATUS status;
  42         union smb_open io;
  43         const char *fname = BASEDIR "\\sd.txt";
  44         BOOL ret = True;
  45         int fnum = -1;
  46         union smb_fileinfo q;
  47         union smb_setfileinfo set;
  48         struct security_ace ace;
  49         struct security_descriptor *sd;
  50         struct dom_sid *test_sid;
  51
  52         printf("TESTING SETFILEINFO EA_SET\n");
  53
  54         io.generic.level = RAW_OPEN_NTCREATEX;
  55         io.ntcreatex.in.root_fid = 0;
  56         io.ntcreatex.in.flags = 0;
  57         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  58         io.ntcreatex.in.create_options = 0;
  59         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
  60         io.ntcreatex.in.share_access =
  61                 NTCREATEX_SHARE_ACCESS_READ |
  62                 NTCREATEX_SHARE_ACCESS_WRITE;
  63         io.ntcreatex.in.alloc_size = 0;
  64         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
  65         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
  66         io.ntcreatex.in.security_flags = 0;
  67         io.ntcreatex.in.fname = fname;
  68         status = smb_raw_open(cli->tree, mem_ctx, &io);
  69         CHECK_STATUS(status, NT_STATUS_OK);
  70         fnum = io.ntcreatex.out.fnum;
  71
  72         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
  73         q.query_secdesc.in.fnum = fnum;
  74         q.query_secdesc.secinfo_flags =
  75                 SECINFO_OWNER |
  76                 SECINFO_GROUP |
  77                 SECINFO_DACL;
  78         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
  79         CHECK_STATUS(status, NT_STATUS_OK);
  80         sd = q.query_secdesc.out.sd;
  81
  82         printf("add a new ACE to the DACL\n");
  83
  84         test_sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-1234-5432");
  85
  86         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
  87         ace.flags = 0;
  88         ace.access_mask = SEC_STD_ALL;
  89         ace.trustee = *test_sid;
  90
  91         status = security_descriptor_dacl_add(sd, &ace);
  92         CHECK_STATUS(status, NT_STATUS_OK);
  93
  94         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
  95         set.set_secdesc.file.fnum = fnum;
  96         set.set_secdesc.in.secinfo_flags = q.query_secdesc.secinfo_flags;
  97         set.set_secdesc.in.sd = sd;
  98
  99         status = smb_raw_setfileinfo(cli->tree, &set);
 100         CHECK_STATUS(status, NT_STATUS_OK);
 101
 102         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 103         CHECK_STATUS(status, NT_STATUS_OK);
 104
 105         if (!security_acl_equal(q.query_secdesc.out.sd->dacl, sd->dacl)) {
 106                 printf("%s: security descriptors don't match!\n", __location__);
 107                 printf("got:\n");
 108                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 109                 printf("expected:\n");
 110                 NDR_PRINT_DEBUG(security_descriptor, sd);
 111                 ret = False;
 112         }
 113
 114         printf("remove it again\n");
 115
 116         status = security_descriptor_dacl_del(sd, test_sid);
 117         CHECK_STATUS(status, NT_STATUS_OK);
 118
 119         status = smb_raw_setfileinfo(cli->tree, &set);
 120         CHECK_STATUS(status, NT_STATUS_OK);
 121
 122         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 123         CHECK_STATUS(status, NT_STATUS_OK);
 124
 125         if (!security_acl_equal(q.query_secdesc.out.sd->dacl, sd->dacl)) {
 126                 printf("%s: security descriptors don't match!\n", __location__);
 127                 printf("got:\n");
 128                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 129                 printf("expected:\n");
 130                 NDR_PRINT_DEBUG(security_descriptor, sd);
 131                 ret = False;
 132         }
 133
 134 done:
 135         smbcli_close(cli->tree, fnum);
 136         return ret;
 137 }
 138
 139
 140 /*
 141   test using NTTRANS CREATE to create a file with an initial ACL set
 142 */
 143 static BOOL test_nttrans_create(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 144 {
 145         NTSTATUS status;
 146         union smb_open io;
 147         const char *fname = BASEDIR "\\acl2.txt";
 148         BOOL ret = True;
 149         int fnum = -1;
 150         union smb_fileinfo q;
 151         struct security_ace ace;
 152         struct security_descriptor *sd;
 153         struct dom_sid *test_sid;
 154
 155         printf("TESTING NTTRANS CREATE WITH SEC_DESC\n");
 156
 157         io.generic.level = RAW_OPEN_NTTRANS_CREATE;
 158         io.ntcreatex.in.root_fid = 0;
 159         io.ntcreatex.in.flags = 0;
 160         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 161         io.ntcreatex.in.create_options = 0;
 162         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 163         io.ntcreatex.in.share_access =
 164                 NTCREATEX_SHARE_ACCESS_READ |
 165                 NTCREATEX_SHARE_ACCESS_WRITE;
 166         io.ntcreatex.in.alloc_size = 0;
 167         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
 168         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 169         io.ntcreatex.in.security_flags = 0;
 170         io.ntcreatex.in.fname = fname;
 171         io.ntcreatex.in.sec_desc = NULL;
 172         io.ntcreatex.in.ea_list = NULL;
 173
 174         printf("creating normal file\n");
 175
 176         status = smb_raw_open(cli->tree, mem_ctx, &io);
 177         CHECK_STATUS(status, NT_STATUS_OK);
 178         fnum = io.ntcreatex.out.fnum;
 179
 180         printf("querying ACL\n");
 181
 182         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 183         q.query_secdesc.in.fnum = fnum;
 184         q.query_secdesc.secinfo_flags =
 185                 SECINFO_OWNER |
 186                 SECINFO_GROUP |
 187                 SECINFO_DACL;
 188         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 189         CHECK_STATUS(status, NT_STATUS_OK);
 190         sd = q.query_secdesc.out.sd;
 191
 192         smbcli_close(cli->tree, fnum);
 193         smbcli_unlink(cli->tree, fname);
 194
 195         printf("adding a new ACE\n");
 196         test_sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-1234-54321");
 197
 198         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
 199         ace.flags = 0;
 200         ace.access_mask = SEC_STD_ALL;
 201         ace.trustee = *test_sid;
 202
 203         status = security_descriptor_dacl_add(sd, &ace);
 204         CHECK_STATUS(status, NT_STATUS_OK);
 205
 206         printf("creating a file with an initial ACL\n");
 207
 208         io.ntcreatex.in.sec_desc = sd;
 209         status = smb_raw_open(cli->tree, mem_ctx, &io);
 210         CHECK_STATUS(status, NT_STATUS_OK);
 211         fnum = io.ntcreatex.out.fnum;
 212
 213         q.query_secdesc.in.fnum = fnum;
 214         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 215         CHECK_STATUS(status, NT_STATUS_OK);
 216
 217         if (!security_acl_equal(q.query_secdesc.out.sd->dacl, sd->dacl)) {
 218                 printf("%s: security descriptors don't match!\n", __location__);
 219                 printf("got:\n");
 220                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 221                 printf("expected:\n");
 222                 NDR_PRINT_DEBUG(security_descriptor, sd);
 223                 ret = False;
 224         }
 225
 226 done:
 227         smbcli_close(cli->tree, fnum);
 228         return ret;
 229 }
 230
 231 #define CHECK_ACCESS_FLAGS(_fnum, flags) do { \
 232         union smb_fileinfo _q; \
 233         _q.access_information.level = RAW_FILEINFO_ACCESS_INFORMATION; \
 234         _q.access_information.in.fnum = (_fnum); \
 235         status = smb_raw_fileinfo(cli->tree, mem_ctx, &_q); \
 236         CHECK_STATUS(status, NT_STATUS_OK); \
 237         if (_q.access_information.out.access_flags != (flags)) { \
 238                 printf("(%s) Incorrect access_flags 0x%08x - should be 0x%08x\n", \
 239                        __location__, _q.access_information.out.access_flags, (flags)); \
 240                 ret = False; \
 241                 goto done; \
 242         } \
 243 } while (0)
 244
 245
 246 /*
 247   test the behaviour of the well known SID_CREATOR_OWNER sid, and some generic
 248   mapping bits
 249 */
 250 static BOOL test_creator_sid(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 251 {
 252         NTSTATUS status;
 253         union smb_open io;
 254         const char *fname = BASEDIR "\\creator.txt";
 255         BOOL ret = True;
 256         int fnum = -1;
 257         union smb_fileinfo q;
 258         union smb_setfileinfo set;
 259         struct security_descriptor *sd, *sd_orig, *sd2;
 260         const char *owner_sid;
 261
 262         printf("TESTING SID_CREATOR_OWNER\n");
 263
 264         io.generic.level = RAW_OPEN_NTCREATEX;
 265         io.ntcreatex.in.root_fid = 0;
 266         io.ntcreatex.in.flags = 0;
 267         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC | SEC_STD_WRITE_OWNER;
 268         io.ntcreatex.in.create_options = 0;
 269         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 270         io.ntcreatex.in.share_access =
 271                 NTCREATEX_SHARE_ACCESS_READ |
 272                 NTCREATEX_SHARE_ACCESS_WRITE;
 273         io.ntcreatex.in.alloc_size = 0;
 274         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 275         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 276         io.ntcreatex.in.security_flags = 0;
 277         io.ntcreatex.in.fname = fname;
 278         status = smb_raw_open(cli->tree, mem_ctx, &io);
 279         CHECK_STATUS(status, NT_STATUS_OK);
 280         fnum = io.ntcreatex.out.fnum;
 281
 282         printf("get the original sd\n");
 283         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 284         q.query_secdesc.in.fnum = fnum;
 285         q.query_secdesc.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 286         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 287         CHECK_STATUS(status, NT_STATUS_OK);
 288         sd_orig = q.query_secdesc.out.sd;
 289
 290         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 291
 292         printf("set a sec desc allowing no write by CREATOR_OWNER\n");
 293         sd = security_descriptor_create(mem_ctx,
 294                                         NULL, NULL,
 295                                         SID_CREATOR_OWNER,
 296                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 297                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 298                                         0,
 299                                         NULL);
 300
 301         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 302         set.set_secdesc.file.fnum = fnum;
 303         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 304         set.set_secdesc.in.sd = sd;
 305
 306         status = smb_raw_setfileinfo(cli->tree, &set);
 307         CHECK_STATUS(status, NT_STATUS_OK);
 308
 309         printf("try open for write\n");
 310         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 311         status = smb_raw_open(cli->tree, mem_ctx, &io);
 312         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 313
 314         printf("try open for read\n");
 315         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 316         status = smb_raw_open(cli->tree, mem_ctx, &io);
 317         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 318
 319         printf("try open for generic write\n");
 320         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 321         status = smb_raw_open(cli->tree, mem_ctx, &io);
 322         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 323
 324         printf("try open for generic read\n");
 325         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 326         status = smb_raw_open(cli->tree, mem_ctx, &io);
 327         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 328
 329         printf("set a sec desc allowing no write by owner\n");
 330         sd = security_descriptor_create(mem_ctx,
 331                                         owner_sid, NULL,
 332                                         owner_sid,
 333                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 334                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 335                                         0,
 336                                         NULL);
 337
 338         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 339         set.set_secdesc.file.fnum = fnum;
 340         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 341         set.set_secdesc.in.sd = sd;
 342         status = smb_raw_setfileinfo(cli->tree, &set);
 343         CHECK_STATUS(status, NT_STATUS_OK);
 344
 345         printf("check that sd has been mapped correctly\n");
 346         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 347         CHECK_STATUS(status, NT_STATUS_OK);
 348         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd)) {
 349                 printf("%s: security descriptors don't match!\n", __location__);
 350                 printf("got:\n");
 351                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 352                 printf("expected:\n");
 353                 NDR_PRINT_DEBUG(security_descriptor, sd);
 354                 ret = False;
 355         }
 356
 357         printf("try open for write\n");
 358         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 359         status = smb_raw_open(cli->tree, mem_ctx, &io);
 360         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 361
 362         printf("try open for read\n");
 363         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 364         status = smb_raw_open(cli->tree, mem_ctx, &io);
 365         CHECK_STATUS(status, NT_STATUS_OK);
 366         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 367                            SEC_FILE_READ_DATA|
 368                            SEC_FILE_READ_ATTRIBUTE);
 369         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 370
 371         printf("try open for generic write\n");
 372         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 373         status = smb_raw_open(cli->tree, mem_ctx, &io);
 374         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 375
 376         printf("try open for generic read\n");
 377         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 378         status = smb_raw_open(cli->tree, mem_ctx, &io);
 379         CHECK_STATUS(status, NT_STATUS_OK);
 380         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 381                            SEC_RIGHTS_FILE_READ);
 382         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 383
 384         printf("set a sec desc allowing generic read by owner\n");
 385         sd = security_descriptor_create(mem_ctx,
 386                                         NULL, NULL,
 387                                         owner_sid,
 388                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 389                                         SEC_GENERIC_READ | SEC_STD_ALL,
 390                                         0,
 391                                         NULL);
 392
 393         set.set_secdesc.in.sd = sd;
 394         status = smb_raw_setfileinfo(cli->tree, &set);
 395         CHECK_STATUS(status, NT_STATUS_OK);
 396
 397         printf("check that generic read has been mapped correctly\n");
 398         sd2 = security_descriptor_create(mem_ctx,
 399                                          owner_sid, NULL,
 400                                          owner_sid,
 401                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
 402                                          SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 403                                          0,
 404                                          NULL);
 405
 406         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 407         CHECK_STATUS(status, NT_STATUS_OK);
 408         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 409                 printf("%s: security descriptors don't match!\n", __location__);
 410                 printf("got:\n");
 411                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 412                 printf("expected:\n");
 413                 NDR_PRINT_DEBUG(security_descriptor, sd2);
 414                 ret = False;
 415         }
 416
 417
 418         printf("try open for write\n");
 419         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 420         status = smb_raw_open(cli->tree, mem_ctx, &io);
 421         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 422
 423         printf("try open for read\n");
 424         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 425         status = smb_raw_open(cli->tree, mem_ctx, &io);
 426         CHECK_STATUS(status, NT_STATUS_OK);
 427         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 428                            SEC_FILE_READ_DATA |
 429                            SEC_FILE_READ_ATTRIBUTE);
 430         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 431
 432         printf("try open for generic write\n");
 433         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 434         status = smb_raw_open(cli->tree, mem_ctx, &io);
 435         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 436
 437         printf("try open for generic read\n");
 438         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 439         status = smb_raw_open(cli->tree, mem_ctx, &io);
 440         CHECK_STATUS(status, NT_STATUS_OK);
 441         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum, SEC_RIGHTS_FILE_READ);
 442         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 443
 444
 445         printf("put back original sd\n");
 446         set.set_secdesc.in.sd = sd_orig;
 447         status = smb_raw_setfileinfo(cli->tree, &set);
 448         CHECK_STATUS(status, NT_STATUS_OK);
 449
 450
 451 done:
 452         smbcli_close(cli->tree, fnum);
 453         return ret;
 454 }
 455
 456
 457 /*
 458   test the mapping of the SEC_GENERIC_xx bits to SEC_STD_xx and
 459   SEC_FILE_xx bits
 460 */
 461 static BOOL test_generic_bits(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 462 {
 463         NTSTATUS status;
 464         union smb_open io;
 465         const char *fname = BASEDIR "\\generic.txt";
 466         BOOL ret = True;
 467         int fnum = -1, i;
 468         union smb_fileinfo q;
 469         union smb_setfileinfo set;
 470         struct security_descriptor *sd, *sd_orig, *sd2;
 471         const char *owner_sid;
 472         const struct {
 473                 uint32_t gen_bits;
 474                 uint32_t specific_bits;
 475         } file_mappings[] = {
 476                 { 0,                       0 },
 477                 { SEC_GENERIC_READ,        SEC_RIGHTS_FILE_READ },
 478                 { SEC_GENERIC_WRITE,       SEC_RIGHTS_FILE_WRITE },
 479                 { SEC_GENERIC_EXECUTE,     SEC_RIGHTS_FILE_EXECUTE },
 480                 { SEC_GENERIC_ALL,         SEC_RIGHTS_FILE_ALL },
 481                 { SEC_FILE_READ_DATA,      SEC_FILE_READ_DATA },
 482                 { SEC_FILE_READ_ATTRIBUTE, SEC_FILE_READ_ATTRIBUTE }
 483         };
 484         const struct {
 485                 uint32_t gen_bits;
 486                 uint32_t specific_bits;
 487         } dir_mappings[] = {
 488                 { 0,                   0 },
 489                 { SEC_GENERIC_READ,    SEC_RIGHTS_DIR_READ },
 490                 { SEC_GENERIC_WRITE,   SEC_RIGHTS_DIR_WRITE },
 491                 { SEC_GENERIC_EXECUTE, SEC_RIGHTS_DIR_EXECUTE },
 492                 { SEC_GENERIC_ALL,     SEC_RIGHTS_DIR_ALL }
 493         };
 494         BOOL has_restore_privilege;
 495         BOOL has_take_ownership_privilege;
 496
 497         printf("TESTING FILE GENERIC BITS\n");
 498
 499         io.generic.level = RAW_OPEN_NTCREATEX;
 500         io.ntcreatex.in.root_fid = 0;
 501         io.ntcreatex.in.flags = 0;
 502         io.ntcreatex.in.access_mask =
 503                 SEC_STD_READ_CONTROL |
 504                 SEC_STD_WRITE_DAC |
 505                 SEC_STD_WRITE_OWNER;
 506         io.ntcreatex.in.create_options = 0;
 507         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 508         io.ntcreatex.in.share_access =
 509                 NTCREATEX_SHARE_ACCESS_READ |
 510                 NTCREATEX_SHARE_ACCESS_WRITE;
 511         io.ntcreatex.in.alloc_size = 0;
 512         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 513         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 514         io.ntcreatex.in.security_flags = 0;
 515         io.ntcreatex.in.fname = fname;
 516         status = smb_raw_open(cli->tree, mem_ctx, &io);
 517         CHECK_STATUS(status, NT_STATUS_OK);
 518         fnum = io.ntcreatex.out.fnum;
 519
 520         printf("get the original sd\n");
 521         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 522         q.query_secdesc.in.fnum = fnum;
 523         q.query_secdesc.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 524         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 525         CHECK_STATUS(status, NT_STATUS_OK);
 526         sd_orig = q.query_secdesc.out.sd;
 527
 528         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 529
 530         status = smblsa_sid_check_privilege(cli,
 531                                             owner_sid,
 532                                             sec_privilege_name(SEC_PRIV_RESTORE));
 533         has_restore_privilege = NT_STATUS_IS_OK(status);
 534         if (!NT_STATUS_IS_OK(status)) {
 535                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 536         }
 537         printf("SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
 538
 539         status = smblsa_sid_check_privilege(cli,
 540                                             owner_sid,
 541                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
 542         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
 543         if (!NT_STATUS_IS_OK(status)) {
 544                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 545         }
 546         printf("SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_take_ownership_privilege?"Yes":"No");
 547
 548         for (i=0;i<ARRAY_SIZE(file_mappings);i++) {
 549                 uint32_t expected_mask =
 550                         SEC_STD_WRITE_DAC |
 551                         SEC_STD_READ_CONTROL |
 552                         SEC_FILE_READ_ATTRIBUTE |
 553                         SEC_STD_DELETE;
 554                 uint32_t expected_mask_anon = SEC_FILE_READ_ATTRIBUTE;
 555
 556                 if (has_restore_privilege) {
 557                         expected_mask_anon |= SEC_STD_DELETE;
 558                 }
 559
 560                 printf("testing generic bits 0x%08x\n",
 561                        file_mappings[i].gen_bits);
 562                 sd = security_descriptor_create(mem_ctx,
 563                                                 owner_sid, NULL,
 564                                                 owner_sid,
 565                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 566                                                 file_mappings[i].gen_bits,
 567                                                 0,
 568                                                 NULL);
 569
 570                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 571                 set.set_secdesc.file.fnum = fnum;
 572                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 573                 set.set_secdesc.in.sd = sd;
 574
 575                 status = smb_raw_setfileinfo(cli->tree, &set);
 576                 CHECK_STATUS(status, NT_STATUS_OK);
 577
 578                 sd2 = security_descriptor_create(mem_ctx,
 579                                                  owner_sid, NULL,
 580                                                  owner_sid,
 581                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 582                                                  file_mappings[i].specific_bits,
 583                                                  0,
 584                                                  NULL);
 585
 586                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 587                 CHECK_STATUS(status, NT_STATUS_OK);
 588                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 589                         printf("%s: security descriptors don't match!\n", __location__);
 590                         printf("got:\n");
 591                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 592                         printf("expected:\n");
 593                         NDR_PRINT_DEBUG(security_descriptor, sd2);
 594                         ret = False;
 595                 }
 596
 597                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 598                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 599                 CHECK_STATUS(status, NT_STATUS_OK);
 600                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 601                                    expected_mask | file_mappings[i].specific_bits);
 602                 smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 603
 604                 if (!has_take_ownership_privilege) {
 605                         continue;
 606                 }
 607
 608                 printf("testing generic bits 0x%08x (anonymous)\n",
 609                        file_mappings[i].gen_bits);
 610                 sd = security_descriptor_create(mem_ctx,
 611                                                 SID_NT_ANONYMOUS, NULL,
 612                                                 owner_sid,
 613                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 614                                                 file_mappings[i].gen_bits,
 615                                                 0,
 616                                                 NULL);
 617
 618                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 619                 set.set_secdesc.file.fnum = fnum;
 620                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 621                 set.set_secdesc.in.sd = sd;
 622
 623                 status = smb_raw_setfileinfo(cli->tree, &set);
 624                 CHECK_STATUS(status, NT_STATUS_OK);
 625
 626                 sd2 = security_descriptor_create(mem_ctx,
 627                                                  SID_NT_ANONYMOUS, NULL,
 628                                                  owner_sid,
 629                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 630                                                  file_mappings[i].specific_bits,
 631                                                  0,
 632                                                  NULL);
 633
 634                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 635                 CHECK_STATUS(status, NT_STATUS_OK);
 636                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 637                         printf("%s: security descriptors don't match!\n", __location__);
 638                         printf("got:\n");
 639                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 640                         printf("expected:\n");
 641                         NDR_PRINT_DEBUG(security_descriptor, sd2);
 642                         ret = False;
 643                 }
 644
 645                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 646                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 647                 CHECK_STATUS(status, NT_STATUS_OK);
 648                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 649                                    expected_mask_anon | file_mappings[i].specific_bits);
 650                 smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 651         }
 652
 653         printf("put back original sd\n");
 654         set.set_secdesc.in.sd = sd_orig;
 655         status = smb_raw_setfileinfo(cli->tree, &set);
 656         CHECK_STATUS(status, NT_STATUS_OK);
 657
 658         smbcli_close(cli->tree, fnum);
 659         smbcli_unlink(cli->tree, fname);
 660
 661
 662         printf("TESTING DIR GENERIC BITS\n");
 663
 664         io.generic.level = RAW_OPEN_NTCREATEX;
 665         io.ntcreatex.in.root_fid = 0;
 666         io.ntcreatex.in.flags = 0;
 667         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC;
 668         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
 669         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
 670         io.ntcreatex.in.share_access =
 671                 NTCREATEX_SHARE_ACCESS_READ |
 672                 NTCREATEX_SHARE_ACCESS_WRITE;
 673         io.ntcreatex.in.alloc_size = 0;
 674         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 675         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 676         io.ntcreatex.in.security_flags = 0;
 677         io.ntcreatex.in.fname = fname;
 678         status = smb_raw_open(cli->tree, mem_ctx, &io);
 679         CHECK_STATUS(status, NT_STATUS_OK);
 680         fnum = io.ntcreatex.out.fnum;
 681
 682         printf("get the original sd\n");
 683         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 684         q.query_secdesc.in.fnum = fnum;
 685         q.query_secdesc.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 686         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 687         CHECK_STATUS(status, NT_STATUS_OK);
 688         sd_orig = q.query_secdesc.out.sd;
 689
 690         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 691
 692
 693         for (i=0;i<ARRAY_SIZE(dir_mappings);i++) {
 694                 uint32_t expected_mask =
 695                         SEC_STD_WRITE_DAC |
 696                         SEC_STD_READ_CONTROL |
 697                         SEC_FILE_READ_ATTRIBUTE |
 698                         SEC_STD_DELETE;
 699
 700                 printf("testing generic bits 0x%08x\n",
 701                        file_mappings[i].gen_bits);
 702                 sd = security_descriptor_create(mem_ctx,
 703                                                 NULL, NULL,
 704                                                 owner_sid,
 705                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 706                                                 dir_mappings[i].gen_bits,
 707                                                 0,
 708                                                 NULL);
 709
 710                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 711                 set.set_secdesc.file.fnum = fnum;
 712                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 713                 set.set_secdesc.in.sd = sd;
 714
 715                 status = smb_raw_setfileinfo(cli->tree, &set);
 716                 CHECK_STATUS(status, NT_STATUS_OK);
 717
 718                 sd2 = security_descriptor_create(mem_ctx,
 719                                                  owner_sid, NULL,
 720                                                  owner_sid,
 721                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 722                                                  dir_mappings[i].specific_bits,
 723                                                  0,
 724                                                  NULL);
 725
 726                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 727                 CHECK_STATUS(status, NT_STATUS_OK);
 728                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 729                         printf("%s: security descriptors don't match!\n", __location__);
 730                         printf("got:\n");
 731                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 732                         printf("expected:\n");
 733                         NDR_PRINT_DEBUG(security_descriptor, sd2);
 734                         ret = False;
 735                 }
 736
 737                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 738                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 739                 CHECK_STATUS(status, NT_STATUS_OK);
 740                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum,
 741                                    expected_mask | dir_mappings[i].specific_bits);
 742                 smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 743         }
 744
 745         printf("put back original sd\n");
 746         set.set_secdesc.in.sd = sd_orig;
 747         status = smb_raw_setfileinfo(cli->tree, &set);
 748         CHECK_STATUS(status, NT_STATUS_OK);
 749
 750         smbcli_close(cli->tree, fnum);
 751         smbcli_unlink(cli->tree, fname);
 752
 753 done:
 754         smbcli_close(cli->tree, fnum);
 755         return ret;
 756 }
 757
 758
 759 /*
 760   see what access bits the owner of a file always gets
 761 */
 762 static BOOL test_owner_bits(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 763 {
 764         NTSTATUS status;
 765         union smb_open io;
 766         const char *fname = BASEDIR "\\generic.txt";
 767         BOOL ret = True;
 768         int fnum = -1, i;
 769         union smb_fileinfo q;
 770         union smb_setfileinfo set;
 771         struct security_descriptor *sd, *sd_orig;
 772         const char *owner_sid;
 773         BOOL has_restore_privilege;
 774         BOOL has_take_ownership_privilege;
 775         uint32_t expected_bits;
 776
 777         printf("TESTING FILE OWNER BITS\n");
 778
 779         io.generic.level = RAW_OPEN_NTCREATEX;
 780         io.ntcreatex.in.root_fid = 0;
 781         io.ntcreatex.in.flags = 0;
 782         io.ntcreatex.in.access_mask =
 783                 SEC_STD_READ_CONTROL |
 784                 SEC_STD_WRITE_DAC |
 785                 SEC_STD_WRITE_OWNER;
 786         io.ntcreatex.in.create_options = 0;
 787         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 788         io.ntcreatex.in.share_access =
 789                 NTCREATEX_SHARE_ACCESS_READ |
 790                 NTCREATEX_SHARE_ACCESS_WRITE;
 791         io.ntcreatex.in.alloc_size = 0;
 792         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 793         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 794         io.ntcreatex.in.security_flags = 0;
 795         io.ntcreatex.in.fname = fname;
 796         status = smb_raw_open(cli->tree, mem_ctx, &io);
 797         CHECK_STATUS(status, NT_STATUS_OK);
 798         fnum = io.ntcreatex.out.fnum;
 799
 800         printf("get the original sd\n");
 801         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 802         q.query_secdesc.in.fnum = fnum;
 803         q.query_secdesc.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 804         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 805         CHECK_STATUS(status, NT_STATUS_OK);
 806         sd_orig = q.query_secdesc.out.sd;
 807
 808         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 809
 810         status = smblsa_sid_check_privilege(cli,
 811                                             owner_sid,
 812                                             sec_privilege_name(SEC_PRIV_RESTORE));
 813         has_restore_privilege = NT_STATUS_IS_OK(status);
 814         if (!NT_STATUS_IS_OK(status)) {
 815                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 816         }
 817         printf("SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
 818
 819         status = smblsa_sid_check_privilege(cli,
 820                                             owner_sid,
 821                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
 822         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
 823         if (!NT_STATUS_IS_OK(status)) {
 824                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 825         }
 826         printf("SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_take_ownership_privilege?"Yes":"No");
 827
 828         sd = security_descriptor_create(mem_ctx,
 829                                         NULL, NULL,
 830                                         owner_sid,
 831                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 832                                         SEC_FILE_WRITE_DATA,
 833                                         0,
 834                                         NULL);
 835
 836         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 837         set.set_secdesc.file.fnum = fnum;
 838         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 839         set.set_secdesc.in.sd = sd;
 840
 841         status = smb_raw_setfileinfo(cli->tree, &set);
 842         CHECK_STATUS(status, NT_STATUS_OK);
 843
 844         expected_bits = SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE;
 845
 846         for (i=0;i<16;i++) {
 847                 uint32_t bit = (1<<i);
 848                 io.ntcreatex.in.access_mask = bit;
 849                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 850                 if (expected_bits & bit) {
 851                         if (!NT_STATUS_IS_OK(status)) {
 852                                 printf("failed with access mask 0x%08x of expected 0x%08x\n",
 853                                        bit, expected_bits);
 854                         }
 855                         CHECK_STATUS(status, NT_STATUS_OK);
 856                         CHECK_ACCESS_FLAGS(io.ntcreatex.out.fnum, bit | SEC_FILE_READ_ATTRIBUTE);
 857                         smbcli_close(cli->tree, io.ntcreatex.out.fnum);
 858                 } else {
 859                         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 860                 }
 861         }
 862
 863         printf("put back original sd\n");
 864         set.set_secdesc.in.sd = sd_orig;
 865         status = smb_raw_setfileinfo(cli->tree, &set);
 866         CHECK_STATUS(status, NT_STATUS_OK);
 867
 868 done:
 869         smbcli_close(cli->tree, fnum);
 870         smbcli_unlink(cli->tree, fname);
 871         return ret;
 872 }
 873
 874
 875
 876 /*
 877   test the inheritance of ACL flags onto new files and directories
 878 */
 879 static BOOL test_inheritance(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 880 {
 881         NTSTATUS status;
 882         union smb_open io;
 883         const char *dname = BASEDIR "\\inheritance";
 884         const char *fname1 = BASEDIR "\\inheritance\\testfile";
 885         const char *fname2 = BASEDIR "\\inheritance\\testdir";
 886         BOOL ret = True;
 887         int fnum, fnum2, i;
 888         union smb_fileinfo q;
 889         union smb_setfileinfo set;
 890         struct security_descriptor *sd, *sd_orig, *sd_def;
 891         const char *owner_sid;
 892         const struct dom_sid *creator_owner;
 893         const struct {
 894                 uint32_t parent_flags;
 895                 uint32_t file_flags;
 896                 uint32_t dir_flags;
 897         } test_flags[] = {
 898                 {
 899                         0,
 900                         0,
 901                         0
 902                 },
 903                 {
 904                         SEC_ACE_FLAG_OBJECT_INHERIT,
 905                         0,
 906                         SEC_ACE_FLAG_OBJECT_INHERIT |
 907                         SEC_ACE_FLAG_INHERIT_ONLY,
 908                 },
 909                 {
 910                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 911                         0,
 912                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 913                 },
 914                 {
 915                         SEC_ACE_FLAG_OBJECT_INHERIT |
 916                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 917                         0,
 918                         SEC_ACE_FLAG_OBJECT_INHERIT |
 919                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 920                 },
 921                 {
 922                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
 923                         0,
 924                         0,
 925                 },
 926                 {
 927                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 928                         SEC_ACE_FLAG_OBJECT_INHERIT,
 929                         0,
 930                         0,
 931                 },
 932                 {
 933                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 934                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 935                         0,
 936                         0,
 937                 },
 938                 {
 939                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 940                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 941                         SEC_ACE_FLAG_OBJECT_INHERIT,
 942                         0,
 943                         0,
 944                 },
 945                 {
 946                         SEC_ACE_FLAG_INHERIT_ONLY,
 947                         0,
 948                         0,
 949                 },
 950                 {
 951                         SEC_ACE_FLAG_INHERIT_ONLY |
 952                         SEC_ACE_FLAG_OBJECT_INHERIT,
 953                         0,
 954                         SEC_ACE_FLAG_OBJECT_INHERIT |
 955                         SEC_ACE_FLAG_INHERIT_ONLY,
 956                 },
 957                 {
 958                         SEC_ACE_FLAG_INHERIT_ONLY |
 959                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 960                         0,
 961                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 962                 },
 963                 {
 964                         SEC_ACE_FLAG_INHERIT_ONLY |
 965                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 966                         SEC_ACE_FLAG_OBJECT_INHERIT,
 967                         0,
 968                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 969                         SEC_ACE_FLAG_OBJECT_INHERIT,
 970                 },
 971                 {
 972                         SEC_ACE_FLAG_INHERIT_ONLY |
 973                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
 974                         0,
 975                         0,
 976                 },
 977                 {
 978                         SEC_ACE_FLAG_INHERIT_ONLY |
 979                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 980                         SEC_ACE_FLAG_OBJECT_INHERIT,
 981                         0,
 982                         0,
 983                 },
 984                 {
 985                         SEC_ACE_FLAG_INHERIT_ONLY |
 986                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 987                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 988                         0,
 989                         0,
 990                 },
 991                 {
 992                         SEC_ACE_FLAG_INHERIT_ONLY |
 993                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 994                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 995                         SEC_ACE_FLAG_OBJECT_INHERIT,
 996                         0,
 997                         0,
 998                 }
 999         };
1000
1001         smbcli_rmdir(cli->tree, dname);
1002
1003         printf("TESTING ACL INHERITANCE\n");
1004
1005         io.generic.level = RAW_OPEN_NTCREATEX;
1006         io.ntcreatex.in.root_fid = 0;
1007         io.ntcreatex.in.flags = 0;
1008         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1009         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1010         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
1011         io.ntcreatex.in.share_access = 0;
1012         io.ntcreatex.in.alloc_size = 0;
1013         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1014         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
1015         io.ntcreatex.in.security_flags = 0;
1016         io.ntcreatex.in.fname = dname;
1017
1018         status = smb_raw_open(cli->tree, mem_ctx, &io);
1019         CHECK_STATUS(status, NT_STATUS_OK);
1020         fnum = io.ntcreatex.out.fnum;
1021
1022         printf("get the original sd\n");
1023         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
1024         q.query_secdesc.in.fnum = fnum;
1025         q.query_secdesc.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1026         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
1027         CHECK_STATUS(status, NT_STATUS_OK);
1028         sd_orig = q.query_secdesc.out.sd;
1029
1030         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
1031
1032         printf("owner_sid is %s\n", owner_sid);
1033
1034         sd_def = security_descriptor_create(mem_ctx,
1035                                             owner_sid, NULL,
1036                                             owner_sid,
1037                                             SEC_ACE_TYPE_ACCESS_ALLOWED,
1038                                             SEC_RIGHTS_FILE_ALL,
1039                                             0,
1040                                             SID_NT_SYSTEM,
1041                                             SEC_ACE_TYPE_ACCESS_ALLOWED,
1042                                             SEC_RIGHTS_FILE_ALL,
1043                                             0,
1044                                             NULL);
1045
1046         creator_owner = dom_sid_parse_talloc(mem_ctx, SID_CREATOR_OWNER);
1047
1048         for (i=0;i<ARRAY_SIZE(test_flags);i++) {
1049                 sd = security_descriptor_create(mem_ctx,
1050                                                 NULL, NULL,
1051                                                 SID_CREATOR_OWNER,
1052                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1053                                                 SEC_FILE_WRITE_DATA,
1054                                                 test_flags[i].parent_flags,
1055                                                 SID_WORLD,
1056                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1057                                                 SEC_FILE_ALL | SEC_STD_ALL,
1058                                                 0,
1059                                                 NULL);
1060                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1061                 set.set_secdesc.file.fnum = fnum;
1062                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1063                 set.set_secdesc.in.sd = sd;
1064                 status = smb_raw_setfileinfo(cli->tree, &set);
1065                 CHECK_STATUS(status, NT_STATUS_OK);
1066
1067                 io.ntcreatex.in.fname = fname1;
1068                 io.ntcreatex.in.create_options = 0;
1069                 status = smb_raw_open(cli->tree, mem_ctx, &io);
1070                 CHECK_STATUS(status, NT_STATUS_OK);
1071                 fnum2 = io.ntcreatex.out.fnum;
1072
1073                 q.query_secdesc.in.fnum = fnum2;
1074                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
1075                 CHECK_STATUS(status, NT_STATUS_OK);
1076
1077                 smbcli_close(cli->tree, fnum2);
1078                 smbcli_unlink(cli->tree, fname1);
1079
1080                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
1081                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def)) {
1082                                 printf("Expected default sd at %d - got:\n", i);
1083                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1084                         }
1085                         goto check_dir;
1086                 }
1087
1088                 if (q.query_secdesc.out.sd->dacl == NULL ||
1089                     q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1090                     q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1091                     !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1092                                    sd_orig->owner_sid)) {
1093                         printf("Bad sd in child file at %d\n", i);
1094                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1095                         ret = False;
1096                         goto check_dir;
1097                 }
1098
1099                 if (q.query_secdesc.out.sd->dacl->aces[0].flags !=
1100                     test_flags[i].file_flags) {
1101                         printf("incorrect file_flags 0x%x - expected 0x%x for parent 0x%x with (i=%d)\n",
1102                                q.query_secdesc.out.sd->dacl->aces[0].flags,
1103                                test_flags[i].file_flags,
1104                                test_flags[i].parent_flags,
1105                                i);
1106                         ret = False;
1107                 }
1108
1109         check_dir:
1110                 io.ntcreatex.in.fname = fname2;
1111                 io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1112                 status = smb_raw_open(cli->tree, mem_ctx, &io);
1113                 CHECK_STATUS(status, NT_STATUS_OK);
1114                 fnum2 = io.ntcreatex.out.fnum;
1115
1116                 q.query_secdesc.in.fnum = fnum2;
1117                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
1118                 CHECK_STATUS(status, NT_STATUS_OK);
1119
1120                 smbcli_close(cli->tree, fnum2);
1121                 smbcli_rmdir(cli->tree, fname2);
1122
1123                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) &&
1124                     (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT) ||
1125                      (test_flags[i].parent_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT))) {
1126                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def)) {
1127                                 printf("Expected default sd for dir at %d - got:\n", i);
1128                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1129                         }
1130                         continue;
1131                 }
1132
1133                 if ((test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) &&
1134                     (test_flags[i].parent_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)) {
1135                         if (q.query_secdesc.out.sd->dacl == NULL ||
1136                             q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1137                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1138                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1139                                            sd_orig->owner_sid) ||
1140                             q.query_secdesc.out.sd->dacl->aces[0].flags != test_flags[i].dir_flags) {
1141                                 printf("Bad sd in child dir at %d (parent 0x%x)\n",
1142                                        i, test_flags[i].parent_flags);
1143                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1144                                 ret = False;
1145                                 continue;
1146                         }
1147                 } else if (test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
1148                         if (q.query_secdesc.out.sd->dacl == NULL ||
1149                             q.query_secdesc.out.sd->dacl->num_aces != 2 ||
1150                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1151                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1152                                            sd_orig->owner_sid) ||
1153                             q.query_secdesc.out.sd->dacl->aces[1].access_mask != SEC_FILE_WRITE_DATA ||
1154                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[1].trustee,
1155                                            creator_owner) ||
1156                             q.query_secdesc.out.sd->dacl->aces[0].flags != 0 ||
1157                             q.query_secdesc.out.sd->dacl->aces[1].flags !=
1158                             (test_flags[i].dir_flags | SEC_ACE_FLAG_INHERIT_ONLY)) {
1159                                 printf("Bad sd in child dir at %d (parent 0x%x)\n",
1160                                        i, test_flags[i].parent_flags);
1161                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1162                                 ret = False;
1163                                 continue;
1164                         }
1165                 } else {
1166                         if (q.query_secdesc.out.sd->dacl == NULL ||
1167                             q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1168                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1169                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1170                                            creator_owner) ||
1171                             q.query_secdesc.out.sd->dacl->aces[0].flags != test_flags[i].dir_flags) {
1172                                 printf("Bad sd in child dir at %d (parent 0x%x)\n",
1173                                        i, test_flags[i].parent_flags);
1174                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1175                                 ret = False;
1176                                 continue;
1177                         }
1178                 }
1179         }
1180
1181         printf("testing access checks on inherited create with %s\n", fname1);
1182         sd = security_descriptor_create(mem_ctx,
1183                                         NULL, NULL,
1184                                         owner_sid,
1185                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1186                                         SEC_FILE_WRITE_DATA | SEC_STD_WRITE_DAC,
1187                                         SEC_ACE_FLAG_OBJECT_INHERIT,
1188                                         SID_WORLD,
1189                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1190                                         SEC_FILE_ALL | SEC_STD_ALL,
1191                                         0,
1192                                         NULL);
1193         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1194         set.set_secdesc.file.fnum = fnum;
1195         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1196         set.set_secdesc.in.sd = sd;
1197         status = smb_raw_setfileinfo(cli->tree, &set);
1198         CHECK_STATUS(status, NT_STATUS_OK);
1199
1200         io.ntcreatex.in.fname = fname1;
1201         io.ntcreatex.in.create_options = 0;
1202         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1203         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1204         status = smb_raw_open(cli->tree, mem_ctx, &io);
1205         CHECK_STATUS(status, NT_STATUS_OK);
1206         fnum2 = io.ntcreatex.out.fnum;
1207         CHECK_ACCESS_FLAGS(fnum2, SEC_RIGHTS_FILE_ALL);
1208
1209         q.query_secdesc.in.fnum = fnum2;
1210         q.query_secdesc.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1211         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
1212         CHECK_STATUS(status, NT_STATUS_OK);
1213         smbcli_close(cli->tree, fnum2);
1214
1215         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1216         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1217         status = smb_raw_open(cli->tree, mem_ctx, &io);
1218         if (NT_STATUS_IS_OK(status)) {
1219                 printf("failed: w2k3 ACL bug (allowed open when ACL should deny)\n");
1220                 ret = False;
1221                 fnum2 = io.ntcreatex.out.fnum;
1222                 smbcli_close(cli->tree, fnum2);
1223         } else {
1224                 CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1225         }
1226
1227         printf("trying without execute\n");
1228         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1229         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL & ~SEC_FILE_EXECUTE;
1230         status = smb_raw_open(cli->tree, mem_ctx, &io);
1231         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1232
1233         printf("and with full permissions again\n");
1234         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1235         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1236         status = smb_raw_open(cli->tree, mem_ctx, &io);
1237         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1238
1239         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1240         status = smb_raw_open(cli->tree, mem_ctx, &io);
1241         CHECK_STATUS(status, NT_STATUS_OK);
1242         fnum2 = io.ntcreatex.out.fnum;
1243         CHECK_ACCESS_FLAGS(fnum2, SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE);
1244         smbcli_close(cli->tree, fnum2);
1245
1246         printf("put back original sd\n");
1247         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1248         set.set_secdesc.file.fnum = fnum;
1249         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1250         set.set_secdesc.in.sd = sd_orig;
1251         status = smb_raw_setfileinfo(cli->tree, &set);
1252         CHECK_STATUS(status, NT_STATUS_OK);
1253
1254         smbcli_close(cli->tree, fnum);
1255
1256         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1257         status = smb_raw_open(cli->tree, mem_ctx, &io);
1258         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1259
1260         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1261         status = smb_raw_open(cli->tree, mem_ctx, &io);
1262         CHECK_STATUS(status, NT_STATUS_OK);
1263         fnum2 = io.ntcreatex.out.fnum;
1264         CHECK_ACCESS_FLAGS(fnum2, SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE);
1265         smbcli_close(cli->tree, fnum2);
1266
1267         smbcli_unlink(cli->tree, fname1);
1268         smbcli_rmdir(cli->tree, dname);
1269
1270 done:
1271         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1272         set.set_secdesc.file.fnum = fnum;
1273         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1274         set.set_secdesc.in.sd = sd_orig;
1275         status = smb_raw_setfileinfo(cli->tree, &set);
1276
1277         smbcli_close(cli->tree, fnum);
1278         return ret;
1279 }
1280
1281
1282 /*
1283   test dynamic acl inheritance
1284 */
1285 static BOOL test_inheritance_dynamic(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
1286 {
1287         NTSTATUS status;
1288         union smb_open io;
1289         const char *dname = BASEDIR "\\inheritance";
1290         const char *fname1 = BASEDIR "\\inheritance\\testfile";
1291         BOOL ret = True;
1292         int fnum, fnum2;
1293         union smb_fileinfo q;
1294         union smb_setfileinfo set;
1295         struct security_descriptor *sd, *sd_orig;
1296         const char *owner_sid;
1297
1298         printf("TESTING DYNAMIC ACL INHERITANCE\n");
1299
1300         if (!torture_setup_dir(cli, BASEDIR)) {
1301                 return False;
1302         }
1303
1304         io.generic.level = RAW_OPEN_NTCREATEX;
1305         io.ntcreatex.in.root_fid = 0;
1306         io.ntcreatex.in.flags = 0;
1307         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1308         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1309         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
1310         io.ntcreatex.in.share_access = 0;
1311         io.ntcreatex.in.alloc_size = 0;
1312         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1313         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
1314         io.ntcreatex.in.security_flags = 0;
1315         io.ntcreatex.in.fname = dname;
1316
1317         status = smb_raw_open(cli->tree, mem_ctx, &io);
1318         CHECK_STATUS(status, NT_STATUS_OK);
1319         fnum = io.ntcreatex.out.fnum;
1320
1321         printf("get the original sd\n");
1322         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
1323         q.query_secdesc.in.fnum = fnum;
1324         q.query_secdesc.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1325         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
1326         CHECK_STATUS(status, NT_STATUS_OK);
1327         sd_orig = q.query_secdesc.out.sd;
1328
1329         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
1330
1331         printf("owner_sid is %s\n", owner_sid);
1332
1333         sd = security_descriptor_create(mem_ctx,
1334                                         NULL, NULL,
1335                                         owner_sid,
1336                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1337                                         SEC_FILE_WRITE_DATA | SEC_STD_DELETE | SEC_FILE_READ_ATTRIBUTE,
1338                                         SEC_ACE_FLAG_OBJECT_INHERIT,
1339                                         NULL);
1340         sd->type |= SEC_DESC_DACL_AUTO_INHERITED | SEC_DESC_DACL_AUTO_INHERIT_REQ;
1341
1342         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1343         set.set_secdesc.file.fnum = fnum;
1344         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1345         set.set_secdesc.in.sd = sd;
1346         status = smb_raw_setfileinfo(cli->tree, &set);
1347         CHECK_STATUS(status, NT_STATUS_OK);
1348
1349         printf("create a file with an inherited acl\n");
1350         io.ntcreatex.in.fname = fname1;
1351         io.ntcreatex.in.create_options = 0;
1352         io.ntcreatex.in.access_mask = SEC_FILE_READ_ATTRIBUTE;
1353         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1354         status = smb_raw_open(cli->tree, mem_ctx, &io);
1355         CHECK_STATUS(status, NT_STATUS_OK);
1356         fnum2 = io.ntcreatex.out.fnum;
1357         smbcli_close(cli->tree, fnum2);
1358
1359         printf("try and access file with base rights - should be OK\n");
1360         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1361         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1362         status = smb_raw_open(cli->tree, mem_ctx, &io);
1363         CHECK_STATUS(status, NT_STATUS_OK);
1364         fnum2 = io.ntcreatex.out.fnum;
1365         smbcli_close(cli->tree, fnum2);
1366
1367         printf("try and access file with extra rights - should be denied\n");
1368         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA | SEC_FILE_EXECUTE;
1369         status = smb_raw_open(cli->tree, mem_ctx, &io);
1370         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1371
1372         printf("update parent sd\n");
1373         sd = security_descriptor_create(mem_ctx,
1374                                         NULL, NULL,
1375                                         owner_sid,
1376                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1377                                         SEC_FILE_WRITE_DATA | SEC_STD_DELETE | SEC_FILE_READ_ATTRIBUTE | SEC_FILE_EXECUTE,
1378                                         SEC_ACE_FLAG_OBJECT_INHERIT,
1379                                         NULL);
1380         sd->type |= SEC_DESC_DACL_AUTO_INHERITED | SEC_DESC_DACL_AUTO_INHERIT_REQ;
1381
1382         set.set_secdesc.in.sd = sd;
1383         status = smb_raw_setfileinfo(cli->tree, &set);
1384         CHECK_STATUS(status, NT_STATUS_OK);
1385
1386         printf("try and access file with base rights - should be OK\n");
1387         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1388         status = smb_raw_open(cli->tree, mem_ctx, &io);
1389         CHECK_STATUS(status, NT_STATUS_OK);
1390         fnum2 = io.ntcreatex.out.fnum;
1391         smbcli_close(cli->tree, fnum2);
1392
1393
1394         printf("try and access now - should be OK if dynamic inheritance works\n");
1395         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA | SEC_FILE_EXECUTE;
1396         status = smb_raw_open(cli->tree, mem_ctx, &io);
1397         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
1398                 printf("Server does not have dynamic inheritance\n");
1399         }
1400         if (NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
1401                 printf("Server does have dynamic inheritance\n");
1402         }
1403         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1404
1405         smbcli_unlink(cli->tree, fname1);
1406
1407 done:
1408         printf("put back original sd\n");
1409         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1410         set.set_secdesc.file.fnum = fnum;
1411         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1412         set.set_secdesc.in.sd = sd_orig;
1413         status = smb_raw_setfileinfo(cli->tree, &set);
1414
1415         smbcli_close(cli->tree, fnum);
1416         smbcli_rmdir(cli->tree, dname);
1417
1418         return ret;
1419 }
1420
1421
1422 /*
1423    basic testing of security descriptor calls
1424 */
1425 BOOL torture_raw_acls(void)
1426 {
1427         struct smbcli_state *cli;
1428         BOOL ret = True;
1429         TALLOC_CTX *mem_ctx;
1430
1431         if (!torture_open_connection(&cli)) {
1432                 return False;
1433         }
1434
1435         mem_ctx = talloc_init("torture_raw_acls");
1436
1437         if (!torture_setup_dir(cli, BASEDIR)) {
1438                 return False;
1439         }
1440
1441         ret &= test_sd(cli, mem_ctx);
1442         ret &= test_nttrans_create(cli, mem_ctx);
1443         ret &= test_creator_sid(cli, mem_ctx);
1444         ret &= test_generic_bits(cli, mem_ctx);
1445         ret &= test_owner_bits(cli, mem_ctx);
1446         ret &= test_inheritance(cli, mem_ctx);
1447         ret &= test_inheritance_dynamic(cli, mem_ctx);
1448
1449         smb_raw_exit(cli->session);
1450         smbcli_deltree(cli->tree, BASEDIR);
1451
1452         torture_close_connection(cli);
1453         talloc_free(mem_ctx);
1454         return ret;
1455 }