r23785: use the GPLv3 boilerplate as recommended by the FSF and the license text
[ira/wip.git] / testsuite / smbd / se_access_check_printer.c
1 /* 
2    Unix SMB/Netbios implementation.
3    Version 1.9.
4    Security context tests
5    Copyright (C) Tim Potter 2000
6    
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 3 of the License, or
10    (at your option) any later version.
11    
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16    
17    You should have received a copy of the GNU General Public License
18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "se_access_check_utils.h"
23
24 /* Globals */
25
26 BOOL failed;
27 SEC_DESC *sd;
28
29 struct ace_entry acl_printer[] = {
30
31         /* Everyone is allowed to print */
32
33         { SEC_ACE_TYPE_ACCESS_ALLOWED, SEC_ACE_FLAG_CONTAINER_INHERIT,
34           PRINTER_ACE_PRINT, "S-1-1-0" },
35
36         /* Except for user0 who uses too much paper */
37
38         { SEC_ACE_TYPE_ACCESS_DENIED, SEC_ACE_FLAG_CONTAINER_INHERIT,
39           PRINTER_ACE_FULL_CONTROL, "user0" },
40
41         /* Users 1 and 2 can manage documents */
42
43         { SEC_ACE_TYPE_ACCESS_ALLOWED, SEC_ACE_FLAG_CONTAINER_INHERIT,
44           PRINTER_ACE_MANAGE_DOCUMENTS, "user1" },
45
46         { SEC_ACE_TYPE_ACCESS_ALLOWED, SEC_ACE_FLAG_CONTAINER_INHERIT,
47           PRINTER_ACE_MANAGE_DOCUMENTS, "user2" },
48
49         /* Domain Admins can also manage documents */
50
51         { SEC_ACE_TYPE_ACCESS_ALLOWED, SEC_ACE_FLAG_CONTAINER_INHERIT,
52           PRINTER_ACE_MANAGE_DOCUMENTS, "Domain Admins" },
53
54         /* User 3 is da man */
55
56         { SEC_ACE_TYPE_ACCESS_ALLOWED, SEC_ACE_FLAG_CONTAINER_INHERIT,
57           PRINTER_ACE_FULL_CONTROL, "user3" },
58
59         { 0, 0, 0, NULL}
60 };
61
62 BOOL test_user(char *username, uint32 acc_desired, uint32 *acc_granted)
63 {
64         struct passwd *pw;
65         uint32 status;
66
67         if (!(pw = getpwnam(username))) {
68                 printf("FAIL: could not lookup user info for %s\n",
69                        username);
70                 exit(1);
71         }
72
73         return se_access_check(sd, pw->pw_uid, pw->pw_gid, 0, NULL,
74                                acc_desired, acc_granted, &status);
75 }
76
77 static char *pace_str(uint32 ace_flags)
78 {
79         if ((ace_flags & PRINTER_ACE_FULL_CONTROL) == 
80             PRINTER_ACE_FULL_CONTROL) return "full control";
81
82         if ((ace_flags & PRINTER_ACE_MANAGE_DOCUMENTS) ==
83             PRINTER_ACE_MANAGE_DOCUMENTS) return "manage documents";
84
85         if ((ace_flags & PRINTER_ACE_PRINT) == PRINTER_ACE_PRINT)
86                 return "print";
87
88         return "UNKNOWN";
89 }
90
91 uint32 perms[] = {
92         PRINTER_ACE_PRINT,
93         PRINTER_ACE_FULL_CONTROL,
94         PRINTER_ACE_MANAGE_DOCUMENTS,
95         0
96 };
97
98 void runtest(void)
99 {
100         uint32 acc_granted;
101         BOOL result;
102         int i, j;
103
104         for (i = 0; perms[i]; i++) {
105
106                 /* Test 10 users */
107                 
108                 for (j = 0; j < 10; j++) {
109                         fstring name;
110
111                         /* Test user against ACL */
112
113                         snprintf(name, sizeof(fstring), "%s/user%d", 
114                                  getenv("TEST_WORKGROUP"), j);
115                         
116                         result = test_user(name, perms[i], &acc_granted);
117
118                         printf("%s: %s %s 0x%08x\n", name, 
119                                pace_str(perms[i]), 
120                                result ? "TRUE " : "FALSE", acc_granted);
121
122                         /* Check results */
123
124                         switch (perms[i]) {
125
126                         case PRINTER_ACE_PRINT: {
127                                 if (!result || acc_granted !=
128                                     PRINTER_ACE_PRINT) {
129                                         printf("FAIL: user %s can't print\n",
130                                                name);
131                                         failed = True;
132                                 }
133                                 break;
134                         }
135
136                         case PRINTER_ACE_FULL_CONTROL: {
137                                 if (j == 3) {
138                                         if (!result || acc_granted !=
139                                             PRINTER_ACE_FULL_CONTROL) {
140                                                 printf("FAIL: user %s doesn't "
141                                                        "have full control\n",
142                                                        name);
143                                                 failed = True;
144                                         }
145                                 } else {
146                                         if (result || acc_granted != 0) {
147                                                 printf("FAIL: user %s has full "
148                                                        "control\n", name);
149                                                 failed = True;
150                                         }
151                                 }
152                                 break;
153                         }
154                         case PRINTER_ACE_MANAGE_DOCUMENTS: {
155                                 if (j == 1 || j == 2) {
156                                         if (!result || acc_granted !=
157                                             PRINTER_ACE_MANAGE_DOCUMENTS) {
158                                                 printf("FAIL: user %s can't "
159                                                        "manage documents\n",
160                                                        name);
161                                                 failed = True;
162                                         }
163                                 } else {
164                                         if (result || acc_granted != 0) {
165                                                 printf("FAIL: user %s can "
166                                                        "manage documents\n",
167                                                        name);
168                                                 failed = True;
169                                         }
170                                 }
171                                 break;
172                         }
173
174                         default:
175                                 printf("FAIL: internal error\n");
176                                 exit(1);
177                         }
178                 }
179         }
180 }
181
182 /* Main function */
183
184 int main(int argc, char **argv)
185 {
186         /* Initialisation */
187
188         generate_wellknown_sids();
189
190         /* Create security descriptor */
191
192         sd = build_sec_desc(acl_printer, NULL, NULL_SID, NULL_SID);
193
194         if (!sd) {
195                 printf("FAIL: could not build security descriptor\n");
196                 return 1;
197         }
198
199         /* Run test */
200
201         runtest();
202
203         /* Return */
204
205         if (!failed) {
206                 printf("PASS\n");
207                 return 0;
208         } 
209
210         return 1;
211 }