source4/torture/raw/acls.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test security descriptor operations
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "torture/torture.h"
  24 #include "libcli/raw/libcliraw.h"
  25 #include "libcli/libcli.h"
  26 #include "librpc/gen_ndr/lsa.h"
  27 #include "libcli/util/clilsa.h"
  28 #include "libcli/security/security.h"
  29 #include "torture/util.h"
  30 #include "librpc/gen_ndr/ndr_security.h"
  31
  32 #define BASEDIR "\\testsd"
  33
  34 #define CHECK_STATUS(status, correct) do { \
  35         if (!NT_STATUS_EQUAL(status, correct)) { \
  36                 printf("(%s) Incorrect status %s - should be %s\n", \
  37                        __location__, nt_errstr(status), nt_errstr(correct)); \
  38                 ret = false; \
  39                 goto done; \
  40         }} while (0)
  41
  42
  43 static bool test_sd(struct torture_context *tctx,
  44                                         struct smbcli_state *cli)
  45 {
  46         NTSTATUS status;
  47         union smb_open io;
  48         const char *fname = BASEDIR "\\sd.txt";
  49         bool ret = true;
  50         int fnum = -1;
  51         union smb_fileinfo q;
  52         union smb_setfileinfo set;
  53         struct security_ace ace;
  54         struct security_descriptor *sd;
  55         struct dom_sid *test_sid;
  56
  57         printf("TESTING SETFILEINFO EA_SET\n");
  58
  59         io.generic.level = RAW_OPEN_NTCREATEX;
  60         io.ntcreatex.in.root_fid = 0;
  61         io.ntcreatex.in.flags = 0;
  62         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  63         io.ntcreatex.in.create_options = 0;
  64         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
  65         io.ntcreatex.in.share_access =
  66                 NTCREATEX_SHARE_ACCESS_READ |
  67                 NTCREATEX_SHARE_ACCESS_WRITE;
  68         io.ntcreatex.in.alloc_size = 0;
  69         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
  70         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
  71         io.ntcreatex.in.security_flags = 0;
  72         io.ntcreatex.in.fname = fname;
  73         status = smb_raw_open(cli->tree, tctx, &io);
  74         CHECK_STATUS(status, NT_STATUS_OK);
  75         fnum = io.ntcreatex.out.file.fnum;
  76
  77         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
  78         q.query_secdesc.in.file.fnum = fnum;
  79         q.query_secdesc.in.secinfo_flags =
  80                 SECINFO_OWNER |
  81                 SECINFO_GROUP |
  82                 SECINFO_DACL;
  83         status = smb_raw_fileinfo(cli->tree, tctx, &q);
  84         CHECK_STATUS(status, NT_STATUS_OK);
  85         sd = q.query_secdesc.out.sd;
  86
  87         printf("add a new ACE to the DACL\n");
  88
  89         test_sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1234-5432");
  90
  91         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
  92         ace.flags = 0;
  93         ace.access_mask = SEC_STD_ALL;
  94         ace.trustee = *test_sid;
  95
  96         status = security_descriptor_dacl_add(sd, &ace);
  97         CHECK_STATUS(status, NT_STATUS_OK);
  98
  99         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 100         set.set_secdesc.in.file.fnum = fnum;
 101         set.set_secdesc.in.secinfo_flags = q.query_secdesc.in.secinfo_flags;
 102         set.set_secdesc.in.sd = sd;
 103
 104         status = smb_raw_setfileinfo(cli->tree, &set);
 105         CHECK_STATUS(status, NT_STATUS_OK);
 106
 107         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 108         CHECK_STATUS(status, NT_STATUS_OK);
 109
 110         if (!security_acl_equal(q.query_secdesc.out.sd->dacl, sd->dacl)) {
 111                 printf("%s: security descriptors don't match!\n", __location__);
 112                 printf("got:\n");
 113                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 114                 printf("expected:\n");
 115                 NDR_PRINT_DEBUG(security_descriptor, sd);
 116                 ret = false;
 117         }
 118
 119         printf("remove it again\n");
 120
 121         status = security_descriptor_dacl_del(sd, test_sid);
 122         CHECK_STATUS(status, NT_STATUS_OK);
 123
 124         status = smb_raw_setfileinfo(cli->tree, &set);
 125         CHECK_STATUS(status, NT_STATUS_OK);
 126
 127         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 128         CHECK_STATUS(status, NT_STATUS_OK);
 129
 130         if (!security_acl_equal(q.query_secdesc.out.sd->dacl, sd->dacl)) {
 131                 printf("%s: security descriptors don't match!\n", __location__);
 132                 printf("got:\n");
 133                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 134                 printf("expected:\n");
 135                 NDR_PRINT_DEBUG(security_descriptor, sd);
 136                 ret = false;
 137         }
 138
 139 done:
 140         smbcli_close(cli->tree, fnum);
 141         return ret;
 142 }
 143
 144
 145 /*
 146   test using nttrans create to create a file with an initial acl set
 147 */
 148 static bool test_nttrans_create(struct torture_context *tctx,
 149                                                                 struct smbcli_state *cli)
 150 {
 151         NTSTATUS status;
 152         union smb_open io;
 153         const char *fname = BASEDIR "\\acl2.txt";
 154         bool ret = true;
 155         int fnum = -1;
 156         union smb_fileinfo q;
 157         struct security_ace ace;
 158         struct security_descriptor *sd;
 159         struct dom_sid *test_sid;
 160
 161         printf("testing nttrans create with sec_desc\n");
 162
 163         io.generic.level = RAW_OPEN_NTTRANS_CREATE;
 164         io.ntcreatex.in.root_fid = 0;
 165         io.ntcreatex.in.flags = 0;
 166         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 167         io.ntcreatex.in.create_options = 0;
 168         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 169         io.ntcreatex.in.share_access =
 170                 NTCREATEX_SHARE_ACCESS_READ |
 171                 NTCREATEX_SHARE_ACCESS_WRITE;
 172         io.ntcreatex.in.alloc_size = 0;
 173         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
 174         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 175         io.ntcreatex.in.security_flags = 0;
 176         io.ntcreatex.in.fname = fname;
 177         io.ntcreatex.in.sec_desc = NULL;
 178         io.ntcreatex.in.ea_list = NULL;
 179
 180         printf("creating normal file\n");
 181
 182         status = smb_raw_open(cli->tree, tctx, &io);
 183         CHECK_STATUS(status, NT_STATUS_OK);
 184         fnum = io.ntcreatex.out.file.fnum;
 185
 186         printf("querying ACL\n");
 187
 188         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 189         q.query_secdesc.in.file.fnum = fnum;
 190         q.query_secdesc.in.secinfo_flags =
 191                 SECINFO_OWNER |
 192                 SECINFO_GROUP |
 193                 SECINFO_DACL;
 194         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 195         CHECK_STATUS(status, NT_STATUS_OK);
 196         sd = q.query_secdesc.out.sd;
 197
 198         smbcli_close(cli->tree, fnum);
 199         smbcli_unlink(cli->tree, fname);
 200
 201         printf("adding a new ACE\n");
 202         test_sid = dom_sid_parse_talloc(tctx, "S-1-5-32-1234-54321");
 203
 204         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
 205         ace.flags = 0;
 206         ace.access_mask = SEC_STD_ALL;
 207         ace.trustee = *test_sid;
 208
 209         status = security_descriptor_dacl_add(sd, &ace);
 210         CHECK_STATUS(status, NT_STATUS_OK);
 211
 212         printf("creating a file with an initial ACL\n");
 213
 214         io.ntcreatex.in.sec_desc = sd;
 215         status = smb_raw_open(cli->tree, tctx, &io);
 216         CHECK_STATUS(status, NT_STATUS_OK);
 217         fnum = io.ntcreatex.out.file.fnum;
 218
 219         q.query_secdesc.in.file.fnum = fnum;
 220         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 221         CHECK_STATUS(status, NT_STATUS_OK);
 222
 223         if (!security_acl_equal(q.query_secdesc.out.sd->dacl, sd->dacl)) {
 224                 printf("%s: security descriptors don't match!\n", __location__);
 225                 printf("got:\n");
 226                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 227                 printf("expected:\n");
 228                 NDR_PRINT_DEBUG(security_descriptor, sd);
 229                 ret = false;
 230         }
 231
 232 done:
 233         smbcli_close(cli->tree, fnum);
 234         return ret;
 235 }
 236
 237 #define CHECK_ACCESS_FLAGS(_fnum, flags) do { \
 238         union smb_fileinfo _q; \
 239         _q.access_information.level = RAW_FILEINFO_ACCESS_INFORMATION; \
 240         _q.access_information.in.file.fnum = (_fnum); \
 241         status = smb_raw_fileinfo(cli->tree, tctx, &_q); \
 242         CHECK_STATUS(status, NT_STATUS_OK); \
 243         if (_q.access_information.out.access_flags != (flags)) { \
 244                 printf("(%s) Incorrect access_flags 0x%08x - should be 0x%08x\n", \
 245                        __location__, _q.access_information.out.access_flags, (flags)); \
 246                 ret = false; \
 247                 goto done; \
 248         } \
 249 } while (0)
 250
 251 /*
 252   test using NTTRANS CREATE to create a file with a null ACL set
 253 */
 254 static bool test_nttrans_create_null_dacl(struct torture_context *tctx,
 255                                           struct smbcli_state *cli)
 256 {
 257         NTSTATUS status;
 258         union smb_open io;
 259         const char *fname = BASEDIR "\\acl3.txt";
 260         bool ret = true;
 261         int fnum = -1;
 262         union smb_fileinfo q;
 263         union smb_setfileinfo s;
 264         struct security_descriptor *sd = security_descriptor_initialise(tctx);
 265         struct security_acl dacl;
 266
 267         printf("TESTING SEC_DESC WITH A NULL DACL\n");
 268
 269         io.generic.level = RAW_OPEN_NTTRANS_CREATE;
 270         io.ntcreatex.in.root_fid = 0;
 271         io.ntcreatex.in.flags = 0;
 272         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC
 273                 | SEC_STD_WRITE_OWNER;
 274         io.ntcreatex.in.create_options = 0;
 275         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 276         io.ntcreatex.in.share_access =
 277                 NTCREATEX_SHARE_ACCESS_READ | NTCREATEX_SHARE_ACCESS_WRITE;
 278         io.ntcreatex.in.alloc_size = 0;
 279         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 280         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 281         io.ntcreatex.in.security_flags = 0;
 282         io.ntcreatex.in.fname = fname;
 283         io.ntcreatex.in.sec_desc = sd;
 284         io.ntcreatex.in.ea_list = NULL;
 285
 286         printf("creating a file with a empty sd\n");
 287         status = smb_raw_open(cli->tree, tctx, &io);
 288         CHECK_STATUS(status, NT_STATUS_OK);
 289         fnum = io.ntcreatex.out.file.fnum;
 290
 291         printf("get the original sd\n");
 292         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 293         q.query_secdesc.in.file.fnum = fnum;
 294         q.query_secdesc.in.secinfo_flags =
 295                 SECINFO_OWNER |
 296                 SECINFO_GROUP |
 297                 SECINFO_DACL;
 298         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 299         CHECK_STATUS(status, NT_STATUS_OK);
 300
 301         /*
 302          * Testing the created DACL,
 303          * the server should add the inherited DACL
 304          * when SEC_DESC_DACL_PRESENT isn't specified
 305          */
 306         if (!(q.query_secdesc.out.sd->type & SEC_DESC_DACL_PRESENT)) {
 307                 printf("DACL_PRESENT flag not set by the server!\n");
 308                 ret = false;
 309                 goto done;
 310         }
 311         if (q.query_secdesc.out.sd->dacl == NULL) {
 312                 printf("no DACL has been created on the server!\n");
 313                 ret = false;
 314                 goto done;
 315         }
 316
 317         printf("set NULL DACL\n");
 318         sd->type |= SEC_DESC_DACL_PRESENT;
 319
 320         s.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 321         s.set_secdesc.in.file.fnum = fnum;
 322         s.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 323         s.set_secdesc.in.sd = sd;
 324         status = smb_raw_setfileinfo(cli->tree, &s);
 325         CHECK_STATUS(status, NT_STATUS_OK);
 326
 327         printf("get the sd\n");
 328         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 329         q.query_secdesc.in.file.fnum = fnum;
 330         q.query_secdesc.in.secinfo_flags =
 331                 SECINFO_OWNER |
 332                 SECINFO_GROUP |
 333                 SECINFO_DACL;
 334         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 335         CHECK_STATUS(status, NT_STATUS_OK);
 336
 337         /* Testing the modified DACL */
 338         if (!(q.query_secdesc.out.sd->type & SEC_DESC_DACL_PRESENT)) {
 339                 printf("DACL_PRESENT flag not set by the server!\n");
 340                 ret = false;
 341                 goto done;
 342         }
 343         if (q.query_secdesc.out.sd->dacl != NULL) {
 344                 printf("DACL has been created on the server!\n");
 345                 ret = false;
 346                 goto done;
 347         }
 348
 349         printf("try open for read control\n");
 350         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL;
 351         status = smb_raw_open(cli->tree, tctx, &io);
 352         CHECK_STATUS(status, NT_STATUS_OK);
 353         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 354                 SEC_STD_READ_CONTROL | SEC_FILE_READ_ATTRIBUTE);
 355         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 356
 357         printf("try open for write\n");
 358         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 359         status = smb_raw_open(cli->tree, tctx, &io);
 360         CHECK_STATUS(status, NT_STATUS_OK);
 361         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 362                 SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE);
 363         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 364
 365         printf("try open for read\n");
 366         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 367         status = smb_raw_open(cli->tree, tctx, &io);
 368         CHECK_STATUS(status, NT_STATUS_OK);
 369         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 370                 SEC_FILE_READ_DATA | SEC_FILE_READ_ATTRIBUTE);
 371         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 372
 373         printf("try open for generic write\n");
 374         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 375         status = smb_raw_open(cli->tree, tctx, &io);
 376         CHECK_STATUS(status, NT_STATUS_OK);
 377         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 378                 SEC_RIGHTS_FILE_WRITE | SEC_FILE_READ_ATTRIBUTE);
 379         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 380
 381         printf("try open for generic read\n");
 382         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 383         status = smb_raw_open(cli->tree, tctx, &io);
 384         CHECK_STATUS(status, NT_STATUS_OK);
 385         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 386                 SEC_RIGHTS_FILE_READ | SEC_FILE_READ_ATTRIBUTE);
 387         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 388
 389         printf("set DACL with 0 aces\n");
 390         ZERO_STRUCT(dacl);
 391         dacl.revision = SECURITY_ACL_REVISION_NT4;
 392         dacl.num_aces = 0;
 393         sd->dacl = &dacl;
 394
 395         s.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 396         s.set_secdesc.in.file.fnum = fnum;
 397         s.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 398         s.set_secdesc.in.sd = sd;
 399         status = smb_raw_setfileinfo(cli->tree, &s);
 400         CHECK_STATUS(status, NT_STATUS_OK);
 401
 402         printf("get the sd\n");
 403         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 404         q.query_secdesc.in.file.fnum = fnum;
 405         q.query_secdesc.in.secinfo_flags =
 406                 SECINFO_OWNER |
 407                 SECINFO_GROUP |
 408                 SECINFO_DACL;
 409         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 410         CHECK_STATUS(status, NT_STATUS_OK);
 411
 412         /* Testing the modified DACL */
 413         if (!(q.query_secdesc.out.sd->type & SEC_DESC_DACL_PRESENT)) {
 414                 printf("DACL_PRESENT flag not set by the server!\n");
 415                 ret = false;
 416                 goto done;
 417         }
 418         if (q.query_secdesc.out.sd->dacl == NULL) {
 419                 printf("no DACL has been created on the server!\n");
 420                 ret = false;
 421                 goto done;
 422         }
 423         if (q.query_secdesc.out.sd->dacl->num_aces != 0) {
 424                 printf("DACL has %u aces!\n",
 425                        q.query_secdesc.out.sd->dacl->num_aces);
 426                 ret = false;
 427                 goto done;
 428         }
 429
 430         printf("try open for read control\n");
 431         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL;
 432         status = smb_raw_open(cli->tree, tctx, &io);
 433         CHECK_STATUS(status, NT_STATUS_OK);
 434         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 435                 SEC_STD_READ_CONTROL | SEC_FILE_READ_ATTRIBUTE);
 436         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 437
 438         printf("try open for write => access_denied\n");
 439         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 440         status = smb_raw_open(cli->tree, tctx, &io);
 441         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 442
 443         printf("try open for read => access_denied\n");
 444         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 445         status = smb_raw_open(cli->tree, tctx, &io);
 446         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 447
 448         printf("try open for generic write => access_denied\n");
 449         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 450         status = smb_raw_open(cli->tree, tctx, &io);
 451         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 452
 453         printf("try open for generic read => access_denied\n");
 454         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 455         status = smb_raw_open(cli->tree, tctx, &io);
 456         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 457
 458         printf("set empty sd\n");
 459         sd->type &= ~SEC_DESC_DACL_PRESENT;
 460         sd->dacl = NULL;
 461
 462         s.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 463         s.set_secdesc.in.file.fnum = fnum;
 464         s.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 465         s.set_secdesc.in.sd = sd;
 466         status = smb_raw_setfileinfo(cli->tree, &s);
 467         CHECK_STATUS(status, NT_STATUS_OK);
 468
 469         printf("get the sd\n");
 470         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 471         q.query_secdesc.in.file.fnum = fnum;
 472         q.query_secdesc.in.secinfo_flags =
 473                 SECINFO_OWNER |
 474                 SECINFO_GROUP |
 475                 SECINFO_DACL;
 476         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 477         CHECK_STATUS(status, NT_STATUS_OK);
 478
 479         /* Testing the modified DACL */
 480         if (!(q.query_secdesc.out.sd->type & SEC_DESC_DACL_PRESENT)) {
 481                 printf("DACL_PRESENT flag not set by the server!\n");
 482                 ret = false;
 483                 goto done;
 484         }
 485         if (q.query_secdesc.out.sd->dacl != NULL) {
 486                 printf("DACL has been created on the server!\n");
 487                 ret = false;
 488                 goto done;
 489         }
 490 done:
 491         smbcli_close(cli->tree, fnum);
 492         return ret;
 493 }
 494
 495 /*
 496   test the behaviour of the well known SID_CREATOR_OWNER sid, and some generic
 497   mapping bits
 498 */
 499 static bool test_creator_sid(struct torture_context *tctx,
 500                                                          struct smbcli_state *cli)
 501 {
 502         NTSTATUS status;
 503         union smb_open io;
 504         const char *fname = BASEDIR "\\creator.txt";
 505         bool ret = true;
 506         int fnum = -1;
 507         union smb_fileinfo q;
 508         union smb_setfileinfo set;
 509         struct security_descriptor *sd, *sd_orig, *sd2;
 510         const char *owner_sid;
 511
 512         printf("TESTING SID_CREATOR_OWNER\n");
 513
 514         io.generic.level = RAW_OPEN_NTCREATEX;
 515         io.ntcreatex.in.root_fid = 0;
 516         io.ntcreatex.in.flags = 0;
 517         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC | SEC_STD_WRITE_OWNER;
 518         io.ntcreatex.in.create_options = 0;
 519         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 520         io.ntcreatex.in.share_access =
 521                 NTCREATEX_SHARE_ACCESS_READ |
 522                 NTCREATEX_SHARE_ACCESS_WRITE;
 523         io.ntcreatex.in.alloc_size = 0;
 524         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 525         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 526         io.ntcreatex.in.security_flags = 0;
 527         io.ntcreatex.in.fname = fname;
 528         status = smb_raw_open(cli->tree, tctx, &io);
 529         CHECK_STATUS(status, NT_STATUS_OK);
 530         fnum = io.ntcreatex.out.file.fnum;
 531
 532         printf("get the original sd\n");
 533         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 534         q.query_secdesc.in.file.fnum = fnum;
 535         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 536         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 537         CHECK_STATUS(status, NT_STATUS_OK);
 538         sd_orig = q.query_secdesc.out.sd;
 539
 540         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
 541
 542         printf("set a sec desc allowing no write by CREATOR_OWNER\n");
 543         sd = security_descriptor_dacl_create(tctx,
 544                                         0, NULL, NULL,
 545                                         SID_CREATOR_OWNER,
 546                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 547                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 548                                         0,
 549                                         NULL);
 550
 551         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 552         set.set_secdesc.in.file.fnum = fnum;
 553         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 554         set.set_secdesc.in.sd = sd;
 555
 556         status = smb_raw_setfileinfo(cli->tree, &set);
 557         CHECK_STATUS(status, NT_STATUS_OK);
 558
 559         printf("try open for write\n");
 560         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 561         status = smb_raw_open(cli->tree, tctx, &io);
 562         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 563
 564         printf("try open for read\n");
 565         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 566         status = smb_raw_open(cli->tree, tctx, &io);
 567         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 568
 569         printf("try open for generic write\n");
 570         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 571         status = smb_raw_open(cli->tree, tctx, &io);
 572         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 573
 574         printf("try open for generic read\n");
 575         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 576         status = smb_raw_open(cli->tree, tctx, &io);
 577         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 578
 579         printf("set a sec desc allowing no write by owner\n");
 580         sd = security_descriptor_dacl_create(tctx,
 581                                         0, owner_sid, NULL,
 582                                         owner_sid,
 583                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 584                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 585                                         0,
 586                                         NULL);
 587
 588         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 589         set.set_secdesc.in.file.fnum = fnum;
 590         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 591         set.set_secdesc.in.sd = sd;
 592         status = smb_raw_setfileinfo(cli->tree, &set);
 593         CHECK_STATUS(status, NT_STATUS_OK);
 594
 595         printf("check that sd has been mapped correctly\n");
 596         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 597         CHECK_STATUS(status, NT_STATUS_OK);
 598         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd)) {
 599                 printf("%s: security descriptors don't match!\n", __location__);
 600                 printf("got:\n");
 601                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 602                 printf("expected:\n");
 603                 NDR_PRINT_DEBUG(security_descriptor, sd);
 604                 ret = false;
 605         }
 606
 607         printf("try open for write\n");
 608         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 609         status = smb_raw_open(cli->tree, tctx, &io);
 610         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 611
 612         printf("try open for read\n");
 613         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 614         status = smb_raw_open(cli->tree, tctx, &io);
 615         CHECK_STATUS(status, NT_STATUS_OK);
 616         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 617                            SEC_FILE_READ_DATA|
 618                            SEC_FILE_READ_ATTRIBUTE);
 619         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 620
 621         printf("try open for generic write\n");
 622         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 623         status = smb_raw_open(cli->tree, tctx, &io);
 624         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 625
 626         printf("try open for generic read\n");
 627         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 628         status = smb_raw_open(cli->tree, tctx, &io);
 629         CHECK_STATUS(status, NT_STATUS_OK);
 630         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 631                            SEC_RIGHTS_FILE_READ);
 632         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 633
 634         printf("set a sec desc allowing generic read by owner\n");
 635         sd = security_descriptor_dacl_create(tctx,
 636                                         0, NULL, NULL,
 637                                         owner_sid,
 638                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 639                                         SEC_GENERIC_READ | SEC_STD_ALL,
 640                                         0,
 641                                         NULL);
 642
 643         set.set_secdesc.in.sd = sd;
 644         status = smb_raw_setfileinfo(cli->tree, &set);
 645         CHECK_STATUS(status, NT_STATUS_OK);
 646
 647         printf("check that generic read has been mapped correctly\n");
 648         sd2 = security_descriptor_dacl_create(tctx,
 649                                          0, owner_sid, NULL,
 650                                          owner_sid,
 651                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
 652                                          SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 653                                          0,
 654                                          NULL);
 655
 656         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 657         CHECK_STATUS(status, NT_STATUS_OK);
 658         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 659                 printf("%s: security descriptors don't match!\n", __location__);
 660                 printf("got:\n");
 661                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 662                 printf("expected:\n");
 663                 NDR_PRINT_DEBUG(security_descriptor, sd2);
 664                 ret = false;
 665         }
 666
 667
 668         printf("try open for write\n");
 669         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 670         status = smb_raw_open(cli->tree, tctx, &io);
 671         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 672
 673         printf("try open for read\n");
 674         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 675         status = smb_raw_open(cli->tree, tctx, &io);
 676         CHECK_STATUS(status, NT_STATUS_OK);
 677         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 678                            SEC_FILE_READ_DATA |
 679                            SEC_FILE_READ_ATTRIBUTE);
 680         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 681
 682         printf("try open for generic write\n");
 683         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 684         status = smb_raw_open(cli->tree, tctx, &io);
 685         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 686
 687         printf("try open for generic read\n");
 688         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 689         status = smb_raw_open(cli->tree, tctx, &io);
 690         CHECK_STATUS(status, NT_STATUS_OK);
 691         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum, SEC_RIGHTS_FILE_READ);
 692         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 693
 694
 695         printf("put back original sd\n");
 696         set.set_secdesc.in.sd = sd_orig;
 697         status = smb_raw_setfileinfo(cli->tree, &set);
 698         CHECK_STATUS(status, NT_STATUS_OK);
 699
 700
 701 done:
 702         smbcli_close(cli->tree, fnum);
 703         return ret;
 704 }
 705
 706
 707 /*
 708   test the mapping of the SEC_GENERIC_xx bits to SEC_STD_xx and
 709   SEC_FILE_xx bits
 710 */
 711 static bool test_generic_bits(struct torture_context *tctx,
 712                                                           struct smbcli_state *cli)
 713 {
 714         NTSTATUS status;
 715         union smb_open io;
 716         const char *fname = BASEDIR "\\generic.txt";
 717         bool ret = true;
 718         int fnum = -1, i;
 719         union smb_fileinfo q;
 720         union smb_setfileinfo set;
 721         struct security_descriptor *sd, *sd_orig, *sd2;
 722         const char *owner_sid;
 723         const struct {
 724                 uint32_t gen_bits;
 725                 uint32_t specific_bits;
 726         } file_mappings[] = {
 727                 { 0,                       0 },
 728                 { SEC_GENERIC_READ,        SEC_RIGHTS_FILE_READ },
 729                 { SEC_GENERIC_WRITE,       SEC_RIGHTS_FILE_WRITE },
 730                 { SEC_GENERIC_EXECUTE,     SEC_RIGHTS_FILE_EXECUTE },
 731                 { SEC_GENERIC_ALL,         SEC_RIGHTS_FILE_ALL },
 732                 { SEC_FILE_READ_DATA,      SEC_FILE_READ_DATA },
 733                 { SEC_FILE_READ_ATTRIBUTE, SEC_FILE_READ_ATTRIBUTE }
 734         };
 735         const struct {
 736                 uint32_t gen_bits;
 737                 uint32_t specific_bits;
 738         } dir_mappings[] = {
 739                 { 0,                   0 },
 740                 { SEC_GENERIC_READ,    SEC_RIGHTS_DIR_READ },
 741                 { SEC_GENERIC_WRITE,   SEC_RIGHTS_DIR_WRITE },
 742                 { SEC_GENERIC_EXECUTE, SEC_RIGHTS_DIR_EXECUTE },
 743                 { SEC_GENERIC_ALL,     SEC_RIGHTS_DIR_ALL }
 744         };
 745         bool has_restore_privilege;
 746         bool has_take_ownership_privilege;
 747
 748         printf("TESTING FILE GENERIC BITS\n");
 749
 750         io.generic.level = RAW_OPEN_NTCREATEX;
 751         io.ntcreatex.in.root_fid = 0;
 752         io.ntcreatex.in.flags = 0;
 753         io.ntcreatex.in.access_mask =
 754                 SEC_STD_READ_CONTROL |
 755                 SEC_STD_WRITE_DAC |
 756                 SEC_STD_WRITE_OWNER;
 757         io.ntcreatex.in.create_options = 0;
 758         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 759         io.ntcreatex.in.share_access =
 760                 NTCREATEX_SHARE_ACCESS_READ |
 761                 NTCREATEX_SHARE_ACCESS_WRITE;
 762         io.ntcreatex.in.alloc_size = 0;
 763         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 764         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 765         io.ntcreatex.in.security_flags = 0;
 766         io.ntcreatex.in.fname = fname;
 767         status = smb_raw_open(cli->tree, tctx, &io);
 768         CHECK_STATUS(status, NT_STATUS_OK);
 769         fnum = io.ntcreatex.out.file.fnum;
 770
 771         printf("get the original sd\n");
 772         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 773         q.query_secdesc.in.file.fnum = fnum;
 774         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 775         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 776         CHECK_STATUS(status, NT_STATUS_OK);
 777         sd_orig = q.query_secdesc.out.sd;
 778
 779         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
 780
 781         status = smblsa_sid_check_privilege(cli,
 782                                             owner_sid,
 783                                             sec_privilege_name(SEC_PRIV_RESTORE));
 784         has_restore_privilege = NT_STATUS_IS_OK(status);
 785         if (!NT_STATUS_IS_OK(status)) {
 786                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 787         }
 788         printf("SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
 789
 790         status = smblsa_sid_check_privilege(cli,
 791                                             owner_sid,
 792                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
 793         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
 794         if (!NT_STATUS_IS_OK(status)) {
 795                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 796         }
 797         printf("SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_take_ownership_privilege?"Yes":"No");
 798
 799         for (i=0;i<ARRAY_SIZE(file_mappings);i++) {
 800                 uint32_t expected_mask =
 801                         SEC_STD_WRITE_DAC |
 802                         SEC_STD_READ_CONTROL |
 803                         SEC_FILE_READ_ATTRIBUTE |
 804                         SEC_STD_DELETE;
 805                 uint32_t expected_mask_anon = SEC_FILE_READ_ATTRIBUTE;
 806
 807                 if (has_restore_privilege) {
 808                         expected_mask_anon |= SEC_STD_DELETE;
 809                 }
 810
 811                 printf("testing generic bits 0x%08x\n",
 812                        file_mappings[i].gen_bits);
 813                 sd = security_descriptor_dacl_create(tctx,
 814                                                 0, owner_sid, NULL,
 815                                                 owner_sid,
 816                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 817                                                 file_mappings[i].gen_bits,
 818                                                 0,
 819                                                 NULL);
 820
 821                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 822                 set.set_secdesc.in.file.fnum = fnum;
 823                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 824                 set.set_secdesc.in.sd = sd;
 825
 826                 status = smb_raw_setfileinfo(cli->tree, &set);
 827                 CHECK_STATUS(status, NT_STATUS_OK);
 828
 829                 sd2 = security_descriptor_dacl_create(tctx,
 830                                                  0, owner_sid, NULL,
 831                                                  owner_sid,
 832                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 833                                                  file_mappings[i].specific_bits,
 834                                                  0,
 835                                                  NULL);
 836
 837                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
 838                 CHECK_STATUS(status, NT_STATUS_OK);
 839                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 840                         printf("%s: security descriptors don't match!\n", __location__);
 841                         printf("got:\n");
 842                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 843                         printf("expected:\n");
 844                         NDR_PRINT_DEBUG(security_descriptor, sd2);
 845                         ret = false;
 846                 }
 847
 848                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 849                 status = smb_raw_open(cli->tree, tctx, &io);
 850                 CHECK_STATUS(status, NT_STATUS_OK);
 851                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 852                                    expected_mask | file_mappings[i].specific_bits);
 853                 smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 854
 855                 if (!has_take_ownership_privilege) {
 856                         continue;
 857                 }
 858
 859                 printf("testing generic bits 0x%08x (anonymous)\n",
 860                        file_mappings[i].gen_bits);
 861                 sd = security_descriptor_dacl_create(tctx,
 862                                                 0, SID_NT_ANONYMOUS, NULL,
 863                                                 owner_sid,
 864                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 865                                                 file_mappings[i].gen_bits,
 866                                                 0,
 867                                                 NULL);
 868
 869                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 870                 set.set_secdesc.in.file.fnum = fnum;
 871                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 872                 set.set_secdesc.in.sd = sd;
 873
 874                 status = smb_raw_setfileinfo(cli->tree, &set);
 875                 CHECK_STATUS(status, NT_STATUS_OK);
 876
 877                 sd2 = security_descriptor_dacl_create(tctx,
 878                                                  0, SID_NT_ANONYMOUS, NULL,
 879                                                  owner_sid,
 880                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 881                                                  file_mappings[i].specific_bits,
 882                                                  0,
 883                                                  NULL);
 884
 885                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
 886                 CHECK_STATUS(status, NT_STATUS_OK);
 887                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 888                         printf("%s: security descriptors don't match!\n", __location__);
 889                         printf("got:\n");
 890                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 891                         printf("expected:\n");
 892                         NDR_PRINT_DEBUG(security_descriptor, sd2);
 893                         ret = false;
 894                 }
 895
 896                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 897                 status = smb_raw_open(cli->tree, tctx, &io);
 898                 CHECK_STATUS(status, NT_STATUS_OK);
 899                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 900                                    expected_mask_anon | file_mappings[i].specific_bits);
 901                 smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 902         }
 903
 904         printf("put back original sd\n");
 905         set.set_secdesc.in.sd = sd_orig;
 906         status = smb_raw_setfileinfo(cli->tree, &set);
 907         CHECK_STATUS(status, NT_STATUS_OK);
 908
 909         smbcli_close(cli->tree, fnum);
 910         smbcli_unlink(cli->tree, fname);
 911
 912
 913         printf("TESTING DIR GENERIC BITS\n");
 914
 915         io.generic.level = RAW_OPEN_NTCREATEX;
 916         io.ntcreatex.in.root_fid = 0;
 917         io.ntcreatex.in.flags = 0;
 918         io.ntcreatex.in.access_mask =
 919                 SEC_STD_READ_CONTROL |
 920                 SEC_STD_WRITE_DAC |
 921                 SEC_STD_WRITE_OWNER;
 922         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
 923         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
 924         io.ntcreatex.in.share_access =
 925                 NTCREATEX_SHARE_ACCESS_READ |
 926                 NTCREATEX_SHARE_ACCESS_WRITE;
 927         io.ntcreatex.in.alloc_size = 0;
 928         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 929         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 930         io.ntcreatex.in.security_flags = 0;
 931         io.ntcreatex.in.fname = fname;
 932         status = smb_raw_open(cli->tree, tctx, &io);
 933         CHECK_STATUS(status, NT_STATUS_OK);
 934         fnum = io.ntcreatex.out.file.fnum;
 935
 936         printf("get the original sd\n");
 937         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 938         q.query_secdesc.in.file.fnum = fnum;
 939         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 940         status = smb_raw_fileinfo(cli->tree, tctx, &q);
 941         CHECK_STATUS(status, NT_STATUS_OK);
 942         sd_orig = q.query_secdesc.out.sd;
 943
 944         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
 945
 946         status = smblsa_sid_check_privilege(cli,
 947                                             owner_sid,
 948                                             sec_privilege_name(SEC_PRIV_RESTORE));
 949         has_restore_privilege = NT_STATUS_IS_OK(status);
 950         if (!NT_STATUS_IS_OK(status)) {
 951                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 952         }
 953         printf("SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
 954
 955         status = smblsa_sid_check_privilege(cli,
 956                                             owner_sid,
 957                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
 958         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
 959         if (!NT_STATUS_IS_OK(status)) {
 960                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 961         }
 962         printf("SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_take_ownership_privilege?"Yes":"No");
 963
 964         for (i=0;i<ARRAY_SIZE(dir_mappings);i++) {
 965                 uint32_t expected_mask =
 966                         SEC_STD_WRITE_DAC |
 967                         SEC_STD_READ_CONTROL |
 968                         SEC_FILE_READ_ATTRIBUTE |
 969                         SEC_STD_DELETE;
 970                 uint32_t expected_mask_anon = SEC_FILE_READ_ATTRIBUTE;
 971
 972                 if (has_restore_privilege) {
 973                         expected_mask_anon |= SEC_STD_DELETE;
 974                 }
 975
 976                 printf("testing generic bits 0x%08x\n",
 977                        file_mappings[i].gen_bits);
 978                 sd = security_descriptor_dacl_create(tctx,
 979                                                 0, owner_sid, NULL,
 980                                                 owner_sid,
 981                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 982                                                 dir_mappings[i].gen_bits,
 983                                                 0,
 984                                                 NULL);
 985
 986                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 987                 set.set_secdesc.in.file.fnum = fnum;
 988                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 989                 set.set_secdesc.in.sd = sd;
 990
 991                 status = smb_raw_setfileinfo(cli->tree, &set);
 992                 CHECK_STATUS(status, NT_STATUS_OK);
 993
 994                 sd2 = security_descriptor_dacl_create(tctx,
 995                                                  0, owner_sid, NULL,
 996                                                  owner_sid,
 997                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 998                                                  dir_mappings[i].specific_bits,
 999                                                  0,
1000                                                  NULL);
1001
1002                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
1003                 CHECK_STATUS(status, NT_STATUS_OK);
1004                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
1005                         printf("%s: security descriptors don't match!\n", __location__);
1006                         printf("got:\n");
1007                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1008                         printf("expected:\n");
1009                         NDR_PRINT_DEBUG(security_descriptor, sd2);
1010                         ret = false;
1011                 }
1012
1013                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1014                 status = smb_raw_open(cli->tree, tctx, &io);
1015                 CHECK_STATUS(status, NT_STATUS_OK);
1016                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
1017                                    expected_mask | dir_mappings[i].specific_bits);
1018                 smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
1019
1020                 if (!has_take_ownership_privilege) {
1021                         continue;
1022                 }
1023
1024                 printf("testing generic bits 0x%08x (anonymous)\n",
1025                        file_mappings[i].gen_bits);
1026                 sd = security_descriptor_dacl_create(tctx,
1027                                                 0, SID_NT_ANONYMOUS, NULL,
1028                                                 owner_sid,
1029                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1030                                                 file_mappings[i].gen_bits,
1031                                                 0,
1032                                                 NULL);
1033
1034                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1035                 set.set_secdesc.in.file.fnum = fnum;
1036                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1037                 set.set_secdesc.in.sd = sd;
1038
1039                 status = smb_raw_setfileinfo(cli->tree, &set);
1040                 CHECK_STATUS(status, NT_STATUS_OK);
1041
1042                 sd2 = security_descriptor_dacl_create(tctx,
1043                                                  0, SID_NT_ANONYMOUS, NULL,
1044                                                  owner_sid,
1045                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
1046                                                  file_mappings[i].specific_bits,
1047                                                  0,
1048                                                  NULL);
1049
1050                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
1051                 CHECK_STATUS(status, NT_STATUS_OK);
1052                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
1053                         printf("%s: security descriptors don't match!\n", __location__);
1054                         printf("got:\n");
1055                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1056                         printf("expected:\n");
1057                         NDR_PRINT_DEBUG(security_descriptor, sd2);
1058                         ret = false;
1059                 }
1060
1061                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1062                 status = smb_raw_open(cli->tree, tctx, &io);
1063                 CHECK_STATUS(status, NT_STATUS_OK);
1064                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
1065                                    expected_mask_anon | dir_mappings[i].specific_bits);
1066                 smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
1067         }
1068
1069         printf("put back original sd\n");
1070         set.set_secdesc.in.sd = sd_orig;
1071         status = smb_raw_setfileinfo(cli->tree, &set);
1072         CHECK_STATUS(status, NT_STATUS_OK);
1073
1074         smbcli_close(cli->tree, fnum);
1075         smbcli_unlink(cli->tree, fname);
1076
1077 done:
1078         smbcli_close(cli->tree, fnum);
1079         return ret;
1080 }
1081
1082
1083 /*
1084   see what access bits the owner of a file always gets
1085 */
1086 static bool test_owner_bits(struct torture_context *tctx,
1087                                                         struct smbcli_state *cli)
1088 {
1089         NTSTATUS status;
1090         union smb_open io;
1091         const char *fname = BASEDIR "\\generic.txt";
1092         bool ret = true;
1093         int fnum = -1, i;
1094         union smb_fileinfo q;
1095         union smb_setfileinfo set;
1096         struct security_descriptor *sd, *sd_orig;
1097         const char *owner_sid;
1098         bool has_restore_privilege;
1099         bool has_take_ownership_privilege;
1100         uint32_t expected_bits;
1101
1102         printf("TESTING FILE OWNER BITS\n");
1103
1104         io.generic.level = RAW_OPEN_NTCREATEX;
1105         io.ntcreatex.in.root_fid = 0;
1106         io.ntcreatex.in.flags = 0;
1107         io.ntcreatex.in.access_mask =
1108                 SEC_STD_READ_CONTROL |
1109                 SEC_STD_WRITE_DAC |
1110                 SEC_STD_WRITE_OWNER;
1111         io.ntcreatex.in.create_options = 0;
1112         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
1113         io.ntcreatex.in.share_access =
1114                 NTCREATEX_SHARE_ACCESS_READ |
1115                 NTCREATEX_SHARE_ACCESS_WRITE;
1116         io.ntcreatex.in.alloc_size = 0;
1117         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
1118         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
1119         io.ntcreatex.in.security_flags = 0;
1120         io.ntcreatex.in.fname = fname;
1121         status = smb_raw_open(cli->tree, tctx, &io);
1122         CHECK_STATUS(status, NT_STATUS_OK);
1123         fnum = io.ntcreatex.out.file.fnum;
1124
1125         printf("get the original sd\n");
1126         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
1127         q.query_secdesc.in.file.fnum = fnum;
1128         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1129         status = smb_raw_fileinfo(cli->tree, tctx, &q);
1130         CHECK_STATUS(status, NT_STATUS_OK);
1131         sd_orig = q.query_secdesc.out.sd;
1132
1133         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
1134
1135         status = smblsa_sid_check_privilege(cli,
1136                                             owner_sid,
1137                                             sec_privilege_name(SEC_PRIV_RESTORE));
1138         has_restore_privilege = NT_STATUS_IS_OK(status);
1139         if (!NT_STATUS_IS_OK(status)) {
1140                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
1141         }
1142         printf("SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
1143
1144         status = smblsa_sid_check_privilege(cli,
1145                                             owner_sid,
1146                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
1147         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
1148         if (!NT_STATUS_IS_OK(status)) {
1149                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
1150         }
1151         printf("SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_take_ownership_privilege?"Yes":"No");
1152
1153         sd = security_descriptor_dacl_create(tctx,
1154                                         0, NULL, NULL,
1155                                         owner_sid,
1156                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1157                                         SEC_FILE_WRITE_DATA,
1158                                         0,
1159                                         NULL);
1160
1161         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1162         set.set_secdesc.in.file.fnum = fnum;
1163         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1164         set.set_secdesc.in.sd = sd;
1165
1166         status = smb_raw_setfileinfo(cli->tree, &set);
1167         CHECK_STATUS(status, NT_STATUS_OK);
1168
1169         expected_bits = SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE;
1170
1171         for (i=0;i<16;i++) {
1172                 uint32_t bit = (1<<i);
1173                 io.ntcreatex.in.access_mask = bit;
1174                 status = smb_raw_open(cli->tree, tctx, &io);
1175                 if (expected_bits & bit) {
1176                         if (!NT_STATUS_IS_OK(status)) {
1177                                 printf("failed with access mask 0x%08x of expected 0x%08x\n",
1178                                        bit, expected_bits);
1179                         }
1180                         CHECK_STATUS(status, NT_STATUS_OK);
1181                         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum, bit | SEC_FILE_READ_ATTRIBUTE);
1182                         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
1183                 } else {
1184                         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1185                 }
1186         }
1187
1188         printf("put back original sd\n");
1189         set.set_secdesc.in.sd = sd_orig;
1190         status = smb_raw_setfileinfo(cli->tree, &set);
1191         CHECK_STATUS(status, NT_STATUS_OK);
1192
1193 done:
1194         smbcli_close(cli->tree, fnum);
1195         smbcli_unlink(cli->tree, fname);
1196         return ret;
1197 }
1198
1199
1200
1201 /*
1202   test the inheritance of ACL flags onto new files and directories
1203 */
1204 static bool test_inheritance(struct torture_context *tctx,
1205                                                          struct smbcli_state *cli)
1206 {
1207         NTSTATUS status;
1208         union smb_open io;
1209         const char *dname = BASEDIR "\\inheritance";
1210         const char *fname1 = BASEDIR "\\inheritance\\testfile";
1211         const char *fname2 = BASEDIR "\\inheritance\\testdir";
1212         bool ret = true;
1213         int fnum=0, fnum2, i;
1214         union smb_fileinfo q;
1215         union smb_setfileinfo set;
1216         struct security_descriptor *sd, *sd2, *sd_orig=NULL, *sd_def;
1217         const char *owner_sid;
1218         const struct dom_sid *creator_owner;
1219         const struct {
1220                 uint32_t parent_flags;
1221                 uint32_t file_flags;
1222                 uint32_t dir_flags;
1223         } test_flags[] = {
1224                 {
1225                         0,
1226                         0,
1227                         0
1228                 },
1229                 {
1230                         SEC_ACE_FLAG_OBJECT_INHERIT,
1231                         0,
1232                         SEC_ACE_FLAG_OBJECT_INHERIT |
1233                         SEC_ACE_FLAG_INHERIT_ONLY,
1234                 },
1235                 {
1236                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1237                         0,
1238                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1239                 },
1240                 {
1241                         SEC_ACE_FLAG_OBJECT_INHERIT |
1242                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1243                         0,
1244                         SEC_ACE_FLAG_OBJECT_INHERIT |
1245                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1246                 },
1247                 {
1248                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
1249                         0,
1250                         0,
1251                 },
1252                 {
1253                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1254                         SEC_ACE_FLAG_OBJECT_INHERIT,
1255                         0,
1256                         0,
1257                 },
1258                 {
1259                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1260                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1261                         0,
1262                         0,
1263                 },
1264                 {
1265                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1266                         SEC_ACE_FLAG_CONTAINER_INHERIT |
1267                         SEC_ACE_FLAG_OBJECT_INHERIT,
1268                         0,
1269                         0,
1270                 },
1271                 {
1272                         SEC_ACE_FLAG_INHERIT_ONLY,
1273                         0,
1274                         0,
1275                 },
1276                 {
1277                         SEC_ACE_FLAG_INHERIT_ONLY |
1278                         SEC_ACE_FLAG_OBJECT_INHERIT,
1279                         0,
1280                         SEC_ACE_FLAG_OBJECT_INHERIT |
1281                         SEC_ACE_FLAG_INHERIT_ONLY,
1282                 },
1283                 {
1284                         SEC_ACE_FLAG_INHERIT_ONLY |
1285                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1286                         0,
1287                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1288                 },
1289                 {
1290                         SEC_ACE_FLAG_INHERIT_ONLY |
1291                         SEC_ACE_FLAG_CONTAINER_INHERIT |
1292                         SEC_ACE_FLAG_OBJECT_INHERIT,
1293                         0,
1294                         SEC_ACE_FLAG_CONTAINER_INHERIT |
1295                         SEC_ACE_FLAG_OBJECT_INHERIT,
1296                 },
1297                 {
1298                         SEC_ACE_FLAG_INHERIT_ONLY |
1299                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
1300                         0,
1301                         0,
1302                 },
1303                 {
1304                         SEC_ACE_FLAG_INHERIT_ONLY |
1305                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1306                         SEC_ACE_FLAG_OBJECT_INHERIT,
1307                         0,
1308                         0,
1309                 },
1310                 {
1311                         SEC_ACE_FLAG_INHERIT_ONLY |
1312                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1313                         SEC_ACE_FLAG_CONTAINER_INHERIT,
1314                         0,
1315                         0,
1316                 },
1317                 {
1318                         SEC_ACE_FLAG_INHERIT_ONLY |
1319                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
1320                         SEC_ACE_FLAG_CONTAINER_INHERIT |
1321                         SEC_ACE_FLAG_OBJECT_INHERIT,
1322                         0,
1323                         0,
1324                 }
1325         };
1326
1327         smbcli_rmdir(cli->tree, dname);
1328
1329         printf("TESTING ACL INHERITANCE\n");
1330
1331         io.generic.level = RAW_OPEN_NTCREATEX;
1332         io.ntcreatex.in.root_fid = 0;
1333         io.ntcreatex.in.flags = 0;
1334         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1335         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1336         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
1337         io.ntcreatex.in.share_access = 0;
1338         io.ntcreatex.in.alloc_size = 0;
1339         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1340         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
1341         io.ntcreatex.in.security_flags = 0;
1342         io.ntcreatex.in.fname = dname;
1343
1344         status = smb_raw_open(cli->tree, tctx, &io);
1345         CHECK_STATUS(status, NT_STATUS_OK);
1346         fnum = io.ntcreatex.out.file.fnum;
1347
1348         printf("get the original sd\n");
1349         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
1350         q.query_secdesc.in.file.fnum = fnum;
1351         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1352         status = smb_raw_fileinfo(cli->tree, tctx, &q);
1353         CHECK_STATUS(status, NT_STATUS_OK);
1354         sd_orig = q.query_secdesc.out.sd;
1355
1356         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
1357
1358         printf("owner_sid is %s\n", owner_sid);
1359
1360         sd_def = security_descriptor_dacl_create(tctx,
1361                                             0, owner_sid, NULL,
1362                                             owner_sid,
1363                                             SEC_ACE_TYPE_ACCESS_ALLOWED,
1364                                             SEC_RIGHTS_FILE_ALL,
1365                                             0,
1366                                             SID_NT_SYSTEM,
1367                                             SEC_ACE_TYPE_ACCESS_ALLOWED,
1368                                             SEC_RIGHTS_FILE_ALL,
1369                                             0,
1370                                             NULL);
1371
1372         creator_owner = dom_sid_parse_talloc(tctx, SID_CREATOR_OWNER);
1373
1374         for (i=0;i<ARRAY_SIZE(test_flags);i++) {
1375                 sd = security_descriptor_dacl_create(tctx,
1376                                                 0, NULL, NULL,
1377                                                 SID_CREATOR_OWNER,
1378                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1379                                                 SEC_FILE_WRITE_DATA,
1380                                                 test_flags[i].parent_flags,
1381                                                 SID_WORLD,
1382                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1383                                                 SEC_FILE_ALL | SEC_STD_ALL,
1384                                                 0,
1385                                                 NULL);
1386                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1387                 set.set_secdesc.in.file.fnum = fnum;
1388                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1389                 set.set_secdesc.in.sd = sd;
1390                 status = smb_raw_setfileinfo(cli->tree, &set);
1391                 CHECK_STATUS(status, NT_STATUS_OK);
1392
1393                 io.ntcreatex.in.fname = fname1;
1394                 io.ntcreatex.in.create_options = 0;
1395                 status = smb_raw_open(cli->tree, tctx, &io);
1396                 CHECK_STATUS(status, NT_STATUS_OK);
1397                 fnum2 = io.ntcreatex.out.file.fnum;
1398
1399                 q.query_secdesc.in.file.fnum = fnum2;
1400                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
1401                 CHECK_STATUS(status, NT_STATUS_OK);
1402
1403                 smbcli_close(cli->tree, fnum2);
1404                 smbcli_unlink(cli->tree, fname1);
1405
1406                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
1407                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def)) {
1408                                 printf("Expected default sd at %d - got:\n", i);
1409                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1410                         }
1411                         goto check_dir;
1412                 }
1413
1414                 if (q.query_secdesc.out.sd->dacl == NULL ||
1415                     q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1416                     q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1417                     !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1418                                    sd_orig->owner_sid)) {
1419                         printf("Bad sd in child file at %d\n", i);
1420                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1421                         ret = false;
1422                         goto check_dir;
1423                 }
1424
1425                 if (q.query_secdesc.out.sd->dacl->aces[0].flags !=
1426                     test_flags[i].file_flags) {
1427                         printf("incorrect file_flags 0x%x - expected 0x%x for parent 0x%x with (i=%d)\n",
1428                                q.query_secdesc.out.sd->dacl->aces[0].flags,
1429                                test_flags[i].file_flags,
1430                                test_flags[i].parent_flags,
1431                                i);
1432                         ret = false;
1433                 }
1434
1435         check_dir:
1436                 io.ntcreatex.in.fname = fname2;
1437                 io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1438                 status = smb_raw_open(cli->tree, tctx, &io);
1439                 CHECK_STATUS(status, NT_STATUS_OK);
1440                 fnum2 = io.ntcreatex.out.file.fnum;
1441
1442                 q.query_secdesc.in.file.fnum = fnum2;
1443                 status = smb_raw_fileinfo(cli->tree, tctx, &q);
1444                 CHECK_STATUS(status, NT_STATUS_OK);
1445
1446                 smbcli_close(cli->tree, fnum2);
1447                 smbcli_rmdir(cli->tree, fname2);
1448
1449                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) &&
1450                     (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT) ||
1451                      (test_flags[i].parent_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT))) {
1452                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def)) {
1453                                 printf("Expected default sd for dir at %d - got:\n", i);
1454                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1455                         }
1456                         continue;
1457                 }
1458
1459                 if ((test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) &&
1460                     (test_flags[i].parent_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)) {
1461                         if (q.query_secdesc.out.sd->dacl == NULL ||
1462                             q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1463                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1464                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1465                                            sd_orig->owner_sid) ||
1466                             q.query_secdesc.out.sd->dacl->aces[0].flags != test_flags[i].dir_flags) {
1467                                 printf("Bad sd in child dir at %d (parent 0x%x)\n",
1468                                        i, test_flags[i].parent_flags);
1469                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1470                                 ret = false;
1471                                 continue;
1472                         }
1473                 } else if (test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
1474                         if (q.query_secdesc.out.sd->dacl == NULL ||
1475                             q.query_secdesc.out.sd->dacl->num_aces != 2 ||
1476                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1477                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1478                                            sd_orig->owner_sid) ||
1479                             q.query_secdesc.out.sd->dacl->aces[1].access_mask != SEC_FILE_WRITE_DATA ||
1480                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[1].trustee,
1481                                            creator_owner) ||
1482                             q.query_secdesc.out.sd->dacl->aces[0].flags != 0 ||
1483                             q.query_secdesc.out.sd->dacl->aces[1].flags !=
1484                             (test_flags[i].dir_flags | SEC_ACE_FLAG_INHERIT_ONLY)) {
1485                                 printf("Bad sd in child dir at %d (parent 0x%x)\n",
1486                                        i, test_flags[i].parent_flags);
1487                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1488                                 ret = false;
1489                                 continue;
1490                         }
1491                 } else {
1492                         if (q.query_secdesc.out.sd->dacl == NULL ||
1493                             q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1494                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1495                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1496                                            creator_owner) ||
1497                             q.query_secdesc.out.sd->dacl->aces[0].flags != test_flags[i].dir_flags) {
1498                                 printf("Bad sd in child dir at %d (parent 0x%x)\n",
1499                                        i, test_flags[i].parent_flags);
1500                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1501                                 ret = false;
1502                                 continue;
1503                         }
1504                 }
1505         }
1506
1507         printf("testing access checks on inherited create with %s\n", fname1);
1508         sd = security_descriptor_dacl_create(tctx,
1509                                         0, NULL, NULL,
1510                                         owner_sid,
1511                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1512                                         SEC_FILE_WRITE_DATA | SEC_STD_WRITE_DAC,
1513                                         SEC_ACE_FLAG_OBJECT_INHERIT,
1514                                         SID_WORLD,
1515                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1516                                         SEC_FILE_ALL | SEC_STD_ALL,
1517                                         0,
1518                                         NULL);
1519         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1520         set.set_secdesc.in.file.fnum = fnum;
1521         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1522         set.set_secdesc.in.sd = sd;
1523         status = smb_raw_setfileinfo(cli->tree, &set);
1524         CHECK_STATUS(status, NT_STATUS_OK);
1525
1526         io.ntcreatex.in.fname = fname1;
1527         io.ntcreatex.in.create_options = 0;
1528         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1529         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1530         status = smb_raw_open(cli->tree, tctx, &io);
1531         CHECK_STATUS(status, NT_STATUS_OK);
1532         fnum2 = io.ntcreatex.out.file.fnum;
1533         CHECK_ACCESS_FLAGS(fnum2, SEC_RIGHTS_FILE_ALL);
1534
1535         q.query_secdesc.in.file.fnum = fnum2;
1536         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1537         status = smb_raw_fileinfo(cli->tree, tctx, &q);
1538         CHECK_STATUS(status, NT_STATUS_OK);
1539         smbcli_close(cli->tree, fnum2);
1540
1541         sd2 = security_descriptor_dacl_create(tctx,
1542                                          0, owner_sid, NULL,
1543                                          owner_sid,
1544                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
1545                                          SEC_FILE_WRITE_DATA | SEC_STD_WRITE_DAC,
1546                                          0,
1547                                          NULL);
1548         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
1549                 printf("%s: security descriptors don't match!\n", __location__);
1550                 printf("got:\n");
1551                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1552                 printf("expected:\n");
1553                 NDR_PRINT_DEBUG(security_descriptor, sd2);
1554                 ret = false;
1555         }
1556
1557         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1558         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1559         status = smb_raw_open(cli->tree, tctx, &io);
1560         if (NT_STATUS_IS_OK(status)) {
1561                 printf("failed: w2k3 ACL bug (allowed open when ACL should deny)\n");
1562                 ret = false;
1563                 fnum2 = io.ntcreatex.out.file.fnum;
1564                 CHECK_ACCESS_FLAGS(fnum2, SEC_RIGHTS_FILE_ALL);
1565                 smbcli_close(cli->tree, fnum2);
1566         } else {
1567                 CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1568         }
1569
1570         printf("trying without execute\n");
1571         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1572         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL & ~SEC_FILE_EXECUTE;
1573         status = smb_raw_open(cli->tree, tctx, &io);
1574         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1575
1576         printf("and with full permissions again\n");
1577         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1578         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1579         status = smb_raw_open(cli->tree, tctx, &io);
1580         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1581
1582         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1583         status = smb_raw_open(cli->tree, tctx, &io);
1584         CHECK_STATUS(status, NT_STATUS_OK);
1585         fnum2 = io.ntcreatex.out.file.fnum;
1586         CHECK_ACCESS_FLAGS(fnum2, SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE);
1587         smbcli_close(cli->tree, fnum2);
1588
1589         printf("put back original sd\n");
1590         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1591         set.set_secdesc.in.file.fnum = fnum;
1592         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1593         set.set_secdesc.in.sd = sd_orig;
1594         status = smb_raw_setfileinfo(cli->tree, &set);
1595         CHECK_STATUS(status, NT_STATUS_OK);
1596
1597         smbcli_close(cli->tree, fnum);
1598
1599         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1600         status = smb_raw_open(cli->tree, tctx, &io);
1601         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1602
1603         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1604         status = smb_raw_open(cli->tree, tctx, &io);
1605         CHECK_STATUS(status, NT_STATUS_OK);
1606         fnum2 = io.ntcreatex.out.file.fnum;
1607         CHECK_ACCESS_FLAGS(fnum2, SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE);
1608         smbcli_close(cli->tree, fnum2);
1609
1610         smbcli_unlink(cli->tree, fname1);
1611         smbcli_rmdir(cli->tree, dname);
1612
1613 done:
1614         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1615         set.set_secdesc.in.file.fnum = fnum;
1616         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1617         set.set_secdesc.in.sd = sd_orig;
1618         status = smb_raw_setfileinfo(cli->tree, &set);
1619
1620         smbcli_close(cli->tree, fnum);
1621         return ret;
1622 }
1623
1624
1625 /*
1626   test dynamic acl inheritance
1627 */
1628 static bool test_inheritance_dynamic(struct torture_context *tctx,
1629                                                                          struct smbcli_state *cli)
1630 {
1631         NTSTATUS status;
1632         union smb_open io;
1633         const char *dname = BASEDIR "\\inheritance";
1634         const char *fname1 = BASEDIR "\\inheritance\\testfile";
1635         bool ret = true;
1636         int fnum=0, fnum2;
1637         union smb_fileinfo q;
1638         union smb_setfileinfo set;
1639         struct security_descriptor *sd, *sd_orig=NULL;
1640         const char *owner_sid;
1641
1642         printf("TESTING DYNAMIC ACL INHERITANCE\n");
1643
1644         if (!torture_setup_dir(cli, BASEDIR)) {
1645                 return false;
1646         }
1647
1648         io.generic.level = RAW_OPEN_NTCREATEX;
1649         io.ntcreatex.in.root_fid = 0;
1650         io.ntcreatex.in.flags = 0;
1651         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1652         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1653         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
1654         io.ntcreatex.in.share_access = 0;
1655         io.ntcreatex.in.alloc_size = 0;
1656         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1657         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
1658         io.ntcreatex.in.security_flags = 0;
1659         io.ntcreatex.in.fname = dname;
1660
1661         status = smb_raw_open(cli->tree, tctx, &io);
1662         CHECK_STATUS(status, NT_STATUS_OK);
1663         fnum = io.ntcreatex.out.file.fnum;
1664
1665         printf("get the original sd\n");
1666         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
1667         q.query_secdesc.in.file.fnum = fnum;
1668         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1669         status = smb_raw_fileinfo(cli->tree, tctx, &q);
1670         CHECK_STATUS(status, NT_STATUS_OK);
1671         sd_orig = q.query_secdesc.out.sd;
1672
1673         owner_sid = dom_sid_string(tctx, sd_orig->owner_sid);
1674
1675         printf("owner_sid is %s\n", owner_sid);
1676
1677         sd = security_descriptor_dacl_create(tctx,
1678                                         0, NULL, NULL,
1679                                         owner_sid,
1680                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1681                                         SEC_FILE_WRITE_DATA | SEC_STD_DELETE | SEC_FILE_READ_ATTRIBUTE,
1682                                         SEC_ACE_FLAG_OBJECT_INHERIT,
1683                                         NULL);
1684         sd->type |= SEC_DESC_DACL_AUTO_INHERITED | SEC_DESC_DACL_AUTO_INHERIT_REQ;
1685
1686         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1687         set.set_secdesc.in.file.fnum = fnum;
1688         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1689         set.set_secdesc.in.sd = sd;
1690         status = smb_raw_setfileinfo(cli->tree, &set);
1691         CHECK_STATUS(status, NT_STATUS_OK);
1692
1693         printf("create a file with an inherited acl\n");
1694         io.ntcreatex.in.fname = fname1;
1695         io.ntcreatex.in.create_options = 0;
1696         io.ntcreatex.in.access_mask = SEC_FILE_READ_ATTRIBUTE;
1697         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1698         status = smb_raw_open(cli->tree, tctx, &io);
1699         CHECK_STATUS(status, NT_STATUS_OK);
1700         fnum2 = io.ntcreatex.out.file.fnum;
1701         smbcli_close(cli->tree, fnum2);
1702
1703         printf("try and access file with base rights - should be OK\n");
1704         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1705         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1706         status = smb_raw_open(cli->tree, tctx, &io);
1707         CHECK_STATUS(status, NT_STATUS_OK);
1708         fnum2 = io.ntcreatex.out.file.fnum;
1709         smbcli_close(cli->tree, fnum2);
1710
1711         printf("try and access file with extra rights - should be denied\n");
1712         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA | SEC_FILE_EXECUTE;
1713         status = smb_raw_open(cli->tree, tctx, &io);
1714         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1715
1716         printf("update parent sd\n");
1717         sd = security_descriptor_dacl_create(tctx,
1718                                         0, NULL, NULL,
1719                                         owner_sid,
1720                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1721                                         SEC_FILE_WRITE_DATA | SEC_STD_DELETE | SEC_FILE_READ_ATTRIBUTE | SEC_FILE_EXECUTE,
1722                                         SEC_ACE_FLAG_OBJECT_INHERIT,
1723                                         NULL);
1724         sd->type |= SEC_DESC_DACL_AUTO_INHERITED | SEC_DESC_DACL_AUTO_INHERIT_REQ;
1725
1726         set.set_secdesc.in.sd = sd;
1727         status = smb_raw_setfileinfo(cli->tree, &set);
1728         CHECK_STATUS(status, NT_STATUS_OK);
1729
1730         printf("try and access file with base rights - should be OK\n");
1731         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1732         status = smb_raw_open(cli->tree, tctx, &io);
1733         CHECK_STATUS(status, NT_STATUS_OK);
1734         fnum2 = io.ntcreatex.out.file.fnum;
1735         smbcli_close(cli->tree, fnum2);
1736
1737
1738         printf("try and access now - should be OK if dynamic inheritance works\n");
1739         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA | SEC_FILE_EXECUTE;
1740         status = smb_raw_open(cli->tree, tctx, &io);
1741         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
1742                 printf("Server does not have dynamic inheritance\n");
1743         }
1744         if (NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
1745                 printf("Server does have dynamic inheritance\n");
1746         }
1747         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1748
1749         smbcli_unlink(cli->tree, fname1);
1750
1751 done:
1752         printf("put back original sd\n");
1753         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1754         set.set_secdesc.in.file.fnum = fnum;
1755         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1756         set.set_secdesc.in.sd = sd_orig;
1757         status = smb_raw_setfileinfo(cli->tree, &set);
1758
1759         smbcli_close(cli->tree, fnum);
1760         smbcli_rmdir(cli->tree, dname);
1761
1762         return ret;
1763 }
1764
1765 #define CHECK_STATUS_FOR_BIT_ACTION(status, bits, action) do { \
1766         if (!(bits & desired_64)) {\
1767                 CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED); \
1768                 action; \
1769         } else { \
1770                 CHECK_STATUS(status, NT_STATUS_OK); \
1771         } \
1772 } while (0)
1773
1774 #define CHECK_STATUS_FOR_BIT(status, bits, access) do { \
1775         if (NT_STATUS_IS_OK(status)) { \
1776                 if (!(granted & access)) {\
1777                         printf("(%s) %s but flags 0x%08X are not granted! granted[0x%08X] desired[0x%08X]\n", \
1778                                __location__, nt_errstr(status), access, granted, desired); \
1779                         ret = false; \
1780                         goto done; \
1781                 } \
1782         } else { \
1783                 if (granted & access) {\
1784                         printf("(%s) %s but flags 0x%08X are granted! granted[0x%08X] desired[0x%08X]\n", \
1785                                __location__, nt_errstr(status), access, granted, desired); \
1786                         ret = false; \
1787                         goto done; \
1788                 } \
1789         } \
1790         CHECK_STATUS_FOR_BIT_ACTION(status, bits, do {} while (0)); \
1791 } while (0)
1792
1793 /* test what access mask is needed for getting and setting security_descriptors */
1794 static bool test_sd_get_set(struct torture_context *tctx,
1795                                                         struct smbcli_state *cli)
1796 {
1797         NTSTATUS status;
1798         bool ret = true;
1799         union smb_open io;
1800         union smb_fileinfo fi;
1801         union smb_setfileinfo si;
1802         struct security_descriptor *sd;
1803         struct security_descriptor *sd_owner = NULL;
1804         struct security_descriptor *sd_group = NULL;
1805         struct security_descriptor *sd_dacl = NULL;
1806         struct security_descriptor *sd_sacl = NULL;
1807         int fnum=0;
1808         const char *fname = BASEDIR "\\sd_get_set.txt";
1809         uint64_t desired_64;
1810         uint32_t desired = 0, granted;
1811         int i = 0;
1812 #define NO_BITS_HACK (((uint64_t)1)<<32)
1813         uint64_t open_bits =
1814                 SEC_MASK_GENERIC |
1815                 SEC_FLAG_SYSTEM_SECURITY |
1816                 SEC_FLAG_MAXIMUM_ALLOWED |
1817                 SEC_STD_ALL |
1818                 SEC_FILE_ALL |
1819                 NO_BITS_HACK;
1820         uint64_t get_owner_bits = SEC_MASK_GENERIC | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_READ_CONTROL;
1821         uint64_t set_owner_bits = SEC_GENERIC_ALL  | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_WRITE_OWNER;
1822         uint64_t get_group_bits = SEC_MASK_GENERIC | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_READ_CONTROL;
1823         uint64_t set_group_bits = SEC_GENERIC_ALL  | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_WRITE_OWNER;
1824         uint64_t get_dacl_bits  = SEC_MASK_GENERIC | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_READ_CONTROL;
1825         uint64_t set_dacl_bits  = SEC_GENERIC_ALL  | SEC_FLAG_MAXIMUM_ALLOWED | SEC_STD_WRITE_DAC;
1826         uint64_t get_sacl_bits  = SEC_FLAG_SYSTEM_SECURITY;
1827         uint64_t set_sacl_bits  = SEC_FLAG_SYSTEM_SECURITY;
1828
1829         printf("TESTING ACCESS MASKS FOR SD GET/SET\n");
1830
1831         /* first create a file with full access for everyone */
1832         sd = security_descriptor_dacl_create(tctx,
1833                                         0, SID_NT_ANONYMOUS, SID_BUILTIN_USERS,
1834                                         SID_WORLD,
1835                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1836                                         SEC_GENERIC_ALL,
1837                                         0,
1838                                         NULL);
1839         sd->type |= SEC_DESC_SACL_PRESENT;
1840         sd->sacl = NULL;
1841         io.ntcreatex.level = RAW_OPEN_NTTRANS_CREATE;
1842         io.ntcreatex.in.root_fid = 0;
1843         io.ntcreatex.in.flags = 0;
1844         io.ntcreatex.in.access_mask = SEC_GENERIC_ALL;
1845         io.ntcreatex.in.create_options = 0;
1846         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
1847         io.ntcreatex.in.share_access = NTCREATEX_SHARE_ACCESS_READ | NTCREATEX_SHARE_ACCESS_WRITE;
1848         io.ntcreatex.in.alloc_size = 0;
1849         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OVERWRITE_IF;
1850         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
1851         io.ntcreatex.in.security_flags = 0;
1852         io.ntcreatex.in.fname = fname;
1853         io.ntcreatex.in.sec_desc = sd;
1854         io.ntcreatex.in.ea_list = NULL;
1855         status = smb_raw_open(cli->tree, tctx, &io);
1856         CHECK_STATUS(status, NT_STATUS_OK);
1857         fnum = io.ntcreatex.out.file.fnum;
1858
1859         status = smbcli_close(cli->tree, fnum);
1860         CHECK_STATUS(status, NT_STATUS_OK);
1861
1862         /*
1863          * now try each access_mask bit and no bit at all in a loop
1864          * and see what's allowed
1865          * NOTE: if i == 32 it means access_mask = 0 (see NO_BITS_HACK above)
1866          */
1867         for (i=0; i <= 32; i++) {
1868                 desired_64 = ((uint64_t)1) << i;
1869                 desired = (uint32_t)desired_64;
1870
1871                 /* first open the file with the desired access */
1872                 io.ntcreatex.level = RAW_OPEN_NTCREATEX;
1873                 io.ntcreatex.in.access_mask = desired;
1874                 io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1875                 status = smb_raw_open(cli->tree, tctx, &io);
1876                 CHECK_STATUS_FOR_BIT_ACTION(status, open_bits, goto next);
1877                 fnum = io.ntcreatex.out.file.fnum;
1878
1879                 /* then check what access was granted */
1880                 fi.access_information.level             = RAW_FILEINFO_ACCESS_INFORMATION;
1881                 fi.access_information.in.file.fnum      = fnum;
1882                 status = smb_raw_fileinfo(cli->tree, tctx, &fi);
1883                 CHECK_STATUS(status, NT_STATUS_OK);
1884                 granted = fi.access_information.out.access_flags;
1885
1886                 /* test the owner */
1887                 ZERO_STRUCT(fi);
1888                 fi.query_secdesc.level                  = RAW_FILEINFO_SEC_DESC;
1889                 fi.query_secdesc.in.file.fnum           = fnum;
1890                 fi.query_secdesc.in.secinfo_flags       = SECINFO_OWNER;
1891                 status = smb_raw_fileinfo(cli->tree, tctx, &fi);
1892                 CHECK_STATUS_FOR_BIT(status, get_owner_bits, SEC_STD_READ_CONTROL);
1893                 if (fi.query_secdesc.out.sd) {
1894                         sd_owner = fi.query_secdesc.out.sd;
1895                 } else if (!sd_owner) {
1896                         sd_owner = sd;
1897                 }
1898                 si.set_secdesc.level                    = RAW_SFILEINFO_SEC_DESC;
1899                 si.set_secdesc.in.file.fnum             = fnum;
1900                 si.set_secdesc.in.secinfo_flags         = SECINFO_OWNER;
1901                 si.set_secdesc.in.sd                    = sd_owner;
1902                 status = smb_raw_setfileinfo(cli->tree, &si);
1903                 CHECK_STATUS_FOR_BIT(status, set_owner_bits, SEC_STD_WRITE_OWNER);
1904
1905                 /* test the group */
1906                 ZERO_STRUCT(fi);
1907                 fi.query_secdesc.level                  = RAW_FILEINFO_SEC_DESC;
1908                 fi.query_secdesc.in.file.fnum           = fnum;
1909                 fi.query_secdesc.in.secinfo_flags       = SECINFO_GROUP;
1910                 status = smb_raw_fileinfo(cli->tree, tctx, &fi);
1911                 CHECK_STATUS_FOR_BIT(status, get_group_bits, SEC_STD_READ_CONTROL);
1912                 if (fi.query_secdesc.out.sd) {
1913                         sd_group = fi.query_secdesc.out.sd;
1914                 } else if (!sd_group) {
1915                         sd_group = sd;
1916                 }
1917                 si.set_secdesc.level                    = RAW_SFILEINFO_SEC_DESC;
1918                 si.set_secdesc.in.file.fnum             = fnum;
1919                 si.set_secdesc.in.secinfo_flags         = SECINFO_GROUP;
1920                 si.set_secdesc.in.sd                    = sd_group;
1921                 status = smb_raw_setfileinfo(cli->tree, &si);
1922                 CHECK_STATUS_FOR_BIT(status, set_group_bits, SEC_STD_WRITE_OWNER);
1923
1924                 /* test the DACL */
1925                 ZERO_STRUCT(fi);
1926                 fi.query_secdesc.level                  = RAW_FILEINFO_SEC_DESC;
1927                 fi.query_secdesc.in.file.fnum           = fnum;
1928                 fi.query_secdesc.in.secinfo_flags       = SECINFO_DACL;
1929                 status = smb_raw_fileinfo(cli->tree, tctx, &fi);
1930                 CHECK_STATUS_FOR_BIT(status, get_dacl_bits, SEC_STD_READ_CONTROL);
1931                 if (fi.query_secdesc.out.sd) {
1932                         sd_dacl = fi.query_secdesc.out.sd;
1933                 } else if (!sd_dacl) {
1934                         sd_dacl = sd;
1935                 }
1936                 si.set_secdesc.level                    = RAW_SFILEINFO_SEC_DESC;
1937                 si.set_secdesc.in.file.fnum             = fnum;
1938                 si.set_secdesc.in.secinfo_flags         = SECINFO_DACL;
1939                 si.set_secdesc.in.sd                    = sd_dacl;
1940                 status = smb_raw_setfileinfo(cli->tree, &si);
1941                 CHECK_STATUS_FOR_BIT(status, set_dacl_bits, SEC_STD_WRITE_DAC);
1942
1943                 /* test the SACL */
1944                 ZERO_STRUCT(fi);
1945                 fi.query_secdesc.level                  = RAW_FILEINFO_SEC_DESC;
1946                 fi.query_secdesc.in.file.fnum           = fnum;
1947                 fi.query_secdesc.in.secinfo_flags       = SECINFO_SACL;
1948                 status = smb_raw_fileinfo(cli->tree, tctx, &fi);
1949                 CHECK_STATUS_FOR_BIT(status, get_sacl_bits, SEC_FLAG_SYSTEM_SECURITY);
1950                 if (fi.query_secdesc.out.sd) {
1951                         sd_sacl = fi.query_secdesc.out.sd;
1952                 } else if (!sd_sacl) {
1953                         sd_sacl = sd;
1954                 }
1955                 si.set_secdesc.level                    = RAW_SFILEINFO_SEC_DESC;
1956                 si.set_secdesc.in.file.fnum             = fnum;
1957                 si.set_secdesc.in.secinfo_flags         = SECINFO_SACL;
1958                 si.set_secdesc.in.sd                    = sd_sacl;
1959                 status = smb_raw_setfileinfo(cli->tree, &si);
1960                 CHECK_STATUS_FOR_BIT(status, set_sacl_bits, SEC_FLAG_SYSTEM_SECURITY);
1961
1962                 /* close the handle */
1963                 status = smbcli_close(cli->tree, fnum);
1964                 CHECK_STATUS(status, NT_STATUS_OK);
1965 next:
1966                 continue;
1967         }
1968
1969 done:
1970         smbcli_close(cli->tree, fnum);
1971         smbcli_unlink(cli->tree, fname);
1972
1973         return ret;
1974 }
1975
1976
1977 /*
1978    basic testing of security descriptor calls
1979 */
1980 bool torture_raw_acls(struct torture_context *tctx, struct smbcli_state *cli)
1981 {
1982         bool ret = true;
1983
1984         if (!torture_setup_dir(cli, BASEDIR)) {
1985                 return false;
1986         }
1987
1988         ret &= test_sd(tctx, cli);
1989         ret &= test_nttrans_create(tctx, cli);
1990         ret &= test_nttrans_create_null_dacl(tctx, cli);
1991         ret &= test_creator_sid(tctx, cli);
1992         ret &= test_generic_bits(tctx, cli);
1993         ret &= test_owner_bits(tctx, cli);
1994         ret &= test_inheritance(tctx, cli);
1995         ret &= test_inheritance_dynamic(tctx, cli);
1996         ret &= test_sd_get_set(tctx, cli);
1997
1998         smb_raw_exit(cli->session);
1999         smbcli_deltree(cli->tree, BASEDIR);
2000
2001         return ret;
2002 }