source4/torture/raw/acls.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    test security descriptor operations
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "torture/torture.h"
  25 #include "libcli/raw/libcliraw.h"
  26 #include "libcli/libcli.h"
  27 #include "librpc/gen_ndr/lsa.h"
  28 #include "libcli/util/clilsa.h"
  29 #include "libcli/security/proto.h"
  30 #include "librpc/gen_ndr/ndr_security.h"
  31 #include "torture/util.h"
  32
  33 #define BASEDIR "\\testsd"
  34
  35 #define CHECK_STATUS(status, correct) do { \
  36         if (!NT_STATUS_EQUAL(status, correct)) { \
  37                 printf("(%s) Incorrect status %s - should be %s\n", \
  38                        __location__, nt_errstr(status), nt_errstr(correct)); \
  39                 ret = False; \
  40                 goto done; \
  41         }} while (0)
  42
  43
  44 static BOOL test_sd(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
  45 {
  46         NTSTATUS status;
  47         union smb_open io;
  48         const char *fname = BASEDIR "\\sd.txt";
  49         BOOL ret = True;
  50         int fnum = -1;
  51         union smb_fileinfo q;
  52         union smb_setfileinfo set;
  53         struct security_ace ace;
  54         struct security_descriptor *sd;
  55         struct dom_sid *test_sid;
  56
  57         printf("TESTING SETFILEINFO EA_SET\n");
  58
  59         io.generic.level = RAW_OPEN_NTCREATEX;
  60         io.ntcreatex.in.root_fid = 0;
  61         io.ntcreatex.in.flags = 0;
  62         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  63         io.ntcreatex.in.create_options = 0;
  64         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
  65         io.ntcreatex.in.share_access =
  66                 NTCREATEX_SHARE_ACCESS_READ |
  67                 NTCREATEX_SHARE_ACCESS_WRITE;
  68         io.ntcreatex.in.alloc_size = 0;
  69         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
  70         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
  71         io.ntcreatex.in.security_flags = 0;
  72         io.ntcreatex.in.fname = fname;
  73         status = smb_raw_open(cli->tree, mem_ctx, &io);
  74         CHECK_STATUS(status, NT_STATUS_OK);
  75         fnum = io.ntcreatex.out.file.fnum;
  76
  77         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
  78         q.query_secdesc.in.file.fnum = fnum;
  79         q.query_secdesc.in.secinfo_flags =
  80                 SECINFO_OWNER |
  81                 SECINFO_GROUP |
  82                 SECINFO_DACL;
  83         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
  84         CHECK_STATUS(status, NT_STATUS_OK);
  85         sd = q.query_secdesc.out.sd;
  86
  87         printf("add a new ACE to the DACL\n");
  88
  89         test_sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-1234-5432");
  90
  91         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
  92         ace.flags = 0;
  93         ace.access_mask = SEC_STD_ALL;
  94         ace.trustee = *test_sid;
  95
  96         status = security_descriptor_dacl_add(sd, &ace);
  97         CHECK_STATUS(status, NT_STATUS_OK);
  98
  99         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 100         set.set_secdesc.in.file.fnum = fnum;
 101         set.set_secdesc.in.secinfo_flags = q.query_secdesc.in.secinfo_flags;
 102         set.set_secdesc.in.sd = sd;
 103
 104         status = smb_raw_setfileinfo(cli->tree, &set);
 105         CHECK_STATUS(status, NT_STATUS_OK);
 106
 107         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 108         CHECK_STATUS(status, NT_STATUS_OK);
 109
 110         if (!security_acl_equal(q.query_secdesc.out.sd->dacl, sd->dacl)) {
 111                 printf("%s: security descriptors don't match!\n", __location__);
 112                 printf("got:\n");
 113                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 114                 printf("expected:\n");
 115                 NDR_PRINT_DEBUG(security_descriptor, sd);
 116                 ret = False;
 117         }
 118
 119         printf("remove it again\n");
 120
 121         status = security_descriptor_dacl_del(sd, test_sid);
 122         CHECK_STATUS(status, NT_STATUS_OK);
 123
 124         status = smb_raw_setfileinfo(cli->tree, &set);
 125         CHECK_STATUS(status, NT_STATUS_OK);
 126
 127         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 128         CHECK_STATUS(status, NT_STATUS_OK);
 129
 130         if (!security_acl_equal(q.query_secdesc.out.sd->dacl, sd->dacl)) {
 131                 printf("%s: security descriptors don't match!\n", __location__);
 132                 printf("got:\n");
 133                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 134                 printf("expected:\n");
 135                 NDR_PRINT_DEBUG(security_descriptor, sd);
 136                 ret = False;
 137         }
 138
 139 done:
 140         smbcli_close(cli->tree, fnum);
 141         return ret;
 142 }
 143
 144
 145 /*
 146   test using NTTRANS CREATE to create a file with an initial ACL set
 147 */
 148 static BOOL test_nttrans_create(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 149 {
 150         NTSTATUS status;
 151         union smb_open io;
 152         const char *fname = BASEDIR "\\acl2.txt";
 153         BOOL ret = True;
 154         int fnum = -1;
 155         union smb_fileinfo q;
 156         struct security_ace ace;
 157         struct security_descriptor *sd;
 158         struct dom_sid *test_sid;
 159
 160         printf("TESTING NTTRANS CREATE WITH SEC_DESC\n");
 161
 162         io.generic.level = RAW_OPEN_NTTRANS_CREATE;
 163         io.ntcreatex.in.root_fid = 0;
 164         io.ntcreatex.in.flags = 0;
 165         io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 166         io.ntcreatex.in.create_options = 0;
 167         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 168         io.ntcreatex.in.share_access =
 169                 NTCREATEX_SHARE_ACCESS_READ |
 170                 NTCREATEX_SHARE_ACCESS_WRITE;
 171         io.ntcreatex.in.alloc_size = 0;
 172         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
 173         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 174         io.ntcreatex.in.security_flags = 0;
 175         io.ntcreatex.in.fname = fname;
 176         io.ntcreatex.in.sec_desc = NULL;
 177         io.ntcreatex.in.ea_list = NULL;
 178
 179         printf("creating normal file\n");
 180
 181         status = smb_raw_open(cli->tree, mem_ctx, &io);
 182         CHECK_STATUS(status, NT_STATUS_OK);
 183         fnum = io.ntcreatex.out.file.fnum;
 184
 185         printf("querying ACL\n");
 186
 187         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 188         q.query_secdesc.in.file.fnum = fnum;
 189         q.query_secdesc.in.secinfo_flags =
 190                 SECINFO_OWNER |
 191                 SECINFO_GROUP |
 192                 SECINFO_DACL;
 193         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 194         CHECK_STATUS(status, NT_STATUS_OK);
 195         sd = q.query_secdesc.out.sd;
 196
 197         smbcli_close(cli->tree, fnum);
 198         smbcli_unlink(cli->tree, fname);
 199
 200         printf("adding a new ACE\n");
 201         test_sid = dom_sid_parse_talloc(mem_ctx, "S-1-5-32-1234-54321");
 202
 203         ace.type = SEC_ACE_TYPE_ACCESS_ALLOWED;
 204         ace.flags = 0;
 205         ace.access_mask = SEC_STD_ALL;
 206         ace.trustee = *test_sid;
 207
 208         status = security_descriptor_dacl_add(sd, &ace);
 209         CHECK_STATUS(status, NT_STATUS_OK);
 210
 211         printf("creating a file with an initial ACL\n");
 212
 213         io.ntcreatex.in.sec_desc = sd;
 214         status = smb_raw_open(cli->tree, mem_ctx, &io);
 215         CHECK_STATUS(status, NT_STATUS_OK);
 216         fnum = io.ntcreatex.out.file.fnum;
 217
 218         q.query_secdesc.in.file.fnum = fnum;
 219         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 220         CHECK_STATUS(status, NT_STATUS_OK);
 221
 222         if (!security_acl_equal(q.query_secdesc.out.sd->dacl, sd->dacl)) {
 223                 printf("%s: security descriptors don't match!\n", __location__);
 224                 printf("got:\n");
 225                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 226                 printf("expected:\n");
 227                 NDR_PRINT_DEBUG(security_descriptor, sd);
 228                 ret = False;
 229         }
 230
 231 done:
 232         smbcli_close(cli->tree, fnum);
 233         return ret;
 234 }
 235
 236 #define CHECK_ACCESS_FLAGS(_fnum, flags) do { \
 237         union smb_fileinfo _q; \
 238         _q.access_information.level = RAW_FILEINFO_ACCESS_INFORMATION; \
 239         _q.access_information.in.file.fnum = (_fnum); \
 240         status = smb_raw_fileinfo(cli->tree, mem_ctx, &_q); \
 241         CHECK_STATUS(status, NT_STATUS_OK); \
 242         if (_q.access_information.out.access_flags != (flags)) { \
 243                 printf("(%s) Incorrect access_flags 0x%08x - should be 0x%08x\n", \
 244                        __location__, _q.access_information.out.access_flags, (flags)); \
 245                 ret = False; \
 246                 goto done; \
 247         } \
 248 } while (0)
 249
 250
 251 /*
 252   test the behaviour of the well known SID_CREATOR_OWNER sid, and some generic
 253   mapping bits
 254 */
 255 static BOOL test_creator_sid(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 256 {
 257         NTSTATUS status;
 258         union smb_open io;
 259         const char *fname = BASEDIR "\\creator.txt";
 260         BOOL ret = True;
 261         int fnum = -1;
 262         union smb_fileinfo q;
 263         union smb_setfileinfo set;
 264         struct security_descriptor *sd, *sd_orig, *sd2;
 265         const char *owner_sid;
 266
 267         printf("TESTING SID_CREATOR_OWNER\n");
 268
 269         io.generic.level = RAW_OPEN_NTCREATEX;
 270         io.ntcreatex.in.root_fid = 0;
 271         io.ntcreatex.in.flags = 0;
 272         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC | SEC_STD_WRITE_OWNER;
 273         io.ntcreatex.in.create_options = 0;
 274         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 275         io.ntcreatex.in.share_access =
 276                 NTCREATEX_SHARE_ACCESS_READ |
 277                 NTCREATEX_SHARE_ACCESS_WRITE;
 278         io.ntcreatex.in.alloc_size = 0;
 279         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 280         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 281         io.ntcreatex.in.security_flags = 0;
 282         io.ntcreatex.in.fname = fname;
 283         status = smb_raw_open(cli->tree, mem_ctx, &io);
 284         CHECK_STATUS(status, NT_STATUS_OK);
 285         fnum = io.ntcreatex.out.file.fnum;
 286
 287         printf("get the original sd\n");
 288         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 289         q.query_secdesc.in.file.fnum = fnum;
 290         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 291         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 292         CHECK_STATUS(status, NT_STATUS_OK);
 293         sd_orig = q.query_secdesc.out.sd;
 294
 295         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 296
 297         printf("set a sec desc allowing no write by CREATOR_OWNER\n");
 298         sd = security_descriptor_create(mem_ctx,
 299                                         NULL, NULL,
 300                                         SID_CREATOR_OWNER,
 301                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 302                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 303                                         0,
 304                                         NULL);
 305
 306         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 307         set.set_secdesc.in.file.fnum = fnum;
 308         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 309         set.set_secdesc.in.sd = sd;
 310
 311         status = smb_raw_setfileinfo(cli->tree, &set);
 312         CHECK_STATUS(status, NT_STATUS_OK);
 313
 314         printf("try open for write\n");
 315         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 316         status = smb_raw_open(cli->tree, mem_ctx, &io);
 317         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 318
 319         printf("try open for read\n");
 320         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 321         status = smb_raw_open(cli->tree, mem_ctx, &io);
 322         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 323
 324         printf("try open for generic write\n");
 325         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 326         status = smb_raw_open(cli->tree, mem_ctx, &io);
 327         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 328
 329         printf("try open for generic read\n");
 330         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 331         status = smb_raw_open(cli->tree, mem_ctx, &io);
 332         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 333
 334         printf("set a sec desc allowing no write by owner\n");
 335         sd = security_descriptor_create(mem_ctx,
 336                                         owner_sid, NULL,
 337                                         owner_sid,
 338                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 339                                         SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 340                                         0,
 341                                         NULL);
 342
 343         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 344         set.set_secdesc.in.file.fnum = fnum;
 345         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 346         set.set_secdesc.in.sd = sd;
 347         status = smb_raw_setfileinfo(cli->tree, &set);
 348         CHECK_STATUS(status, NT_STATUS_OK);
 349
 350         printf("check that sd has been mapped correctly\n");
 351         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 352         CHECK_STATUS(status, NT_STATUS_OK);
 353         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd)) {
 354                 printf("%s: security descriptors don't match!\n", __location__);
 355                 printf("got:\n");
 356                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 357                 printf("expected:\n");
 358                 NDR_PRINT_DEBUG(security_descriptor, sd);
 359                 ret = False;
 360         }
 361
 362         printf("try open for write\n");
 363         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 364         status = smb_raw_open(cli->tree, mem_ctx, &io);
 365         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 366
 367         printf("try open for read\n");
 368         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 369         status = smb_raw_open(cli->tree, mem_ctx, &io);
 370         CHECK_STATUS(status, NT_STATUS_OK);
 371         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 372                            SEC_FILE_READ_DATA|
 373                            SEC_FILE_READ_ATTRIBUTE);
 374         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 375
 376         printf("try open for generic write\n");
 377         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 378         status = smb_raw_open(cli->tree, mem_ctx, &io);
 379         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 380
 381         printf("try open for generic read\n");
 382         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 383         status = smb_raw_open(cli->tree, mem_ctx, &io);
 384         CHECK_STATUS(status, NT_STATUS_OK);
 385         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 386                            SEC_RIGHTS_FILE_READ);
 387         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 388
 389         printf("set a sec desc allowing generic read by owner\n");
 390         sd = security_descriptor_create(mem_ctx,
 391                                         NULL, NULL,
 392                                         owner_sid,
 393                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 394                                         SEC_GENERIC_READ | SEC_STD_ALL,
 395                                         0,
 396                                         NULL);
 397
 398         set.set_secdesc.in.sd = sd;
 399         status = smb_raw_setfileinfo(cli->tree, &set);
 400         CHECK_STATUS(status, NT_STATUS_OK);
 401
 402         printf("check that generic read has been mapped correctly\n");
 403         sd2 = security_descriptor_create(mem_ctx,
 404                                          owner_sid, NULL,
 405                                          owner_sid,
 406                                          SEC_ACE_TYPE_ACCESS_ALLOWED,
 407                                          SEC_RIGHTS_FILE_READ | SEC_STD_ALL,
 408                                          0,
 409                                          NULL);
 410
 411         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 412         CHECK_STATUS(status, NT_STATUS_OK);
 413         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 414                 printf("%s: security descriptors don't match!\n", __location__);
 415                 printf("got:\n");
 416                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 417                 printf("expected:\n");
 418                 NDR_PRINT_DEBUG(security_descriptor, sd2);
 419                 ret = False;
 420         }
 421
 422
 423         printf("try open for write\n");
 424         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
 425         status = smb_raw_open(cli->tree, mem_ctx, &io);
 426         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 427
 428         printf("try open for read\n");
 429         io.ntcreatex.in.access_mask = SEC_FILE_READ_DATA;
 430         status = smb_raw_open(cli->tree, mem_ctx, &io);
 431         CHECK_STATUS(status, NT_STATUS_OK);
 432         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 433                            SEC_FILE_READ_DATA |
 434                            SEC_FILE_READ_ATTRIBUTE);
 435         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 436
 437         printf("try open for generic write\n");
 438         io.ntcreatex.in.access_mask = SEC_GENERIC_WRITE;
 439         status = smb_raw_open(cli->tree, mem_ctx, &io);
 440         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 441
 442         printf("try open for generic read\n");
 443         io.ntcreatex.in.access_mask = SEC_GENERIC_READ;
 444         status = smb_raw_open(cli->tree, mem_ctx, &io);
 445         CHECK_STATUS(status, NT_STATUS_OK);
 446         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum, SEC_RIGHTS_FILE_READ);
 447         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 448
 449
 450         printf("put back original sd\n");
 451         set.set_secdesc.in.sd = sd_orig;
 452         status = smb_raw_setfileinfo(cli->tree, &set);
 453         CHECK_STATUS(status, NT_STATUS_OK);
 454
 455
 456 done:
 457         smbcli_close(cli->tree, fnum);
 458         return ret;
 459 }
 460
 461
 462 /*
 463   test the mapping of the SEC_GENERIC_xx bits to SEC_STD_xx and
 464   SEC_FILE_xx bits
 465 */
 466 static BOOL test_generic_bits(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 467 {
 468         NTSTATUS status;
 469         union smb_open io;
 470         const char *fname = BASEDIR "\\generic.txt";
 471         BOOL ret = True;
 472         int fnum = -1, i;
 473         union smb_fileinfo q;
 474         union smb_setfileinfo set;
 475         struct security_descriptor *sd, *sd_orig, *sd2;
 476         const char *owner_sid;
 477         const struct {
 478                 uint32_t gen_bits;
 479                 uint32_t specific_bits;
 480         } file_mappings[] = {
 481                 { 0,                       0 },
 482                 { SEC_GENERIC_READ,        SEC_RIGHTS_FILE_READ },
 483                 { SEC_GENERIC_WRITE,       SEC_RIGHTS_FILE_WRITE },
 484                 { SEC_GENERIC_EXECUTE,     SEC_RIGHTS_FILE_EXECUTE },
 485                 { SEC_GENERIC_ALL,         SEC_RIGHTS_FILE_ALL },
 486                 { SEC_FILE_READ_DATA,      SEC_FILE_READ_DATA },
 487                 { SEC_FILE_READ_ATTRIBUTE, SEC_FILE_READ_ATTRIBUTE }
 488         };
 489         const struct {
 490                 uint32_t gen_bits;
 491                 uint32_t specific_bits;
 492         } dir_mappings[] = {
 493                 { 0,                   0 },
 494                 { SEC_GENERIC_READ,    SEC_RIGHTS_DIR_READ },
 495                 { SEC_GENERIC_WRITE,   SEC_RIGHTS_DIR_WRITE },
 496                 { SEC_GENERIC_EXECUTE, SEC_RIGHTS_DIR_EXECUTE },
 497                 { SEC_GENERIC_ALL,     SEC_RIGHTS_DIR_ALL }
 498         };
 499         BOOL has_restore_privilege;
 500         BOOL has_take_ownership_privilege;
 501
 502         printf("TESTING FILE GENERIC BITS\n");
 503
 504         io.generic.level = RAW_OPEN_NTCREATEX;
 505         io.ntcreatex.in.root_fid = 0;
 506         io.ntcreatex.in.flags = 0;
 507         io.ntcreatex.in.access_mask =
 508                 SEC_STD_READ_CONTROL |
 509                 SEC_STD_WRITE_DAC |
 510                 SEC_STD_WRITE_OWNER;
 511         io.ntcreatex.in.create_options = 0;
 512         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 513         io.ntcreatex.in.share_access =
 514                 NTCREATEX_SHARE_ACCESS_READ |
 515                 NTCREATEX_SHARE_ACCESS_WRITE;
 516         io.ntcreatex.in.alloc_size = 0;
 517         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 518         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 519         io.ntcreatex.in.security_flags = 0;
 520         io.ntcreatex.in.fname = fname;
 521         status = smb_raw_open(cli->tree, mem_ctx, &io);
 522         CHECK_STATUS(status, NT_STATUS_OK);
 523         fnum = io.ntcreatex.out.file.fnum;
 524
 525         printf("get the original sd\n");
 526         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 527         q.query_secdesc.in.file.fnum = fnum;
 528         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 529         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 530         CHECK_STATUS(status, NT_STATUS_OK);
 531         sd_orig = q.query_secdesc.out.sd;
 532
 533         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 534
 535         status = smblsa_sid_check_privilege(cli,
 536                                             owner_sid,
 537                                             sec_privilege_name(SEC_PRIV_RESTORE));
 538         has_restore_privilege = NT_STATUS_IS_OK(status);
 539         if (!NT_STATUS_IS_OK(status)) {
 540                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 541         }
 542         printf("SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
 543
 544         status = smblsa_sid_check_privilege(cli,
 545                                             owner_sid,
 546                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
 547         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
 548         if (!NT_STATUS_IS_OK(status)) {
 549                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 550         }
 551         printf("SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_take_ownership_privilege?"Yes":"No");
 552
 553         for (i=0;i<ARRAY_SIZE(file_mappings);i++) {
 554                 uint32_t expected_mask =
 555                         SEC_STD_WRITE_DAC |
 556                         SEC_STD_READ_CONTROL |
 557                         SEC_FILE_READ_ATTRIBUTE |
 558                         SEC_STD_DELETE;
 559                 uint32_t expected_mask_anon = SEC_FILE_READ_ATTRIBUTE;
 560
 561                 if (has_restore_privilege) {
 562                         expected_mask_anon |= SEC_STD_DELETE;
 563                 }
 564
 565                 printf("testing generic bits 0x%08x\n",
 566                        file_mappings[i].gen_bits);
 567                 sd = security_descriptor_create(mem_ctx,
 568                                                 owner_sid, NULL,
 569                                                 owner_sid,
 570                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 571                                                 file_mappings[i].gen_bits,
 572                                                 0,
 573                                                 NULL);
 574
 575                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 576                 set.set_secdesc.in.file.fnum = fnum;
 577                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 578                 set.set_secdesc.in.sd = sd;
 579
 580                 status = smb_raw_setfileinfo(cli->tree, &set);
 581                 CHECK_STATUS(status, NT_STATUS_OK);
 582
 583                 sd2 = security_descriptor_create(mem_ctx,
 584                                                  owner_sid, NULL,
 585                                                  owner_sid,
 586                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 587                                                  file_mappings[i].specific_bits,
 588                                                  0,
 589                                                  NULL);
 590
 591                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 592                 CHECK_STATUS(status, NT_STATUS_OK);
 593                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 594                         printf("%s: security descriptors don't match!\n", __location__);
 595                         printf("got:\n");
 596                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 597                         printf("expected:\n");
 598                         NDR_PRINT_DEBUG(security_descriptor, sd2);
 599                         ret = False;
 600                 }
 601
 602                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 603                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 604                 CHECK_STATUS(status, NT_STATUS_OK);
 605                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 606                                    expected_mask | file_mappings[i].specific_bits);
 607                 smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 608
 609                 if (!has_take_ownership_privilege) {
 610                         continue;
 611                 }
 612
 613                 printf("testing generic bits 0x%08x (anonymous)\n",
 614                        file_mappings[i].gen_bits);
 615                 sd = security_descriptor_create(mem_ctx,
 616                                                 SID_NT_ANONYMOUS, NULL,
 617                                                 owner_sid,
 618                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 619                                                 file_mappings[i].gen_bits,
 620                                                 0,
 621                                                 NULL);
 622
 623                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 624                 set.set_secdesc.in.file.fnum = fnum;
 625                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 626                 set.set_secdesc.in.sd = sd;
 627
 628                 status = smb_raw_setfileinfo(cli->tree, &set);
 629                 CHECK_STATUS(status, NT_STATUS_OK);
 630
 631                 sd2 = security_descriptor_create(mem_ctx,
 632                                                  SID_NT_ANONYMOUS, NULL,
 633                                                  owner_sid,
 634                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 635                                                  file_mappings[i].specific_bits,
 636                                                  0,
 637                                                  NULL);
 638
 639                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 640                 CHECK_STATUS(status, NT_STATUS_OK);
 641                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 642                         printf("%s: security descriptors don't match!\n", __location__);
 643                         printf("got:\n");
 644                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 645                         printf("expected:\n");
 646                         NDR_PRINT_DEBUG(security_descriptor, sd2);
 647                         ret = False;
 648                 }
 649
 650                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 651                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 652                 CHECK_STATUS(status, NT_STATUS_OK);
 653                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 654                                    expected_mask_anon | file_mappings[i].specific_bits);
 655                 smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 656         }
 657
 658         printf("put back original sd\n");
 659         set.set_secdesc.in.sd = sd_orig;
 660         status = smb_raw_setfileinfo(cli->tree, &set);
 661         CHECK_STATUS(status, NT_STATUS_OK);
 662
 663         smbcli_close(cli->tree, fnum);
 664         smbcli_unlink(cli->tree, fname);
 665
 666
 667         printf("TESTING DIR GENERIC BITS\n");
 668
 669         io.generic.level = RAW_OPEN_NTCREATEX;
 670         io.ntcreatex.in.root_fid = 0;
 671         io.ntcreatex.in.flags = 0;
 672         io.ntcreatex.in.access_mask = SEC_STD_READ_CONTROL | SEC_STD_WRITE_DAC;
 673         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
 674         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
 675         io.ntcreatex.in.share_access =
 676                 NTCREATEX_SHARE_ACCESS_READ |
 677                 NTCREATEX_SHARE_ACCESS_WRITE;
 678         io.ntcreatex.in.alloc_size = 0;
 679         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 680         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 681         io.ntcreatex.in.security_flags = 0;
 682         io.ntcreatex.in.fname = fname;
 683         status = smb_raw_open(cli->tree, mem_ctx, &io);
 684         CHECK_STATUS(status, NT_STATUS_OK);
 685         fnum = io.ntcreatex.out.file.fnum;
 686
 687         printf("get the original sd\n");
 688         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 689         q.query_secdesc.in.file.fnum = fnum;
 690         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 691         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 692         CHECK_STATUS(status, NT_STATUS_OK);
 693         sd_orig = q.query_secdesc.out.sd;
 694
 695         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 696
 697
 698         for (i=0;i<ARRAY_SIZE(dir_mappings);i++) {
 699                 uint32_t expected_mask =
 700                         SEC_STD_WRITE_DAC |
 701                         SEC_STD_READ_CONTROL |
 702                         SEC_FILE_READ_ATTRIBUTE |
 703                         SEC_STD_DELETE;
 704
 705                 printf("testing generic bits 0x%08x\n",
 706                        file_mappings[i].gen_bits);
 707                 sd = security_descriptor_create(mem_ctx,
 708                                                 NULL, NULL,
 709                                                 owner_sid,
 710                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
 711                                                 dir_mappings[i].gen_bits,
 712                                                 0,
 713                                                 NULL);
 714
 715                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 716                 set.set_secdesc.in.file.fnum = fnum;
 717                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 718                 set.set_secdesc.in.sd = sd;
 719
 720                 status = smb_raw_setfileinfo(cli->tree, &set);
 721                 CHECK_STATUS(status, NT_STATUS_OK);
 722
 723                 sd2 = security_descriptor_create(mem_ctx,
 724                                                  owner_sid, NULL,
 725                                                  owner_sid,
 726                                                  SEC_ACE_TYPE_ACCESS_ALLOWED,
 727                                                  dir_mappings[i].specific_bits,
 728                                                  0,
 729                                                  NULL);
 730
 731                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 732                 CHECK_STATUS(status, NT_STATUS_OK);
 733                 if (!security_descriptor_equal(q.query_secdesc.out.sd, sd2)) {
 734                         printf("%s: security descriptors don't match!\n", __location__);
 735                         printf("got:\n");
 736                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
 737                         printf("expected:\n");
 738                         NDR_PRINT_DEBUG(security_descriptor, sd2);
 739                         ret = False;
 740                 }
 741
 742                 io.ntcreatex.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 743                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 744                 CHECK_STATUS(status, NT_STATUS_OK);
 745                 CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum,
 746                                    expected_mask | dir_mappings[i].specific_bits);
 747                 smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 748         }
 749
 750         printf("put back original sd\n");
 751         set.set_secdesc.in.sd = sd_orig;
 752         status = smb_raw_setfileinfo(cli->tree, &set);
 753         CHECK_STATUS(status, NT_STATUS_OK);
 754
 755         smbcli_close(cli->tree, fnum);
 756         smbcli_unlink(cli->tree, fname);
 757
 758 done:
 759         smbcli_close(cli->tree, fnum);
 760         return ret;
 761 }
 762
 763
 764 /*
 765   see what access bits the owner of a file always gets
 766 */
 767 static BOOL test_owner_bits(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 768 {
 769         NTSTATUS status;
 770         union smb_open io;
 771         const char *fname = BASEDIR "\\generic.txt";
 772         BOOL ret = True;
 773         int fnum = -1, i;
 774         union smb_fileinfo q;
 775         union smb_setfileinfo set;
 776         struct security_descriptor *sd, *sd_orig;
 777         const char *owner_sid;
 778         BOOL has_restore_privilege;
 779         BOOL has_take_ownership_privilege;
 780         uint32_t expected_bits;
 781
 782         printf("TESTING FILE OWNER BITS\n");
 783
 784         io.generic.level = RAW_OPEN_NTCREATEX;
 785         io.ntcreatex.in.root_fid = 0;
 786         io.ntcreatex.in.flags = 0;
 787         io.ntcreatex.in.access_mask =
 788                 SEC_STD_READ_CONTROL |
 789                 SEC_STD_WRITE_DAC |
 790                 SEC_STD_WRITE_OWNER;
 791         io.ntcreatex.in.create_options = 0;
 792         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_NORMAL;
 793         io.ntcreatex.in.share_access =
 794                 NTCREATEX_SHARE_ACCESS_READ |
 795                 NTCREATEX_SHARE_ACCESS_WRITE;
 796         io.ntcreatex.in.alloc_size = 0;
 797         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
 798         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
 799         io.ntcreatex.in.security_flags = 0;
 800         io.ntcreatex.in.fname = fname;
 801         status = smb_raw_open(cli->tree, mem_ctx, &io);
 802         CHECK_STATUS(status, NT_STATUS_OK);
 803         fnum = io.ntcreatex.out.file.fnum;
 804
 805         printf("get the original sd\n");
 806         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
 807         q.query_secdesc.in.file.fnum = fnum;
 808         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
 809         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
 810         CHECK_STATUS(status, NT_STATUS_OK);
 811         sd_orig = q.query_secdesc.out.sd;
 812
 813         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
 814
 815         status = smblsa_sid_check_privilege(cli,
 816                                             owner_sid,
 817                                             sec_privilege_name(SEC_PRIV_RESTORE));
 818         has_restore_privilege = NT_STATUS_IS_OK(status);
 819         if (!NT_STATUS_IS_OK(status)) {
 820                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 821         }
 822         printf("SEC_PRIV_RESTORE - %s\n", has_restore_privilege?"Yes":"No");
 823
 824         status = smblsa_sid_check_privilege(cli,
 825                                             owner_sid,
 826                                             sec_privilege_name(SEC_PRIV_TAKE_OWNERSHIP));
 827         has_take_ownership_privilege = NT_STATUS_IS_OK(status);
 828         if (!NT_STATUS_IS_OK(status)) {
 829                 printf("smblsa_sid_check_privilege - %s\n", nt_errstr(status));
 830         }
 831         printf("SEC_PRIV_TAKE_OWNERSHIP - %s\n", has_take_ownership_privilege?"Yes":"No");
 832
 833         sd = security_descriptor_create(mem_ctx,
 834                                         NULL, NULL,
 835                                         owner_sid,
 836                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
 837                                         SEC_FILE_WRITE_DATA,
 838                                         0,
 839                                         NULL);
 840
 841         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
 842         set.set_secdesc.in.file.fnum = fnum;
 843         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
 844         set.set_secdesc.in.sd = sd;
 845
 846         status = smb_raw_setfileinfo(cli->tree, &set);
 847         CHECK_STATUS(status, NT_STATUS_OK);
 848
 849         expected_bits = SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE;
 850
 851         for (i=0;i<16;i++) {
 852                 uint32_t bit = (1<<i);
 853                 io.ntcreatex.in.access_mask = bit;
 854                 status = smb_raw_open(cli->tree, mem_ctx, &io);
 855                 if (expected_bits & bit) {
 856                         if (!NT_STATUS_IS_OK(status)) {
 857                                 printf("failed with access mask 0x%08x of expected 0x%08x\n",
 858                                        bit, expected_bits);
 859                         }
 860                         CHECK_STATUS(status, NT_STATUS_OK);
 861                         CHECK_ACCESS_FLAGS(io.ntcreatex.out.file.fnum, bit | SEC_FILE_READ_ATTRIBUTE);
 862                         smbcli_close(cli->tree, io.ntcreatex.out.file.fnum);
 863                 } else {
 864                         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
 865                 }
 866         }
 867
 868         printf("put back original sd\n");
 869         set.set_secdesc.in.sd = sd_orig;
 870         status = smb_raw_setfileinfo(cli->tree, &set);
 871         CHECK_STATUS(status, NT_STATUS_OK);
 872
 873 done:
 874         smbcli_close(cli->tree, fnum);
 875         smbcli_unlink(cli->tree, fname);
 876         return ret;
 877 }
 878
 879
 880
 881 /*
 882   test the inheritance of ACL flags onto new files and directories
 883 */
 884 static BOOL test_inheritance(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
 885 {
 886         NTSTATUS status;
 887         union smb_open io;
 888         const char *dname = BASEDIR "\\inheritance";
 889         const char *fname1 = BASEDIR "\\inheritance\\testfile";
 890         const char *fname2 = BASEDIR "\\inheritance\\testdir";
 891         BOOL ret = True;
 892         int fnum, fnum2, i;
 893         union smb_fileinfo q;
 894         union smb_setfileinfo set;
 895         struct security_descriptor *sd, *sd_orig, *sd_def;
 896         const char *owner_sid;
 897         const struct dom_sid *creator_owner;
 898         const struct {
 899                 uint32_t parent_flags;
 900                 uint32_t file_flags;
 901                 uint32_t dir_flags;
 902         } test_flags[] = {
 903                 {
 904                         0,
 905                         0,
 906                         0
 907                 },
 908                 {
 909                         SEC_ACE_FLAG_OBJECT_INHERIT,
 910                         0,
 911                         SEC_ACE_FLAG_OBJECT_INHERIT |
 912                         SEC_ACE_FLAG_INHERIT_ONLY,
 913                 },
 914                 {
 915                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 916                         0,
 917                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 918                 },
 919                 {
 920                         SEC_ACE_FLAG_OBJECT_INHERIT |
 921                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 922                         0,
 923                         SEC_ACE_FLAG_OBJECT_INHERIT |
 924                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 925                 },
 926                 {
 927                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
 928                         0,
 929                         0,
 930                 },
 931                 {
 932                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 933                         SEC_ACE_FLAG_OBJECT_INHERIT,
 934                         0,
 935                         0,
 936                 },
 937                 {
 938                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 939                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 940                         0,
 941                         0,
 942                 },
 943                 {
 944                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 945                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 946                         SEC_ACE_FLAG_OBJECT_INHERIT,
 947                         0,
 948                         0,
 949                 },
 950                 {
 951                         SEC_ACE_FLAG_INHERIT_ONLY,
 952                         0,
 953                         0,
 954                 },
 955                 {
 956                         SEC_ACE_FLAG_INHERIT_ONLY |
 957                         SEC_ACE_FLAG_OBJECT_INHERIT,
 958                         0,
 959                         SEC_ACE_FLAG_OBJECT_INHERIT |
 960                         SEC_ACE_FLAG_INHERIT_ONLY,
 961                 },
 962                 {
 963                         SEC_ACE_FLAG_INHERIT_ONLY |
 964                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 965                         0,
 966                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 967                 },
 968                 {
 969                         SEC_ACE_FLAG_INHERIT_ONLY |
 970                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 971                         SEC_ACE_FLAG_OBJECT_INHERIT,
 972                         0,
 973                         SEC_ACE_FLAG_CONTAINER_INHERIT |
 974                         SEC_ACE_FLAG_OBJECT_INHERIT,
 975                 },
 976                 {
 977                         SEC_ACE_FLAG_INHERIT_ONLY |
 978                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT,
 979                         0,
 980                         0,
 981                 },
 982                 {
 983                         SEC_ACE_FLAG_INHERIT_ONLY |
 984                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 985                         SEC_ACE_FLAG_OBJECT_INHERIT,
 986                         0,
 987                         0,
 988                 },
 989                 {
 990                         SEC_ACE_FLAG_INHERIT_ONLY |
 991                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 992                         SEC_ACE_FLAG_CONTAINER_INHERIT,
 993                         0,
 994                         0,
 995                 },
 996                 {
 997                         SEC_ACE_FLAG_INHERIT_ONLY |
 998                         SEC_ACE_FLAG_NO_PROPAGATE_INHERIT |
 999                         SEC_ACE_FLAG_CONTAINER_INHERIT |
1000                         SEC_ACE_FLAG_OBJECT_INHERIT,
1001                         0,
1002                         0,
1003                 }
1004         };
1005
1006         smbcli_rmdir(cli->tree, dname);
1007
1008         printf("TESTING ACL INHERITANCE\n");
1009
1010         io.generic.level = RAW_OPEN_NTCREATEX;
1011         io.ntcreatex.in.root_fid = 0;
1012         io.ntcreatex.in.flags = 0;
1013         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1014         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1015         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
1016         io.ntcreatex.in.share_access = 0;
1017         io.ntcreatex.in.alloc_size = 0;
1018         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1019         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
1020         io.ntcreatex.in.security_flags = 0;
1021         io.ntcreatex.in.fname = dname;
1022
1023         status = smb_raw_open(cli->tree, mem_ctx, &io);
1024         CHECK_STATUS(status, NT_STATUS_OK);
1025         fnum = io.ntcreatex.out.file.fnum;
1026
1027         printf("get the original sd\n");
1028         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
1029         q.query_secdesc.in.file.fnum = fnum;
1030         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1031         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
1032         CHECK_STATUS(status, NT_STATUS_OK);
1033         sd_orig = q.query_secdesc.out.sd;
1034
1035         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
1036
1037         printf("owner_sid is %s\n", owner_sid);
1038
1039         sd_def = security_descriptor_create(mem_ctx,
1040                                             owner_sid, NULL,
1041                                             owner_sid,
1042                                             SEC_ACE_TYPE_ACCESS_ALLOWED,
1043                                             SEC_RIGHTS_FILE_ALL,
1044                                             0,
1045                                             SID_NT_SYSTEM,
1046                                             SEC_ACE_TYPE_ACCESS_ALLOWED,
1047                                             SEC_RIGHTS_FILE_ALL,
1048                                             0,
1049                                             NULL);
1050
1051         creator_owner = dom_sid_parse_talloc(mem_ctx, SID_CREATOR_OWNER);
1052
1053         for (i=0;i<ARRAY_SIZE(test_flags);i++) {
1054                 sd = security_descriptor_create(mem_ctx,
1055                                                 NULL, NULL,
1056                                                 SID_CREATOR_OWNER,
1057                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1058                                                 SEC_FILE_WRITE_DATA,
1059                                                 test_flags[i].parent_flags,
1060                                                 SID_WORLD,
1061                                                 SEC_ACE_TYPE_ACCESS_ALLOWED,
1062                                                 SEC_FILE_ALL | SEC_STD_ALL,
1063                                                 0,
1064                                                 NULL);
1065                 set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1066                 set.set_secdesc.in.file.fnum = fnum;
1067                 set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1068                 set.set_secdesc.in.sd = sd;
1069                 status = smb_raw_setfileinfo(cli->tree, &set);
1070                 CHECK_STATUS(status, NT_STATUS_OK);
1071
1072                 io.ntcreatex.in.fname = fname1;
1073                 io.ntcreatex.in.create_options = 0;
1074                 status = smb_raw_open(cli->tree, mem_ctx, &io);
1075                 CHECK_STATUS(status, NT_STATUS_OK);
1076                 fnum2 = io.ntcreatex.out.file.fnum;
1077
1078                 q.query_secdesc.in.file.fnum = fnum2;
1079                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
1080                 CHECK_STATUS(status, NT_STATUS_OK);
1081
1082                 smbcli_close(cli->tree, fnum2);
1083                 smbcli_unlink(cli->tree, fname1);
1084
1085                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
1086                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def)) {
1087                                 printf("Expected default sd at %d - got:\n", i);
1088                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1089                         }
1090                         goto check_dir;
1091                 }
1092
1093                 if (q.query_secdesc.out.sd->dacl == NULL ||
1094                     q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1095                     q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1096                     !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1097                                    sd_orig->owner_sid)) {
1098                         printf("Bad sd in child file at %d\n", i);
1099                         NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1100                         ret = False;
1101                         goto check_dir;
1102                 }
1103
1104                 if (q.query_secdesc.out.sd->dacl->aces[0].flags !=
1105                     test_flags[i].file_flags) {
1106                         printf("incorrect file_flags 0x%x - expected 0x%x for parent 0x%x with (i=%d)\n",
1107                                q.query_secdesc.out.sd->dacl->aces[0].flags,
1108                                test_flags[i].file_flags,
1109                                test_flags[i].parent_flags,
1110                                i);
1111                         ret = False;
1112                 }
1113
1114         check_dir:
1115                 io.ntcreatex.in.fname = fname2;
1116                 io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1117                 status = smb_raw_open(cli->tree, mem_ctx, &io);
1118                 CHECK_STATUS(status, NT_STATUS_OK);
1119                 fnum2 = io.ntcreatex.out.file.fnum;
1120
1121                 q.query_secdesc.in.file.fnum = fnum2;
1122                 status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
1123                 CHECK_STATUS(status, NT_STATUS_OK);
1124
1125                 smbcli_close(cli->tree, fnum2);
1126                 smbcli_rmdir(cli->tree, fname2);
1127
1128                 if (!(test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) &&
1129                     (!(test_flags[i].parent_flags & SEC_ACE_FLAG_OBJECT_INHERIT) ||
1130                      (test_flags[i].parent_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT))) {
1131                         if (!security_descriptor_equal(q.query_secdesc.out.sd, sd_def)) {
1132                                 printf("Expected default sd for dir at %d - got:\n", i);
1133                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1134                         }
1135                         continue;
1136                 }
1137
1138                 if ((test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) &&
1139                     (test_flags[i].parent_flags & SEC_ACE_FLAG_NO_PROPAGATE_INHERIT)) {
1140                         if (q.query_secdesc.out.sd->dacl == NULL ||
1141                             q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1142                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1143                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1144                                            sd_orig->owner_sid) ||
1145                             q.query_secdesc.out.sd->dacl->aces[0].flags != test_flags[i].dir_flags) {
1146                                 printf("Bad sd in child dir at %d (parent 0x%x)\n",
1147                                        i, test_flags[i].parent_flags);
1148                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1149                                 ret = False;
1150                                 continue;
1151                         }
1152                 } else if (test_flags[i].parent_flags & SEC_ACE_FLAG_CONTAINER_INHERIT) {
1153                         if (q.query_secdesc.out.sd->dacl == NULL ||
1154                             q.query_secdesc.out.sd->dacl->num_aces != 2 ||
1155                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1156                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1157                                            sd_orig->owner_sid) ||
1158                             q.query_secdesc.out.sd->dacl->aces[1].access_mask != SEC_FILE_WRITE_DATA ||
1159                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[1].trustee,
1160                                            creator_owner) ||
1161                             q.query_secdesc.out.sd->dacl->aces[0].flags != 0 ||
1162                             q.query_secdesc.out.sd->dacl->aces[1].flags !=
1163                             (test_flags[i].dir_flags | SEC_ACE_FLAG_INHERIT_ONLY)) {
1164                                 printf("Bad sd in child dir at %d (parent 0x%x)\n",
1165                                        i, test_flags[i].parent_flags);
1166                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1167                                 ret = False;
1168                                 continue;
1169                         }
1170                 } else {
1171                         if (q.query_secdesc.out.sd->dacl == NULL ||
1172                             q.query_secdesc.out.sd->dacl->num_aces != 1 ||
1173                             q.query_secdesc.out.sd->dacl->aces[0].access_mask != SEC_FILE_WRITE_DATA ||
1174                             !dom_sid_equal(&q.query_secdesc.out.sd->dacl->aces[0].trustee,
1175                                            creator_owner) ||
1176                             q.query_secdesc.out.sd->dacl->aces[0].flags != test_flags[i].dir_flags) {
1177                                 printf("Bad sd in child dir at %d (parent 0x%x)\n",
1178                                        i, test_flags[i].parent_flags);
1179                                 NDR_PRINT_DEBUG(security_descriptor, q.query_secdesc.out.sd);
1180                                 ret = False;
1181                                 continue;
1182                         }
1183                 }
1184         }
1185
1186         printf("testing access checks on inherited create with %s\n", fname1);
1187         sd = security_descriptor_create(mem_ctx,
1188                                         NULL, NULL,
1189                                         owner_sid,
1190                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1191                                         SEC_FILE_WRITE_DATA | SEC_STD_WRITE_DAC,
1192                                         SEC_ACE_FLAG_OBJECT_INHERIT,
1193                                         SID_WORLD,
1194                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1195                                         SEC_FILE_ALL | SEC_STD_ALL,
1196                                         0,
1197                                         NULL);
1198         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1199         set.set_secdesc.in.file.fnum = fnum;
1200         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1201         set.set_secdesc.in.sd = sd;
1202         status = smb_raw_setfileinfo(cli->tree, &set);
1203         CHECK_STATUS(status, NT_STATUS_OK);
1204
1205         io.ntcreatex.in.fname = fname1;
1206         io.ntcreatex.in.create_options = 0;
1207         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1208         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1209         status = smb_raw_open(cli->tree, mem_ctx, &io);
1210         CHECK_STATUS(status, NT_STATUS_OK);
1211         fnum2 = io.ntcreatex.out.file.fnum;
1212         CHECK_ACCESS_FLAGS(fnum2, SEC_RIGHTS_FILE_ALL);
1213
1214         q.query_secdesc.in.file.fnum = fnum2;
1215         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1216         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
1217         CHECK_STATUS(status, NT_STATUS_OK);
1218         smbcli_close(cli->tree, fnum2);
1219
1220         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1221         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1222         status = smb_raw_open(cli->tree, mem_ctx, &io);
1223         if (NT_STATUS_IS_OK(status)) {
1224                 printf("failed: w2k3 ACL bug (allowed open when ACL should deny)\n");
1225                 ret = False;
1226                 fnum2 = io.ntcreatex.out.file.fnum;
1227                 smbcli_close(cli->tree, fnum2);
1228         } else {
1229                 CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1230         }
1231
1232         printf("trying without execute\n");
1233         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1234         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL & ~SEC_FILE_EXECUTE;
1235         status = smb_raw_open(cli->tree, mem_ctx, &io);
1236         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1237
1238         printf("and with full permissions again\n");
1239         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1240         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1241         status = smb_raw_open(cli->tree, mem_ctx, &io);
1242         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1243
1244         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1245         status = smb_raw_open(cli->tree, mem_ctx, &io);
1246         CHECK_STATUS(status, NT_STATUS_OK);
1247         fnum2 = io.ntcreatex.out.file.fnum;
1248         CHECK_ACCESS_FLAGS(fnum2, SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE);
1249         smbcli_close(cli->tree, fnum2);
1250
1251         printf("put back original sd\n");
1252         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1253         set.set_secdesc.in.file.fnum = fnum;
1254         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1255         set.set_secdesc.in.sd = sd_orig;
1256         status = smb_raw_setfileinfo(cli->tree, &set);
1257         CHECK_STATUS(status, NT_STATUS_OK);
1258
1259         smbcli_close(cli->tree, fnum);
1260
1261         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1262         status = smb_raw_open(cli->tree, mem_ctx, &io);
1263         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1264
1265         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1266         status = smb_raw_open(cli->tree, mem_ctx, &io);
1267         CHECK_STATUS(status, NT_STATUS_OK);
1268         fnum2 = io.ntcreatex.out.file.fnum;
1269         CHECK_ACCESS_FLAGS(fnum2, SEC_FILE_WRITE_DATA | SEC_FILE_READ_ATTRIBUTE);
1270         smbcli_close(cli->tree, fnum2);
1271
1272         smbcli_unlink(cli->tree, fname1);
1273         smbcli_rmdir(cli->tree, dname);
1274
1275 done:
1276         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1277         set.set_secdesc.in.file.fnum = fnum;
1278         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1279         set.set_secdesc.in.sd = sd_orig;
1280         status = smb_raw_setfileinfo(cli->tree, &set);
1281
1282         smbcli_close(cli->tree, fnum);
1283         return ret;
1284 }
1285
1286
1287 /*
1288   test dynamic acl inheritance
1289 */
1290 static BOOL test_inheritance_dynamic(struct smbcli_state *cli, TALLOC_CTX *mem_ctx)
1291 {
1292         NTSTATUS status;
1293         union smb_open io;
1294         const char *dname = BASEDIR "\\inheritance";
1295         const char *fname1 = BASEDIR "\\inheritance\\testfile";
1296         BOOL ret = True;
1297         int fnum, fnum2;
1298         union smb_fileinfo q;
1299         union smb_setfileinfo set;
1300         struct security_descriptor *sd, *sd_orig;
1301         const char *owner_sid;
1302
1303         printf("TESTING DYNAMIC ACL INHERITANCE\n");
1304
1305         if (!torture_setup_dir(cli, BASEDIR)) {
1306                 return False;
1307         }
1308
1309         io.generic.level = RAW_OPEN_NTCREATEX;
1310         io.ntcreatex.in.root_fid = 0;
1311         io.ntcreatex.in.flags = 0;
1312         io.ntcreatex.in.access_mask = SEC_RIGHTS_FILE_ALL;
1313         io.ntcreatex.in.create_options = NTCREATEX_OPTIONS_DIRECTORY;
1314         io.ntcreatex.in.file_attr = FILE_ATTRIBUTE_DIRECTORY;
1315         io.ntcreatex.in.share_access = 0;
1316         io.ntcreatex.in.alloc_size = 0;
1317         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1318         io.ntcreatex.in.impersonation = NTCREATEX_IMPERSONATION_ANONYMOUS;
1319         io.ntcreatex.in.security_flags = 0;
1320         io.ntcreatex.in.fname = dname;
1321
1322         status = smb_raw_open(cli->tree, mem_ctx, &io);
1323         CHECK_STATUS(status, NT_STATUS_OK);
1324         fnum = io.ntcreatex.out.file.fnum;
1325
1326         printf("get the original sd\n");
1327         q.query_secdesc.level = RAW_FILEINFO_SEC_DESC;
1328         q.query_secdesc.in.file.fnum = fnum;
1329         q.query_secdesc.in.secinfo_flags = SECINFO_DACL | SECINFO_OWNER;
1330         status = smb_raw_fileinfo(cli->tree, mem_ctx, &q);
1331         CHECK_STATUS(status, NT_STATUS_OK);
1332         sd_orig = q.query_secdesc.out.sd;
1333
1334         owner_sid = dom_sid_string(mem_ctx, sd_orig->owner_sid);
1335
1336         printf("owner_sid is %s\n", owner_sid);
1337
1338         sd = security_descriptor_create(mem_ctx,
1339                                         NULL, NULL,
1340                                         owner_sid,
1341                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1342                                         SEC_FILE_WRITE_DATA | SEC_STD_DELETE | SEC_FILE_READ_ATTRIBUTE,
1343                                         SEC_ACE_FLAG_OBJECT_INHERIT,
1344                                         NULL);
1345         sd->type |= SEC_DESC_DACL_AUTO_INHERITED | SEC_DESC_DACL_AUTO_INHERIT_REQ;
1346
1347         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1348         set.set_secdesc.in.file.fnum = fnum;
1349         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1350         set.set_secdesc.in.sd = sd;
1351         status = smb_raw_setfileinfo(cli->tree, &set);
1352         CHECK_STATUS(status, NT_STATUS_OK);
1353
1354         printf("create a file with an inherited acl\n");
1355         io.ntcreatex.in.fname = fname1;
1356         io.ntcreatex.in.create_options = 0;
1357         io.ntcreatex.in.access_mask = SEC_FILE_READ_ATTRIBUTE;
1358         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_CREATE;
1359         status = smb_raw_open(cli->tree, mem_ctx, &io);
1360         CHECK_STATUS(status, NT_STATUS_OK);
1361         fnum2 = io.ntcreatex.out.file.fnum;
1362         smbcli_close(cli->tree, fnum2);
1363
1364         printf("try and access file with base rights - should be OK\n");
1365         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1366         io.ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
1367         status = smb_raw_open(cli->tree, mem_ctx, &io);
1368         CHECK_STATUS(status, NT_STATUS_OK);
1369         fnum2 = io.ntcreatex.out.file.fnum;
1370         smbcli_close(cli->tree, fnum2);
1371
1372         printf("try and access file with extra rights - should be denied\n");
1373         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA | SEC_FILE_EXECUTE;
1374         status = smb_raw_open(cli->tree, mem_ctx, &io);
1375         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1376
1377         printf("update parent sd\n");
1378         sd = security_descriptor_create(mem_ctx,
1379                                         NULL, NULL,
1380                                         owner_sid,
1381                                         SEC_ACE_TYPE_ACCESS_ALLOWED,
1382                                         SEC_FILE_WRITE_DATA | SEC_STD_DELETE | SEC_FILE_READ_ATTRIBUTE | SEC_FILE_EXECUTE,
1383                                         SEC_ACE_FLAG_OBJECT_INHERIT,
1384                                         NULL);
1385         sd->type |= SEC_DESC_DACL_AUTO_INHERITED | SEC_DESC_DACL_AUTO_INHERIT_REQ;
1386
1387         set.set_secdesc.in.sd = sd;
1388         status = smb_raw_setfileinfo(cli->tree, &set);
1389         CHECK_STATUS(status, NT_STATUS_OK);
1390
1391         printf("try and access file with base rights - should be OK\n");
1392         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA;
1393         status = smb_raw_open(cli->tree, mem_ctx, &io);
1394         CHECK_STATUS(status, NT_STATUS_OK);
1395         fnum2 = io.ntcreatex.out.file.fnum;
1396         smbcli_close(cli->tree, fnum2);
1397
1398
1399         printf("try and access now - should be OK if dynamic inheritance works\n");
1400         io.ntcreatex.in.access_mask = SEC_FILE_WRITE_DATA | SEC_FILE_EXECUTE;
1401         status = smb_raw_open(cli->tree, mem_ctx, &io);
1402         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
1403                 printf("Server does not have dynamic inheritance\n");
1404         }
1405         if (NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
1406                 printf("Server does have dynamic inheritance\n");
1407         }
1408         CHECK_STATUS(status, NT_STATUS_ACCESS_DENIED);
1409
1410         smbcli_unlink(cli->tree, fname1);
1411
1412 done:
1413         printf("put back original sd\n");
1414         set.set_secdesc.level = RAW_SFILEINFO_SEC_DESC;
1415         set.set_secdesc.in.file.fnum = fnum;
1416         set.set_secdesc.in.secinfo_flags = SECINFO_DACL;
1417         set.set_secdesc.in.sd = sd_orig;
1418         status = smb_raw_setfileinfo(cli->tree, &set);
1419
1420         smbcli_close(cli->tree, fnum);
1421         smbcli_rmdir(cli->tree, dname);
1422
1423         return ret;
1424 }
1425
1426
1427 /*
1428    basic testing of security descriptor calls
1429 */
1430 BOOL torture_raw_acls(struct torture_context *torture)
1431 {
1432         struct smbcli_state *cli;
1433         BOOL ret = True;
1434         TALLOC_CTX *mem_ctx;
1435
1436         if (!torture_open_connection(&cli)) {
1437                 return False;
1438         }
1439
1440         mem_ctx = talloc_init("torture_raw_acls");
1441
1442         if (!torture_setup_dir(cli, BASEDIR)) {
1443                 return False;
1444         }
1445
1446         ret &= test_sd(cli, mem_ctx);
1447         ret &= test_nttrans_create(cli, mem_ctx);
1448         ret &= test_creator_sid(cli, mem_ctx);
1449         ret &= test_generic_bits(cli, mem_ctx);
1450         ret &= test_owner_bits(cli, mem_ctx);
1451         ret &= test_inheritance(cli, mem_ctx);
1452         ret &= test_inheritance_dynamic(cli, mem_ctx);
1453
1454         smb_raw_exit(cli->session);
1455         smbcli_deltree(cli->tree, BASEDIR);
1456
1457         torture_close_connection(cli);
1458         talloc_free(mem_ctx);
1459         return ret;
1460 }