← Back to branch summary

~zulcss/samba/server-dailies-3.4

« back to all changes in this revision

Viewing changes to testsuite/smbd/se_access_check_printer.c

  • Committer: Chuck Short
  • Date: 2010-09-28 20:38:39 UTC
  • Revision ID: zulcss@ubuntu.com-20100928203839-pgjulytsi9ue63x1
Initial version

Show diffs side-by-side

added added

removed removed

Lines of Context:
testsuite/smbd/se_access_check_printer.c
 
1
/* 
 
2
   Unix SMB/Netbios implementation.
 
3
   Version 1.9.
 
4
   Security context tests
 
5
   Copyright (C) Tim Potter 2000
 
6
   
 
7
   This program is free software; you can redistribute it and/or modify
 
8
   it under the terms of the GNU General Public License as published by
 
9
   the Free Software Foundation; either version 3 of the License, or
 
10
   (at your option) any later version.
 
11
   
 
12
   This program is distributed in the hope that it will be useful,
 
13
   but WITHOUT ANY WARRANTY; without even the implied warranty of
 
14
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
15
   GNU General Public License for more details.
 
16
   
 
17
   You should have received a copy of the GNU General Public License
 
18
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
19
*/
 
20
 
 
21
#include "includes.h"
 
22
#include "se_access_check_utils.h"
 
23
 
 
24
/* Globals */
 
25
 
 
26
BOOL failed;
 
27
SEC_DESC *sd;
 
28
 
 
29
struct ace_entry acl_printer[] = {
 
30
 
 
31
        /* Everyone is allowed to print */
 
32
 
 
33
        { SEC_ACE_TYPE_ACCESS_ALLOWED, SEC_ACE_FLAG_CONTAINER_INHERIT,
 
34
          PRINTER_ACE_PRINT, "S-1-1-0" },
 
35
 
 
36
        /* Except for user0 who uses too much paper */
 
37
 
 
38
        { SEC_ACE_TYPE_ACCESS_DENIED, SEC_ACE_FLAG_CONTAINER_INHERIT,
 
39
          PRINTER_ACE_FULL_CONTROL, "user0" },
 
40
 
 
41
        /* Users 1 and 2 can manage documents */
 
42
 
 
43
        { SEC_ACE_TYPE_ACCESS_ALLOWED, SEC_ACE_FLAG_CONTAINER_INHERIT,
 
44
          PRINTER_ACE_MANAGE_DOCUMENTS, "user1" },
 
45
 
 
46
        { SEC_ACE_TYPE_ACCESS_ALLOWED, SEC_ACE_FLAG_CONTAINER_INHERIT,
 
47
          PRINTER_ACE_MANAGE_DOCUMENTS, "user2" },
 
48
 
 
49
        /* Domain Admins can also manage documents */
 
50
 
 
51
        { SEC_ACE_TYPE_ACCESS_ALLOWED, SEC_ACE_FLAG_CONTAINER_INHERIT,
 
52
          PRINTER_ACE_MANAGE_DOCUMENTS, "Domain Admins" },
 
53
 
 
54
        /* User 3 is da man */
 
55
 
 
56
        { SEC_ACE_TYPE_ACCESS_ALLOWED, SEC_ACE_FLAG_CONTAINER_INHERIT,
 
57
          PRINTER_ACE_FULL_CONTROL, "user3" },
 
58
 
 
59
        { 0, 0, 0, NULL}
 
60
};
 
61
 
 
62
BOOL test_user(char *username, uint32 acc_desired, uint32 *acc_granted)
 
63
{
 
64
        struct passwd *pw;
 
65
        uint32 status;
 
66
 
 
67
        if (!(pw = getpwnam(username))) {
 
68
                printf("FAIL: could not lookup user info for %s\n",
 
69
                       username);
 
70
                exit(1);
 
71
        }
 
72
 
 
73
        return se_access_check(sd, pw->pw_uid, pw->pw_gid, 0, NULL,
 
74
                               acc_desired, acc_granted, &status);
 
75
}
 
76
 
 
77
static char *pace_str(uint32 ace_flags)
 
78
{
 
79
        if ((ace_flags & PRINTER_ACE_FULL_CONTROL) == 
 
80
            PRINTER_ACE_FULL_CONTROL) return "full control";
 
81
 
 
82
        if ((ace_flags & PRINTER_ACE_MANAGE_DOCUMENTS) ==
 
83
            PRINTER_ACE_MANAGE_DOCUMENTS) return "manage documents";
 
84
 
 
85
        if ((ace_flags & PRINTER_ACE_PRINT) == PRINTER_ACE_PRINT)
 
86
                return "print";
 
87
 
 
88
        return "UNKNOWN";
 
89
}
 
90
 
 
91
uint32 perms[] = {
 
92
        PRINTER_ACE_PRINT,
 
93
        PRINTER_ACE_FULL_CONTROL,
 
94
        PRINTER_ACE_MANAGE_DOCUMENTS,
 
95
        0
 
96
};
 
97
 
 
98
void runtest(void)
 
99
{
 
100
        uint32 acc_granted;
 
101
        BOOL result;
 
102
        int i, j;
 
103
 
 
104
        for (i = 0; perms[i]; i++) {
 
105
 
 
106
                /* Test 10 users */
 
107
                
 
108
                for (j = 0; j < 10; j++) {
 
109
                        fstring name;
 
110
 
 
111
                        /* Test user against ACL */
 
112
 
 
113
                        snprintf(name, sizeof(fstring), "%s/user%d", 
 
114
                                 getenv("TEST_WORKGROUP"), j);
 
115
                        
 
116
                        result = test_user(name, perms[i], &acc_granted);
 
117
 
 
118
                        printf("%s: %s %s 0x%08x\n", name, 
 
119
                               pace_str(perms[i]), 
 
120
                               result ? "TRUE " : "FALSE", acc_granted);
 
121
 
 
122
                        /* Check results */
 
123
 
 
124
                        switch (perms[i]) {
 
125
 
 
126
                        case PRINTER_ACE_PRINT: {
 
127
                                if (!result || acc_granted !=
 
128
                                    PRINTER_ACE_PRINT) {
 
129
                                        printf("FAIL: user %s can't print\n",
 
130
                                               name);
 
131
                                        failed = True;
 
132
                                }
 
133
                                break;
 
134
                        }
 
135
 
 
136
                        case PRINTER_ACE_FULL_CONTROL: {
 
137
                                if (j == 3) {
 
138
                                        if (!result || acc_granted !=
 
139
                                            PRINTER_ACE_FULL_CONTROL) {
 
140
                                                printf("FAIL: user %s doesn't "
 
141
                                                       "have full control\n",
 
142
                                                       name);
 
143
                                                failed = True;
 
144
                                        }
 
145
                                } else {
 
146
                                        if (result || acc_granted != 0) {
 
147
                                                printf("FAIL: user %s has full "
 
148
                                                       "control\n", name);
 
149
                                                failed = True;
 
150
                                        }
 
151
                                }
 
152
                                break;
 
153
                        }
 
154
                        case PRINTER_ACE_MANAGE_DOCUMENTS: {
 
155
                                if (j == 1 || j == 2) {
 
156
                                        if (!result || acc_granted !=
 
157
                                            PRINTER_ACE_MANAGE_DOCUMENTS) {
 
158
                                                printf("FAIL: user %s can't "
 
159
                                                       "manage documents\n",
 
160
                                                       name);
 
161
                                                failed = True;
 
162
                                        }
 
163
                                } else {
 
164
                                        if (result || acc_granted != 0) {
 
165
                                                printf("FAIL: user %s can "
 
166
                                                       "manage documents\n",
 
167
                                                       name);
 
168
                                                failed = True;
 
169
                                        }
 
170
                                }
 
171
                                break;
 
172
                        }
 
173
 
 
174
                        default:
 
175
                                printf("FAIL: internal error\n");
 
176
                                exit(1);
 
177
                        }
 
178
                }
 
179
        }
 
180
}
 
181
 
 
182
/* Main function */
 
183
 
 
184
int main(int argc, char **argv)
 
185
{
 
186
        /* Initialisation */
 
187
 
 
188
        generate_wellknown_sids();
 
189
 
 
190
        /* Create security descriptor */
 
191
 
 
192
        sd = build_sec_desc(acl_printer, NULL, NULL_SID, NULL_SID);
 
193
 
 
194
        if (!sd) {
 
195
                printf("FAIL: could not build security descriptor\n");
 
196
                return 1;
 
197
        }
 
198
 
 
199
        /* Run test */
 
200
 
 
201
        runtest();
 
202
 
 
203
        /* Return */
 
204
 
 
205
        if (!failed) {
 
206
                printf("PASS\n");
 
207
                return 0;
 
208
        } 
 
209
 
 
210
        return 1;
 
211
}