smbtorture: add additional checks to smb2.maximum_allowed.read_only_file

Prooves that:

- the "MxAC" context response actually ignores FILE_ATTRIBUTE_READONLY,

- actuall effective access rights honor FILE_ATTRIBUTE_READONLY (using
  RAW_FILEINFO_ACCESS_INFORMATION getinfo level),

- attempting to write to a file with FILE_ATTRIBUTE_READONLY fails.

Test passed against Windows, fails against both s3 and s4 servers. Skipping the
ad_dc_ntvfs test in the future, I'm not going to fix that.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16030

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/selftest/knownfail.d/smb2.maximum_allowed b/selftest/knownfail.d/smb2.maximum_allowed
new file mode 100644 (file)
index 0000000..7e29a84
--- /dev/null
+++ b/selftest/knownfail.d/smb2.maximum_allowed
@@ -0,0 +1 @@
+^samba3.smb2.maximum_allowed.read_only_file\(.*\)

diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index d98a42d3b6126593a8b67954b06d9e6983ef9a15..d82da700e6f33e934f98496cc6f506c24d63d8d1 100755 (executable)
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -429,6 +429,7 @@ smb2_s3only = [
     "smb2.ea",
     "smb2.create_no_streams",
     "smb2.streams",
+    "smb2.maximum_allowed",
 ]
 smb2 = [x for x in smbtorture4_testsuites("smb2.") if x not in smb2_s3only]
 

diff --git a/source4/torture/smb2/max_allowed.c b/source4/torture/smb2/max_allowed.c
index bc4b75527fc4f1843e795205e94764b9dc01271e..4f1a1ca3a4028571345d0c699a99b785f1c6e3d5 100644 (file)
--- a/source4/torture/smb2/max_allowed.c
+++ b/source4/torture/smb2/max_allowed.c
@@ -228,6 +228,7 @@ static bool torture_smb2_read_only_file(struct torture_context *tctx,
 {
        struct smb2_create c;
        struct smb2_handle h = {{0}};
+       union smb_fileinfo getinfo;
        bool ret = true;
        NTSTATUS status;
 
@@ -252,6 +253,7 @@ static bool torture_smb2_read_only_file(struct torture_context *tctx,
                .in.file_attributes = FILE_ATTRIBUTE_READONLY,
                .in.create_disposition = NTCREATEX_DISP_OPEN,
                .in.fname = MAXIMUM_ALLOWED_FILE,
+               .in.query_maximal_access = true,
        };
 
        status = smb2_create(tree, tctx, &c);
@@ -259,6 +261,53 @@ static bool torture_smb2_read_only_file(struct torture_context *tctx,
                tctx, status, ret, done,
                "Failed to open READ-ONLY file with SEC_FLAG_MAXIMUM_ALLOWED\n");
        h = c.out.file.handle;
+
+       /*
+        * Verify maximum access from create context
+        */
+
+       torture_assert_u32_equal_goto(tctx,
+                                     c.out.maximal_access,
+                                     SEC_RIGHTS_FILE_ALL,
+                                     ret, done,
+                                     "Wrong maxaccess\n");
+
+       /*
+        * Verify actual access mask from infolevel
+        */
+
+       ZERO_STRUCT(getinfo);
+       getinfo.generic.level = RAW_FILEINFO_ACCESS_INFORMATION;
+       getinfo.generic.in.file.handle = h;
+
+       status = smb2_getinfo_file(tree, tree, &getinfo);
+       torture_assert_ntstatus_ok_goto(tctx, status, ret, done,
+                                       "smb2_getinfo_file\n");
+
+       torture_assert_u32_equal_goto(
+               tctx,
+               getinfo.access_information.out.access_flags,
+               /*
+                * Use exactly the bits from MS-FSA 2.1.5.1.2.1 "Algorithm to
+                * Check Access to an Existing File" and note that
+                * SEC_FILE_APPEND_DATA = SEC_DIR_ADD_SUBDIR
+                */
+               SEC_RIGHTS_FILE_ALL & ~(
+                       SEC_FILE_WRITE_DATA |
+                       SEC_FILE_APPEND_DATA |
+                       SEC_DIR_ADD_SUBDIR |
+                       SEC_DIR_DELETE_CHILD
+               ),
+               ret, done,
+               "Bad access mask\n");
+
+       status = smb2_util_write(tree, h, "foo", 0, 3);
+       torture_assert_ntstatus_equal_goto(tctx,
+                                          status,
+                                          NT_STATUS_ACCESS_DENIED,
+                                          ret, done,
+                                          "smb2_getinfo_file\n");
+
        smb2_util_close(tree, h);
        ZERO_STRUCT(h);