xpcom/tests/windows/TestNTFSPermissions.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
   2 /* ***** BEGIN LICENSE BLOCK *****
   3  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   4  *
   5  * The contents of this file are subject to the Mozilla Public License Version
   6  * 1.1 (the "License"); you may not use this file except in compliance with
   7  * the License. You may obtain a copy of the License at
   8  * http://www.mozilla.org/MPL/
   9  *
  10  * Software distributed under the License is distributed on an "AS IS" basis,
  11  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  12  * for the specific language governing rights and limitations under the
  13  * License.
  14  *
  15  * The Original Code is mozilla.org code.
  16  *
  17  * The Initial Developer of the Original Code is
  18  * Aaron Nowack <anowack@mimiru.net>.
  19  * Portions created by the Initial Developer are Copyright (C) 2008
  20  * the Initial Developer. All Rights Reserved.
  21  *
  22  * Contributor(s):
  23  *
  24  * Alternatively, the contents of this file may be used under the terms of
  25  * either of the GNU General Public License Version 2 or later (the "GPL"),
  26  * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  27  * in which case the provisions of the GPL or the LGPL are applicable instead
  28  * of those above. If you wish to allow use of your version of this file only
  29  * under the terms of either the GPL or the LGPL, and not to allow others to
  30  * use your version of this file under the terms of the MPL, indicate your
  31  * decision by deleting the provisions above and replace them with the notice
  32  * and other provisions required by the GPL or the LGPL. If you do not delete
  33  * the provisions above, a recipient may use your version of this file under
  34  * the terms of any one of the MPL, the GPL or the LGPL.
  35  *
  36  * ***** END LICENSE BLOCK ***** */
  37
  38 /*
  39  * Test for NTFS File Permissions being correctly changed to match the new
  40  * directory upon moving a file.  (Bug 224692.)
  41  */
  42
  43 #include "../TestHarness.h"
  44 #include "nsEmbedString.h"
  45 #include "nsILocalFile.h"
  46 #include <windows.h>
  47 #include <aclapi.h>
  48
  49 #define BUFFSIZE 512
  50
  51
  52
  53 nsresult TestPermissions()
  54 {
  55
  56     nsresult rv; // Return value
  57
  58     // File variables
  59     HANDLE tempFileHandle;
  60     nsCOMPtr<nsILocalFile> tempFile;
  61     nsCOMPtr<nsILocalFile> tempDirectory1;
  62     nsCOMPtr<nsILocalFile> tempDirectory2;
  63     WCHAR filePath[MAX_PATH];
  64     WCHAR dir1Path[MAX_PATH];
  65     WCHAR dir2Path[MAX_PATH];
  66
  67     // Security variables
  68     DWORD result;
  69     PSID everyoneSID = NULL, adminSID = NULL;
  70     PACL dirACL = NULL, fileACL = NULL;
  71     PSECURITY_DESCRIPTOR dirSD = NULL, fileSD = NULL;
  72     EXPLICIT_ACCESS ea[2];
  73     SID_IDENTIFIER_AUTHORITY SIDAuthWorld =
  74             SECURITY_WORLD_SID_AUTHORITY;
  75     SID_IDENTIFIER_AUTHORITY SIDAuthNT = SECURITY_NT_AUTHORITY;
  76     SECURITY_ATTRIBUTES sa;
  77     TRUSTEE everyoneTrustee;
  78     ACCESS_MASK everyoneRights;
  79
  80     // Create a well-known SID for the Everyone group.
  81     if(!AllocateAndInitializeSid(&SIDAuthWorld, 1,
  82                      SECURITY_WORLD_RID,
  83                      0, 0, 0, 0, 0, 0, 0,
  84                      &everyoneSID))
  85     {
  86         fail("NTFS Permissions: AllocateAndInitializeSid Error");
  87         return NS_ERROR_FAILURE;
  88     }
  89
  90     // Create a SID for the Administrators group.
  91     if(! AllocateAndInitializeSid(&SIDAuthNT, 2,
  92                      SECURITY_BUILTIN_DOMAIN_RID,
  93                      DOMAIN_ALIAS_RID_ADMINS,
  94                      0, 0, 0, 0, 0, 0,
  95                      &adminSID))
  96     {
  97         fail("NTFS Permissions: AllocateAndInitializeSid Error");
  98         return NS_ERROR_FAILURE;
  99     }
 100
 101     // Initialize an EXPLICIT_ACCESS structure for an ACE.
 102     // The ACE will allow Everyone read access to the directory.
 103     ZeroMemory(&ea, 2 * sizeof(EXPLICIT_ACCESS));
 104     ea[0].grfAccessPermissions = GENERIC_READ;
 105     ea[0].grfAccessMode = SET_ACCESS;
 106     ea[0].grfInheritance= SUB_CONTAINERS_AND_OBJECTS_INHERIT;
 107     ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
 108     ea[0].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
 109     ea[0].Trustee.ptstrName  = (LPTSTR) everyoneSID;
 110
 111     // Initialize an EXPLICIT_ACCESS structure for an ACE.
 112     // The ACE will allow the Administrators group full access
 113     ea[1].grfAccessPermissions = GENERIC_ALL | STANDARD_RIGHTS_ALL;
 114     ea[1].grfAccessMode = SET_ACCESS;
 115     ea[1].grfInheritance= SUB_CONTAINERS_AND_OBJECTS_INHERIT;
 116     ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;
 117     ea[1].Trustee.TrusteeType = TRUSTEE_IS_GROUP;
 118     ea[1].Trustee.ptstrName  = (LPTSTR) adminSID;
 119
 120     // Create a new ACL that contains the new ACEs.
 121     result = SetEntriesInAcl(2, ea, NULL, &dirACL);
 122     if (ERROR_SUCCESS != result)
 123     {
 124         fail("NTFS Permissions: SetEntriesInAcl Error");
 125         return NS_ERROR_FAILURE;
 126     }
 127
 128     // Initialize a security descriptor.
 129     dirSD = (PSECURITY_DESCRIPTOR) LocalAlloc(LPTR,
 130                              SECURITY_DESCRIPTOR_MIN_LENGTH);
 131     if (NULL == dirSD)
 132     {
 133         fail("NTFS Permissions: LocalAlloc Error");
 134         return NS_ERROR_FAILURE;
 135     }
 136
 137     if (!InitializeSecurityDescriptor(dirSD,
 138             SECURITY_DESCRIPTOR_REVISION))
 139     {
 140         fail("NTFS Permissions: InitializeSecurityDescriptor Error");
 141         return NS_ERROR_FAILURE;
 142     }
 143
 144     // Add the ACL to the security descriptor.
 145     if (!SetSecurityDescriptorDacl(dirSD, PR_TRUE, dirACL, PR_FALSE))
 146     {
 147         fail("NTFS Permissions: SetSecurityDescriptorDacl Error");
 148         return NS_ERROR_FAILURE;
 149     }
 150
 151     // Initialize a security attributes structure.
 152     sa.nLength = sizeof (SECURITY_ATTRIBUTES);
 153     sa.lpSecurityDescriptor = dirSD;
 154     sa.bInheritHandle = PR_FALSE;
 155
 156     // Create and open first temporary directory
 157     if(!CreateDirectoryW(L".\\NTFSPERMTEMP1", &sa))
 158     {
 159         fail("NTFS Permissions: Creating Temporary Directory");
 160         return NS_ERROR_FAILURE;
 161     }
 162
 163     GetFullPathNameW((LPCWSTR)L".\\NTFSPERMTEMP1", MAX_PATH, dir1Path, NULL);
 164
 165
 166     rv = NS_NewLocalFile(nsEmbedString(dir1Path), PR_FALSE,
 167                          getter_AddRefs(tempDirectory1));
 168     if (NS_FAILED(rv))
 169     {
 170         fail("NTFS Permissions: Opening Temporary Directory 1");
 171         return rv;
 172     }
 173
 174
 175     // Create and open temporary file
 176     tempFileHandle = CreateFileW(L".\\NTFSPERMTEMP1\\NTFSPerm.tmp",
 177                             GENERIC_READ | GENERIC_WRITE,
 178                             0,
 179                             NULL, //default security
 180                             CREATE_ALWAYS,
 181                             FILE_ATTRIBUTE_NORMAL,
 182                             NULL);
 183
 184     if(tempFileHandle == INVALID_HANDLE_VALUE)
 185     {
 186         fail("NTFS Permissions: Creating Temporary File");
 187         return NS_ERROR_FAILURE;
 188     }
 189
 190     CloseHandle(tempFileHandle);
 191
 192     GetFullPathNameW((LPCWSTR)L".\\NTFSPERMTEMP1\\NTFSPerm.tmp",
 193                         MAX_PATH, filePath, NULL);
 194
 195     rv = NS_NewLocalFile(nsEmbedString(filePath), PR_FALSE,
 196                          getter_AddRefs(tempFile));
 197     if (NS_FAILED(rv))
 198     {
 199         fail("NTFS Permissions: Opening Temporary File");
 200                 return rv;
 201     }
 202
 203     // Update Everyone Explict_Acess to full access.
 204     ea[0].grfAccessPermissions = GENERIC_ALL | STANDARD_RIGHTS_ALL;
 205
 206     // Update the ACL to contain the new ACEs.
 207     result = SetEntriesInAcl(2, ea, NULL, &dirACL);
 208     if (ERROR_SUCCESS != result)
 209     {
 210         fail("NTFS Permissions: SetEntriesInAcl 2 Error");
 211         return NS_ERROR_FAILURE;
 212     }
 213
 214     // Add the new ACL to the security descriptor.
 215     if (!SetSecurityDescriptorDacl(dirSD, PR_TRUE, dirACL, PR_FALSE))
 216     {
 217         fail("NTFS Permissions: SetSecurityDescriptorDacl 2 Error");
 218         return NS_ERROR_FAILURE;
 219     }
 220
 221     // Create and open second temporary directory
 222     if(!CreateDirectoryW(L".\\NTFSPERMTEMP2", &sa))
 223     {
 224         fail("NTFS Permissions: Creating Temporary Directory 2");
 225         return NS_ERROR_FAILURE;
 226     }
 227
 228     GetFullPathNameW((LPCWSTR)L".\\NTFSPERMTEMP2", MAX_PATH, dir2Path, NULL);
 229
 230
 231     rv = NS_NewLocalFile(nsEmbedString(dir2Path), PR_FALSE,
 232                          getter_AddRefs(tempDirectory2));
 233     if (NS_FAILED(rv))
 234     {
 235         fail("NTFS Permissions: Opening Temporary Directory 2");
 236         return rv;
 237     }
 238
 239     // Move the file.
 240     rv = tempFile->MoveTo(tempDirectory2, EmptyString());
 241
 242     if (NS_FAILED(rv))
 243     {
 244         fail("NTFS Permissions: Moving");
 245         return rv;
 246     }
 247
 248     // Access the ACL of the file
 249     result = GetNamedSecurityInfoW(L".\\NTFSPERMTEMP2\\NTFSPerm.tmp",
 250                                         SE_FILE_OBJECT,
 251                                         DACL_SECURITY_INFORMATION |
 252                                         UNPROTECTED_DACL_SECURITY_INFORMATION,
 253                                         NULL, NULL, &fileACL, NULL, &fileSD);
 254     if (ERROR_SUCCESS != result)
 255     {
 256         fail("NTFS Permissions: GetNamedSecurityDescriptor Error");
 257         return NS_ERROR_FAILURE;
 258     }
 259
 260     // Build a trustee representing "Everyone"
 261     BuildTrusteeWithSid(&everyoneTrustee, everyoneSID);
 262
 263     // Get Everyone's effective rights.
 264     result = GetEffectiveRightsFromAcl(fileACL, &everyoneTrustee,
 265                                         &everyoneRights);
 266     if (ERROR_SUCCESS != result)
 267     {
 268         fail("NTFS Permissions: GetEffectiveRightsFromAcl Error");
 269         return NS_ERROR_FAILURE;
 270     }
 271
 272     // Check for delete access, which we won't have unless permissions have
 273     // updated
 274     if((everyoneRights & DELETE) == (DELETE))
 275     {
 276         passed("NTFS Permissions Test");
 277         rv = NS_OK;
 278     }
 279     else
 280     {
 281         fail("NTFS Permissions: Access check.");
 282         rv = NS_ERROR_FAILURE;
 283     }
 284
 285     // Cleanup
 286     if (everyoneSID)
 287         FreeSid(everyoneSID);
 288     if (adminSID)
 289         FreeSid(adminSID);
 290     if (dirACL)
 291         LocalFree(dirACL);
 292     if (dirSD)
 293         LocalFree(dirSD);
 294     if(fileACL)
 295         LocalFree(fileACL);
 296
 297     tempDirectory1->Remove(PR_TRUE);
 298     tempDirectory2->Remove(PR_TRUE);
 299
 300     return rv;
 301 }
 302
 303 int main(int argc, char** argv)
 304 {
 305     ScopedXPCOM xpcom("NTFSPermissionsTests"); // name for tests being run
 306     if (xpcom.failed())
 307         return 1;
 308
 309     int rv = 0;
 310
 311     if(NS_FAILED(TestPermissions()))
 312         rv = 1;
 313
 314     return rv;
 315
 316 }
 317