250 lines
9.9 KiB
C#
250 lines
9.9 KiB
C#
|
// DiscretionaryAclTest.cs - NUnit Test Cases for DiscretionaryAcl
|
||
|
|
//
|
||
|
|
// Authors:
|
||
|
|
// James Bellinger <jfb@zer7.com>
|
||
|
|
//
|
||
|
|
// Copyright (C) 2012 James Bellinger
|
||
|
|
|
||
|
|
using System;
|
||
|
|
using System.Collections.Generic;
|
||
|
|
using System.Security.AccessControl;
|
||
|
|
using System.Security.Principal;
|
||
|
|
using NUnit.Framework;
|
||
|
|
|
||
|
|
namespace MonoTests.System.Security.AccessControl
|
||
|
|
{
|
||
|
|
[TestFixture]
|
||
|
|
public class DiscretionaryAclTest
|
||
|
|
{
|
||
|
|
[Test]
|
||
|
|
public void StartsEmpty ()
|
||
|
|
{
|
||
|
|
Assert.AreEqual (0, new DiscretionaryAcl (false, false, 0).Count);
|
||
|
|
Assert.AreEqual (0, new DiscretionaryAcl (false, false, null).Count);
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test]
|
||
|
|
public void AddAccessCommonAce ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BA");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, 0);
|
||
|
|
|
||
|
|
dacl.AddAccess (AccessControlType.Allow, sid, 1, InheritanceFlags.None, PropagationFlags.None);
|
||
|
|
Assert.AreEqual (1, dacl.Count);
|
||
|
|
|
||
|
|
CommonAce ace = (CommonAce)dacl[0];
|
||
|
|
Assert.AreEqual (1, ace.AccessMask);
|
||
|
|
Assert.AreEqual ("S-1-5-32-544", ace.SecurityIdentifier.Value);
|
||
|
|
Assert.IsFalse (ace.IsInherited);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test]
|
||
|
|
public void AddAccessCommonAceUsingDSOverload ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BA");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, true, 0);
|
||
|
|
|
||
|
|
dacl.AddAccess (AccessControlType.Allow, sid, 1, InheritanceFlags.None, PropagationFlags.None,
|
||
|
|
ObjectAceFlags.None, Guid.NewGuid (), Guid.NewGuid ());
|
||
|
|
Assert.AreEqual (1, dacl.Count);
|
||
|
|
|
||
|
|
CommonAce ace = (CommonAce)dacl [0];
|
||
|
|
Assert.AreEqual (1, ace.AccessMask);
|
||
|
|
Assert.AreEqual ("S-1-5-32-544", ace.SecurityIdentifier.Value);
|
||
|
|
Assert.IsFalse (ace.IsInherited);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test, ExpectedException (typeof (InvalidOperationException))]
|
||
|
|
public void AddAccessObjectAceNonDSFailsEvenIfObjectAceFlagsNoneImplyingCommonAce ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BA");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, 0);
|
||
|
|
|
||
|
|
dacl.AddAccess (AccessControlType.Allow, sid, 1, InheritanceFlags.None, PropagationFlags.None,
|
||
|
|
ObjectAceFlags.None, Guid.Empty, Guid.Empty);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test, ExpectedException (typeof (InvalidOperationException))]
|
||
|
|
public void AddAccessFailsOnNonCanonical ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BU");
|
||
|
|
|
||
|
|
RawAcl acl = new RawAcl (RawAcl.AclRevision, 0);
|
||
|
|
acl.InsertAce (0, new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 1, sid, false, null));
|
||
|
|
acl.InsertAce (1, new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 1, sid, false, null));
|
||
|
|
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
|
||
|
|
Assert.IsFalse (dacl.IsCanonical);
|
||
|
|
Assert.AreEqual (2, dacl.Count);
|
||
|
|
|
||
|
|
dacl.AddAccess (AccessControlType.Allow, sid, 1, InheritanceFlags.None, PropagationFlags.None);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test, ExpectedException (typeof (ArgumentException))]
|
||
|
|
public void InheritanceFlagsRequireContainer ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BU");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, 0);
|
||
|
|
dacl.AddAccess (AccessControlType.Allow, sid, 3, InheritanceFlags.ContainerInherit, PropagationFlags.None);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test, ExpectedException (typeof (ArgumentException))]
|
||
|
|
public void PropagationFlagsRequireInheritanceFlagsForAdd ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BU");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (true, false, 0);
|
||
|
|
dacl.AddAccess (AccessControlType.Allow, sid, 3, InheritanceFlags.None, PropagationFlags.InheritOnly);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test]
|
||
|
|
public void AddAccessObjectAceAndCommonAce ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BA");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, true, 0);
|
||
|
|
|
||
|
|
dacl.AddAccess (AccessControlType.Allow, sid, 1, InheritanceFlags.None, PropagationFlags.None,
|
||
|
|
ObjectAceFlags.ObjectAceTypePresent, Guid.NewGuid (), Guid.Empty);
|
||
|
|
dacl.AddAccess (AccessControlType.Allow, sid, 1, InheritanceFlags.None, PropagationFlags.None,
|
||
|
|
ObjectAceFlags.None, Guid.Empty, Guid.Empty);
|
||
|
|
Assert.AreEqual (2, dacl.Count);
|
||
|
|
|
||
|
|
CommonAce cace = (CommonAce)dacl [0];
|
||
|
|
Assert.AreEqual (1, cace.AccessMask);
|
||
|
|
Assert.AreEqual ("S-1-5-32-544", cace.SecurityIdentifier.Value);
|
||
|
|
Assert.IsFalse (cace.IsCallback);
|
||
|
|
Assert.IsFalse (cace.IsInherited);
|
||
|
|
|
||
|
|
ObjectAce oace = (ObjectAce)dacl [1];
|
||
|
|
Assert.AreEqual (1, oace.AccessMask);
|
||
|
|
Assert.AreEqual ("S-1-5-32-544", oace.SecurityIdentifier.Value);
|
||
|
|
Assert.IsFalse (oace.IsCallback);
|
||
|
|
Assert.IsFalse (oace.IsInherited);
|
||
|
|
|
||
|
|
dacl.AddAccess (AccessControlType.Allow, sid, 2, InheritanceFlags.None, PropagationFlags.None,
|
||
|
|
ObjectAceFlags.None, Guid.Empty, Guid.Empty);
|
||
|
|
Assert.AreEqual (2, dacl.Count);
|
||
|
|
|
||
|
|
CommonAce cace2 = (CommonAce)dacl [0];
|
||
|
|
Assert.AreEqual (3, cace2.AccessMask);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test, ExpectedException (typeof (ArgumentOutOfRangeException))]
|
||
|
|
public void InvalidAccessControlType ()
|
||
|
|
{
|
||
|
|
// This is also testing the fact that the AccessControlType is checked before the
|
||
|
|
// InheritanceFlags are validated -- IsContainer is false here, so if the InheritanceFlags
|
||
|
|
// were checked first, ArgumentException would be thrown instead.
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BA");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, 0);
|
||
|
|
dacl.AddAccess ((AccessControlType)43210, sid, 1, InheritanceFlags.ContainerInherit, PropagationFlags.None);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test]
|
||
|
|
public void RemoveSpecific ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BA");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, 0);
|
||
|
|
|
||
|
|
RemoveSpecificBegin (sid, dacl, InheritanceFlags.None);
|
||
|
|
dacl.RemoveAccessSpecific (AccessControlType.Allow, sid, 3, InheritanceFlags.None, PropagationFlags.None);
|
||
|
|
Assert.AreEqual (0, dacl.Count);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test]
|
||
|
|
public void RemoveSpecificUsingDSOverload ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BA");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, true, 0);
|
||
|
|
|
||
|
|
RemoveSpecificBegin (sid, dacl, InheritanceFlags.None);
|
||
|
|
dacl.RemoveAccessSpecific (AccessControlType.Allow, sid, 3, InheritanceFlags.None, PropagationFlags.None,
|
||
|
|
ObjectAceFlags.ObjectAceTypePresent, Guid.Empty, Guid.Empty);
|
||
|
|
Assert.AreEqual (1, dacl.Count);
|
||
|
|
dacl.RemoveAccessSpecific (AccessControlType.Allow, sid, 3, InheritanceFlags.None, PropagationFlags.None,
|
||
|
|
ObjectAceFlags.None, Guid.Empty, Guid.Empty);
|
||
|
|
Assert.AreEqual (0, dacl.Count);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test]
|
||
|
|
public void RemoveSpecificIsContainer ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BA");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (true, false, 0);
|
||
|
|
|
||
|
|
RemoveSpecificBegin (sid, dacl, InheritanceFlags.ObjectInherit);
|
||
|
|
dacl.RemoveAccessSpecific (AccessControlType.Allow, sid, 3, InheritanceFlags.ObjectInherit, PropagationFlags.None);
|
||
|
|
Assert.AreEqual (0, dacl.Count);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test]
|
||
|
|
public void RemoveSpecificIgnoresPropagationFlagsWhenMatchingInheritanceFlagsNone()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BA");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, 0);
|
||
|
|
|
||
|
|
RemoveSpecificBegin (sid, dacl, InheritanceFlags.None);
|
||
|
|
dacl.RemoveAccessSpecific (AccessControlType.Allow, sid, 3,
|
||
|
|
InheritanceFlags.None, PropagationFlags.InheritOnly);
|
||
|
|
Assert.AreEqual (0, dacl.Count);
|
||
|
|
}
|
||
|
|
|
||
|
|
void RemoveSpecificBegin (SecurityIdentifier sid, DiscretionaryAcl dacl, InheritanceFlags inheritanceFlags)
|
||
|
|
{
|
||
|
|
SecurityIdentifier otherSid = new SecurityIdentifier ("BU");
|
||
|
|
|
||
|
|
dacl.AddAccess (AccessControlType.Allow, sid, 3, inheritanceFlags, PropagationFlags.None);
|
||
|
|
Assert.AreEqual (1, dacl.Count);
|
||
|
|
dacl.RemoveAccessSpecific (AccessControlType.Deny, sid, 1, inheritanceFlags, PropagationFlags.None);
|
||
|
|
Assert.AreEqual (1, dacl.Count);
|
||
|
|
dacl.RemoveAccessSpecific (AccessControlType.Allow, otherSid, 1, inheritanceFlags, PropagationFlags.None);
|
||
|
|
Assert.AreEqual (1, dacl.Count);
|
||
|
|
dacl.RemoveAccessSpecific (AccessControlType.Allow, sid, 1, inheritanceFlags, PropagationFlags.None);
|
||
|
|
Assert.AreEqual (1, dacl.Count);
|
||
|
|
Assert.AreEqual (3, ((CommonAce)dacl [0]).AccessMask);
|
||
|
|
dacl.RemoveAccessSpecific (AccessControlType.Allow, sid, 3,
|
||
|
|
inheritanceFlags ^ InheritanceFlags.ContainerInherit,
|
||
|
|
PropagationFlags.None);
|
||
|
|
Assert.AreEqual (1, dacl.Count);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test]
|
||
|
|
public void PropagationFlagsDoNotRequireInheritanceFlagsForRemoveSpecific ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BU");
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, 0);
|
||
|
|
dacl.RemoveAccessSpecific (AccessControlType.Allow, sid, 3,
|
||
|
|
InheritanceFlags.ContainerInherit, PropagationFlags.InheritOnly);
|
||
|
|
}
|
||
|
|
|
||
|
|
[Test]
|
||
|
|
public void SetAccess ()
|
||
|
|
{
|
||
|
|
SecurityIdentifier adminSid = new SecurityIdentifier ("BA"); // S-1-5-32-544
|
||
|
|
SecurityIdentifier userSid = new SecurityIdentifier ("BU"); // S-1-5-32-545
|
||
|
|
|
||
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (true, false, 0);
|
||
|
|
dacl.SetAccess (AccessControlType.Allow, adminSid, 1, InheritanceFlags.ObjectInherit, PropagationFlags.None);
|
||
|
|
dacl.SetAccess (AccessControlType.Allow, userSid, 2, InheritanceFlags.None, PropagationFlags.None);
|
||
|
|
Assert.AreEqual (2, dacl.Count);
|
||
|
|
|
||
|
|
CommonAce ace = (CommonAce)dacl [0];
|
||
|
|
Assert.AreEqual (adminSid, ace.SecurityIdentifier);
|
||
|
|
Assert.AreEqual (1, ace.AccessMask);
|
||
|
|
|
||
|
|
dacl.SetAccess (AccessControlType.Allow, adminSid, 4, InheritanceFlags.ObjectInherit, PropagationFlags.None);
|
||
|
|
Assert.AreNotEqual (4, ace.AccessMask); // remove and add, not modify, despite AccessMask having a setter
|
||
|
|
ace = (CommonAce)dacl [0];
|
||
|
|
Assert.AreEqual (4, ace.AccessMask);
|
||
|
|
|
||
|
|
dacl.SetAccess (AccessControlType.Deny, adminSid, 4, InheritanceFlags.ObjectInherit, PropagationFlags.None);
|
||
|
|
Assert.AreEqual (3, dacl.Count);
|
||
|
|
ace = (CommonAce)dacl [0];
|
||
|
|
Assert.AreEqual (AceQualifier.AccessDenied, ace.AceQualifier);
|
||
|
|
ace = (CommonAce)dacl [1];
|
||
|
|
Assert.AreEqual (AceQualifier.AccessAllowed, ace.AceQualifier);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|