444 lines
17 KiB
C#
444 lines
17 KiB
C#
// CommonAclTest.cs - NUnit Test Cases for CommonAcl
|
|
//
|
|
// Authors:
|
|
// James Bellinger <jfb@zer7.com>
|
|
//
|
|
// Copyright (C) 2012 James Bellinger
|
|
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Security.AccessControl;
|
|
using System.Security.Principal;
|
|
using NUnit.Framework;
|
|
|
|
namespace MonoTests.System.Security.AccessControl
|
|
{
|
|
[TestFixture]
|
|
public class CommonAclTest
|
|
{
|
|
[Test]
|
|
public void RevisionOK ()
|
|
{
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl(false, false, 0);
|
|
Assert.AreEqual (2, dacl.Revision);
|
|
}
|
|
|
|
[Test]
|
|
public void RevisionDSOK ()
|
|
{
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl(false, true, 0);
|
|
Assert.AreEqual (4, dacl.Revision);
|
|
}
|
|
|
|
[Test]
|
|
public void NullRawAclRevisionOK ()
|
|
{
|
|
DiscretionaryAcl dacl1 = new DiscretionaryAcl (false, false, null);
|
|
Assert.AreEqual (2, dacl1.Revision);
|
|
|
|
DiscretionaryAcl dacl2 = new DiscretionaryAcl (false, true, null);
|
|
Assert.AreEqual (4, dacl2.Revision);
|
|
}
|
|
|
|
[Test]
|
|
public void UsesRawAclRevision ()
|
|
{
|
|
RawAcl acl1 = new RawAcl (RawAcl.AclRevisionDS, 0);
|
|
DiscretionaryAcl dacl1 = new DiscretionaryAcl (false, false, acl1);
|
|
Assert.AreEqual (4, dacl1.Revision);
|
|
|
|
RawAcl acl2 = new RawAcl (RawAcl.AclRevision, 0);
|
|
DiscretionaryAcl dacl2 = new DiscretionaryAcl (false, true, acl2);
|
|
Assert.AreEqual (2, dacl2.Revision);
|
|
}
|
|
|
|
[Test]
|
|
public void IndexerMakesCopies ()
|
|
{
|
|
// This behavior is mentioned in the DiscretionaryAcl RawAcl constructor overload.
|
|
// Turns out it applies to more than just the constructor.
|
|
SecurityIdentifier worldSid = new SecurityIdentifier ("WD");
|
|
|
|
// RawAcl does not make copies.
|
|
RawAcl acl = new RawAcl (RawAcl.AclRevision, 1);
|
|
CommonAce ace = new CommonAce (AceFlags.SuccessfulAccess, AceQualifier.SystemAudit, 1, worldSid, false, null);
|
|
acl.InsertAce (0, ace);
|
|
Assert.AreSame (acl [0], acl [0]);
|
|
|
|
// CommonAcl does.
|
|
SystemAcl sacl = new SystemAcl (false, false, acl);
|
|
Assert.AreNotSame (sacl [0], sacl [0]);
|
|
|
|
// Make sure the copying occurs in the constructor as well as the indexer.
|
|
ace.AceFlags = AceFlags.FailedAccess;
|
|
Assert.AreEqual (AceFlags.SuccessfulAccess, sacl [0].AceFlags);
|
|
}
|
|
|
|
[Test]
|
|
public void EmptyBinaryLengthOK()
|
|
{
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, 0);
|
|
Assert.AreEqual (8, dacl.BinaryLength);
|
|
}
|
|
|
|
[Test]
|
|
public void EmptyBinaryFormOK()
|
|
{
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl(false, false, 0);
|
|
byte[] buffer = new byte[8];
|
|
dacl.GetBinaryForm (buffer, 0);
|
|
|
|
Assert.AreEqual (2, buffer [0]); // Revision
|
|
Assert.AreEqual (8, ToUInt16 (buffer, 2)); // ACL Size
|
|
Assert.AreEqual (0, ToUInt16 (buffer, 4)); // ACE Count
|
|
}
|
|
|
|
[Test]
|
|
public void EmptyBinaryFormDSOK()
|
|
{
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, true, 0);
|
|
byte[] buffer = new byte[8];
|
|
dacl.GetBinaryForm (buffer, 0);
|
|
|
|
Assert.AreEqual (4, buffer [0]); // Revision
|
|
Assert.AreEqual (8, ToUInt16 (buffer, 2)); // ACL Size
|
|
Assert.AreEqual (0, ToUInt16 (buffer, 4)); // ACE Count
|
|
}
|
|
|
|
[Test] // ... stumbled upon this by choosing Guid.Empty when needing an arbitrary GUID ...
|
|
public void GuidEmptyMergesRegardlessOfFlagsAndOpaqueDataIsNotConsidered ()
|
|
{
|
|
SecurityIdentifier sid = new SecurityIdentifier (WellKnownSidType.BuiltinUsersSid, null);
|
|
|
|
RawAcl acl = MakeRawAcl (new GenericAce[] {
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 1, sid, true, new byte[12]),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 4, sid, false, new byte[8]), // gets merged
|
|
new ObjectAce (AceFlags.None, AceQualifier.AccessAllowed, 1, sid,
|
|
ObjectAceFlags.ObjectAceTypePresent, Guid.Empty, Guid.Empty, false, new byte[8]),
|
|
new ObjectAce (AceFlags.None, AceQualifier.AccessAllowed, 2, sid,
|
|
ObjectAceFlags.InheritedObjectAceTypePresent, Guid.Empty, Guid.Empty, true, new byte[16]), // gets merged
|
|
new ObjectAce (AceFlags.None, AceQualifier.AccessAllowed, 4, sid,
|
|
ObjectAceFlags.InheritedObjectAceTypePresent, Guid.Empty, Guid.NewGuid (), true, new byte[4])
|
|
});
|
|
Assert.AreEqual (236, acl.BinaryLength);
|
|
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
|
|
Assert.IsTrue (dacl.IsCanonical);
|
|
Assert.AreEqual (3, dacl.Count);
|
|
|
|
CommonAce cace = (CommonAce)dacl [0];
|
|
Assert.AreEqual (12, cace.OpaqueLength);
|
|
Assert.AreEqual (5, cace.AccessMask);
|
|
Assert.IsTrue (cace.IsCallback);
|
|
|
|
ObjectAce oace = (ObjectAce)dacl [1];
|
|
Assert.AreEqual (8, oace.OpaqueLength);
|
|
Assert.AreEqual (3, oace.AccessMask);
|
|
Assert.AreEqual (ObjectAceFlags.ObjectAceTypePresent, oace.ObjectAceFlags);
|
|
Assert.AreEqual (Guid.Empty, oace.ObjectAceType);
|
|
Assert.IsFalse (oace.IsCallback);
|
|
}
|
|
|
|
[Test]
|
|
public void DetectsCanonicalMergesAndRemovesInheritedAces ()
|
|
{
|
|
SecurityIdentifier sid = new SecurityIdentifier (WellKnownSidType.BuiltinUsersSid, null);
|
|
|
|
RawAcl acl = MakeRawAcl(new GenericAce[] {
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 4, sid, false, null),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 8, sid, false, null),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 1, sid, false, null),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 2, sid, false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessAllowed, 4, sid, false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessAllowed, 4, sid, false, null)
|
|
});
|
|
Assert.AreEqual (6, acl.Count);
|
|
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
|
|
Assert.IsTrue (dacl.IsCanonical);
|
|
Assert.AreEqual (4, dacl.Count);
|
|
|
|
Assert.AreEqual (AceFlags.None, ((CommonAce)dacl [0]).AceFlags);
|
|
Assert.AreEqual (AceFlags.None, ((CommonAce)dacl [1]).AceFlags);
|
|
Assert.AreEqual (AceFlags.Inherited, ((CommonAce)dacl [2]).AceFlags);
|
|
Assert.AreEqual (AceFlags.Inherited, ((CommonAce)dacl [3]).AceFlags);
|
|
Assert.AreEqual (AceQualifier.AccessDenied, ((CommonAce)dacl [0]).AceQualifier);
|
|
Assert.AreEqual (AceQualifier.AccessAllowed, ((CommonAce)dacl [1]).AceQualifier);
|
|
Assert.AreEqual (AceQualifier.AccessAllowed, ((CommonAce)dacl [2]).AceQualifier);
|
|
Assert.AreEqual (AceQualifier.AccessAllowed, ((CommonAce)dacl [3]).AceQualifier);
|
|
GenericAce ace7 = dacl[0];
|
|
Assert.IsInstanceOfType (typeof (CommonAce), ace7);
|
|
|
|
dacl.RemoveInheritedAces ();
|
|
Assert.AreEqual (2, dacl.Count);
|
|
|
|
dacl.Purge (sid);
|
|
Assert.AreEqual (0, dacl.Count);
|
|
}
|
|
|
|
[Test]
|
|
public void MergesAfterSortingForMultipleSids ()
|
|
{
|
|
SecurityIdentifier adminSid = new SecurityIdentifier
|
|
(WellKnownSidType.BuiltinAdministratorsSid, null); // S-1-5-32-544
|
|
|
|
SecurityIdentifier userSid = new SecurityIdentifier
|
|
(WellKnownSidType.BuiltinUsersSid, null); // S-1-5-32-545
|
|
|
|
RawAcl acl = MakeRawAcl(new GenericAce[] {
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 1, userSid, false, null),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 2, adminSid, false, null),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 4, userSid, false, null),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 8, adminSid, false, null),
|
|
});
|
|
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
|
|
Assert.IsTrue (dacl.IsCanonical);
|
|
Assert.AreEqual (2, dacl.Count);
|
|
|
|
CommonAce adminAce = (CommonAce)dacl [0];
|
|
Assert.AreEqual (adminSid, adminAce.SecurityIdentifier);
|
|
Assert.AreEqual (10, adminAce.AccessMask);
|
|
|
|
CommonAce userAce = (CommonAce)dacl [1];
|
|
Assert.AreEqual (userSid, userAce.SecurityIdentifier);
|
|
Assert.AreEqual (5, userAce.AccessMask);
|
|
}
|
|
|
|
[Test]
|
|
public void DetectsNonCanonicalAndDoesNotMerge ()
|
|
{
|
|
SecurityIdentifier sid = new SecurityIdentifier (WellKnownSidType.BuiltinUsersSid, null);
|
|
|
|
RawAcl acl = MakeRawAcl(new GenericAce[] {
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 1, sid, false, null),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 2, sid, false, null),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 4, sid, false, null),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 8, sid, false, null)
|
|
});
|
|
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
|
|
Assert.IsFalse (dacl.IsCanonical);
|
|
Assert.AreEqual (4, dacl.Count);
|
|
}
|
|
|
|
[Test]
|
|
public void DoesNotMergeOrEvaluateOrderingForInherited ()
|
|
{
|
|
SecurityIdentifier sid = new SecurityIdentifier (WellKnownSidType.BuiltinUsersSid, null);
|
|
|
|
RawAcl acl = MakeRawAcl(new GenericAce[] {
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessDenied, 1, sid, false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessAllowed, 2, sid, false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessAllowed, 4, sid, false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessDenied, 8, sid, false, null)
|
|
});
|
|
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
|
|
Assert.IsTrue (dacl.IsCanonical);
|
|
Assert.AreEqual (4, dacl.Count);
|
|
}
|
|
|
|
[Test]
|
|
public void SetterNotSupported ()
|
|
{
|
|
SecurityIdentifier sid = new SecurityIdentifier (WellKnownSidType.BuiltinUsersSid, null);
|
|
|
|
RawAcl acl = MakeRawAcl(new GenericAce[] {
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 1, sid, false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessDenied, 2, sid, false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessAllowed, 4, sid, false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessAllowed, 4, sid, false, null)
|
|
});
|
|
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
|
|
Assert.IsTrue (dacl.IsCanonical);
|
|
Assert.AreEqual (4, dacl.Count);
|
|
|
|
bool throws1 = false;
|
|
try { dacl[0] = acl[0]; } catch (NotSupportedException) { throws1 = true; }
|
|
Assert.IsTrue (throws1);
|
|
|
|
bool throws2 = false;
|
|
try { dacl[0] = acl[2]; } catch (NotSupportedException) { throws2 = true; }
|
|
Assert.IsTrue (throws2);
|
|
}
|
|
|
|
// FIXME: Uncomment this once CompoundAce is implemented on Mono.
|
|
/*
|
|
[Test]
|
|
public void CompoundAcesAreNotCanonical ()
|
|
{
|
|
SecurityIdentifier sid = new SecurityIdentifier (WellKnownSidType.BuiltinUsersSid, null);
|
|
|
|
RawAcl acl = MakeRawAcl(new GenericAce[] {
|
|
new CompoundAce (AceFlags.None, 1, CompoundAceType.Impersonation, sid)
|
|
});
|
|
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
|
|
Assert.IsFalse (dacl.IsCanonical);
|
|
}
|
|
*/
|
|
|
|
[Test]
|
|
public void RemovesMeaninglessAces ()
|
|
{
|
|
RawAcl acl = GetRemovesMeaninglessAcesAcl ();
|
|
|
|
DiscretionaryAcl dacl1 = new DiscretionaryAcl (false, false, acl);
|
|
Assert.IsTrue (dacl1.IsCanonical);
|
|
Assert.AreEqual (7, dacl1.Count);
|
|
Assert.AreEqual (12, ((KnownAce)dacl1 [0]).AccessMask);
|
|
|
|
DiscretionaryAcl dacl2 = new DiscretionaryAcl (true, false, acl);
|
|
Assert.IsTrue (dacl2.IsCanonical);
|
|
Assert.AreEqual (8, dacl2.Count);
|
|
Assert.AreEqual (12, ((KnownAce)dacl1 [0]).AccessMask);
|
|
}
|
|
|
|
// shared with BinaryRoundtrip as well
|
|
static RawAcl GetRemovesMeaninglessAcesAcl ()
|
|
{
|
|
SecurityIdentifier sid = new SecurityIdentifier (WellKnownSidType.BuiltinUsersSid, null);
|
|
|
|
return MakeRawAcl(new GenericAce[] {
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 4, sid, false, null),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessDenied, 8, sid, false, null), // merged
|
|
new CommonAce (AceFlags.InheritOnly|AceFlags.ObjectInherit,
|
|
AceQualifier.AccessDenied, 42, sid, false, null), // removed ONLY if !IsContainer
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 0, sid, false, null), // removed
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 1, sid, false, null),
|
|
new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 2, sid, false, null), // merged
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessAllowed, 1, sid, false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessAllowed, 2, sid, false, null),
|
|
new ObjectAce (AceFlags.None, AceQualifier.AccessAllowed, 0, sid,
|
|
ObjectAceFlags.None, Guid.NewGuid (), Guid.NewGuid (), false, null), // removed
|
|
new ObjectAce (AceFlags.InheritOnly, AceQualifier.AccessAllowed, 1, sid,
|
|
ObjectAceFlags.ObjectAceTypePresent, Guid.NewGuid (), Guid.NewGuid (), false, null), // removed
|
|
new ObjectAce (AceFlags.Inherited, AceQualifier.AccessAllowed, 1, sid,
|
|
ObjectAceFlags.None, Guid.NewGuid (), Guid.NewGuid (), false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessAllowed, 0, sid, false, null), // removed
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessDenied, 4, sid, false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.AccessDenied, 4, sid, false, null),
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.SystemAlarm, 4, sid, false, null), // removed
|
|
new CommonAce (AceFlags.Inherited, AceQualifier.SystemAudit, 4, sid, false, null) // removed
|
|
});
|
|
}
|
|
|
|
[Test]
|
|
public void BinaryRoundtrip ()
|
|
{
|
|
RawAcl acl = GetRemovesMeaninglessAcesAcl ();
|
|
|
|
DiscretionaryAcl dacl1 = new DiscretionaryAcl (false, false, acl);
|
|
byte[] binaryForm1 = new byte[dacl1.BinaryLength];
|
|
dacl1.GetBinaryForm (binaryForm1, 0);
|
|
|
|
DiscretionaryAcl dacl2 = new DiscretionaryAcl (false, false, new RawAcl (binaryForm1, 0));
|
|
byte[] binaryForm2 = new byte[dacl2.BinaryLength];
|
|
dacl2.GetBinaryForm (binaryForm2, 0);
|
|
|
|
Assert.AreEqual (binaryForm1.Length, binaryForm2.Length);
|
|
for (int i = 0; i < binaryForm1.Length; i ++)
|
|
Assert.AreEqual (binaryForm1 [i], binaryForm2 [i]);
|
|
}
|
|
|
|
[Test]
|
|
public void ContiguousRangeSorting ()
|
|
{
|
|
SecurityIdentifier[] sids = new SecurityIdentifier[] {
|
|
new SecurityIdentifier (WellKnownSidType.BuiltinAdministratorsSid, null), // S-1-5-32-544
|
|
new SecurityIdentifier (WellKnownSidType.BuiltinUsersSid, null), // S-1-5-32-545
|
|
new SecurityIdentifier (WellKnownSidType.WorldSid, null), // S-1-1-0
|
|
new SecurityIdentifier ("S-1-5-40"),
|
|
new SecurityIdentifier ("S-1-5-30-123"),
|
|
new SecurityIdentifier ("S-1-5-32-99"),
|
|
new SecurityIdentifier ("S-1-5-23-45-67"),
|
|
new SecurityIdentifier ("S-1-5-32-5432"),
|
|
new SecurityIdentifier ("S-1-0-2"),
|
|
new SecurityIdentifier ("S-1-6-0")
|
|
};
|
|
|
|
GenericAce[] aces = new GenericAce[sids.Length];
|
|
for (int i = 0; i < aces.Length; i ++)
|
|
aces [i] = new CommonAce (AceFlags.None, AceQualifier.AccessAllowed, 1, sids[i], false, null);
|
|
RawAcl acl = MakeRawAcl (aces);
|
|
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
|
|
Assert.IsTrue (dacl.IsCanonical);
|
|
Assert.AreEqual (sids[8], ((CommonAce)dacl [0]).SecurityIdentifier); // S-1-0-2
|
|
Assert.AreEqual (sids[2], ((CommonAce)dacl [1]).SecurityIdentifier); // S-1-1-0
|
|
Assert.AreEqual (sids[3], ((CommonAce)dacl [2]).SecurityIdentifier); // S-1-5-40
|
|
Assert.AreEqual (sids[4], ((CommonAce)dacl [3]).SecurityIdentifier); // S-1-5-30-123
|
|
Assert.AreEqual (sids[5], ((CommonAce)dacl [4]).SecurityIdentifier); // S-1-5-32-99
|
|
Assert.AreEqual (sids[0], ((CommonAce)dacl [5]).SecurityIdentifier); // S-1-5-32-544
|
|
Assert.AreEqual (sids[1], ((CommonAce)dacl [6]).SecurityIdentifier); // S-1-5-32-545
|
|
Assert.AreEqual (sids[7], ((CommonAce)dacl [7]).SecurityIdentifier); // S-1-5-32-5432
|
|
Assert.AreEqual (sids[6], ((CommonAce)dacl [8]).SecurityIdentifier); // S-1-5-23-45-67
|
|
Assert.AreEqual (sids[9], ((CommonAce)dacl [9]).SecurityIdentifier); // S-1-6-0
|
|
}
|
|
|
|
static RawAcl MakeRawAcl (GenericAce[] aces)
|
|
{
|
|
RawAcl acl = new RawAcl (RawAcl.AclRevision, 0);
|
|
for (int i = 0; i < aces.Length; i ++) { acl.InsertAce (i, aces [i]); }
|
|
return acl;
|
|
}
|
|
|
|
static ushort ToUInt16 (byte[] buffer, int offset)
|
|
{
|
|
return (ushort)(buffer [offset] | buffer [offset + 1]);
|
|
}
|
|
|
|
[Test]
|
|
public void InheritanceFlagsMergeForAccessMasksThatMatch ()
|
|
{
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BU");
|
|
|
|
RawAcl acl = MakeRawAcl (new GenericAce[] {
|
|
new CommonAce (AceFlags.ContainerInherit, AceQualifier.AccessAllowed, 1, sid, false, null),
|
|
new CommonAce (AceFlags.ObjectInherit, AceQualifier.AccessAllowed, 1, sid, false, null)
|
|
});
|
|
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (true, false, acl);
|
|
Assert.AreEqual (1, dacl.Count);
|
|
|
|
CommonAce ace = (CommonAce) dacl [0];
|
|
Assert.AreEqual (InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, ace.InheritanceFlags);
|
|
}
|
|
|
|
[Test]
|
|
public void InheritanceFlagsDoNotMergeForAccessMasksThatAND ()
|
|
{
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BU");
|
|
|
|
RawAcl acl = MakeRawAcl (new GenericAce[] {
|
|
new CommonAce (AceFlags.ContainerInherit, AceQualifier.AccessAllowed, 1, sid, false, null),
|
|
new CommonAce (AceFlags.ObjectInherit, AceQualifier.AccessAllowed, 3, sid, false, null)
|
|
});
|
|
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (true, false, acl);
|
|
Assert.AreEqual (2, dacl.Count);
|
|
}
|
|
|
|
[Test]
|
|
public void InheritanceFlagsAreClearedBeforeMergeCheckingWhenNotContainer ()
|
|
{
|
|
SecurityIdentifier sid = new SecurityIdentifier ("BU");
|
|
|
|
RawAcl acl = MakeRawAcl (new GenericAce[] {
|
|
new CommonAce (AceFlags.ContainerInherit, AceQualifier.AccessAllowed, 1, sid, false, null),
|
|
new CommonAce (AceFlags.ObjectInherit, AceQualifier.AccessAllowed, 2, sid, false, null)
|
|
});
|
|
|
|
DiscretionaryAcl dacl = new DiscretionaryAcl (false, false, acl);
|
|
Assert.AreEqual (1, dacl.Count);
|
|
|
|
CommonAce ace = (CommonAce) dacl [0];
|
|
Assert.AreEqual (3, ace.AccessMask);
|
|
Assert.AreEqual (InheritanceFlags.None, ace.InheritanceFlags);
|
|
}
|
|
}
|
|
}
|
|
|