2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001, 2006.
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
10 * Copyright (C) Simo Sorce 2003.
11 * Copyright (C) Gerald (Jerry) Carter 2005.
12 * Copyright (C) Volker Lendecke 2005.
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2 of the License, or
17 * (at your option) any later version.
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, write to the Free Software
26 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 /* This is the implementation of the lsa server code. */
34 #define DBGC_CLASS DBGC_RPC_SRV
43 struct generic_mapping lsa_generic_mapping
= {
50 /*******************************************************************
51 Function to free the per handle data.
52 ********************************************************************/
54 static void free_lsa_info(void *ptr
)
56 struct lsa_info
*lsa
= (struct lsa_info
*)ptr
;
61 /***************************************************************************
63 ***************************************************************************/
65 static void init_dom_query_3(DOM_QUERY_3
*d_q
, const char *dom_name
, DOM_SID
*dom_sid
)
67 d_q
->buffer_dom_name
= (dom_name
!= NULL
) ? 1 : 0; /* domain buffer pointer */
68 d_q
->buffer_dom_sid
= (dom_sid
!= NULL
) ? 1 : 0; /* domain sid pointer */
70 /* this string is supposed to be non-null terminated. */
71 /* But the maxlen in this UNISTR2 must include the terminating null. */
72 init_unistr2(&d_q
->uni_domain_name
, dom_name
, UNI_BROKEN_NON_NULL
);
75 * I'm not sure why this really odd combination of length
76 * values works, but it does appear to. I need to look at
77 * this *much* more closely - but at the moment leave alone
78 * until it's understood. This allows a W2k client to join
79 * a domain with both odd and even length names... JRA.
84 * The two fields below probably are reversed in meaning, ie.
85 * the first field is probably the str_len, the second the max
86 * len. Both are measured in bytes anyway.
89 d_q
->uni_dom_str_len
= d_q
->uni_domain_name
.uni_max_len
* 2;
90 d_q
->uni_dom_max_len
= d_q
->uni_domain_name
.uni_str_len
* 2;
93 init_dom_sid2(&d_q
->dom_sid
, dom_sid
);
96 /***************************************************************************
98 ***************************************************************************/
100 static void init_dom_query_5(DOM_QUERY_5
*d_q
, const char *dom_name
, DOM_SID
*dom_sid
)
102 init_dom_query_3(d_q
, dom_name
, dom_sid
);
105 /***************************************************************************
106 init_dom_ref - adds a domain if it's not already in, returns the index.
107 ***************************************************************************/
109 static int init_dom_ref(DOM_R_REF
*ref
, const char *dom_name
, DOM_SID
*dom_sid
)
113 if (dom_name
!= NULL
) {
114 for (num
= 0; num
< ref
->num_ref_doms_1
; num
++) {
115 if (sid_equal(dom_sid
, &ref
->ref_dom
[num
].ref_dom
.sid
))
119 num
= ref
->num_ref_doms_1
;
122 if (num
>= MAX_REF_DOMAINS
) {
123 /* index not found, already at maximum domain limit */
127 ref
->num_ref_doms_1
= num
+1;
128 ref
->ptr_ref_dom
= 1;
129 ref
->max_entries
= MAX_REF_DOMAINS
;
130 ref
->num_ref_doms_2
= num
+1;
132 ref
->hdr_ref_dom
[num
].ptr_dom_sid
= 1; /* dom sid cannot be NULL. */
134 init_unistr2(&ref
->ref_dom
[num
].uni_dom_name
, dom_name
, UNI_FLAGS_NONE
);
135 init_uni_hdr(&ref
->hdr_ref_dom
[num
].hdr_dom_name
, &ref
->ref_dom
[num
].uni_dom_name
);
137 init_dom_sid2(&ref
->ref_dom
[num
].ref_dom
, dom_sid
);
142 /***************************************************************************
143 lookup_lsa_rids. Must be called as root for lookup_name to work.
144 ***************************************************************************/
146 static NTSTATUS
lookup_lsa_rids(TALLOC_CTX
*mem_ctx
,
152 uint32
*pmapped_count
)
154 uint32 mapped_count
, i
;
156 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
161 for (i
= 0; i
< num_entries
; i
++) {
167 enum lsa_SidType type
= SID_NAME_UNKNOWN
;
169 /* Split name into domain and user component */
171 full_name
= rpcstr_pull_unistr2_talloc(mem_ctx
, &name
[i
]);
172 if (full_name
== NULL
) {
173 DEBUG(0, ("pull_ucs2_talloc failed\n"));
174 return NT_STATUS_NO_MEMORY
;
177 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name
));
179 /* We can ignore the result of lookup_name, it will not touch
180 "type" if it's not successful */
182 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
187 case SID_NAME_DOM_GRP
:
188 case SID_NAME_DOMAIN
:
190 case SID_NAME_WKN_GRP
:
191 DEBUG(5, ("init_lsa_rids: %s found\n", full_name
));
192 /* Leave these unchanged */
195 /* Don't hand out anything but the list above */
196 DEBUG(5, ("init_lsa_rids: %s not found\n", full_name
));
197 type
= SID_NAME_UNKNOWN
;
204 if (type
!= SID_NAME_UNKNOWN
) {
205 sid_split_rid(&sid
, &rid
);
206 dom_idx
= init_dom_ref(ref
, domain
, &sid
);
210 init_dom_rid(&prid
[i
], rid
, type
, dom_idx
);
213 *pmapped_count
= mapped_count
;
217 /***************************************************************************
218 lookup_lsa_sids. Must be called as root for lookup_name to work.
219 ***************************************************************************/
221 static NTSTATUS
lookup_lsa_sids(TALLOC_CTX
*mem_ctx
,
223 LSA_TRANSLATED_SID3
*trans_sids
,
227 uint32
*pmapped_count
)
229 uint32 mapped_count
, i
;
231 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
236 for (i
= 0; i
< num_entries
; i
++) {
242 enum lsa_SidType type
= SID_NAME_UNKNOWN
;
244 /* Split name into domain and user component */
246 full_name
= rpcstr_pull_unistr2_talloc(mem_ctx
, &name
[i
]);
247 if (full_name
== NULL
) {
248 DEBUG(0, ("pull_ucs2_talloc failed\n"));
249 return NT_STATUS_NO_MEMORY
;
252 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name
));
254 /* We can ignore the result of lookup_name, it will not touch
255 "type" if it's not successful */
257 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
262 case SID_NAME_DOM_GRP
:
263 case SID_NAME_DOMAIN
:
265 case SID_NAME_WKN_GRP
:
266 DEBUG(5, ("init_lsa_sids: %s found\n", full_name
));
267 /* Leave these unchanged */
270 /* Don't hand out anything but the list above */
271 DEBUG(5, ("init_lsa_sids: %s not found\n", full_name
));
272 type
= SID_NAME_UNKNOWN
;
279 if (type
!= SID_NAME_UNKNOWN
) {
281 sid_copy(&domain_sid
, &sid
);
282 sid_split_rid(&domain_sid
, &rid
);
283 dom_idx
= init_dom_ref(ref
, domain
, &domain_sid
);
287 /* Initialize the LSA_TRANSLATED_SID3 return. */
288 trans_sids
[i
].sid_type
= type
;
289 trans_sids
[i
].sid2
= TALLOC_P(mem_ctx
, DOM_SID2
);
290 if (trans_sids
[i
].sid2
== NULL
) {
291 return NT_STATUS_NO_MEMORY
;
293 init_dom_sid2(trans_sids
[i
].sid2
, &sid
);
294 trans_sids
[i
].sid_idx
= dom_idx
;
297 *pmapped_count
= mapped_count
;
301 /***************************************************************************
302 init_reply_lookup_names
303 ***************************************************************************/
305 static void init_reply_lookup_names(LSA_R_LOOKUP_NAMES
*r_l
,
306 DOM_R_REF
*ref
, uint32 num_entries
,
307 DOM_RID
*rid
, uint32 mapped_count
)
309 r_l
->ptr_dom_ref
= 1;
312 r_l
->num_entries
= num_entries
;
313 r_l
->ptr_entries
= 1;
314 r_l
->num_entries2
= num_entries
;
317 r_l
->mapped_count
= mapped_count
;
320 /***************************************************************************
321 init_reply_lookup_names2
322 ***************************************************************************/
324 static void init_reply_lookup_names2(LSA_R_LOOKUP_NAMES2
*r_l
,
325 DOM_R_REF
*ref
, uint32 num_entries
,
326 DOM_RID2
*rid
, uint32 mapped_count
)
328 r_l
->ptr_dom_ref
= 1;
331 r_l
->num_entries
= num_entries
;
332 r_l
->ptr_entries
= 1;
333 r_l
->num_entries2
= num_entries
;
336 r_l
->mapped_count
= mapped_count
;
339 /***************************************************************************
340 init_reply_lookup_names3
341 ***************************************************************************/
343 static void init_reply_lookup_names3(LSA_R_LOOKUP_NAMES3
*r_l
,
344 DOM_R_REF
*ref
, uint32 num_entries
,
345 LSA_TRANSLATED_SID3
*trans_sids
, uint32 mapped_count
)
347 r_l
->ptr_dom_ref
= 1;
350 r_l
->num_entries
= num_entries
;
351 r_l
->ptr_entries
= 1;
352 r_l
->num_entries2
= num_entries
;
353 r_l
->trans_sids
= trans_sids
;
355 r_l
->mapped_count
= mapped_count
;
358 /***************************************************************************
359 init_reply_lookup_names4
360 ***************************************************************************/
362 static void init_reply_lookup_names4(LSA_R_LOOKUP_NAMES4
*r_l
,
363 DOM_R_REF
*ref
, uint32 num_entries
,
364 LSA_TRANSLATED_SID3
*trans_sids
, uint32 mapped_count
)
366 r_l
->ptr_dom_ref
= 1;
369 r_l
->num_entries
= num_entries
;
370 r_l
->ptr_entries
= 1;
371 r_l
->num_entries2
= num_entries
;
372 r_l
->trans_sids
= trans_sids
;
374 r_l
->mapped_count
= mapped_count
;
377 /***************************************************************************
378 Init_reply_lookup_sids.
379 ***************************************************************************/
381 static void init_reply_lookup_sids2(LSA_R_LOOKUP_SIDS2
*r_l
,
385 r_l
->ptr_dom_ref
= ref
? 1 : 0;
387 r_l
->mapped_count
= mapped_count
;
390 /***************************************************************************
391 Init_reply_lookup_sids.
392 ***************************************************************************/
394 static void init_reply_lookup_sids3(LSA_R_LOOKUP_SIDS3
*r_l
,
398 r_l
->ptr_dom_ref
= ref
? 1 : 0;
400 r_l
->mapped_count
= mapped_count
;
403 /***************************************************************************
404 Init_reply_lookup_sids.
405 ***************************************************************************/
407 static NTSTATUS
init_reply_lookup_sids(TALLOC_CTX
*mem_ctx
,
408 LSA_R_LOOKUP_SIDS
*r_l
,
410 LSA_TRANS_NAME_ENUM2
*names
,
413 LSA_TRANS_NAME_ENUM
*oldnames
= &r_l
->names
;
415 oldnames
->num_entries
= names
->num_entries
;
416 oldnames
->ptr_trans_names
= names
->ptr_trans_names
;
417 oldnames
->num_entries2
= names
->num_entries2
;
418 oldnames
->uni_name
= names
->uni_name
;
420 if (names
->num_entries
) {
423 oldnames
->name
= TALLOC_ARRAY(mem_ctx
, LSA_TRANS_NAME
, names
->num_entries
);
425 if (!oldnames
->name
) {
426 return NT_STATUS_NO_MEMORY
;
428 for (i
= 0; i
< names
->num_entries
; i
++) {
429 oldnames
->name
[i
].sid_name_use
= names
->name
[i
].sid_name_use
;
430 oldnames
->name
[i
].hdr_name
= names
->name
[i
].hdr_name
;
431 oldnames
->name
[i
].domain_idx
= names
->name
[i
].domain_idx
;
435 r_l
->ptr_dom_ref
= ref
? 1 : 0;
437 r_l
->mapped_count
= mapped_count
;
441 static NTSTATUS
lsa_get_generic_sd(TALLOC_CTX
*mem_ctx
, SEC_DESC
**sd
, size_t *sd_size
)
443 DOM_SID local_adm_sid
;
451 init_sec_access(&mask
, POLICY_EXECUTE
);
452 init_sec_ace(&ace
[0], &global_sid_World
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
454 sid_copy(&adm_sid
, get_global_sam_sid());
455 sid_append_rid(&adm_sid
, DOMAIN_GROUP_RID_ADMINS
);
456 init_sec_access(&mask
, POLICY_ALL_ACCESS
);
457 init_sec_ace(&ace
[1], &adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
459 sid_copy(&local_adm_sid
, &global_sid_Builtin
);
460 sid_append_rid(&local_adm_sid
, BUILTIN_ALIAS_RID_ADMINS
);
461 init_sec_access(&mask
, POLICY_ALL_ACCESS
);
462 init_sec_ace(&ace
[2], &local_adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
464 if((psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
, 3, ace
)) == NULL
)
465 return NT_STATUS_NO_MEMORY
;
467 if((*sd
= make_sec_desc(mem_ctx
, SEC_DESC_REVISION
, SEC_DESC_SELF_RELATIVE
, &adm_sid
, NULL
, NULL
, psa
, sd_size
)) == NULL
)
468 return NT_STATUS_NO_MEMORY
;
473 #if 0 /* AD DC work in ongoing in Samba 4 */
475 /***************************************************************************
477 ***************************************************************************/
479 static void init_dns_dom_info(LSA_DNS_DOM_INFO
*r_l
, const char *nb_name
,
480 const char *dns_name
, const char *forest_name
,
481 struct GUID
*dom_guid
, DOM_SID
*dom_sid
)
483 if (nb_name
&& *nb_name
) {
484 init_unistr2(&r_l
->uni_nb_dom_name
, nb_name
, UNI_FLAGS_NONE
);
485 init_uni_hdr(&r_l
->hdr_nb_dom_name
, &r_l
->uni_nb_dom_name
);
486 r_l
->hdr_nb_dom_name
.uni_max_len
+= 2;
487 r_l
->uni_nb_dom_name
.uni_max_len
+= 1;
490 if (dns_name
&& *dns_name
) {
491 init_unistr2(&r_l
->uni_dns_dom_name
, dns_name
, UNI_FLAGS_NONE
);
492 init_uni_hdr(&r_l
->hdr_dns_dom_name
, &r_l
->uni_dns_dom_name
);
493 r_l
->hdr_dns_dom_name
.uni_max_len
+= 2;
494 r_l
->uni_dns_dom_name
.uni_max_len
+= 1;
497 if (forest_name
&& *forest_name
) {
498 init_unistr2(&r_l
->uni_forest_name
, forest_name
, UNI_FLAGS_NONE
);
499 init_uni_hdr(&r_l
->hdr_forest_name
, &r_l
->uni_forest_name
);
500 r_l
->hdr_forest_name
.uni_max_len
+= 2;
501 r_l
->uni_forest_name
.uni_max_len
+= 1;
504 /* how do we init the guid ? probably should write an init fn */
506 memcpy(&r_l
->dom_guid
, dom_guid
, sizeof(struct GUID
));
510 r_l
->ptr_dom_sid
= 1;
511 init_dom_sid2(&r_l
->dom_sid
, dom_sid
);
514 #endif /* AD DC work in ongoing in Samba 4 */
517 /***************************************************************************
519 ***************************************************************************/
521 NTSTATUS
_lsa_open_policy2(pipes_struct
*p
, LSA_Q_OPEN_POL2
*q_u
, LSA_R_OPEN_POL2
*r_u
)
523 struct lsa_info
*info
;
524 SEC_DESC
*psd
= NULL
;
526 uint32 des_access
=q_u
->des_access
;
531 /* map the generic bits to the lsa policy ones */
532 se_map_generic(&des_access
, &lsa_generic_mapping
);
534 /* get the generic lsa policy SD until we store it */
535 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
537 if(!se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
, &status
)) {
538 if (geteuid() != 0) {
541 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
542 acc_granted
, des_access
));
543 DEBUGADD(4,("but overwritten by euid == 0\n"));
546 /* This is needed for lsa_open_account and rpcclient .... :-) */
549 acc_granted
= POLICY_ALL_ACCESS
;
551 /* associate the domain SID with the (unique) handle. */
552 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
553 return NT_STATUS_NO_MEMORY
;
556 sid_copy(&info
->sid
,get_global_sam_sid());
557 info
->access
= acc_granted
;
559 /* set up the LSA QUERY INFO response */
560 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
561 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
566 /***************************************************************************
568 ***************************************************************************/
570 NTSTATUS
_lsa_open_policy(pipes_struct
*p
, LSA_Q_OPEN_POL
*q_u
, LSA_R_OPEN_POL
*r_u
)
572 struct lsa_info
*info
;
573 SEC_DESC
*psd
= NULL
;
575 uint32 des_access
=q_u
->des_access
;
580 /* map the generic bits to the lsa policy ones */
581 se_map_generic(&des_access
, &lsa_generic_mapping
);
583 /* get the generic lsa policy SD until we store it */
584 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
586 if(!se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
, &status
)) {
587 if (geteuid() != 0) {
590 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
591 acc_granted
, des_access
));
592 DEBUGADD(4,("but overwritten by euid == 0\n"));
593 acc_granted
= des_access
;
596 /* associate the domain SID with the (unique) handle. */
597 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
598 return NT_STATUS_NO_MEMORY
;
601 sid_copy(&info
->sid
,get_global_sam_sid());
602 info
->access
= acc_granted
;
604 /* set up the LSA QUERY INFO response */
605 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
606 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
611 /***************************************************************************
612 _lsa_enum_trust_dom - this needs fixing to do more than return NULL ! JRA.
614 ***************************************************************************/
616 NTSTATUS
_lsa_enum_trust_dom(pipes_struct
*p
, LSA_Q_ENUM_TRUST_DOM
*q_u
,
617 LSA_R_ENUM_TRUST_DOM
*r_u
)
619 struct lsa_info
*info
;
621 struct trustdom_info
**domains
;
624 * preferred length is set to 5 as a "our" preferred length
625 * nt sets this parameter to 2
626 * update (20.08.2002): it's not preferred length, but preferred size!
627 * it needs further investigation how to optimally choose this value
629 uint32 max_num_domains
=
630 q_u
->preferred_len
< 5 ? q_u
->preferred_len
: 10;
635 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
636 return NT_STATUS_INVALID_HANDLE
;
638 /* check if the user have enough rights */
639 if (!(info
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
640 return NT_STATUS_ACCESS_DENIED
;
642 nt_status
= secrets_trusted_domains(p
->mem_ctx
, &num_domains
,
645 if (!NT_STATUS_IS_OK(nt_status
)) {
649 if (q_u
->enum_context
< num_domains
) {
650 num_thistime
= MIN(num_domains
, max_num_domains
);
652 r_u
->status
= STATUS_MORE_ENTRIES
;
654 if (q_u
->enum_context
+ num_thistime
> num_domains
) {
655 num_thistime
= num_domains
- q_u
->enum_context
;
656 r_u
->status
= NT_STATUS_OK
;
659 next_idx
= q_u
->enum_context
+ num_thistime
;
662 next_idx
= 0xffffffff;
663 r_u
->status
= NT_STATUS_NO_MORE_ENTRIES
;
666 /* set up the lsa_enum_trust_dom response */
668 init_r_enum_trust_dom(p
->mem_ctx
, r_u
, next_idx
,
669 num_thistime
, domains
+q_u
->enum_context
);
674 /***************************************************************************
675 _lsa_query_info. See the POLICY_INFOMATION_CLASS docs at msdn.
676 ***************************************************************************/
678 NTSTATUS
_lsa_query_info(pipes_struct
*p
, LSA_Q_QUERY_INFO
*q_u
, LSA_R_QUERY_INFO
*r_u
)
680 struct lsa_info
*handle
;
681 LSA_INFO_CTR
*ctr
= &r_u
->ctr
;
686 r_u
->status
= NT_STATUS_OK
;
688 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
689 return NT_STATUS_INVALID_HANDLE
;
691 switch (q_u
->info_class
) {
695 uint32 policy_def
= LSA_AUDIT_POLICY_ALL
;
697 /* check if the user have enough rights */
698 if (!(handle
->access
& POLICY_VIEW_AUDIT_INFORMATION
)) {
699 DEBUG(10,("_lsa_query_info: insufficient access rights\n"));
700 return NT_STATUS_ACCESS_DENIED
;
703 /* fake info: We audit everything. ;) */
704 ctr
->info
.id2
.ptr
= 1;
705 ctr
->info
.id2
.auditing_enabled
= True
;
706 ctr
->info
.id2
.count1
= ctr
->info
.id2
.count2
= LSA_AUDIT_NUM_CATEGORIES
;
708 if ((ctr
->info
.id2
.auditsettings
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, uint32
, LSA_AUDIT_NUM_CATEGORIES
)) == NULL
)
709 return NT_STATUS_NO_MEMORY
;
711 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT
] = policy_def
;
712 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS
] = policy_def
;
713 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_LOGON
] = policy_def
;
714 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING
] = policy_def
;
715 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES
] = policy_def
;
716 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_SYSTEM
] = policy_def
;
717 ctr
->info
.id2
.auditsettings
[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS
] = policy_def
;
722 /* check if the user have enough rights */
723 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
724 return NT_STATUS_ACCESS_DENIED
;
726 /* Request PolicyPrimaryDomainInformation. */
727 switch (lp_server_role()) {
728 case ROLE_DOMAIN_PDC
:
729 case ROLE_DOMAIN_BDC
:
730 name
= get_global_sam_name();
731 sid
= get_global_sam_sid();
733 case ROLE_DOMAIN_MEMBER
:
734 name
= lp_workgroup();
735 /* We need to return the Domain SID here. */
736 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid
))
739 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
741 case ROLE_STANDALONE
:
742 name
= lp_workgroup();
746 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
748 init_dom_query_3(&r_u
->ctr
.info
.id3
, name
, sid
);
751 /* check if the user have enough rights */
752 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
753 return NT_STATUS_ACCESS_DENIED
;
755 /* Request PolicyAccountDomainInformation. */
756 name
= get_global_sam_name();
757 sid
= get_global_sam_sid();
758 init_dom_query_5(&r_u
->ctr
.info
.id5
, name
, sid
);
761 /* check if the user have enough rights */
762 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
763 return NT_STATUS_ACCESS_DENIED
;
765 switch (lp_server_role()) {
766 case ROLE_DOMAIN_BDC
:
768 * only a BDC is a backup controller
769 * of the domain, it controls.
771 ctr
->info
.id6
.server_role
= 2;
775 * any other role is a primary
776 * of the domain, it controls.
778 ctr
->info
.id6
.server_role
= 3;
783 DEBUG(0,("_lsa_query_info: unknown info level in Lsa Query: %d\n", q_u
->info_class
));
784 r_u
->status
= NT_STATUS_INVALID_INFO_CLASS
;
788 if (NT_STATUS_IS_OK(r_u
->status
)) {
789 r_u
->dom_ptr
= 0x22000000; /* bizarre */
790 ctr
->info_class
= q_u
->info_class
;
796 /***************************************************************************
797 _lsa_lookup_sids_internal
798 ***************************************************************************/
800 static NTSTATUS
_lsa_lookup_sids_internal(pipes_struct
*p
,
801 uint16 level
, /* input */
802 int num_sids
, /* input */
803 const DOM_SID2
*sid
, /* input */
804 DOM_R_REF
**pp_ref
, /* output */
805 LSA_TRANS_NAME_ENUM2
*names
, /* input/output */
806 uint32
*pp_mapped_count
)
810 const DOM_SID
**sids
= NULL
;
811 DOM_R_REF
*ref
= NULL
;
812 uint32 mapped_count
= 0;
813 struct lsa_dom_info
*dom_infos
= NULL
;
814 struct lsa_name_info
*name_infos
= NULL
;
816 *pp_mapped_count
= 0;
824 sids
= TALLOC_ARRAY(p
->mem_ctx
, const DOM_SID
*, num_sids
);
825 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
827 if (sids
== NULL
|| ref
== NULL
) {
828 return NT_STATUS_NO_MEMORY
;
831 for (i
=0; i
<num_sids
; i
++) {
832 sids
[i
] = &sid
[i
].sid
;
835 status
= lookup_sids(p
->mem_ctx
, num_sids
, sids
, level
,
836 &dom_infos
, &name_infos
);
838 if (!NT_STATUS_IS_OK(status
)) {
842 names
->name
= TALLOC_ARRAY(p
->mem_ctx
, LSA_TRANS_NAME2
, num_sids
);
843 names
->uni_name
= TALLOC_ARRAY(p
->mem_ctx
, UNISTR2
, num_sids
);
844 if ((names
->name
== NULL
) || (names
->uni_name
== NULL
)) {
845 return NT_STATUS_NO_MEMORY
;
848 for (i
=0; i
<MAX_REF_DOMAINS
; i
++) {
850 if (!dom_infos
[i
].valid
) {
854 if (init_dom_ref(ref
, dom_infos
[i
].name
,
855 &dom_infos
[i
].sid
) != i
) {
856 DEBUG(0, ("Domain %s mentioned twice??\n",
858 return NT_STATUS_INTERNAL_ERROR
;
862 for (i
=0; i
<num_sids
; i
++) {
863 struct lsa_name_info
*name
= &name_infos
[i
];
865 if (name
->type
== SID_NAME_UNKNOWN
) {
867 /* unknown sids should return the string representation of the SID */
868 name
->name
= talloc_asprintf(p
->mem_ctx
, "%s",
869 sid_string_static(sids
[i
]));
870 if (name
->name
== NULL
) {
871 return NT_STATUS_NO_MEMORY
;
876 init_lsa_trans_name2(&names
->name
[i
], &names
->uni_name
[i
],
877 name
->type
, name
->name
, name
->dom_idx
);
880 names
->num_entries
= num_sids
;
881 names
->ptr_trans_names
= 1;
882 names
->num_entries2
= num_sids
;
884 status
= NT_STATUS_NONE_MAPPED
;
885 if (mapped_count
> 0) {
886 status
= (mapped_count
< num_sids
) ?
887 STATUS_SOME_UNMAPPED
: NT_STATUS_OK
;
890 DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
891 num_sids
, mapped_count
, nt_errstr(status
)));
893 *pp_mapped_count
= mapped_count
;
899 /***************************************************************************
901 ***************************************************************************/
903 NTSTATUS
_lsa_lookup_sids(pipes_struct
*p
,
904 LSA_Q_LOOKUP_SIDS
*q_u
,
905 LSA_R_LOOKUP_SIDS
*r_u
)
907 struct lsa_info
*handle
;
908 int num_sids
= q_u
->sids
.num_entries
;
909 uint32 mapped_count
= 0;
910 DOM_R_REF
*ref
= NULL
;
911 LSA_TRANS_NAME_ENUM2 names
;
914 if ((q_u
->level
< 1) || (q_u
->level
> 6)) {
915 return NT_STATUS_INVALID_PARAMETER
;
918 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
919 return NT_STATUS_INVALID_HANDLE
;
922 /* check if the user has enough rights */
923 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
924 return NT_STATUS_ACCESS_DENIED
;
927 if (num_sids
> MAX_LOOKUP_SIDS
) {
928 DEBUG(5,("_lsa_lookup_sids: limit of %d exceeded, requested %d\n",
929 MAX_LOOKUP_SIDS
, num_sids
));
930 return NT_STATUS_NONE_MAPPED
;
933 r_u
->status
= _lsa_lookup_sids_internal(p
,
941 /* Convert from LSA_TRANS_NAME_ENUM2 to LSA_TRANS_NAME_ENUM */
943 status
= init_reply_lookup_sids(p
->mem_ctx
, r_u
, ref
, &names
, mapped_count
);
944 if (!NT_STATUS_IS_OK(status
)) {
950 /***************************************************************************
952 ***************************************************************************/
954 NTSTATUS
_lsa_lookup_sids2(pipes_struct
*p
,
955 LSA_Q_LOOKUP_SIDS2
*q_u
,
956 LSA_R_LOOKUP_SIDS2
*r_u
)
958 struct lsa_info
*handle
;
959 int num_sids
= q_u
->sids
.num_entries
;
960 uint32 mapped_count
= 0;
961 DOM_R_REF
*ref
= NULL
;
963 if ((q_u
->level
< 1) || (q_u
->level
> 6)) {
964 return NT_STATUS_INVALID_PARAMETER
;
967 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
968 return NT_STATUS_INVALID_HANDLE
;
971 /* check if the user have enough rights */
972 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
973 return NT_STATUS_ACCESS_DENIED
;
976 if (num_sids
> MAX_LOOKUP_SIDS
) {
977 DEBUG(5,("_lsa_lookup_sids2: limit of %d exceeded, requested %d\n",
978 MAX_LOOKUP_SIDS
, num_sids
));
979 return NT_STATUS_NONE_MAPPED
;
982 r_u
->status
= _lsa_lookup_sids_internal(p
,
990 init_reply_lookup_sids2(r_u
, ref
, mapped_count
);
994 /***************************************************************************
996 ***************************************************************************/
998 NTSTATUS
_lsa_lookup_sids3(pipes_struct
*p
,
999 LSA_Q_LOOKUP_SIDS3
*q_u
,
1000 LSA_R_LOOKUP_SIDS3
*r_u
)
1002 int num_sids
= q_u
->sids
.num_entries
;
1003 uint32 mapped_count
= 0;
1004 DOM_R_REF
*ref
= NULL
;
1006 if ((q_u
->level
< 1) || (q_u
->level
> 6)) {
1007 return NT_STATUS_INVALID_PARAMETER
;
1010 /* No policy handle on this call. Restrict to crypto connections. */
1011 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
1012 DEBUG(0,("_lsa_lookup_sids3: client %s not using schannel for netlogon\n",
1013 get_remote_machine_name() ));
1014 return NT_STATUS_INVALID_PARAMETER
;
1017 if (num_sids
> MAX_LOOKUP_SIDS
) {
1018 DEBUG(5,("_lsa_lookup_sids3: limit of %d exceeded, requested %d\n",
1019 MAX_LOOKUP_SIDS
, num_sids
));
1020 return NT_STATUS_NONE_MAPPED
;
1023 r_u
->status
= _lsa_lookup_sids_internal(p
,
1031 init_reply_lookup_sids3(r_u
, ref
, mapped_count
);
1035 /***************************************************************************
1036 lsa_reply_lookup_names
1037 ***************************************************************************/
1039 NTSTATUS
_lsa_lookup_names(pipes_struct
*p
,LSA_Q_LOOKUP_NAMES
*q_u
, LSA_R_LOOKUP_NAMES
*r_u
)
1041 struct lsa_info
*handle
;
1042 UNISTR2
*names
= q_u
->uni_name
;
1043 uint32 num_entries
= q_u
->num_entries
;
1046 uint32 mapped_count
= 0;
1049 if (num_entries
> MAX_LOOKUP_SIDS
) {
1050 num_entries
= MAX_LOOKUP_SIDS
;
1051 DEBUG(5,("_lsa_lookup_names: truncating name lookup list to %d\n", num_entries
));
1054 /* Probably the lookup_level is some sort of bitmask. */
1055 if (q_u
->lookup_level
== 1) {
1056 flags
= LOOKUP_NAME_ALL
;
1059 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1061 return NT_STATUS_NO_MEMORY
;
1065 rids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_RID
, num_entries
);
1067 return NT_STATUS_NO_MEMORY
;
1073 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
1074 r_u
->status
= NT_STATUS_INVALID_HANDLE
;
1078 /* check if the user have enough rights */
1079 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
1080 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
1084 /* set up the LSA Lookup RIDs response */
1085 become_root(); /* lookup_name can require root privs */
1086 r_u
->status
= lookup_lsa_rids(p
->mem_ctx
, ref
, rids
, num_entries
,
1087 names
, flags
, &mapped_count
);
1092 if (NT_STATUS_IS_OK(r_u
->status
) && (num_entries
!= 0) ) {
1093 if (mapped_count
== 0)
1094 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1095 else if (mapped_count
!= num_entries
)
1096 r_u
->status
= STATUS_SOME_UNMAPPED
;
1099 init_reply_lookup_names(r_u
, ref
, num_entries
, rids
, mapped_count
);
1103 /***************************************************************************
1104 lsa_reply_lookup_names2
1105 ***************************************************************************/
1107 NTSTATUS
_lsa_lookup_names2(pipes_struct
*p
, LSA_Q_LOOKUP_NAMES2
*q_u
, LSA_R_LOOKUP_NAMES2
*r_u
)
1109 struct lsa_info
*handle
;
1110 UNISTR2
*names
= q_u
->uni_name
;
1111 uint32 num_entries
= q_u
->num_entries
;
1116 uint32 mapped_count
= 0;
1119 if (num_entries
> MAX_LOOKUP_SIDS
) {
1120 num_entries
= MAX_LOOKUP_SIDS
;
1121 DEBUG(5,("_lsa_lookup_names2: truncating name lookup list to %d\n", num_entries
));
1124 /* Probably the lookup_level is some sort of bitmask. */
1125 if (q_u
->lookup_level
== 1) {
1126 flags
= LOOKUP_NAME_ALL
;
1129 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1131 r_u
->status
= NT_STATUS_NO_MEMORY
;
1132 return NT_STATUS_NO_MEMORY
;
1136 rids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_RID
, num_entries
);
1137 rids2
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_RID2
, num_entries
);
1138 if ((rids
== NULL
) || (rids2
== NULL
)) {
1139 r_u
->status
= NT_STATUS_NO_MEMORY
;
1140 return NT_STATUS_NO_MEMORY
;
1147 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
1148 r_u
->status
= NT_STATUS_INVALID_HANDLE
;
1152 /* check if the user have enough rights */
1153 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
1154 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
1158 /* set up the LSA Lookup RIDs response */
1159 become_root(); /* lookup_name can require root privs */
1160 r_u
->status
= lookup_lsa_rids(p
->mem_ctx
, ref
, rids
, num_entries
,
1161 names
, flags
, &mapped_count
);
1166 if (NT_STATUS_IS_OK(r_u
->status
)) {
1167 if (mapped_count
== 0) {
1168 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1169 } else if (mapped_count
!= num_entries
) {
1170 r_u
->status
= STATUS_SOME_UNMAPPED
;
1174 /* Convert the rids array to rids2. */
1175 for (i
= 0; i
< num_entries
; i
++) {
1176 rids2
[i
].type
= rids
[i
].type
;
1177 rids2
[i
].rid
= rids
[i
].rid
;
1178 rids2
[i
].rid_idx
= rids
[i
].rid_idx
;
1179 rids2
[i
].unknown
= 0;
1182 init_reply_lookup_names2(r_u
, ref
, num_entries
, rids2
, mapped_count
);
1186 /***************************************************************************
1187 lsa_reply_lookup_names3.
1188 ***************************************************************************/
1190 NTSTATUS
_lsa_lookup_names3(pipes_struct
*p
, LSA_Q_LOOKUP_NAMES3
*q_u
, LSA_R_LOOKUP_NAMES3
*r_u
)
1192 struct lsa_info
*handle
;
1193 UNISTR2
*names
= q_u
->uni_name
;
1194 uint32 num_entries
= q_u
->num_entries
;
1195 DOM_R_REF
*ref
= NULL
;
1196 LSA_TRANSLATED_SID3
*trans_sids
= NULL
;
1197 uint32 mapped_count
= 0;
1200 if (num_entries
> MAX_LOOKUP_SIDS
) {
1201 num_entries
= MAX_LOOKUP_SIDS
;
1202 DEBUG(5,("_lsa_lookup_names3: truncating name lookup list to %d\n", num_entries
));
1205 /* Probably the lookup_level is some sort of bitmask. */
1206 if (q_u
->lookup_level
== 1) {
1207 flags
= LOOKUP_NAME_ALL
;
1210 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1212 return NT_STATUS_NO_MEMORY
;
1215 trans_sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, LSA_TRANSLATED_SID3
, num_entries
);
1217 return NT_STATUS_NO_MEMORY
;
1223 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
)) {
1224 r_u
->status
= NT_STATUS_INVALID_HANDLE
;
1228 /* check if the user have enough rights */
1229 if (!(handle
->access
& POLICY_LOOKUP_NAMES
)) {
1230 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
1234 /* set up the LSA Lookup SIDs response */
1235 become_root(); /* lookup_name can require root privs */
1236 r_u
->status
= lookup_lsa_sids(p
->mem_ctx
, ref
, trans_sids
, num_entries
,
1237 names
, flags
, &mapped_count
);
1242 if (NT_STATUS_IS_OK(r_u
->status
)) {
1243 if (mapped_count
== 0) {
1244 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1245 } else if (mapped_count
!= num_entries
) {
1246 r_u
->status
= STATUS_SOME_UNMAPPED
;
1250 init_reply_lookup_names3(r_u
, ref
, num_entries
, trans_sids
, mapped_count
);
1254 /***************************************************************************
1255 lsa_reply_lookup_names4.
1256 ***************************************************************************/
1258 NTSTATUS
_lsa_lookup_names4(pipes_struct
*p
, LSA_Q_LOOKUP_NAMES4
*q_u
, LSA_R_LOOKUP_NAMES4
*r_u
)
1260 UNISTR2
*names
= q_u
->uni_name
;
1261 uint32 num_entries
= q_u
->num_entries
;
1262 DOM_R_REF
*ref
= NULL
;
1263 LSA_TRANSLATED_SID3
*trans_sids
= NULL
;
1264 uint32 mapped_count
= 0;
1267 if (num_entries
> MAX_LOOKUP_SIDS
) {
1268 num_entries
= MAX_LOOKUP_SIDS
;
1269 DEBUG(5,("_lsa_lookup_names4: truncating name lookup list to %d\n", num_entries
));
1272 /* Probably the lookup_level is some sort of bitmask. */
1273 if (q_u
->lookup_level
== 1) {
1274 flags
= LOOKUP_NAME_ALL
;
1277 /* No policy handle on this call. Restrict to crypto connections. */
1278 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
1279 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1280 get_remote_machine_name() ));
1281 return NT_STATUS_INVALID_PARAMETER
;
1284 ref
= TALLOC_ZERO_P(p
->mem_ctx
, DOM_R_REF
);
1286 return NT_STATUS_NO_MEMORY
;
1290 trans_sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, LSA_TRANSLATED_SID3
, num_entries
);
1292 return NT_STATUS_NO_MEMORY
;
1298 /* set up the LSA Lookup SIDs response */
1299 become_root(); /* lookup_name can require root privs */
1300 r_u
->status
= lookup_lsa_sids(p
->mem_ctx
, ref
, trans_sids
, num_entries
,
1301 names
, flags
, &mapped_count
);
1304 if (NT_STATUS_IS_OK(r_u
->status
)) {
1305 if (mapped_count
== 0) {
1306 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1307 } else if (mapped_count
!= num_entries
) {
1308 r_u
->status
= STATUS_SOME_UNMAPPED
;
1312 init_reply_lookup_names4(r_u
, ref
, num_entries
, trans_sids
, mapped_count
);
1316 /***************************************************************************
1317 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1318 ***************************************************************************/
1320 NTSTATUS
_lsa_close(pipes_struct
*p
, LSA_Q_CLOSE
*q_u
, LSA_R_CLOSE
*r_u
)
1322 if (!find_policy_by_hnd(p
, &q_u
->pol
, NULL
)) {
1323 return NT_STATUS_INVALID_HANDLE
;
1326 close_policy_hnd(p
, &q_u
->pol
);
1327 return NT_STATUS_OK
;
1330 /***************************************************************************
1331 ***************************************************************************/
1333 NTSTATUS
_lsa_open_secret(pipes_struct
*p
, LSA_Q_OPEN_SECRET
*q_u
, LSA_R_OPEN_SECRET
*r_u
)
1335 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1338 /***************************************************************************
1339 ***************************************************************************/
1341 NTSTATUS
_lsa_open_trusted_domain(pipes_struct
*p
, LSA_Q_OPEN_TRUSTED_DOMAIN
*q_u
, LSA_R_OPEN_TRUSTED_DOMAIN
*r_u
)
1343 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1346 /***************************************************************************
1347 ***************************************************************************/
1349 NTSTATUS
_lsa_create_trusted_domain(pipes_struct
*p
, LSA_Q_CREATE_TRUSTED_DOMAIN
*q_u
, LSA_R_CREATE_TRUSTED_DOMAIN
*r_u
)
1351 return NT_STATUS_ACCESS_DENIED
;
1354 /***************************************************************************
1355 ***************************************************************************/
1357 NTSTATUS
_lsa_create_secret(pipes_struct
*p
, LSA_Q_CREATE_SECRET
*q_u
, LSA_R_CREATE_SECRET
*r_u
)
1359 return NT_STATUS_ACCESS_DENIED
;
1362 /***************************************************************************
1363 ***************************************************************************/
1365 NTSTATUS
_lsa_set_secret(pipes_struct
*p
, LSA_Q_SET_SECRET
*q_u
, LSA_R_SET_SECRET
*r_u
)
1367 return NT_STATUS_ACCESS_DENIED
;
1370 /***************************************************************************
1371 ***************************************************************************/
1373 NTSTATUS
_lsa_delete_object(pipes_struct
*p
, LSA_Q_DELETE_OBJECT
*q_u
, LSA_R_DELETE_OBJECT
*r_u
)
1375 return NT_STATUS_ACCESS_DENIED
;
1378 /***************************************************************************
1380 ***************************************************************************/
1382 NTSTATUS
_lsa_enum_privs(pipes_struct
*p
, LSA_Q_ENUM_PRIVS
*q_u
, LSA_R_ENUM_PRIVS
*r_u
)
1384 struct lsa_info
*handle
;
1386 uint32 enum_context
= q_u
->enum_context
;
1387 int num_privs
= count_all_privileges();
1388 LSA_PRIV_ENTRY
*entries
= NULL
;
1391 /* remember that the enum_context starts at 0 and not 1 */
1393 if ( enum_context
>= num_privs
)
1394 return NT_STATUS_NO_MORE_ENTRIES
;
1396 DEBUG(10,("_lsa_enum_privs: enum_context:%d total entries:%d\n",
1397 enum_context
, num_privs
));
1399 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1400 return NT_STATUS_INVALID_HANDLE
;
1402 /* check if the user have enough rights
1403 I don't know if it's the right one. not documented. */
1405 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1406 return NT_STATUS_ACCESS_DENIED
;
1409 if ( !(entries
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, LSA_PRIV_ENTRY
, num_privs
)) )
1410 return NT_STATUS_NO_MEMORY
;
1415 for (i
= 0; i
< num_privs
; i
++) {
1416 if( i
< enum_context
) {
1417 init_unistr2(&entries
[i
].name
, NULL
, UNI_FLAGS_NONE
);
1418 init_uni_hdr(&entries
[i
].hdr_name
, &entries
[i
].name
);
1420 entries
[i
].luid_low
= 0;
1421 entries
[i
].luid_high
= 0;
1423 init_unistr2(&entries
[i
].name
, privs
[i
].name
, UNI_FLAGS_NONE
);
1424 init_uni_hdr(&entries
[i
].hdr_name
, &entries
[i
].name
);
1426 luid
= get_privilege_luid( &privs
[i
].se_priv
);
1428 entries
[i
].luid_low
= luid
.luid
.low
;
1429 entries
[i
].luid_high
= luid
.luid
.high
;
1433 enum_context
= num_privs
;
1435 init_lsa_r_enum_privs(r_u
, enum_context
, num_privs
, entries
);
1437 return NT_STATUS_OK
;
1440 /***************************************************************************
1441 _lsa_priv_get_dispname.
1442 ***************************************************************************/
1444 NTSTATUS
_lsa_priv_get_dispname(pipes_struct
*p
, LSA_Q_PRIV_GET_DISPNAME
*q_u
, LSA_R_PRIV_GET_DISPNAME
*r_u
)
1446 struct lsa_info
*handle
;
1448 const char *description
;
1450 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1451 return NT_STATUS_INVALID_HANDLE
;
1453 /* check if the user have enough rights */
1456 * I don't know if it's the right one. not documented.
1458 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1459 return NT_STATUS_ACCESS_DENIED
;
1461 unistr2_to_ascii(name_asc
, &q_u
->name
, sizeof(name_asc
));
1463 DEBUG(10,("_lsa_priv_get_dispname: name = %s\n", name_asc
));
1465 description
= get_privilege_dispname( name_asc
);
1467 if ( description
) {
1468 DEBUG(10,("_lsa_priv_get_dispname: display name = %s\n", description
));
1470 init_unistr2(&r_u
->desc
, description
, UNI_FLAGS_NONE
);
1471 init_uni_hdr(&r_u
->hdr_desc
, &r_u
->desc
);
1473 r_u
->ptr_info
= 0xdeadbeef;
1474 r_u
->lang_id
= q_u
->lang_id
;
1476 return NT_STATUS_OK
;
1478 DEBUG(10,("_lsa_priv_get_dispname: doesn't exist\n"));
1482 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1486 /***************************************************************************
1488 ***************************************************************************/
1490 NTSTATUS
_lsa_enum_accounts(pipes_struct
*p
, LSA_Q_ENUM_ACCOUNTS
*q_u
, LSA_R_ENUM_ACCOUNTS
*r_u
)
1492 struct lsa_info
*handle
;
1494 int i
, j
, num_entries
;
1495 LSA_SID_ENUM
*sids
=&r_u
->sids
;
1498 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1499 return NT_STATUS_INVALID_HANDLE
;
1501 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1502 return NT_STATUS_ACCESS_DENIED
;
1507 /* The only way we can currently find out all the SIDs that have been
1508 privileged is to scan all privileges */
1510 if (!NT_STATUS_IS_OK(ret
= privilege_enumerate_accounts(&sid_list
, &num_entries
))) {
1514 if (q_u
->enum_context
>= num_entries
)
1515 return NT_STATUS_NO_MORE_ENTRIES
;
1517 if (num_entries
-q_u
->enum_context
) {
1518 sids
->ptr_sid
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, uint32
, num_entries
-q_u
->enum_context
);
1519 sids
->sid
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_SID2
, num_entries
-q_u
->enum_context
);
1521 if (sids
->ptr_sid
==NULL
|| sids
->sid
==NULL
) {
1522 SAFE_FREE(sid_list
);
1523 return NT_STATUS_NO_MEMORY
;
1526 sids
->ptr_sid
= NULL
;
1530 for (i
= q_u
->enum_context
, j
= 0; i
< num_entries
; i
++, j
++) {
1531 init_dom_sid2(&(*sids
).sid
[j
], &sid_list
[i
]);
1532 (*sids
).ptr_sid
[j
] = 1;
1535 talloc_free(sid_list
);
1537 init_lsa_r_enum_accounts(r_u
, num_entries
);
1539 return NT_STATUS_OK
;
1543 NTSTATUS
_lsa_unk_get_connuser(pipes_struct
*p
, LSA_Q_UNK_GET_CONNUSER
*q_u
, LSA_R_UNK_GET_CONNUSER
*r_u
)
1545 fstring username
, domname
;
1546 user_struct
*vuser
= get_valid_user_struct(p
->vuid
);
1549 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1551 fstrcpy(username
, vuser
->user
.smb_name
);
1552 fstrcpy(domname
, vuser
->user
.domain
);
1554 r_u
->ptr_user_name
= 1;
1555 init_unistr2(&r_u
->uni2_user_name
, username
, UNI_STR_TERMINATE
);
1556 init_uni_hdr(&r_u
->hdr_user_name
, &r_u
->uni2_user_name
);
1560 r_u
->ptr_dom_name
= 1;
1561 init_unistr2(&r_u
->uni2_dom_name
, domname
, UNI_STR_TERMINATE
);
1562 init_uni_hdr(&r_u
->hdr_dom_name
, &r_u
->uni2_dom_name
);
1564 r_u
->status
= NT_STATUS_OK
;
1569 /***************************************************************************
1571 ***************************************************************************/
1573 NTSTATUS
_lsa_create_account(pipes_struct
*p
, LSA_Q_CREATEACCOUNT
*q_u
, LSA_R_CREATEACCOUNT
*r_u
)
1575 struct lsa_info
*handle
;
1576 struct lsa_info
*info
;
1578 /* find the connection policy handle. */
1579 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1580 return NT_STATUS_INVALID_HANDLE
;
1582 /* check if the user have enough rights */
1585 * I don't know if it's the right one. not documented.
1586 * but guessed with rpcclient.
1588 if (!(handle
->access
& POLICY_GET_PRIVATE_INFORMATION
))
1589 return NT_STATUS_ACCESS_DENIED
;
1591 /* check to see if the pipe_user is a Domain Admin since
1592 account_pol.tdb was already opened as root, this is all we have */
1594 if ( !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1595 return NT_STATUS_ACCESS_DENIED
;
1597 if ( is_privileged_sid( &q_u
->sid
.sid
) )
1598 return NT_STATUS_OBJECT_NAME_COLLISION
;
1600 /* associate the user/group SID with the (unique) handle. */
1602 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1603 return NT_STATUS_NO_MEMORY
;
1606 info
->sid
= q_u
->sid
.sid
;
1607 info
->access
= q_u
->access
;
1609 /* get a (unique) handle. open a policy on it. */
1610 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
1611 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1613 return privilege_create_account( &info
->sid
);
1617 /***************************************************************************
1619 ***************************************************************************/
1621 NTSTATUS
_lsa_open_account(pipes_struct
*p
, LSA_Q_OPENACCOUNT
*q_u
, LSA_R_OPENACCOUNT
*r_u
)
1623 struct lsa_info
*handle
;
1624 struct lsa_info
*info
;
1626 /* find the connection policy handle. */
1627 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1628 return NT_STATUS_INVALID_HANDLE
;
1630 /* check if the user have enough rights */
1633 * I don't know if it's the right one. not documented.
1634 * but guessed with rpcclient.
1636 if (!(handle
->access
& POLICY_GET_PRIVATE_INFORMATION
))
1637 return NT_STATUS_ACCESS_DENIED
;
1639 /* TODO: Fis the parsing routine before reenabling this check! */
1641 if (!lookup_sid(&handle
->sid
, dom_name
, name
, &type
))
1642 return NT_STATUS_ACCESS_DENIED
;
1644 /* associate the user/group SID with the (unique) handle. */
1645 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1646 return NT_STATUS_NO_MEMORY
;
1649 info
->sid
= q_u
->sid
.sid
;
1650 info
->access
= q_u
->access
;
1652 /* get a (unique) handle. open a policy on it. */
1653 if (!create_policy_hnd(p
, &r_u
->pol
, free_lsa_info
, (void *)info
))
1654 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1656 return NT_STATUS_OK
;
1659 /***************************************************************************
1660 For a given SID, enumerate all the privilege this account has.
1661 ***************************************************************************/
1663 NTSTATUS
_lsa_enum_privsaccount(pipes_struct
*p
, prs_struct
*ps
, LSA_Q_ENUMPRIVSACCOUNT
*q_u
, LSA_R_ENUMPRIVSACCOUNT
*r_u
)
1665 struct lsa_info
*info
=NULL
;
1667 PRIVILEGE_SET privileges
;
1669 /* find the connection policy handle. */
1670 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1671 return NT_STATUS_INVALID_HANDLE
;
1673 if ( !get_privileges_for_sids( &mask
, &info
->sid
, 1 ) )
1674 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1676 privilege_set_init( &privileges
);
1678 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
1680 DEBUG(10,("_lsa_enum_privsaccount: %s has %d privileges\n",
1681 sid_string_static(&info
->sid
), privileges
.count
));
1683 r_u
->status
= init_lsa_r_enum_privsaccount(ps
->mem_ctx
, r_u
, privileges
.set
, privileges
.count
, 0);
1686 r_u
->status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
1688 privilege_set_free( &privileges
);
1693 /***************************************************************************
1695 ***************************************************************************/
1697 NTSTATUS
_lsa_getsystemaccount(pipes_struct
*p
, LSA_Q_GETSYSTEMACCOUNT
*q_u
, LSA_R_GETSYSTEMACCOUNT
*r_u
)
1699 struct lsa_info
*info
=NULL
;
1701 /* find the connection policy handle. */
1703 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1704 return NT_STATUS_INVALID_HANDLE
;
1706 if (!lookup_sid(p
->mem_ctx
, &info
->sid
, NULL
, NULL
, NULL
))
1707 return NT_STATUS_ACCESS_DENIED
;
1710 0x01 -> Log on locally
1711 0x02 -> Access this computer from network
1712 0x04 -> Log on as a batch job
1713 0x10 -> Log on as a service
1715 they can be ORed together
1718 r_u
->access
= PR_LOG_ON_LOCALLY
| PR_ACCESS_FROM_NETWORK
;
1720 return NT_STATUS_OK
;
1723 /***************************************************************************
1724 update the systemaccount information
1725 ***************************************************************************/
1727 NTSTATUS
_lsa_setsystemaccount(pipes_struct
*p
, LSA_Q_SETSYSTEMACCOUNT
*q_u
, LSA_R_SETSYSTEMACCOUNT
*r_u
)
1729 struct lsa_info
*info
=NULL
;
1731 r_u
->status
= NT_STATUS_OK
;
1733 /* find the connection policy handle. */
1734 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1735 return NT_STATUS_INVALID_HANDLE
;
1737 /* check to see if the pipe_user is a Domain Admin since
1738 account_pol.tdb was already opened as root, this is all we have */
1740 if ( !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1741 return NT_STATUS_ACCESS_DENIED
;
1743 if (!pdb_getgrsid(&map
, info
->sid
))
1744 return NT_STATUS_NO_SUCH_GROUP
;
1746 return pdb_update_group_mapping_entry(&map
);
1749 /***************************************************************************
1750 For a given SID, add some privileges.
1751 ***************************************************************************/
1753 NTSTATUS
_lsa_addprivs(pipes_struct
*p
, LSA_Q_ADDPRIVS
*q_u
, LSA_R_ADDPRIVS
*r_u
)
1755 struct lsa_info
*info
= NULL
;
1757 PRIVILEGE_SET
*set
= NULL
;
1758 struct current_user user
;
1760 /* find the connection policy handle. */
1761 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1762 return NT_STATUS_INVALID_HANDLE
;
1764 /* check to see if the pipe_user is root or a Domain Admin since
1765 account_pol.tdb was already opened as root, this is all we have */
1767 get_current_user( &user
, p
);
1768 if ( user
.ut
.uid
!= sec_initial_uid()
1769 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1771 return NT_STATUS_ACCESS_DENIED
;
1776 if ( !privilege_set_to_se_priv( &mask
, set
) )
1777 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1779 if ( !grant_privilege( &info
->sid
, &mask
) ) {
1780 DEBUG(3,("_lsa_addprivs: grant_privilege(%s) failed!\n",
1781 sid_string_static(&info
->sid
) ));
1782 DEBUG(3,("Privilege mask:\n"));
1783 dump_se_priv( DBGC_ALL
, 3, &mask
);
1784 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1787 return NT_STATUS_OK
;
1790 /***************************************************************************
1791 For a given SID, remove some privileges.
1792 ***************************************************************************/
1794 NTSTATUS
_lsa_removeprivs(pipes_struct
*p
, LSA_Q_REMOVEPRIVS
*q_u
, LSA_R_REMOVEPRIVS
*r_u
)
1796 struct lsa_info
*info
= NULL
;
1798 PRIVILEGE_SET
*set
= NULL
;
1799 struct current_user user
;
1801 /* find the connection policy handle. */
1802 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1803 return NT_STATUS_INVALID_HANDLE
;
1805 /* check to see if the pipe_user is root or a Domain Admin since
1806 account_pol.tdb was already opened as root, this is all we have */
1808 get_current_user( &user
, p
);
1809 if ( user
.ut
.uid
!= sec_initial_uid()
1810 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1812 return NT_STATUS_ACCESS_DENIED
;
1817 if ( !privilege_set_to_se_priv( &mask
, set
) )
1818 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1820 if ( !revoke_privilege( &info
->sid
, &mask
) ) {
1821 DEBUG(3,("_lsa_removeprivs: revoke_privilege(%s) failed!\n",
1822 sid_string_static(&info
->sid
) ));
1823 DEBUG(3,("Privilege mask:\n"));
1824 dump_se_priv( DBGC_ALL
, 3, &mask
);
1825 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1828 return NT_STATUS_OK
;
1831 /***************************************************************************
1832 For a given SID, remove some privileges.
1833 ***************************************************************************/
1835 NTSTATUS
_lsa_query_secobj(pipes_struct
*p
, LSA_Q_QUERY_SEC_OBJ
*q_u
, LSA_R_QUERY_SEC_OBJ
*r_u
)
1837 struct lsa_info
*handle
=NULL
;
1838 SEC_DESC
*psd
= NULL
;
1842 r_u
->status
= NT_STATUS_OK
;
1844 /* find the connection policy handle. */
1845 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1846 return NT_STATUS_INVALID_HANDLE
;
1848 /* check if the user have enough rights */
1849 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1850 return NT_STATUS_ACCESS_DENIED
;
1853 switch (q_u
->sec_info
) {
1855 /* SD contains only the owner */
1857 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1858 if(!NT_STATUS_IS_OK(status
))
1859 return NT_STATUS_NO_MEMORY
;
1862 if((r_u
->buf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1863 return NT_STATUS_NO_MEMORY
;
1866 /* SD contains only the ACL */
1868 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1869 if(!NT_STATUS_IS_OK(status
))
1870 return NT_STATUS_NO_MEMORY
;
1872 if((r_u
->buf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1873 return NT_STATUS_NO_MEMORY
;
1876 return NT_STATUS_INVALID_LEVEL
;
1884 #if 0 /* AD DC work in ongoing in Samba 4 */
1886 /***************************************************************************
1887 ***************************************************************************/
1889 NTSTATUS
_lsa_query_info2(pipes_struct
*p
, LSA_Q_QUERY_INFO2
*q_u
, LSA_R_QUERY_INFO2
*r_u
)
1891 struct lsa_info
*handle
;
1892 const char *nb_name
;
1893 char *dns_name
= NULL
;
1894 char *forest_name
= NULL
;
1895 DOM_SID
*sid
= NULL
;
1900 r_u
->status
= NT_STATUS_OK
;
1902 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1903 return NT_STATUS_INVALID_HANDLE
;
1905 switch (q_u
->info_class
) {
1907 /* check if the user have enough rights */
1908 if (!(handle
->access
& POLICY_VIEW_LOCAL_INFORMATION
))
1909 return NT_STATUS_ACCESS_DENIED
;
1911 /* Request PolicyPrimaryDomainInformation. */
1912 switch (lp_server_role()) {
1913 case ROLE_DOMAIN_PDC
:
1914 case ROLE_DOMAIN_BDC
:
1915 nb_name
= get_global_sam_name();
1916 /* ugly temp hack for these next two */
1918 /* This should be a 'netbios domain -> DNS domain' mapping */
1919 dnsdomname
[0] = '\0';
1920 get_mydnsdomname(dnsdomname
);
1921 strlower_m(dnsdomname
);
1923 dns_name
= dnsdomname
;
1924 forest_name
= dnsdomname
;
1926 sid
= get_global_sam_sid();
1927 secrets_fetch_domain_guid(lp_workgroup(), &guid
);
1930 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1932 init_dns_dom_info(&r_u
->info
.dns_dom_info
, nb_name
, dns_name
,
1933 forest_name
,&guid
,sid
);
1936 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u
->info_class
));
1937 r_u
->status
= NT_STATUS_INVALID_INFO_CLASS
;
1941 if (NT_STATUS_IS_OK(r_u
->status
)) {
1943 r_u
->info_class
= q_u
->info_class
;
1948 #endif /* AD DC work in ongoing in Samba 4 */
1950 /***************************************************************************
1951 ***************************************************************************/
1953 NTSTATUS
_lsa_add_acct_rights(pipes_struct
*p
, LSA_Q_ADD_ACCT_RIGHTS
*q_u
, LSA_R_ADD_ACCT_RIGHTS
*r_u
)
1955 struct lsa_info
*info
= NULL
;
1959 UNISTR4_ARRAY
*uni_privnames
= q_u
->rights
;
1960 struct current_user user
;
1963 /* find the connection policy handle. */
1964 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1965 return NT_STATUS_INVALID_HANDLE
;
1967 /* check to see if the pipe_user is a Domain Admin since
1968 account_pol.tdb was already opened as root, this is all we have */
1970 get_current_user( &user
, p
);
1971 if ( user
.ut
.uid
!= sec_initial_uid()
1972 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1974 return NT_STATUS_ACCESS_DENIED
;
1977 /* according to an NT4 PDC, you can add privileges to SIDs even without
1978 call_lsa_create_account() first. And you can use any arbitrary SID. */
1980 sid_copy( &sid
, &q_u
->sid
.sid
);
1982 /* just a little sanity check */
1984 if ( q_u
->count
!= uni_privnames
->count
) {
1985 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
1986 return NT_STATUS_INVALID_HANDLE
;
1989 for ( i
=0; i
<q_u
->count
; i
++ ) {
1990 UNISTR4
*uni4_str
= &uni_privnames
->strings
[i
];
1992 /* only try to add non-null strings */
1994 if ( !uni4_str
->string
)
1997 rpcstr_pull( privname
, uni4_str
->string
->buffer
, sizeof(privname
), -1, STR_TERMINATE
);
1999 if ( !grant_privilege_by_name( &sid
, privname
) ) {
2000 DEBUG(2,("_lsa_add_acct_rights: Failed to add privilege [%s]\n", privname
));
2001 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2005 return NT_STATUS_OK
;
2008 /***************************************************************************
2009 ***************************************************************************/
2011 NTSTATUS
_lsa_remove_acct_rights(pipes_struct
*p
, LSA_Q_REMOVE_ACCT_RIGHTS
*q_u
, LSA_R_REMOVE_ACCT_RIGHTS
*r_u
)
2013 struct lsa_info
*info
= NULL
;
2017 UNISTR4_ARRAY
*uni_privnames
= q_u
->rights
;
2018 struct current_user user
;
2021 /* find the connection policy handle. */
2022 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
2023 return NT_STATUS_INVALID_HANDLE
;
2025 /* check to see if the pipe_user is a Domain Admin since
2026 account_pol.tdb was already opened as root, this is all we have */
2028 get_current_user( &user
, p
);
2029 if ( user
.ut
.uid
!= sec_initial_uid()
2030 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
2032 return NT_STATUS_ACCESS_DENIED
;
2035 sid_copy( &sid
, &q_u
->sid
.sid
);
2037 if ( q_u
->removeall
) {
2038 if ( !revoke_all_privileges( &sid
) )
2039 return NT_STATUS_ACCESS_DENIED
;
2041 return NT_STATUS_OK
;
2044 /* just a little sanity check */
2046 if ( q_u
->count
!= uni_privnames
->count
) {
2047 DEBUG(0,("_lsa_add_acct_rights: count != number of UNISTR2 elements!\n"));
2048 return NT_STATUS_INVALID_HANDLE
;
2051 for ( i
=0; i
<q_u
->count
; i
++ ) {
2052 UNISTR4
*uni4_str
= &uni_privnames
->strings
[i
];
2054 /* only try to add non-null strings */
2056 if ( !uni4_str
->string
)
2059 rpcstr_pull( privname
, uni4_str
->string
->buffer
, sizeof(privname
), -1, STR_TERMINATE
);
2061 if ( !revoke_privilege_by_name( &sid
, privname
) ) {
2062 DEBUG(2,("_lsa_remove_acct_rights: Failed to revoke privilege [%s]\n", privname
));
2063 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2067 return NT_STATUS_OK
;
2071 /***************************************************************************
2072 ***************************************************************************/
2074 NTSTATUS
_lsa_enum_acct_rights(pipes_struct
*p
, LSA_Q_ENUM_ACCT_RIGHTS
*q_u
, LSA_R_ENUM_ACCT_RIGHTS
*r_u
)
2076 struct lsa_info
*info
= NULL
;
2078 PRIVILEGE_SET privileges
;
2082 /* find the connection policy handle. */
2084 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
2085 return NT_STATUS_INVALID_HANDLE
;
2087 /* according to an NT4 PDC, you can add privileges to SIDs even without
2088 call_lsa_create_account() first. And you can use any arbitrary SID. */
2090 sid_copy( &sid
, &q_u
->sid
.sid
);
2092 if ( !get_privileges_for_sids( &mask
, &sid
, 1 ) )
2093 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2095 privilege_set_init( &privileges
);
2097 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
2099 DEBUG(10,("_lsa_enum_acct_rights: %s has %d privileges\n",
2100 sid_string_static(&sid
), privileges
.count
));
2102 r_u
->status
= init_r_enum_acct_rights( r_u
, &privileges
);
2105 r_u
->status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
2107 privilege_set_free( &privileges
);
2113 /***************************************************************************
2114 ***************************************************************************/
2116 NTSTATUS
_lsa_lookup_priv_value(pipes_struct
*p
, LSA_Q_LOOKUP_PRIV_VALUE
*q_u
, LSA_R_LOOKUP_PRIV_VALUE
*r_u
)
2118 struct lsa_info
*info
= NULL
;
2120 LUID_ATTR priv_luid
;
2123 /* find the connection policy handle. */
2125 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
2126 return NT_STATUS_INVALID_HANDLE
;
2128 unistr2_to_ascii(name
, &q_u
->privname
.unistring
, sizeof(name
));
2130 DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name
));
2132 if ( !se_priv_from_name( name
, &mask
) )
2133 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2135 priv_luid
= get_privilege_luid( &mask
);
2137 r_u
->luid
.low
= priv_luid
.luid
.low
;
2138 r_u
->luid
.high
= priv_luid
.luid
.high
;
2141 return NT_STATUS_OK
;