source/rpc_server/srv_samr_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell                   1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton      1996-1997,
   6  *  Copyright (C) Paul Ashton                       1997,
   7  *  Copyright (C) Marc Jacobsen                     1999,
   8  *  Copyright (C) Jeremy Allison                    2001-2005,
   9  *  Copyright (C) Jean François Micouleau           1998-2001,
  10  *  Copyright (C) Jim McDonough <jmcd@us.ibm.com>   2002,
  11  *  Copyright (C) Gerald (Jerry) Carter             2003-2004,
  12  *  Copyright (C) Simo Sorce                        2003.
  13  *  Copyright (C) Volker Lendecke                   2005.
  14  *
  15  *  This program is free software; you can redistribute it and/or modify
  16  *  it under the terms of the GNU General Public License as published by
  17  *  the Free Software Foundation; either version 2 of the License, or
  18  *  (at your option) any later version.
  19  *
  20  *  This program is distributed in the hope that it will be useful,
  21  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  22  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23  *  GNU General Public License for more details.
  24  *
  25  *  You should have received a copy of the GNU General Public License
  26  *  along with this program; if not, write to the Free Software
  27  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  28  */
  29
  30 /*
  31  * This is the implementation of the SAMR code.
  32  */
  33
  34 #include "includes.h"
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_RPC_SRV
  38
  39 #define SAMR_USR_RIGHTS_WRITE_PW \
  40                 ( READ_CONTROL_ACCESS           | \
  41                   SA_RIGHT_USER_CHANGE_PASSWORD | \
  42                   SA_RIGHT_USER_SET_LOC_COM )
  43 #define SAMR_USR_RIGHTS_CANT_WRITE_PW \
  44                 ( READ_CONTROL_ACCESS | SA_RIGHT_USER_SET_LOC_COM )
  45
  46 #define DISP_INFO_CACHE_TIMEOUT 10
  47
  48 typedef struct disp_info {
  49         DOM_SID sid; /* identify which domain this is. */
  50         BOOL builtin_domain; /* Quick flag to check if this is the builtin domain. */
  51         struct pdb_search *users; /* querydispinfo 1 and 4 */
  52         struct pdb_search *machines; /* querydispinfo 2 */
  53         struct pdb_search *groups; /* querydispinfo 3 and 5, enumgroups */
  54         struct pdb_search *aliases; /* enumaliases */
  55
  56         uint16 enum_acb_mask;
  57         struct pdb_search *enum_users; /* enumusers with a mask */
  58
  59
  60         smb_event_id_t di_cache_timeout_event; /* cache idle timeout handler. */
  61 } DISP_INFO;
  62
  63 /* We keep a static list of these by SID as modern clients close down
  64    all resources between each request in a complete enumeration. */
  65
  66 struct samr_info {
  67         /* for use by the \PIPE\samr policy */
  68         DOM_SID sid;
  69         BOOL builtin_domain; /* Quick flag to check if this is the builtin domain. */
  70         uint32 status; /* some sort of flag.  best to record it.  comes from opnum 0x39 */
  71         uint32 acc_granted;
  72         DISP_INFO *disp_info;
  73         TALLOC_CTX *mem_ctx;
  74 };
  75
  76 static struct generic_mapping sam_generic_mapping = {
  77         GENERIC_RIGHTS_SAM_READ,
  78         GENERIC_RIGHTS_SAM_WRITE,
  79         GENERIC_RIGHTS_SAM_EXECUTE,
  80         GENERIC_RIGHTS_SAM_ALL_ACCESS};
  81 static struct generic_mapping dom_generic_mapping = {
  82         GENERIC_RIGHTS_DOMAIN_READ,
  83         GENERIC_RIGHTS_DOMAIN_WRITE,
  84         GENERIC_RIGHTS_DOMAIN_EXECUTE,
  85         GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
  86 static struct generic_mapping usr_generic_mapping = {
  87         GENERIC_RIGHTS_USER_READ,
  88         GENERIC_RIGHTS_USER_WRITE,
  89         GENERIC_RIGHTS_USER_EXECUTE,
  90         GENERIC_RIGHTS_USER_ALL_ACCESS};
  91 static struct generic_mapping usr_nopwchange_generic_mapping = {
  92         GENERIC_RIGHTS_USER_READ,
  93         GENERIC_RIGHTS_USER_WRITE,
  94         GENERIC_RIGHTS_USER_EXECUTE & ~SA_RIGHT_USER_CHANGE_PASSWORD,
  95         GENERIC_RIGHTS_USER_ALL_ACCESS};
  96 static struct generic_mapping grp_generic_mapping = {
  97         GENERIC_RIGHTS_GROUP_READ,
  98         GENERIC_RIGHTS_GROUP_WRITE,
  99         GENERIC_RIGHTS_GROUP_EXECUTE,
 100         GENERIC_RIGHTS_GROUP_ALL_ACCESS};
 101 static struct generic_mapping ali_generic_mapping = {
 102         GENERIC_RIGHTS_ALIAS_READ,
 103         GENERIC_RIGHTS_ALIAS_WRITE,
 104         GENERIC_RIGHTS_ALIAS_EXECUTE,
 105         GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
 106
 107 /*******************************************************************
 108 *******************************************************************/
 109
 110 static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size,
 111                                      struct generic_mapping *map,
 112                                      DOM_SID *sid, uint32 sid_access )
 113 {
 114         DOM_SID domadmin_sid;
 115         SEC_ACE ace[5];         /* at most 5 entries */
 116         SEC_ACCESS mask;
 117         size_t i = 0;
 118
 119         SEC_ACL *psa = NULL;
 120
 121         /* basic access for Everyone */
 122
 123         init_sec_access(&mask, map->generic_execute | map->generic_read );
 124         init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 125
 126         /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
 127
 128         init_sec_access(&mask, map->generic_all);
 129
 130         init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 131         init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 132
 133         /* Add Full Access for Domain Admins if we are a DC */
 134
 135         if ( IS_DC ) {
 136                 sid_copy( &domadmin_sid, get_global_sam_sid() );
 137                 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
 138                 init_sec_ace(&ace[i++], &domadmin_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 139         }
 140
 141         /* if we have a sid, give it some special access */
 142
 143         if ( sid ) {
 144                 init_sec_access( &mask, sid_access );
 145                 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
 146         }
 147
 148         /* create the security descriptor */
 149
 150         if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
 151                 return NT_STATUS_NO_MEMORY;
 152
 153         if ((*psd = make_sec_desc(ctx, SEC_DESC_REVISION, SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL, psa, sd_size)) == NULL)
 154                 return NT_STATUS_NO_MEMORY;
 155
 156         return NT_STATUS_OK;
 157 }
 158
 159 /*******************************************************************
 160  Checks if access to an object should be granted, and returns that
 161  level of access for further checks.
 162 ********************************************************************/
 163
 164 static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
 165                                           SE_PRIV *rights, uint32 rights_mask,
 166                                           uint32 des_access, uint32 *acc_granted,
 167                                           const char *debug )
 168 {
 169         NTSTATUS status = NT_STATUS_ACCESS_DENIED;
 170         uint32 saved_mask = 0;
 171
 172         /* check privileges; certain SAM access bits should be overridden
 173            by privileges (mostly having to do with creating/modifying/deleting
 174            users and groups) */
 175
 176         if ( rights && user_has_any_privilege( token, rights ) ) {
 177
 178                 saved_mask = (des_access & rights_mask);
 179                 des_access &= ~saved_mask;
 180
 181                 DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
 182                         rights_mask));
 183         }
 184
 185
 186         /* check the security descriptor first */
 187
 188         if ( se_access_check(psd, token, des_access, acc_granted, &status) )
 189                 goto done;
 190
 191         /* give root a free pass */
 192
 193         if ( geteuid() == sec_initial_uid() ) {
 194
 195                 DEBUG(4,("%s: ACCESS should be DENIED  (requested: %#010x)\n", debug, des_access));
 196                 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
 197
 198                 *acc_granted = des_access;
 199
 200                 status = NT_STATUS_OK;
 201                 goto done;
 202         }
 203
 204
 205 done:
 206         /* add in any bits saved during the privilege check (only
 207            matters is status is ok) */
 208
 209         *acc_granted |= rights_mask;
 210
 211         DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
 212                 debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED",
 213                 des_access, *acc_granted));
 214
 215         return status;
 216 }
 217
 218 /*******************************************************************
 219  Checks if access to a function can be granted
 220 ********************************************************************/
 221
 222 static NTSTATUS access_check_samr_function(uint32 acc_granted, uint32 acc_required, const char *debug)
 223 {
 224         DEBUG(5,("%s: access check ((granted: %#010x;  required: %#010x)\n",
 225                 debug, acc_granted, acc_required));
 226
 227         /* check the security descriptor first */
 228
 229         if ( (acc_granted&acc_required) == acc_required )
 230                 return NT_STATUS_OK;
 231
 232         /* give root a free pass */
 233
 234         if (geteuid() == sec_initial_uid()) {
 235
 236                 DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x;  required: %#010x)\n",
 237                         debug, acc_granted, acc_required));
 238                 DEBUGADD(4,("but overwritten by euid == 0\n"));
 239
 240                 return NT_STATUS_OK;
 241         }
 242
 243         DEBUG(2,("%s: ACCESS DENIED (granted: %#010x;  required: %#010x)\n",
 244                 debug, acc_granted, acc_required));
 245
 246         return NT_STATUS_ACCESS_DENIED;
 247 }
 248
 249 /*******************************************************************
 250  Fetch or create a dispinfo struct.
 251 ********************************************************************/
 252
 253 static DISP_INFO *get_samr_dispinfo_by_sid(DOM_SID *psid)
 254 {
 255         /*
 256          * We do a static cache for DISP_INFO's here. Explanation can be found
 257          * in Jeremy's checkin message to r11793:
 258          *
 259          * Fix the SAMR cache so it works across completely insane
 260          * client behaviour (ie.:
 261          * open pipe/open SAMR handle/enumerate 0 - 1024
 262          * close SAMR handle, close pipe.
 263          * open pipe/open SAMR handle/enumerate 1024 - 2048...
 264          * close SAMR handle, close pipe.
 265          * And on ad-nausium. Amazing.... probably object-oriented
 266          * client side programming in action yet again.
 267          * This change should *massively* improve performance when
 268          * enumerating users from an LDAP database.
 269          * Jeremy.
 270          *
 271          * "Our" and the builtin domain are the only ones where we ever
 272          * enumerate stuff, so just cache 2 entries.
 273          */
 274
 275         static struct disp_info builtin_dispinfo;
 276         static struct disp_info domain_dispinfo;
 277
 278         /* There are two cases to consider here:
 279            1) The SID is a domain SID and we look for an equality match, or
 280            2) This is an account SID and so we return the DISP_INFO* for our
 281               domain */
 282
 283         if (psid == NULL) {
 284                 return NULL;
 285         }
 286
 287         if (sid_check_is_builtin(psid) || sid_check_is_in_builtin(psid)) {
 288                 /*
 289                  * Necessary only once, but it does not really hurt.
 290                  */
 291                 sid_copy(&builtin_dispinfo.sid, &global_sid_Builtin);
 292
 293                 return &builtin_dispinfo;
 294         }
 295
 296         if (sid_check_is_domain(psid) || sid_check_is_in_our_domain(psid)) {
 297                 /*
 298                  * Necessary only once, but it does not really hurt.
 299                  */
 300                 sid_copy(&domain_dispinfo.sid, get_global_sam_sid());
 301
 302                 return &domain_dispinfo;
 303         }
 304
 305         return NULL;
 306 }
 307
 308 /*******************************************************************
 309  Create a samr_info struct.
 310 ********************************************************************/
 311
 312 static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
 313 {
 314         struct samr_info *info;
 315         fstring sid_str;
 316         TALLOC_CTX *mem_ctx;
 317
 318         if (psid) {
 319                 sid_to_string(sid_str, psid);
 320         } else {
 321                 fstrcpy(sid_str,"(NULL)");
 322         }
 323
 324         mem_ctx = talloc_init("samr_info for domain sid %s", sid_str);
 325
 326         if ((info = TALLOC_ZERO_P(mem_ctx, struct samr_info)) == NULL)
 327                 return NULL;
 328
 329         DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str));
 330         if (psid) {
 331                 sid_copy( &info->sid, psid);
 332                 info->builtin_domain = sid_check_is_builtin(psid);
 333         } else {
 334                 DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
 335                 info->builtin_domain = False;
 336         }
 337         info->mem_ctx = mem_ctx;
 338
 339         info->disp_info = get_samr_dispinfo_by_sid(psid);
 340
 341         return info;
 342 }
 343
 344 /*******************************************************************
 345  Function to free the per SID data.
 346  ********************************************************************/
 347
 348 static void free_samr_cache(DISP_INFO *disp_info, const char *sid_str)
 349 {
 350         DEBUG(10,("free_samr_cache: deleting cache for SID %s\n", sid_str));
 351
 352         /* We need to become root here because the paged search might have to
 353          * tell the LDAP server we're not interested in the rest anymore. */
 354
 355         become_root();
 356
 357         if (disp_info->users) {
 358                 DEBUG(10,("free_samr_cache: deleting users cache\n"));
 359                 pdb_search_destroy(disp_info->users);
 360                 disp_info->users = NULL;
 361         }
 362         if (disp_info->machines) {
 363                 DEBUG(10,("free_samr_cache: deleting machines cache\n"));
 364                 pdb_search_destroy(disp_info->machines);
 365                 disp_info->machines = NULL;
 366         }
 367         if (disp_info->groups) {
 368                 DEBUG(10,("free_samr_cache: deleting groups cache\n"));
 369                 pdb_search_destroy(disp_info->groups);
 370                 disp_info->groups = NULL;
 371         }
 372         if (disp_info->aliases) {
 373                 DEBUG(10,("free_samr_cache: deleting aliases cache\n"));
 374                 pdb_search_destroy(disp_info->aliases);
 375                 disp_info->aliases = NULL;
 376         }
 377         if (disp_info->enum_users) {
 378                 DEBUG(10,("free_samr_cache: deleting enum_users cache\n"));
 379                 pdb_search_destroy(disp_info->enum_users);
 380                 disp_info->enum_users = NULL;
 381         }
 382         disp_info->enum_acb_mask = 0;
 383
 384         unbecome_root();
 385 }
 386
 387 /*******************************************************************
 388  Function to free the per handle data.
 389  ********************************************************************/
 390
 391 static void free_samr_info(void *ptr)
 392 {
 393         struct samr_info *info=(struct samr_info *) ptr;
 394
 395         /* Only free the dispinfo cache if no one bothered to set up
 396            a timeout. */
 397
 398         if (info->disp_info && info->disp_info->di_cache_timeout_event == (smb_event_id_t)0) {
 399                 fstring sid_str;
 400                 sid_to_string(sid_str, &info->disp_info->sid);
 401                 free_samr_cache(info->disp_info, sid_str);
 402         }
 403
 404         talloc_destroy(info->mem_ctx);
 405 }
 406
 407 /*******************************************************************
 408  Idle event handler. Throw away the disp info cache.
 409  ********************************************************************/
 410
 411 static void disp_info_cache_idle_timeout_handler(void **private_data,
 412                                         time_t *ev_interval,
 413                                         time_t ev_now)
 414 {
 415         fstring sid_str;
 416         DISP_INFO *disp_info = (DISP_INFO *)(*private_data);
 417
 418         sid_to_string(sid_str, &disp_info->sid);
 419
 420         free_samr_cache(disp_info, sid_str);
 421
 422         /* Remove the event. */
 423         smb_unregister_idle_event(disp_info->di_cache_timeout_event);
 424         disp_info->di_cache_timeout_event = (smb_event_id_t)0;
 425
 426         DEBUG(10,("disp_info_cache_idle_timeout_handler: caching timed out for SID %s at %u\n",
 427                 sid_str, (unsigned int)ev_now));
 428 }
 429
 430 /*******************************************************************
 431  Setup cache removal idle event handler.
 432  ********************************************************************/
 433
 434 static void set_disp_info_cache_timeout(DISP_INFO *disp_info, time_t secs_fromnow)
 435 {
 436         fstring sid_str;
 437
 438         sid_to_string(sid_str, &disp_info->sid);
 439
 440         /* Remove any pending timeout and update. */
 441
 442         if (disp_info->di_cache_timeout_event) {
 443                 smb_unregister_idle_event(disp_info->di_cache_timeout_event);
 444                 disp_info->di_cache_timeout_event = (smb_event_id_t)0;
 445         }
 446
 447         DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for SID %s for %u seconds\n",
 448                 sid_str, (unsigned int)secs_fromnow ));
 449
 450         disp_info->di_cache_timeout_event =
 451                 smb_register_idle_event(disp_info_cache_idle_timeout_handler,
 452                                         disp_info,
 453                                         secs_fromnow);
 454 }
 455
 456 /*******************************************************************
 457  Force flush any cache. We do this on any samr_set_xxx call.
 458  We must also remove the timeout handler.
 459  ********************************************************************/
 460
 461 static void force_flush_samr_cache(DISP_INFO *disp_info)
 462 {
 463         if (disp_info) {
 464                 fstring sid_str;
 465
 466                 sid_to_string(sid_str, &disp_info->sid);
 467                 if (disp_info->di_cache_timeout_event) {
 468                         smb_unregister_idle_event(disp_info->di_cache_timeout_event);
 469                         disp_info->di_cache_timeout_event = (smb_event_id_t)0;
 470                         DEBUG(10,("force_flush_samr_cache: clearing idle event for SID %s\n",
 471                                 sid_str));
 472                 }
 473                 free_samr_cache(disp_info, sid_str);
 474         }
 475 }
 476
 477 /*******************************************************************
 478  Ensure password info is never given out. Paranioa... JRA.
 479  ********************************************************************/
 480
 481 static void samr_clear_sam_passwd(struct samu *sam_pass)
 482 {
 483
 484         if (!sam_pass)
 485                 return;
 486
 487         /* These now zero out the old password */
 488
 489         pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
 490         pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
 491 }
 492
 493 static uint32 count_sam_users(struct disp_info *info, uint32 acct_flags)
 494 {
 495         struct samr_displayentry *entry;
 496
 497         if (info->builtin_domain) {
 498                 /* No users in builtin. */
 499                 return 0;
 500         }
 501
 502         if (info->users == NULL) {
 503                 info->users = pdb_search_users(acct_flags);
 504                 if (info->users == NULL) {
 505                         return 0;
 506                 }
 507         }
 508         /* Fetch the last possible entry, thus trigger an enumeration */
 509         pdb_search_entries(info->users, 0xffffffff, 1, &entry);
 510
 511         /* Ensure we cache this enumeration. */
 512         set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
 513
 514         return info->users->num_entries;
 515 }
 516
 517 static uint32 count_sam_groups(struct disp_info *info)
 518 {
 519         struct samr_displayentry *entry;
 520
 521         if (info->builtin_domain) {
 522                 /* No groups in builtin. */
 523                 return 0;
 524         }
 525
 526         if (info->groups == NULL) {
 527                 info->groups = pdb_search_groups();
 528                 if (info->groups == NULL) {
 529                         return 0;
 530                 }
 531         }
 532         /* Fetch the last possible entry, thus trigger an enumeration */
 533         pdb_search_entries(info->groups, 0xffffffff, 1, &entry);
 534
 535         /* Ensure we cache this enumeration. */
 536         set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
 537
 538         return info->groups->num_entries;
 539 }
 540
 541 static uint32 count_sam_aliases(struct disp_info *info)
 542 {
 543         struct samr_displayentry *entry;
 544
 545         if (info->aliases == NULL) {
 546                 info->aliases = pdb_search_aliases(&info->sid);
 547                 if (info->aliases == NULL) {
 548                         return 0;
 549                 }
 550         }
 551         /* Fetch the last possible entry, thus trigger an enumeration */
 552         pdb_search_entries(info->aliases, 0xffffffff, 1, &entry);
 553
 554         /* Ensure we cache this enumeration. */
 555         set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
 556
 557         return info->aliases->num_entries;
 558 }
 559
 560 /*******************************************************************
 561  _samr_close_hnd
 562  ********************************************************************/
 563
 564 NTSTATUS _samr_close_hnd(pipes_struct *p, SAMR_Q_CLOSE_HND *q_u, SAMR_R_CLOSE_HND *r_u)
 565 {
 566         r_u->status = NT_STATUS_OK;
 567
 568         /* close the policy handle */
 569         if (!close_policy_hnd(p, &q_u->pol))
 570                 return NT_STATUS_OBJECT_NAME_INVALID;
 571
 572         DEBUG(5,("samr_reply_close_hnd: %d\n", __LINE__));
 573
 574         return r_u->status;
 575 }
 576
 577 /*******************************************************************
 578  samr_reply_open_domain
 579  ********************************************************************/
 580
 581 NTSTATUS _samr_open_domain(pipes_struct *p, SAMR_Q_OPEN_DOMAIN *q_u, SAMR_R_OPEN_DOMAIN *r_u)
 582 {
 583         struct    samr_info *info;
 584         SEC_DESC *psd = NULL;
 585         uint32    acc_granted;
 586         uint32    des_access = q_u->flags;
 587         NTSTATUS  status;
 588         size_t    sd_size;
 589         SE_PRIV se_rights;
 590
 591         r_u->status = NT_STATUS_OK;
 592
 593         /* find the connection policy handle. */
 594
 595         if ( !find_policy_by_hnd(p, &q_u->pol, (void**)(void *)&info) )
 596                 return NT_STATUS_INVALID_HANDLE;
 597
 598         status = access_check_samr_function( info->acc_granted,
 599                 SA_RIGHT_SAM_OPEN_DOMAIN, "_samr_open_domain" );
 600
 601         if ( !NT_STATUS_IS_OK(status) )
 602                 return status;
 603
 604         /*check if access can be granted as requested by client. */
 605
 606         make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
 607         se_map_generic( &des_access, &dom_generic_mapping );
 608
 609         se_priv_copy( &se_rights, &se_machine_account );
 610         se_priv_add( &se_rights, &se_add_users );
 611
 612         status = access_check_samr_object( psd, p->pipe_user.nt_user_token,
 613                 &se_rights, GENERIC_RIGHTS_DOMAIN_WRITE, des_access,
 614                 &acc_granted, "_samr_open_domain" );
 615
 616         if ( !NT_STATUS_IS_OK(status) )
 617                 return status;
 618
 619         if (!sid_check_is_domain(&q_u->dom_sid.sid) &&
 620             !sid_check_is_builtin(&q_u->dom_sid.sid)) {
 621                 return NT_STATUS_NO_SUCH_DOMAIN;
 622         }
 623
 624         /* associate the domain SID with the (unique) handle. */
 625         if ((info = get_samr_info_by_sid(&q_u->dom_sid.sid))==NULL)
 626                 return NT_STATUS_NO_MEMORY;
 627         info->acc_granted = acc_granted;
 628
 629         /* get a (unique) handle.  open a policy on it. */
 630         if (!create_policy_hnd(p, &r_u->domain_pol, free_samr_info, (void *)info))
 631                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 632
 633         DEBUG(5,("samr_open_domain: %d\n", __LINE__));
 634
 635         return r_u->status;
 636 }
 637
 638 /*******************************************************************
 639  _samr_get_usrdom_pwinfo
 640  ********************************************************************/
 641
 642 NTSTATUS _samr_get_usrdom_pwinfo(pipes_struct *p, SAMR_Q_GET_USRDOM_PWINFO *q_u, SAMR_R_GET_USRDOM_PWINFO *r_u)
 643 {
 644         struct samr_info *info = NULL;
 645
 646         r_u->status = NT_STATUS_OK;
 647
 648         /* find the policy handle.  open a policy on it. */
 649         if (!find_policy_by_hnd(p, &q_u->user_pol, (void **)(void *)&info))
 650                 return NT_STATUS_INVALID_HANDLE;
 651
 652         if (!sid_check_is_in_our_domain(&info->sid))
 653                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 654
 655         init_samr_r_get_usrdom_pwinfo(r_u, NT_STATUS_OK);
 656
 657         DEBUG(5,("_samr_get_usrdom_pwinfo: %d\n", __LINE__));
 658
 659         /*
 660          * NT sometimes return NT_STATUS_ACCESS_DENIED
 661          * I don't know yet why.
 662          */
 663
 664         return r_u->status;
 665 }
 666
 667 /*******************************************************************
 668 ********************************************************************/
 669
 670 static BOOL get_lsa_policy_samr_sid( pipes_struct *p, POLICY_HND *pol,
 671                                         DOM_SID *sid, uint32 *acc_granted,
 672                                         DISP_INFO **ppdisp_info)
 673 {
 674         struct samr_info *info = NULL;
 675
 676         /* find the policy handle.  open a policy on it. */
 677         if (!find_policy_by_hnd(p, pol, (void **)(void *)&info))
 678                 return False;
 679
 680         if (!info)
 681                 return False;
 682
 683         *sid = info->sid;
 684         *acc_granted = info->acc_granted;
 685         if (ppdisp_info) {
 686                 *ppdisp_info = info->disp_info;
 687         }
 688
 689         return True;
 690 }
 691
 692 /*******************************************************************
 693  _samr_set_sec_obj
 694  ********************************************************************/
 695
 696 NTSTATUS _samr_set_sec_obj(pipes_struct *p, SAMR_Q_SET_SEC_OBJ *q_u, SAMR_R_SET_SEC_OBJ *r_u)
 697 {
 698         DOM_SID pol_sid;
 699         uint32 acc_granted, i;
 700         SEC_ACL *dacl;
 701         BOOL ret;
 702         struct samu *sampass=NULL;
 703         NTSTATUS status;
 704
 705         r_u->status = NT_STATUS_OK;
 706
 707         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted, NULL))
 708                 return NT_STATUS_INVALID_HANDLE;
 709
 710         if (!(sampass = samu_new( p->mem_ctx))) {
 711                 DEBUG(0,("No memory!\n"));
 712                 return NT_STATUS_NO_MEMORY;
 713         }
 714
 715         /* get the user record */
 716         become_root();
 717         ret = pdb_getsampwsid(sampass, &pol_sid);
 718         unbecome_root();
 719
 720         if (!ret) {
 721                 DEBUG(4, ("User %s not found\n", sid_string_static(&pol_sid)));
 722                 TALLOC_FREE(sampass);
 723                 return NT_STATUS_INVALID_HANDLE;
 724         }
 725
 726         dacl = q_u->buf->sec->dacl;
 727         for (i=0; i < dacl->num_aces; i++) {
 728                 if (sid_equal(&pol_sid, &dacl->aces[i].trustee)) {
 729                         ret = pdb_set_pass_can_change(sampass,
 730                                 (dacl->aces[i].access_mask &
 731                                  SA_RIGHT_USER_CHANGE_PASSWORD) ?
 732                                                       True: False);
 733                         break;
 734                 }
 735         }
 736
 737         if (!ret) {
 738                 TALLOC_FREE(sampass);
 739                 return NT_STATUS_ACCESS_DENIED;
 740         }
 741
 742         status = access_check_samr_function(acc_granted, SA_RIGHT_USER_SET_ATTRIBUTES, "_samr_set_sec_obj");
 743         if (NT_STATUS_IS_OK(status)) {
 744                 become_root();
 745                 status = pdb_update_sam_account(sampass);
 746                 unbecome_root();
 747         }
 748
 749         TALLOC_FREE(sampass);
 750
 751         return status;
 752 }
 753
 754 /*******************************************************************
 755   build correct perms based on policies and password times for _samr_query_sec_obj
 756 *******************************************************************/
 757 static BOOL check_change_pw_access(TALLOC_CTX *mem_ctx, DOM_SID *user_sid)
 758 {
 759         struct samu *sampass=NULL;
 760         BOOL ret;
 761
 762         if ( !(sampass = samu_new( mem_ctx )) ) {
 763                 DEBUG(0,("No memory!\n"));
 764                 return False;
 765         }
 766
 767         become_root();
 768         ret = pdb_getsampwsid(sampass, user_sid);
 769         unbecome_root();
 770
 771         if (ret == False) {
 772                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
 773                 TALLOC_FREE(sampass);
 774                 return False;
 775         }
 776
 777         DEBUG(3,("User:[%s]\n",  pdb_get_username(sampass) ));
 778
 779         if (pdb_get_pass_can_change(sampass)) {
 780                 TALLOC_FREE(sampass);
 781                 return True;
 782         }
 783         TALLOC_FREE(sampass);
 784         return False;
 785 }
 786
 787
 788 /*******************************************************************
 789  _samr_query_sec_obj
 790  ********************************************************************/
 791
 792 NTSTATUS _samr_query_sec_obj(pipes_struct *p, SAMR_Q_QUERY_SEC_OBJ *q_u, SAMR_R_QUERY_SEC_OBJ *r_u)
 793 {
 794         DOM_SID pol_sid;
 795         fstring str_sid;
 796         SEC_DESC * psd = NULL;
 797         uint32 acc_granted;
 798         size_t sd_size;
 799
 800         r_u->status = NT_STATUS_OK;
 801
 802         /* Get the SID. */
 803         if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &pol_sid, &acc_granted, NULL))
 804                 return NT_STATUS_INVALID_HANDLE;
 805
 806         DEBUG(10,("_samr_query_sec_obj: querying security on SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 807
 808         /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
 809
 810         /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
 811         if (pol_sid.sid_rev_num == 0) {
 812                 DEBUG(5,("_samr_query_sec_obj: querying security on SAM\n"));
 813                 r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
 814         } else if (sid_equal(&pol_sid,get_global_sam_sid())) {
 815                 /* check if it is our domain SID */
 816                 DEBUG(5,("_samr_query_sec_obj: querying security on Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 817                 r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
 818         } else if (sid_equal(&pol_sid,&global_sid_Builtin)) {
 819                 /* check if it is the Builtin  Domain */
 820                 /* TODO: Builtin probably needs a different SD with restricted write access*/
 821                 DEBUG(5,("_samr_query_sec_obj: querying security on Builtin Domain with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 822                 r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
 823         } else if (sid_check_is_in_our_domain(&pol_sid) ||
 824                  sid_check_is_in_builtin(&pol_sid)) {
 825                 /* TODO: different SDs have to be generated for aliases groups and users.
 826                          Currently all three get a default user SD  */
 827                 DEBUG(10,("_samr_query_sec_obj: querying security on Object with SID: %s\n", sid_to_string(str_sid, &pol_sid)));
 828                 if (check_change_pw_access(p->mem_ctx, &pol_sid)) {
 829                         r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
 830                                                           &pol_sid, SAMR_USR_RIGHTS_WRITE_PW);
 831                 } else {
 832                         r_u->status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_nopwchange_generic_mapping,
 833                                                           &pol_sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
 834                 }
 835         } else {
 836                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 837         }
 838
 839         if ((r_u->buf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
 840                 return NT_STATUS_NO_MEMORY;
 841
 842         if (NT_STATUS_IS_OK(r_u->status))
 843                 r_u->ptr = 1;
 844
 845         return r_u->status;
 846 }
 847
 848 /*******************************************************************
 849 makes a SAM_ENTRY / UNISTR2* structure from a user list.
 850 ********************************************************************/
 851
 852 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp,
 853                                          UNISTR2 **uni_name_pp,
 854                                          uint32 num_entries, uint32 start_idx,
 855                                          struct samr_displayentry *entries)
 856 {
 857         uint32 i;
 858         SAM_ENTRY *sam;
 859         UNISTR2 *uni_name;
 860
 861         *sam_pp = NULL;
 862         *uni_name_pp = NULL;
 863
 864         if (num_entries == 0)
 865                 return NT_STATUS_OK;
 866
 867         sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_entries);
 868
 869         uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_entries);
 870
 871         if (sam == NULL || uni_name == NULL) {
 872                 DEBUG(0, ("make_user_sam_entry_list: TALLOC_ZERO failed!\n"));
 873                 return NT_STATUS_NO_MEMORY;
 874         }
 875
 876         for (i = 0; i < num_entries; i++) {
 877                 UNISTR2 uni_temp_name;
 878                 /*
 879                  * usrmgr expects a non-NULL terminated string with
 880                  * trust relationships
 881                  */
 882                 if (entries[i].acct_flags & ACB_DOMTRUST) {
 883                         init_unistr2(&uni_temp_name, entries[i].account_name,
 884                                      UNI_FLAGS_NONE);
 885                 } else {
 886                         init_unistr2(&uni_temp_name, entries[i].account_name,
 887                                      UNI_STR_TERMINATE);
 888                 }
 889
 890                 init_sam_entry(&sam[i], &uni_temp_name, entries[i].rid);
 891                 copy_unistr2(&uni_name[i], &uni_temp_name);
 892         }
 893
 894         *sam_pp = sam;
 895         *uni_name_pp = uni_name;
 896         return NT_STATUS_OK;
 897 }
 898
 899 /*******************************************************************
 900  samr_reply_enum_dom_users
 901  ********************************************************************/
 902
 903 NTSTATUS _samr_enum_dom_users(pipes_struct *p, SAMR_Q_ENUM_DOM_USERS *q_u,
 904                               SAMR_R_ENUM_DOM_USERS *r_u)
 905 {
 906         struct samr_info *info = NULL;
 907         int num_account;
 908         uint32 enum_context=q_u->start_idx;
 909         enum remote_arch_types ra_type = get_remote_arch();
 910         int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
 911         uint32 max_entries = max_sam_entries;
 912         struct samr_displayentry *entries = NULL;
 913
 914         r_u->status = NT_STATUS_OK;
 915
 916         /* find the policy handle.  open a policy on it. */
 917         if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
 918                 return NT_STATUS_INVALID_HANDLE;
 919
 920         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
 921                                         SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
 922                                         "_samr_enum_dom_users"))) {
 923                 return r_u->status;
 924         }
 925
 926         DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
 927
 928         if (info->builtin_domain) {
 929                 /* No users in builtin. */
 930                 init_samr_r_enum_dom_users(r_u, q_u->start_idx, 0);
 931                 DEBUG(5,("_samr_enum_dom_users: No users in BUILTIN\n"));
 932                 return r_u->status;
 933         }
 934
 935         become_root();
 936
 937         /* AS ROOT !!!! */
 938
 939         if ((info->disp_info->enum_users != NULL) &&
 940             (info->disp_info->enum_acb_mask != q_u->acb_mask)) {
 941                 pdb_search_destroy(info->disp_info->enum_users);
 942                 info->disp_info->enum_users = NULL;
 943         }
 944
 945         if (info->disp_info->enum_users == NULL) {
 946                 info->disp_info->enum_users = pdb_search_users(q_u->acb_mask);
 947                 info->disp_info->enum_acb_mask = q_u->acb_mask;
 948         }
 949
 950         if (info->disp_info->enum_users == NULL) {
 951                 /* END AS ROOT !!!! */
 952                 unbecome_root();
 953                 return NT_STATUS_ACCESS_DENIED;
 954         }
 955
 956         num_account = pdb_search_entries(info->disp_info->enum_users,
 957                                          enum_context, max_entries,
 958                                          &entries);
 959
 960         /* END AS ROOT !!!! */
 961
 962         unbecome_root();
 963
 964         if (num_account == 0) {
 965                 DEBUG(5, ("_samr_enum_dom_users: enumeration handle over "
 966                           "total entries\n"));
 967                 init_samr_r_enum_dom_users(r_u, q_u->start_idx, 0);
 968                 return NT_STATUS_OK;
 969         }
 970
 971         r_u->status = make_user_sam_entry_list(p->mem_ctx, &r_u->sam,
 972                                                &r_u->uni_acct_name,
 973                                                num_account, enum_context,
 974                                                entries);
 975
 976         if (!NT_STATUS_IS_OK(r_u->status))
 977                 return r_u->status;
 978
 979         if (max_entries <= num_account) {
 980                 r_u->status = STATUS_MORE_ENTRIES;
 981         } else {
 982                 r_u->status = NT_STATUS_OK;
 983         }
 984
 985         /* Ensure we cache this enumeration. */
 986         set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
 987
 988         DEBUG(5, ("_samr_enum_dom_users: %d\n", __LINE__));
 989
 990         init_samr_r_enum_dom_users(r_u, q_u->start_idx + num_account,
 991                                    num_account);
 992
 993         DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__));
 994
 995         return r_u->status;
 996 }
 997
 998 /*******************************************************************
 999 makes a SAM_ENTRY / UNISTR2* structure from a group list.
1000 ********************************************************************/
1001
1002 static void make_group_sam_entry_list(TALLOC_CTX *ctx, SAM_ENTRY **sam_pp,
1003                                       UNISTR2 **uni_name_pp,
1004                                       uint32 num_sam_entries,
1005                                       struct samr_displayentry *entries)
1006 {
1007         uint32 i;
1008         SAM_ENTRY *sam;
1009         UNISTR2 *uni_name;
1010
1011         *sam_pp = NULL;
1012         *uni_name_pp = NULL;
1013
1014         if (num_sam_entries == 0)
1015                 return;
1016
1017         sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
1018         uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
1019
1020         if (sam == NULL || uni_name == NULL) {
1021                 DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
1022                 return;
1023         }
1024
1025         for (i = 0; i < num_sam_entries; i++) {
1026                 /*
1027                  * JRA. I think this should include the null. TNG does not.
1028                  */
1029                 init_unistr2(&uni_name[i], entries[i].account_name,
1030                              UNI_STR_TERMINATE);
1031                 init_sam_entry(&sam[i], &uni_name[i], entries[i].rid);
1032         }
1033
1034         *sam_pp = sam;
1035         *uni_name_pp = uni_name;
1036 }
1037
1038 /*******************************************************************
1039  samr_reply_enum_dom_groups
1040  ********************************************************************/
1041
1042 NTSTATUS _samr_enum_dom_groups(pipes_struct *p, SAMR_Q_ENUM_DOM_GROUPS *q_u, SAMR_R_ENUM_DOM_GROUPS *r_u)
1043 {
1044         struct samr_info *info = NULL;
1045         struct samr_displayentry *groups;
1046         uint32 num_groups;
1047
1048         r_u->status = NT_STATUS_OK;
1049
1050         /* find the policy handle.  open a policy on it. */
1051         if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
1052                 return NT_STATUS_INVALID_HANDLE;
1053
1054         r_u->status = access_check_samr_function(info->acc_granted,
1055                                                  SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
1056                                                  "_samr_enum_dom_groups");
1057         if (!NT_STATUS_IS_OK(r_u->status))
1058                 return r_u->status;
1059
1060         DEBUG(5,("samr_reply_enum_dom_groups: %d\n", __LINE__));
1061
1062         if (info->builtin_domain) {
1063                 /* No groups in builtin. */
1064                 init_samr_r_enum_dom_groups(r_u, q_u->start_idx, 0);
1065                 DEBUG(5,("_samr_enum_dom_users: No groups in BUILTIN\n"));
1066                 return r_u->status;
1067         }
1068
1069         /* the domain group array is being allocated in the function below */
1070
1071         become_root();
1072
1073         if (info->disp_info->groups == NULL) {
1074                 info->disp_info->groups = pdb_search_groups();
1075
1076                 if (info->disp_info->groups == NULL) {
1077                         unbecome_root();
1078                         return NT_STATUS_ACCESS_DENIED;
1079                 }
1080         }
1081
1082         num_groups = pdb_search_entries(info->disp_info->groups, q_u->start_idx,
1083                                         MAX_SAM_ENTRIES, &groups);
1084         unbecome_root();
1085
1086         /* Ensure we cache this enumeration. */
1087         set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1088
1089         make_group_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_grp_name,
1090                                   num_groups, groups);
1091
1092         init_samr_r_enum_dom_groups(r_u, q_u->start_idx, num_groups);
1093
1094         DEBUG(5,("samr_enum_dom_groups: %d\n", __LINE__));
1095
1096         return r_u->status;
1097 }
1098
1099 /*******************************************************************
1100  samr_reply_enum_dom_aliases
1101  ********************************************************************/
1102
1103 NTSTATUS _samr_enum_dom_aliases(pipes_struct *p, SAMR_Q_ENUM_DOM_ALIASES *q_u, SAMR_R_ENUM_DOM_ALIASES *r_u)
1104 {
1105         struct samr_info *info;
1106         struct samr_displayentry *aliases;
1107         uint32 num_aliases = 0;
1108
1109         /* find the policy handle.  open a policy on it. */
1110         if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
1111                 return NT_STATUS_INVALID_HANDLE;
1112
1113         r_u->status = access_check_samr_function(info->acc_granted,
1114                                                  SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
1115                                                  "_samr_enum_dom_aliases");
1116         if (!NT_STATUS_IS_OK(r_u->status))
1117                 return r_u->status;
1118
1119         DEBUG(5,("samr_reply_enum_dom_aliases: sid %s\n",
1120                  sid_string_static(&info->sid)));
1121
1122         become_root();
1123
1124         if (info->disp_info->aliases == NULL) {
1125                 info->disp_info->aliases = pdb_search_aliases(&info->sid);
1126                 if (info->disp_info->aliases == NULL) {
1127                         unbecome_root();
1128                         return NT_STATUS_ACCESS_DENIED;
1129                 }
1130         }
1131
1132         num_aliases = pdb_search_entries(info->disp_info->aliases, q_u->start_idx,
1133                                          MAX_SAM_ENTRIES, &aliases);
1134         unbecome_root();
1135
1136         /* Ensure we cache this enumeration. */
1137         set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1138
1139         make_group_sam_entry_list(p->mem_ctx, &r_u->sam, &r_u->uni_grp_name,
1140                                   num_aliases, aliases);
1141
1142         init_samr_r_enum_dom_aliases(r_u, q_u->start_idx + num_aliases,
1143                                      num_aliases);
1144
1145         DEBUG(5,("samr_enum_dom_aliases: %d\n", __LINE__));
1146
1147         return r_u->status;
1148 }
1149
1150 /*******************************************************************
1151  samr_reply_query_dispinfo
1152  ********************************************************************/
1153
1154 NTSTATUS _samr_query_dispinfo(pipes_struct *p, SAMR_Q_QUERY_DISPINFO *q_u,
1155                               SAMR_R_QUERY_DISPINFO *r_u)
1156 {
1157         struct samr_info *info = NULL;
1158         uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
1159
1160         uint32 max_entries=q_u->max_entries;
1161         uint32 enum_context=q_u->start_idx;
1162         uint32 max_size=q_u->max_size;
1163
1164         SAM_DISPINFO_CTR *ctr;
1165         uint32 temp_size=0, total_data_size=0;
1166         NTSTATUS disp_ret = NT_STATUS_UNSUCCESSFUL;
1167         uint32 num_account = 0;
1168         enum remote_arch_types ra_type = get_remote_arch();
1169         int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
1170         struct samr_displayentry *entries = NULL;
1171
1172         DEBUG(5, ("samr_reply_query_dispinfo: %d\n", __LINE__));
1173         r_u->status = NT_STATUS_UNSUCCESSFUL;
1174
1175         /* find the policy handle.  open a policy on it. */
1176         if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)(void *)&info))
1177                 return NT_STATUS_INVALID_HANDLE;
1178
1179         /*
1180          * calculate how many entries we will return.
1181          * based on
1182          * - the number of entries the client asked
1183          * - our limit on that
1184          * - the starting point (enumeration context)
1185          * - the buffer size the client will accept
1186          */
1187
1188         /*
1189          * We are a lot more like W2K. Instead of reading the SAM
1190          * each time to find the records we need to send back,
1191          * we read it once and link that copy to the sam handle.
1192          * For large user list (over the MAX_SAM_ENTRIES)
1193          * it's a definitive win.
1194          * second point to notice: between enumerations
1195          * our sam is now the same as it's a snapshoot.
1196          * third point: got rid of the static SAM_USER_21 struct
1197          * no more intermediate.
1198          * con: it uses much more memory, as a full copy is stored
1199          * in memory.
1200          *
1201          * If you want to change it, think twice and think
1202          * of the second point , that's really important.
1203          *
1204          * JFM, 12/20/2001
1205          */
1206
1207         if ((q_u->switch_level < 1) || (q_u->switch_level > 5)) {
1208                 DEBUG(0,("_samr_query_dispinfo: Unknown info level (%u)\n",
1209                          (unsigned int)q_u->switch_level ));
1210                 return NT_STATUS_INVALID_INFO_CLASS;
1211         }
1212
1213         /* first limit the number of entries we will return */
1214         if(max_entries > max_sam_entries) {
1215                 DEBUG(5, ("samr_reply_query_dispinfo: client requested %d "
1216                           "entries, limiting to %d\n", max_entries,
1217                           max_sam_entries));
1218                 max_entries = max_sam_entries;
1219         }
1220
1221         /* calculate the size and limit on the number of entries we will
1222          * return */
1223
1224         temp_size=max_entries*struct_size;
1225
1226         if (temp_size>max_size) {
1227                 max_entries=MIN((max_size/struct_size),max_entries);;
1228                 DEBUG(5, ("samr_reply_query_dispinfo: buffer size limits to "
1229                           "only %d entries\n", max_entries));
1230         }
1231
1232         if (!(ctr = TALLOC_ZERO_P(p->mem_ctx,SAM_DISPINFO_CTR)))
1233                 return NT_STATUS_NO_MEMORY;
1234
1235         ZERO_STRUCTP(ctr);
1236
1237         become_root();
1238
1239         /* THe following done as ROOT. Don't return without unbecome_root(). */
1240
1241         switch (q_u->switch_level) {
1242         case 0x1:
1243         case 0x4:
1244                 if (info->disp_info->users == NULL) {
1245                         info->disp_info->users = pdb_search_users(ACB_NORMAL);
1246                         if (info->disp_info->users == NULL) {
1247                                 unbecome_root();
1248                                 return NT_STATUS_ACCESS_DENIED;
1249                         }
1250                         DEBUG(10,("samr_reply_query_dispinfo: starting user enumeration at index %u\n",
1251                                 (unsigned  int)enum_context ));
1252                 } else {
1253                         DEBUG(10,("samr_reply_query_dispinfo: using cached user enumeration at index %u\n",
1254                                 (unsigned  int)enum_context ));
1255                 }
1256
1257                 num_account = pdb_search_entries(info->disp_info->users,
1258                                                  enum_context, max_entries,
1259                                                  &entries);
1260                 break;
1261         case 0x2:
1262                 if (info->disp_info->machines == NULL) {
1263                         info->disp_info->machines =
1264                                 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
1265                         if (info->disp_info->machines == NULL) {
1266                                 unbecome_root();
1267                                 return NT_STATUS_ACCESS_DENIED;
1268                         }
1269                         DEBUG(10,("samr_reply_query_dispinfo: starting machine enumeration at index %u\n",
1270                                 (unsigned  int)enum_context ));
1271                 } else {
1272                         DEBUG(10,("samr_reply_query_dispinfo: using cached machine enumeration at index %u\n",
1273                                 (unsigned  int)enum_context ));
1274                 }
1275
1276                 num_account = pdb_search_entries(info->disp_info->machines,
1277                                                  enum_context, max_entries,
1278                                                  &entries);
1279                 break;
1280         case 0x3:
1281         case 0x5:
1282                 if (info->disp_info->groups == NULL) {
1283                         info->disp_info->groups = pdb_search_groups();
1284                         if (info->disp_info->groups == NULL) {
1285                                 unbecome_root();
1286                                 return NT_STATUS_ACCESS_DENIED;
1287                         }
1288                         DEBUG(10,("samr_reply_query_dispinfo: starting group enumeration at index %u\n",
1289                                 (unsigned  int)enum_context ));
1290                 } else {
1291                         DEBUG(10,("samr_reply_query_dispinfo: using cached group enumeration at index %u\n",
1292                                 (unsigned  int)enum_context ));
1293                 }
1294
1295                 num_account = pdb_search_entries(info->disp_info->groups,
1296                                                  enum_context, max_entries,
1297                                                  &entries);
1298                 break;
1299         default:
1300                 unbecome_root();
1301                 smb_panic("info class changed");
1302                 break;
1303         }
1304         unbecome_root();
1305
1306         /* Now create reply structure */
1307         switch (q_u->switch_level) {
1308         case 0x1:
1309                 disp_ret = init_sam_dispinfo_1(p->mem_ctx, &ctr->sam.info1,
1310                                                num_account, enum_context,
1311                                                entries);
1312                 break;
1313         case 0x2:
1314                 disp_ret = init_sam_dispinfo_2(p->mem_ctx, &ctr->sam.info2,
1315                                                num_account, enum_context,
1316                                                entries);
1317                 break;
1318         case 0x3:
1319                 disp_ret = init_sam_dispinfo_3(p->mem_ctx, &ctr->sam.info3,
1320                                                num_account, enum_context,
1321                                                entries);
1322                 break;
1323         case 0x4:
1324                 disp_ret = init_sam_dispinfo_4(p->mem_ctx, &ctr->sam.info4,
1325                                                num_account, enum_context,
1326                                                entries);
1327                 break;
1328         case 0x5:
1329                 disp_ret = init_sam_dispinfo_5(p->mem_ctx, &ctr->sam.info5,
1330                                                num_account, enum_context,
1331                                                entries);
1332                 break;
1333         default:
1334                 smb_panic("info class changed");
1335                 break;
1336         }
1337
1338         if (!NT_STATUS_IS_OK(disp_ret))
1339                 return disp_ret;
1340
1341         temp_size = num_account * struct_size;
1342
1343         if (num_account) {
1344                 r_u->status = STATUS_MORE_ENTRIES;
1345         } else {
1346                 r_u->status = NT_STATUS_OK;
1347         }
1348
1349         if (num_account < max_entries) {
1350                 r_u->status = NT_STATUS_OK;
1351         }
1352
1353         /* Ensure we cache this enumeration. */
1354         set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1355
1356         DEBUG(5, ("_samr_query_dispinfo: %d\n", __LINE__));
1357
1358         init_samr_r_query_dispinfo(r_u, num_account, total_data_size,
1359                                    temp_size, q_u->switch_level, ctr,
1360                                    r_u->status);
1361
1362         return r_u->status;
1363
1364 }
1365
1366 /*******************************************************************
1367  samr_reply_query_aliasinfo
1368  ********************************************************************/
1369
1370 NTSTATUS _samr_query_aliasinfo(pipes_struct *p, SAMR_Q_QUERY_ALIASINFO *q_u, SAMR_R_QUERY_ALIASINFO *r_u)
1371 {
1372         DOM_SID   sid;
1373         struct acct_info info;
1374         uint32    acc_granted;
1375         BOOL ret;
1376
1377         r_u->status = NT_STATUS_OK;
1378
1379         DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__));
1380
1381         /* find the policy handle.  open a policy on it. */
1382         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted, NULL))
1383                 return NT_STATUS_INVALID_HANDLE;
1384         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_LOOKUP_INFO, "_samr_query_aliasinfo"))) {
1385                 return r_u->status;
1386         }
1387
1388         become_root();
1389         ret = pdb_get_aliasinfo(&sid, &info);
1390         unbecome_root();
1391
1392         if ( !ret )
1393                 return NT_STATUS_NO_SUCH_ALIAS;
1394
1395         if ( !(r_u->ctr = TALLOC_ZERO_P( p->mem_ctx, ALIAS_INFO_CTR )) )
1396                 return NT_STATUS_NO_MEMORY;
1397
1398
1399         switch (q_u->level ) {
1400         case 1:
1401                 r_u->ctr->level = 1;
1402                 init_samr_alias_info1(&r_u->ctr->alias.info1, info.acct_name, 1, info.acct_desc);
1403                 break;
1404         case 3:
1405                 r_u->ctr->level = 3;
1406                 init_samr_alias_info3(&r_u->ctr->alias.info3, info.acct_desc);
1407                 break;
1408         default:
1409                 return NT_STATUS_INVALID_INFO_CLASS;
1410         }
1411
1412         DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__));
1413
1414         return r_u->status;
1415 }
1416
1417 #if 0
1418 /*******************************************************************
1419  samr_reply_lookup_ids
1420  ********************************************************************/
1421
1422  uint32 _samr_lookup_ids(pipes_struct *p, SAMR_Q_LOOKUP_IDS *q_u, SAMR_R_LOOKUP_IDS *r_u)
1423 {
1424     uint32 rid[MAX_SAM_ENTRIES];
1425     int num_rids = q_u->num_sids1;
1426
1427     r_u->status = NT_STATUS_OK;
1428
1429     DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1430
1431     if (num_rids > MAX_SAM_ENTRIES) {
1432         num_rids = MAX_SAM_ENTRIES;
1433         DEBUG(5,("_samr_lookup_ids: truncating entries to %d\n", num_rids));
1434     }
1435
1436 #if 0
1437     int i;
1438     SMB_ASSERT_ARRAY(q_u->uni_user_name, num_rids);
1439
1440     for (i = 0; i < num_rids && status == 0; i++)
1441     {
1442         struct sam_passwd *sam_pass;
1443         fstring user_name;
1444
1445
1446         fstrcpy(user_name, unistrn2(q_u->uni_user_name[i].buffer,
1447                                     q_u->uni_user_name[i].uni_str_len));
1448
1449         /* find the user account */
1450         become_root();
1451         sam_pass = get_smb21pwd_entry(user_name, 0);
1452         unbecome_root();
1453
1454         if (sam_pass == NULL)
1455         {
1456             status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
1457             rid[i] = 0;
1458         }
1459         else
1460         {
1461             rid[i] = sam_pass->user_rid;
1462         }
1463     }
1464 #endif
1465
1466     num_rids = 1;
1467     rid[0] = BUILTIN_ALIAS_RID_USERS;
1468
1469     init_samr_r_lookup_ids(&r_u, num_rids, rid, NT_STATUS_OK);
1470
1471     DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1472
1473     return r_u->status;
1474 }
1475 #endif
1476
1477 /*******************************************************************
1478  _samr_lookup_names
1479  ********************************************************************/
1480
1481 NTSTATUS _samr_lookup_names(pipes_struct *p, SAMR_Q_LOOKUP_NAMES *q_u, SAMR_R_LOOKUP_NAMES *r_u)
1482 {
1483         uint32 rid[MAX_SAM_ENTRIES];
1484         enum lsa_SidType type[MAX_SAM_ENTRIES];
1485         int i;
1486         int num_rids = q_u->num_names2;
1487         DOM_SID pol_sid;
1488         fstring sid_str;
1489         uint32  acc_granted;
1490
1491         r_u->status = NT_STATUS_OK;
1492
1493         DEBUG(5,("_samr_lookup_names: %d\n", __LINE__));
1494
1495         ZERO_ARRAY(rid);
1496         ZERO_ARRAY(type);
1497
1498         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted, NULL)) {
1499                 init_samr_r_lookup_names(p->mem_ctx, r_u, 0, NULL, NULL, NT_STATUS_OBJECT_TYPE_MISMATCH);
1500                 return r_u->status;
1501         }
1502
1503         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, 0, "_samr_lookup_names"))) { /* Don't know the acc_bits yet */
1504                 return r_u->status;
1505         }
1506
1507         if (num_rids > MAX_SAM_ENTRIES) {
1508                 num_rids = MAX_SAM_ENTRIES;
1509                 DEBUG(5,("_samr_lookup_names: truncating entries to %d\n", num_rids));
1510         }
1511
1512         DEBUG(5,("_samr_lookup_names: looking name on SID %s\n", sid_to_string(sid_str, &pol_sid)));
1513
1514         for (i = 0; i < num_rids; i++) {
1515                 fstring name;
1516                 int ret;
1517
1518                 r_u->status = NT_STATUS_NONE_MAPPED;
1519                 type[i] = SID_NAME_UNKNOWN;
1520
1521                 rid [i] = 0xffffffff;
1522
1523                 ret = rpcstr_pull(name, q_u->uni_name[i].buffer, sizeof(name), q_u->uni_name[i].uni_str_len*2, 0);
1524
1525                 if (ret <= 0) {
1526                         continue;
1527                 }
1528
1529                 if (sid_check_is_builtin(&pol_sid)) {
1530                         if (lookup_builtin_name(name, &rid[i])) {
1531                                 type[i] = SID_NAME_ALIAS;
1532                         }
1533                 } else {
1534                         lookup_global_sam_name(name, 0, &rid[i], &type[i]);
1535                 }
1536
1537                 if (type[i] != SID_NAME_UNKNOWN) {
1538                         r_u->status = NT_STATUS_OK;
1539                 }
1540         }
1541
1542         init_samr_r_lookup_names(p->mem_ctx, r_u, num_rids, rid, type, r_u->status);
1543
1544         DEBUG(5,("_samr_lookup_names: %d\n", __LINE__));
1545
1546         return r_u->status;
1547 }
1548
1549 /*******************************************************************
1550  _samr_chgpasswd_user
1551  ********************************************************************/
1552
1553 NTSTATUS _samr_chgpasswd_user(pipes_struct *p, SAMR_Q_CHGPASSWD_USER *q_u, SAMR_R_CHGPASSWD_USER *r_u)
1554 {
1555         fstring user_name;
1556         fstring wks;
1557
1558         DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__));
1559
1560         r_u->status = NT_STATUS_OK;
1561
1562         rpcstr_pull(user_name, q_u->uni_user_name.buffer, sizeof(user_name), q_u->uni_user_name.uni_str_len*2, 0);
1563         rpcstr_pull(wks, q_u->uni_dest_host.buffer, sizeof(wks), q_u->uni_dest_host.uni_str_len*2,0);
1564
1565         DEBUG(5,("samr_chgpasswd_user: user: %s wks: %s\n", user_name, wks));
1566
1567         /*
1568          * Pass the user through the NT -> unix user mapping
1569          * function.
1570          */
1571
1572         (void)map_username(user_name);
1573
1574         /*
1575          * UNIX username case mangling not required, pass_oem_change
1576          * is case insensitive.
1577          */
1578
1579         r_u->status = pass_oem_change(user_name, q_u->lm_newpass.pass, q_u->lm_oldhash.hash,
1580                                 q_u->nt_newpass.pass, q_u->nt_oldhash.hash, NULL);
1581
1582         init_samr_r_chgpasswd_user(r_u, r_u->status);
1583
1584         DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__));
1585
1586         return r_u->status;
1587 }
1588
1589 /*******************************************************************
1590  _samr_chgpasswd_user3
1591  ********************************************************************/
1592
1593 NTSTATUS _samr_chgpasswd_user3(pipes_struct *p, SAMR_Q_CHGPASSWD_USER3 *q_u, SAMR_R_CHGPASSWD_USER3 *r_u)
1594 {
1595         fstring user_name;
1596         fstring wks;
1597         uint32 reject_reason;
1598         SAM_UNK_INFO_1 *info = NULL;
1599         SAMR_CHANGE_REJECT *reject = NULL;
1600
1601         DEBUG(5,("_samr_chgpasswd_user3: %d\n", __LINE__));
1602
1603         rpcstr_pull(user_name, q_u->uni_user_name.buffer, sizeof(user_name), q_u->uni_user_name.uni_str_len*2, 0);
1604         rpcstr_pull(wks, q_u->uni_dest_host.buffer, sizeof(wks), q_u->uni_dest_host.uni_str_len*2,0);
1605
1606         DEBUG(5,("_samr_chgpasswd_user3: user: %s wks: %s\n", user_name, wks));
1607
1608         /*
1609          * Pass the user through the NT -> unix user mapping
1610          * function.
1611          */
1612
1613         (void)map_username(user_name);
1614
1615         /*
1616          * UNIX username case mangling not required, pass_oem_change
1617          * is case insensitive.
1618          */
1619
1620         r_u->status = pass_oem_change(user_name, q_u->lm_newpass.pass, q_u->lm_oldhash.hash,
1621                                       q_u->nt_newpass.pass, q_u->nt_oldhash.hash, &reject_reason);
1622
1623         if (NT_STATUS_EQUAL(r_u->status, NT_STATUS_PASSWORD_RESTRICTION) ||
1624             NT_STATUS_EQUAL(r_u->status, NT_STATUS_ACCOUNT_RESTRICTION)) {
1625
1626                 uint32 min_pass_len,pass_hist,password_properties;
1627                 time_t u_expire, u_min_age;
1628                 NTTIME nt_expire, nt_min_age;
1629                 uint32 account_policy_temp;
1630
1631                 if ((info = TALLOC_ZERO_P(p->mem_ctx, SAM_UNK_INFO_1)) == NULL) {
1632                         return NT_STATUS_NO_MEMORY;
1633                 }
1634
1635                 if ((reject = TALLOC_ZERO_P(p->mem_ctx, SAMR_CHANGE_REJECT)) == NULL) {
1636                         return NT_STATUS_NO_MEMORY;
1637                 }
1638
1639                 ZERO_STRUCTP(info);
1640                 ZERO_STRUCTP(reject);
1641
1642                 become_root();
1643
1644                 /* AS ROOT !!! */
1645
1646                 pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp);
1647                 min_pass_len = account_policy_temp;
1648
1649                 pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
1650                 pass_hist = account_policy_temp;
1651
1652                 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
1653                 password_properties = account_policy_temp;
1654
1655                 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
1656                 u_expire = account_policy_temp;
1657
1658                 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
1659                 u_min_age = account_policy_temp;
1660
1661                 /* !AS ROOT */
1662
1663                 unbecome_root();
1664
1665                 unix_to_nt_time_abs(&nt_expire, u_expire);
1666                 unix_to_nt_time_abs(&nt_min_age, u_min_age);
1667
1668                 init_unk_info1(info, (uint16)min_pass_len, (uint16)pass_hist,
1669                                password_properties, nt_expire, nt_min_age);
1670
1671                 reject->reject_reason = reject_reason;
1672         }
1673
1674         init_samr_r_chgpasswd_user3(r_u, r_u->status, reject, info);
1675
1676         DEBUG(5,("_samr_chgpasswd_user3: %d\n", __LINE__));
1677
1678         return r_u->status;
1679 }
1680
1681 /*******************************************************************
1682 makes a SAMR_R_LOOKUP_RIDS structure.
1683 ********************************************************************/
1684
1685 static BOOL make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
1686                                   const char **names, UNIHDR **pp_hdr_name,
1687                                   UNISTR2 **pp_uni_name)
1688 {
1689         uint32 i;
1690         UNIHDR *hdr_name=NULL;
1691         UNISTR2 *uni_name=NULL;
1692
1693         *pp_uni_name = NULL;
1694         *pp_hdr_name = NULL;
1695
1696         if (num_names != 0) {
1697                 hdr_name = TALLOC_ZERO_ARRAY(ctx, UNIHDR, num_names);
1698                 if (hdr_name == NULL)
1699                         return False;
1700
1701                 uni_name = TALLOC_ZERO_ARRAY(ctx,UNISTR2, num_names);
1702                 if (uni_name == NULL)
1703                         return False;
1704         }
1705
1706         for (i = 0; i < num_names; i++) {
1707                 DEBUG(10, ("names[%d]:%s\n", i, names[i] && *names[i] ? names[i] : ""));
1708                 init_unistr2(&uni_name[i], names[i], UNI_FLAGS_NONE);
1709                 init_uni_hdr(&hdr_name[i], &uni_name[i]);
1710         }
1711
1712         *pp_uni_name = uni_name;
1713         *pp_hdr_name = hdr_name;
1714
1715         return True;
1716 }
1717
1718 /*******************************************************************
1719  _samr_lookup_rids
1720  ********************************************************************/
1721
1722 NTSTATUS _samr_lookup_rids(pipes_struct *p, SAMR_Q_LOOKUP_RIDS *q_u, SAMR_R_LOOKUP_RIDS *r_u)
1723 {
1724         const char **names;
1725         enum lsa_SidType *attrs = NULL;
1726         uint32 *wire_attrs = NULL;
1727         UNIHDR *hdr_name = NULL;
1728         UNISTR2 *uni_name = NULL;
1729         DOM_SID pol_sid;
1730         int num_rids = (int)q_u->num_rids1;
1731         uint32 acc_granted;
1732         int i;
1733
1734         r_u->status = NT_STATUS_OK;
1735
1736         DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__));
1737
1738         /* find the policy handle.  open a policy on it. */
1739         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &pol_sid, &acc_granted, NULL))
1740                 return NT_STATUS_INVALID_HANDLE;
1741
1742         if (num_rids > 1000) {
1743                 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
1744                           "to samba4 idl this is not possible\n", num_rids));
1745                 return NT_STATUS_UNSUCCESSFUL;
1746         }
1747
1748         if (num_rids) {
1749                 names = TALLOC_ZERO_ARRAY(p->mem_ctx, const char *, num_rids);
1750                 attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, enum lsa_SidType, num_rids);
1751                 wire_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids);
1752
1753                 if ((names == NULL) || (attrs == NULL) || (wire_attrs==NULL))
1754                         return NT_STATUS_NO_MEMORY;
1755         } else {
1756                 names = NULL;
1757                 attrs = NULL;
1758                 wire_attrs = NULL;
1759         }
1760
1761         become_root();  /* lookup_sid can require root privs */
1762         r_u->status = pdb_lookup_rids(&pol_sid, num_rids, q_u->rid,
1763                                       names, attrs);
1764         unbecome_root();
1765
1766         if ( NT_STATUS_EQUAL(r_u->status, NT_STATUS_NONE_MAPPED) && (num_rids == 0) ) {
1767                 r_u->status = NT_STATUS_OK;
1768         }
1769
1770         if(!make_samr_lookup_rids(p->mem_ctx, num_rids, names,
1771                                   &hdr_name, &uni_name))
1772                 return NT_STATUS_NO_MEMORY;
1773
1774         /* Convert from enum lsa_SidType to uint32 for wire format. */
1775         for (i = 0; i < num_rids; i++) {
1776                 wire_attrs[i] = (uint32)attrs[i];
1777         }
1778
1779         init_samr_r_lookup_rids(r_u, num_rids, hdr_name, uni_name, wire_attrs);
1780
1781         DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__));
1782
1783         return r_u->status;
1784 }
1785
1786 /*******************************************************************
1787  _samr_open_user. Safe - gives out no passwd info.
1788  ********************************************************************/
1789
1790 NTSTATUS _samr_open_user(pipes_struct *p, SAMR_Q_OPEN_USER *q_u, SAMR_R_OPEN_USER *r_u)
1791 {
1792         struct samu *sampass=NULL;
1793         DOM_SID sid;
1794         POLICY_HND domain_pol = q_u->domain_pol;
1795         POLICY_HND *user_pol = &r_u->user_pol;
1796         struct samr_info *info = NULL;
1797         SEC_DESC *psd = NULL;
1798         uint32    acc_granted;
1799         uint32    des_access = q_u->access_mask;
1800         size_t    sd_size;
1801         BOOL ret;
1802         NTSTATUS nt_status;
1803         SE_PRIV se_rights;
1804
1805         r_u->status = NT_STATUS_OK;
1806
1807         /* find the domain policy handle and get domain SID / access bits in the domain policy. */
1808
1809         if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted, NULL) )
1810                 return NT_STATUS_INVALID_HANDLE;
1811
1812         nt_status = access_check_samr_function( acc_granted,
1813                 SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_user" );
1814
1815         if ( !NT_STATUS_IS_OK(nt_status) )
1816                 return nt_status;
1817
1818         if ( !(sampass = samu_new( p->mem_ctx )) ) {
1819                 return NT_STATUS_NO_MEMORY;
1820         }
1821
1822         /* append the user's RID to it */
1823
1824         if (!sid_append_rid(&sid, q_u->user_rid))
1825                 return NT_STATUS_NO_SUCH_USER;
1826
1827         /* check if access can be granted as requested by client. */
1828
1829         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
1830         se_map_generic(&des_access, &usr_generic_mapping);
1831
1832         se_priv_copy( &se_rights, &se_machine_account );
1833         se_priv_add( &se_rights, &se_add_users );
1834
1835         nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
1836                 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
1837                 &acc_granted, "_samr_open_user");
1838
1839         if ( !NT_STATUS_IS_OK(nt_status) )
1840                 return nt_status;
1841
1842         become_root();
1843         ret=pdb_getsampwsid(sampass, &sid);
1844         unbecome_root();
1845
1846         /* check that the SID exists in our domain. */
1847         if (ret == False) {
1848                 return NT_STATUS_NO_SUCH_USER;
1849         }
1850
1851         TALLOC_FREE(sampass);
1852
1853         /* associate the user's SID and access bits with the new handle. */
1854         if ((info = get_samr_info_by_sid(&sid)) == NULL)
1855                 return NT_STATUS_NO_MEMORY;
1856         info->acc_granted = acc_granted;
1857
1858         /* get a (unique) handle.  open a policy on it. */
1859         if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info))
1860                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1861
1862         return r_u->status;
1863 }
1864
1865 /*************************************************************************
1866  get_user_info_7. Safe. Only gives out account_name.
1867  *************************************************************************/
1868
1869 static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx, SAM_USER_INFO_7 *id7, DOM_SID *user_sid)
1870 {
1871         struct samu *smbpass=NULL;
1872         BOOL ret;
1873
1874         if ( !(smbpass = samu_new( mem_ctx )) ) {
1875                 return NT_STATUS_NO_MEMORY;
1876         }
1877
1878         become_root();
1879         ret = pdb_getsampwsid(smbpass, user_sid);
1880         unbecome_root();
1881
1882         if ( !ret ) {
1883                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1884                 return NT_STATUS_NO_SUCH_USER;
1885         }
1886
1887         DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
1888
1889         ZERO_STRUCTP(id7);
1890         init_sam_user_info7(id7, pdb_get_username(smbpass) );
1891
1892         TALLOC_FREE(smbpass);
1893
1894         return NT_STATUS_OK;
1895 }
1896
1897 /*************************************************************************
1898  get_user_info_9. Only gives out primary group SID.
1899  *************************************************************************/
1900 static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx, SAM_USER_INFO_9 * id9, DOM_SID *user_sid)
1901 {
1902         struct samu *smbpass=NULL;
1903         BOOL ret;
1904
1905         if ( !(smbpass = samu_new( mem_ctx )) ) {
1906                 return NT_STATUS_NO_MEMORY;
1907         }
1908
1909         become_root();
1910         ret = pdb_getsampwsid(smbpass, user_sid);
1911         unbecome_root();
1912
1913         if (ret==False) {
1914                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1915                 return NT_STATUS_NO_SUCH_USER;
1916         }
1917
1918         DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
1919
1920         ZERO_STRUCTP(id9);
1921         init_sam_user_info9(id9, pdb_get_group_rid(smbpass) );
1922
1923         TALLOC_FREE(smbpass);
1924
1925         return NT_STATUS_OK;
1926 }
1927
1928 /*************************************************************************
1929  get_user_info_16. Safe. Only gives out acb bits.
1930  *************************************************************************/
1931
1932 static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx, SAM_USER_INFO_16 *id16, DOM_SID *user_sid)
1933 {
1934         struct samu *smbpass=NULL;
1935         BOOL ret;
1936
1937         if ( !(smbpass = samu_new( mem_ctx )) ) {
1938                 return NT_STATUS_NO_MEMORY;
1939         }
1940
1941         become_root();
1942         ret = pdb_getsampwsid(smbpass, user_sid);
1943         unbecome_root();
1944
1945         if (ret==False) {
1946                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
1947                 return NT_STATUS_NO_SUCH_USER;
1948         }
1949
1950         DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
1951
1952         ZERO_STRUCTP(id16);
1953         init_sam_user_info16(id16, pdb_get_acct_ctrl(smbpass) );
1954
1955         TALLOC_FREE(smbpass);
1956
1957         return NT_STATUS_OK;
1958 }
1959
1960 /*************************************************************************
1961  get_user_info_18. OK - this is the killer as it gives out password info.
1962  Ensure that this is only allowed on an encrypted connection with a root
1963  user. JRA.
1964  *************************************************************************/
1965
1966 static NTSTATUS get_user_info_18(pipes_struct *p, TALLOC_CTX *mem_ctx, SAM_USER_INFO_18 * id18, DOM_SID *user_sid)
1967 {
1968         struct samu *smbpass=NULL;
1969         BOOL ret;
1970
1971         if (p->auth.auth_type != PIPE_AUTH_TYPE_NTLMSSP || p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) {
1972                 return NT_STATUS_ACCESS_DENIED;
1973         }
1974
1975         if (p->auth.auth_level != PIPE_AUTH_LEVEL_PRIVACY) {
1976                 return NT_STATUS_ACCESS_DENIED;
1977         }
1978
1979         /*
1980          * Do *NOT* do become_root()/unbecome_root() here ! JRA.
1981          */
1982
1983         if ( !(smbpass = samu_new( mem_ctx )) ) {
1984                 return NT_STATUS_NO_MEMORY;
1985         }
1986
1987         ret = pdb_getsampwsid(smbpass, user_sid);
1988
1989         if (ret == False) {
1990                 DEBUG(4, ("User %s not found\n", sid_string_static(user_sid)));
1991                 TALLOC_FREE(smbpass);
1992                 return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
1993         }
1994
1995         DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
1996
1997         if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
1998                 TALLOC_FREE(smbpass);
1999                 return NT_STATUS_ACCOUNT_DISABLED;
2000         }
2001
2002         ZERO_STRUCTP(id18);
2003         init_sam_user_info18(id18, pdb_get_lanman_passwd(smbpass), pdb_get_nt_passwd(smbpass));
2004
2005         TALLOC_FREE(smbpass);
2006
2007         return NT_STATUS_OK;
2008 }
2009
2010 /*************************************************************************
2011  get_user_info_20
2012  *************************************************************************/
2013
2014 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx, SAM_USER_INFO_20 *id20, DOM_SID *user_sid)
2015 {
2016         struct samu *sampass=NULL;
2017         BOOL ret;
2018
2019         if ( !(sampass = samu_new( mem_ctx )) ) {
2020                 return NT_STATUS_NO_MEMORY;
2021         }
2022
2023         become_root();
2024         ret = pdb_getsampwsid(sampass, user_sid);
2025         unbecome_root();
2026
2027         if (ret == False) {
2028                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
2029                 return NT_STATUS_NO_SUCH_USER;
2030         }
2031
2032         samr_clear_sam_passwd(sampass);
2033
2034         DEBUG(3,("User:[%s]\n",  pdb_get_username(sampass) ));
2035
2036         ZERO_STRUCTP(id20);
2037         init_sam_user_info20A(id20, sampass);
2038
2039         TALLOC_FREE(sampass);
2040
2041         return NT_STATUS_OK;
2042 }
2043
2044 /*************************************************************************
2045  get_user_info_21
2046  *************************************************************************/
2047
2048 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx, SAM_USER_INFO_21 *id21,
2049                                  DOM_SID *user_sid, DOM_SID *domain_sid)
2050 {
2051         struct samu *sampass=NULL;
2052         BOOL ret;
2053         NTSTATUS nt_status;
2054
2055         if ( !(sampass = samu_new( mem_ctx )) ) {
2056                 return NT_STATUS_NO_MEMORY;
2057         }
2058
2059         become_root();
2060         ret = pdb_getsampwsid(sampass, user_sid);
2061         unbecome_root();
2062
2063         if (ret == False) {
2064                 DEBUG(4,("User %s not found\n", sid_string_static(user_sid)));
2065                 return NT_STATUS_NO_SUCH_USER;
2066         }
2067
2068         samr_clear_sam_passwd(sampass);
2069
2070         DEBUG(3,("User:[%s]\n",  pdb_get_username(sampass) ));
2071
2072         ZERO_STRUCTP(id21);
2073         nt_status = init_sam_user_info21A(id21, sampass, domain_sid);
2074
2075         TALLOC_FREE(sampass);
2076
2077         return nt_status;
2078 }
2079
2080 /*******************************************************************
2081  _samr_query_userinfo
2082  ********************************************************************/
2083
2084 NTSTATUS _samr_query_userinfo(pipes_struct *p, SAMR_Q_QUERY_USERINFO *q_u, SAMR_R_QUERY_USERINFO *r_u)
2085 {
2086         SAM_USERINFO_CTR *ctr;
2087         struct samr_info *info = NULL;
2088         DOM_SID domain_sid;
2089         uint32 rid;
2090
2091         r_u->status=NT_STATUS_OK;
2092
2093         /* search for the handle */
2094         if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
2095                 return NT_STATUS_INVALID_HANDLE;
2096
2097         domain_sid = info->sid;
2098
2099         sid_split_rid(&domain_sid, &rid);
2100
2101         if (!sid_check_is_in_our_domain(&info->sid))
2102                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2103
2104         DEBUG(5,("_samr_query_userinfo: sid:%s\n", sid_string_static(&info->sid)));
2105
2106         ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_USERINFO_CTR);
2107         if (!ctr)
2108                 return NT_STATUS_NO_MEMORY;
2109
2110         ZERO_STRUCTP(ctr);
2111
2112         /* ok!  user info levels (lots: see MSDEV help), off we go... */
2113         ctr->switch_value = q_u->switch_value;
2114
2115         DEBUG(5,("_samr_query_userinfo: user info level: %d\n", q_u->switch_value));
2116
2117         switch (q_u->switch_value) {
2118         case 7:
2119                 ctr->info.id7 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_7);
2120                 if (ctr->info.id7 == NULL)
2121                         return NT_STATUS_NO_MEMORY;
2122
2123                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_7(p->mem_ctx, ctr->info.id7, &info->sid)))
2124                         return r_u->status;
2125                 break;
2126         case 9:
2127                 ctr->info.id9 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_9);
2128                 if (ctr->info.id9 == NULL)
2129                         return NT_STATUS_NO_MEMORY;
2130
2131                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_9(p->mem_ctx, ctr->info.id9, &info->sid)))
2132                         return r_u->status;
2133                 break;
2134         case 16:
2135                 ctr->info.id16 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_16);
2136                 if (ctr->info.id16 == NULL)
2137                         return NT_STATUS_NO_MEMORY;
2138
2139                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_16(p->mem_ctx, ctr->info.id16, &info->sid)))
2140                         return r_u->status;
2141                 break;
2142
2143         case 18:
2144                 ctr->info.id18 = TALLOC_ZERO_P(p->mem_ctx, SAM_USER_INFO_18);
2145                 if (ctr->info.id18 == NULL)
2146                         return NT_STATUS_NO_MEMORY;
2147
2148                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_18(p, p->mem_ctx, ctr->info.id18, &info->sid)))
2149                         return r_u->status;
2150                 break;
2151
2152         case 20:
2153                 ctr->info.id20 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_20);
2154                 if (ctr->info.id20 == NULL)
2155                         return NT_STATUS_NO_MEMORY;
2156                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_20(p->mem_ctx, ctr->info.id20, &info->sid)))
2157                         return r_u->status;
2158                 break;
2159
2160         case 21:
2161                 ctr->info.id21 = TALLOC_ZERO_P(p->mem_ctx,SAM_USER_INFO_21);
2162                 if (ctr->info.id21 == NULL)
2163                         return NT_STATUS_NO_MEMORY;
2164                 if (!NT_STATUS_IS_OK(r_u->status = get_user_info_21(p->mem_ctx, ctr->info.id21,
2165                                                                     &info->sid, &domain_sid)))
2166                         return r_u->status;
2167                 break;
2168
2169         default:
2170                 return NT_STATUS_INVALID_INFO_CLASS;
2171         }
2172
2173         init_samr_r_query_userinfo(r_u, ctr, r_u->status);
2174
2175         DEBUG(5,("_samr_query_userinfo: %d\n", __LINE__));
2176
2177         return r_u->status;
2178 }
2179
2180 /*******************************************************************
2181  samr_reply_query_usergroups
2182  ********************************************************************/
2183
2184 NTSTATUS _samr_query_usergroups(pipes_struct *p, SAMR_Q_QUERY_USERGROUPS *q_u, SAMR_R_QUERY_USERGROUPS *r_u)
2185 {
2186         struct samu *sam_pass=NULL;
2187         DOM_SID  sid;
2188         DOM_SID *sids;
2189         DOM_GID dom_gid;
2190         DOM_GID *gids = NULL;
2191         uint32 primary_group_rid;
2192         size_t num_groups = 0;
2193         gid_t *unix_gids;
2194         size_t i, num_gids;
2195         uint32 acc_granted;
2196         BOOL ret;
2197         NTSTATUS result;
2198         BOOL success = False;
2199
2200         /*
2201          * from the SID in the request:
2202          * we should send back the list of DOMAIN GROUPS
2203          * the user is a member of
2204          *
2205          * and only the DOMAIN GROUPS
2206          * no ALIASES !!! neither aliases of the domain
2207          * nor aliases of the builtin SID
2208          *
2209          * JFM, 12/2/2001
2210          */
2211
2212         r_u->status = NT_STATUS_OK;
2213
2214         DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
2215
2216         /* find the policy handle.  open a policy on it. */
2217         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &sid, &acc_granted, NULL))
2218                 return NT_STATUS_INVALID_HANDLE;
2219
2220         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_USER_GET_GROUPS, "_samr_query_usergroups"))) {
2221                 return r_u->status;
2222         }
2223
2224         if (!sid_check_is_in_our_domain(&sid))
2225                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2226
2227         if ( !(sam_pass = samu_new( p->mem_ctx )) ) {
2228                 return NT_STATUS_NO_MEMORY;
2229         }
2230
2231         become_root();
2232         ret = pdb_getsampwsid(sam_pass, &sid);
2233         unbecome_root();
2234
2235         if (!ret) {
2236                 DEBUG(10, ("pdb_getsampwsid failed for %s\n",
2237                            sid_string_static(&sid)));
2238                 return NT_STATUS_NO_SUCH_USER;
2239         }
2240
2241         sids = NULL;
2242
2243         /* make both calls inside the root block */
2244         become_root();
2245         result = pdb_enum_group_memberships(p->mem_ctx, sam_pass,
2246                                             &sids, &unix_gids, &num_groups);
2247         if ( NT_STATUS_IS_OK(result) ) {
2248                 success = sid_peek_check_rid(get_global_sam_sid(),
2249                                              pdb_get_group_sid(sam_pass),
2250                                              &primary_group_rid);
2251         }
2252         unbecome_root();
2253
2254         if (!NT_STATUS_IS_OK(result)) {
2255                 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
2256                            sid_string_static(&sid)));
2257                 return result;
2258         }
2259
2260         if ( !success ) {
2261                 DEBUG(5, ("Group sid %s for user %s not in our domain\n",
2262                           sid_string_static(pdb_get_group_sid(sam_pass)),
2263                           pdb_get_username(sam_pass)));
2264                 TALLOC_FREE(sam_pass);
2265                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2266         }
2267
2268         gids = NULL;
2269         num_gids = 0;
2270
2271         dom_gid.attr = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
2272                         SE_GROUP_ENABLED);
2273         dom_gid.g_rid = primary_group_rid;
2274         ADD_TO_ARRAY(p->mem_ctx, DOM_GID, dom_gid, &gids, &num_gids);
2275
2276         for (i=0; i<num_groups; i++) {
2277
2278                 if (!sid_peek_check_rid(get_global_sam_sid(),
2279                                         &(sids[i]), &dom_gid.g_rid)) {
2280                         DEBUG(10, ("Found sid %s not in our domain\n",
2281                                    sid_string_static(&sids[i])));
2282                         continue;
2283                 }
2284
2285                 if (dom_gid.g_rid == primary_group_rid) {
2286                         /* We added the primary group directly from the
2287                          * sam_account. The other SIDs are unique from
2288                          * enum_group_memberships */
2289                         continue;
2290                 }
2291
2292                 ADD_TO_ARRAY(p->mem_ctx, DOM_GID, dom_gid, &gids, &num_gids);
2293         }
2294
2295         /* construct the response.  lkclXXXX: gids are not copied! */
2296         init_samr_r_query_usergroups(r_u, num_gids, gids, r_u->status);
2297
2298         DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__));
2299
2300         return r_u->status;
2301 }
2302
2303 /*******************************************************************
2304  _samr_query_domain_info
2305  ********************************************************************/
2306
2307 NTSTATUS _samr_query_domain_info(pipes_struct *p,
2308                                  SAMR_Q_QUERY_DOMAIN_INFO *q_u,
2309                                  SAMR_R_QUERY_DOMAIN_INFO *r_u)
2310 {
2311         struct samr_info *info = NULL;
2312         SAM_UNK_CTR *ctr;
2313         uint32 min_pass_len,pass_hist,password_properties;
2314         time_t u_expire, u_min_age;
2315         NTTIME nt_expire, nt_min_age;
2316
2317         time_t u_lock_duration, u_reset_time;
2318         NTTIME nt_lock_duration, nt_reset_time;
2319         uint32 lockout;
2320         time_t u_logout;
2321         NTTIME nt_logout;
2322
2323         uint32 account_policy_temp;
2324
2325         time_t seq_num;
2326         uint32 server_role;
2327
2328         uint32 num_users=0, num_groups=0, num_aliases=0;
2329
2330         if ((ctr = TALLOC_ZERO_P(p->mem_ctx, SAM_UNK_CTR)) == NULL) {
2331                 return NT_STATUS_NO_MEMORY;
2332         }
2333
2334         ZERO_STRUCTP(ctr);
2335
2336         r_u->status = NT_STATUS_OK;
2337
2338         DEBUG(5,("_samr_query_domain_info: %d\n", __LINE__));
2339
2340         /* find the policy handle.  open a policy on it. */
2341         if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)(void *)&info)) {
2342                 return NT_STATUS_INVALID_HANDLE;
2343         }
2344
2345         switch (q_u->switch_value) {
2346                 case 0x01:
2347
2348                         become_root();
2349
2350                         /* AS ROOT !!! */
2351
2352                         pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp);
2353                         min_pass_len = account_policy_temp;
2354
2355                         pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
2356                         pass_hist = account_policy_temp;
2357
2358                         pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
2359                         password_properties = account_policy_temp;
2360
2361                         pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
2362                         u_expire = account_policy_temp;
2363
2364                         pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
2365                         u_min_age = account_policy_temp;
2366
2367                         /* !AS ROOT */
2368
2369                         unbecome_root();
2370
2371                         unix_to_nt_time_abs(&nt_expire, u_expire);
2372                         unix_to_nt_time_abs(&nt_min_age, u_min_age);
2373
2374                         init_unk_info1(&ctr->info.inf1, (uint16)min_pass_len, (uint16)pass_hist,
2375                                        password_properties, nt_expire, nt_min_age);
2376                         break;
2377                 case 0x02:
2378
2379                         become_root();
2380
2381                         /* AS ROOT !!! */
2382
2383                         num_users = count_sam_users(info->disp_info, ACB_NORMAL);
2384                         num_groups = count_sam_groups(info->disp_info);
2385                         num_aliases = count_sam_aliases(info->disp_info);
2386
2387                         pdb_get_account_policy(AP_TIME_TO_LOGOUT, &account_policy_temp);
2388                         u_logout = account_policy_temp;
2389
2390                         unix_to_nt_time_abs(&nt_logout, u_logout);
2391
2392                         if (!pdb_get_seq_num(&seq_num))
2393                                 seq_num = time(NULL);
2394
2395                         /* !AS ROOT */
2396
2397                         unbecome_root();
2398
2399                         server_role = ROLE_DOMAIN_PDC;
2400                         if (lp_server_role() == ROLE_DOMAIN_BDC)
2401                                 server_role = ROLE_DOMAIN_BDC;
2402
2403                         init_unk_info2(&ctr->info.inf2, lp_serverstring(), lp_workgroup(), global_myname(), seq_num,
2404                                        num_users, num_groups, num_aliases, nt_logout, server_role);
2405                         break;
2406                 case 0x03:
2407
2408                         become_root();
2409
2410                         /* AS ROOT !!! */
2411
2412                         {
2413                                 uint32 ul;
2414                                 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &ul);
2415                                 u_logout = (time_t)ul;
2416                         }
2417
2418                         /* !AS ROOT */
2419
2420                         unbecome_root();
2421
2422                         unix_to_nt_time_abs(&nt_logout, u_logout);
2423
2424                         init_unk_info3(&ctr->info.inf3, nt_logout);
2425                         break;
2426                 case 0x04:
2427                         init_unk_info4(&ctr->info.inf4, lp_serverstring());
2428                         break;
2429                 case 0x05:
2430                         init_unk_info5(&ctr->info.inf5, get_global_sam_name());
2431                         break;
2432                 case 0x06:
2433                         /* NT returns its own name when a PDC. win2k and later
2434                          * only the name of the PDC if itself is a BDC (samba4
2435                          * idl) */
2436                         init_unk_info6(&ctr->info.inf6, global_myname());
2437                         break;
2438                 case 0x07:
2439                         server_role = ROLE_DOMAIN_PDC;
2440                         if (lp_server_role() == ROLE_DOMAIN_BDC)
2441                                 server_role = ROLE_DOMAIN_BDC;
2442
2443                         init_unk_info7(&ctr->info.inf7, server_role);
2444                         break;
2445                 case 0x08:
2446
2447                         become_root();
2448
2449                         /* AS ROOT !!! */
2450
2451                         if (!pdb_get_seq_num(&seq_num)) {
2452                                 seq_num = time(NULL);
2453                         }
2454
2455                         /* !AS ROOT */
2456
2457                         unbecome_root();
2458
2459                         init_unk_info8(&ctr->info.inf8, (uint32) seq_num);
2460                         break;
2461                 case 0x0c:
2462
2463                         become_root();
2464
2465                         /* AS ROOT !!! */
2466
2467                         pdb_get_account_policy(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
2468                         u_lock_duration = account_policy_temp;
2469                         if (u_lock_duration != -1) {
2470                                 u_lock_duration *= 60;
2471                         }
2472
2473                         pdb_get_account_policy(AP_RESET_COUNT_TIME, &account_policy_temp);
2474                         u_reset_time = account_policy_temp * 60;
2475
2476                         pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
2477                         lockout = account_policy_temp;
2478
2479                         /* !AS ROOT */
2480
2481                         unbecome_root();
2482
2483                         unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
2484                         unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
2485
2486                         init_unk_info12(&ctr->info.inf12, nt_lock_duration, nt_reset_time, (uint16)lockout);
2487                         break;
2488                 default:
2489                         return NT_STATUS_INVALID_INFO_CLASS;
2490                 }
2491
2492
2493         init_samr_r_query_domain_info(r_u, q_u->switch_value, ctr, NT_STATUS_OK);
2494
2495         DEBUG(5,("_samr_query_domain_info: %d\n", __LINE__));
2496
2497         return r_u->status;
2498 }
2499
2500 /* W2k3 seems to use the same check for all 3 objects that can be created via
2501  * SAMR, if you try to create for example "Dialup" as an alias it says
2502  * "NT_STATUS_USER_EXISTS". This is racy, but we can't really lock the user
2503  * database. */
2504
2505 static NTSTATUS can_create(TALLOC_CTX *mem_ctx, const char *new_name)
2506 {
2507         enum lsa_SidType type;
2508         BOOL result;
2509
2510         DEBUG(10, ("Checking whether [%s] can be created\n", new_name));
2511
2512         become_root();
2513         /* Lookup in our local databases (LOOKUP_NAME_REMOTE not set)
2514          * whether the name already exists */
2515         result = lookup_name(mem_ctx, new_name, LOOKUP_NAME_LOCAL,
2516                              NULL, NULL, NULL, &type);
2517         unbecome_root();
2518
2519         if (!result) {
2520                 DEBUG(10, ("%s does not exist, can create it\n", new_name));
2521                 return NT_STATUS_OK;
2522         }
2523
2524         DEBUG(5, ("trying to create %s, exists as %s\n",
2525                   new_name, sid_type_lookup(type)));
2526
2527         if (type == SID_NAME_DOM_GRP) {
2528                 return NT_STATUS_GROUP_EXISTS;
2529         }
2530         if (type == SID_NAME_ALIAS) {
2531                 return NT_STATUS_ALIAS_EXISTS;
2532         }
2533
2534         /* Yes, the default is NT_STATUS_USER_EXISTS */
2535         return NT_STATUS_USER_EXISTS;
2536 }
2537
2538 /*******************************************************************
2539  _samr_create_user
2540  Create an account, can be either a normal user or a machine.
2541  This funcion will need to be updated for bdc/domain trusts.
2542  ********************************************************************/
2543
2544 NTSTATUS _samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u,
2545                            SAMR_R_CREATE_USER *r_u)
2546 {
2547         char *account;
2548         DOM_SID sid;
2549         POLICY_HND dom_pol = q_u->domain_pol;
2550         uint16 acb_info = q_u->acb_info;
2551         POLICY_HND *user_pol = &r_u->user_pol;
2552         struct samr_info *info = NULL;
2553         NTSTATUS nt_status;
2554         uint32 acc_granted;
2555         SEC_DESC *psd;
2556         size_t    sd_size;
2557         /* check this, when giving away 'add computer to domain' privs */
2558         uint32    des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
2559         BOOL can_add_account = False;
2560         SE_PRIV se_rights;
2561         DISP_INFO *disp_info = NULL;
2562
2563         /* Get the domain SID stored in the domain policy */
2564         if (!get_lsa_policy_samr_sid(p, &dom_pol, &sid, &acc_granted,
2565                                      &disp_info))
2566                 return NT_STATUS_INVALID_HANDLE;
2567
2568         nt_status = access_check_samr_function(acc_granted,
2569                                                SA_RIGHT_DOMAIN_CREATE_USER,
2570                                                "_samr_create_user");
2571         if (!NT_STATUS_IS_OK(nt_status)) {
2572                 return nt_status;
2573         }
2574
2575         if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST ||
2576               acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
2577                 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
2578                    this parameter is not an account type */
2579                 return NT_STATUS_INVALID_PARAMETER;
2580         }
2581
2582         account = rpcstr_pull_unistr2_talloc(p->mem_ctx, &q_u->uni_name);
2583         if (account == NULL) {
2584                 return NT_STATUS_NO_MEMORY;
2585         }
2586
2587         nt_status = can_create(p->mem_ctx, account);
2588         if (!NT_STATUS_IS_OK(nt_status)) {
2589                 return nt_status;
2590         }
2591
2592         /* determine which user right we need to check based on the acb_info */
2593
2594         if ( acb_info & ACB_WSTRUST )
2595         {
2596                 se_priv_copy( &se_rights, &se_machine_account );
2597                 can_add_account = user_has_privileges(
2598                         p->pipe_user.nt_user_token, &se_rights );
2599         }
2600         /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
2601            account for domain trusts and changes the ACB flags later */
2602         else if ( acb_info & ACB_NORMAL &&
2603                   (account[strlen(account)-1] != '$') )
2604         {
2605                 se_priv_copy( &se_rights, &se_add_users );
2606                 can_add_account = user_has_privileges(
2607                         p->pipe_user.nt_user_token, &se_rights );
2608         }
2609         else    /* implicit assumption of a BDC or domain trust account here
2610                  * (we already check the flags earlier) */
2611         {
2612                 if ( lp_enable_privileges() ) {
2613                         /* only Domain Admins can add a BDC or domain trust */
2614                         se_priv_copy( &se_rights, &se_priv_none );
2615                         can_add_account = nt_token_check_domain_rid(
2616                                 p->pipe_user.nt_user_token,
2617                                 DOMAIN_GROUP_RID_ADMINS );
2618                 }
2619         }
2620
2621         DEBUG(5, ("_samr_create_user: %s can add this account : %s\n",
2622                   uidtoname(p->pipe_user.ut.uid),
2623                   can_add_account ? "True":"False" ));
2624
2625         /********** BEGIN Admin BLOCK **********/
2626
2627         if ( can_add_account )
2628                 become_root();
2629
2630         nt_status = pdb_create_user(p->mem_ctx, account, acb_info,
2631                                     &r_u->user_rid);
2632
2633         if ( can_add_account )
2634                 unbecome_root();
2635
2636         /********** END Admin BLOCK **********/
2637
2638         /* now check for failure */
2639
2640         if ( !NT_STATUS_IS_OK(nt_status) )
2641                 return nt_status;
2642
2643         /* Get the user's SID */
2644
2645         sid_compose(&sid, get_global_sam_sid(), r_u->user_rid);
2646
2647         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
2648                             &sid, SAMR_USR_RIGHTS_WRITE_PW);
2649         se_map_generic(&des_access, &usr_generic_mapping);
2650
2651         nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2652                 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
2653                 &acc_granted, "_samr_create_user");
2654
2655         if ( !NT_STATUS_IS_OK(nt_status) ) {
2656                 return nt_status;
2657         }
2658
2659         /* associate the user's SID with the new handle. */
2660         if ((info = get_samr_info_by_sid(&sid)) == NULL) {
2661                 return NT_STATUS_NO_MEMORY;
2662         }
2663
2664         ZERO_STRUCTP(info);
2665         info->sid = sid;
2666         info->acc_granted = acc_granted;
2667
2668         /* get a (unique) handle.  open a policy on it. */
2669         if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info)) {
2670                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2671         }
2672
2673         /* After a "set" ensure we have no cached display info. */
2674         force_flush_samr_cache(info->disp_info);
2675
2676         r_u->access_granted = acc_granted;
2677
2678         return NT_STATUS_OK;
2679 }
2680
2681 /*******************************************************************
2682  samr_reply_connect_anon
2683  ********************************************************************/
2684
2685 NTSTATUS _samr_connect_anon(pipes_struct *p, SAMR_Q_CONNECT_ANON *q_u, SAMR_R_CONNECT_ANON *r_u)
2686 {
2687         struct samr_info *info = NULL;
2688         uint32    des_access = q_u->access_mask;
2689
2690         /* Access check */
2691
2692         if (!pipe_access_check(p)) {
2693                 DEBUG(3, ("access denied to samr_connect_anon\n"));
2694                 r_u->status = NT_STATUS_ACCESS_DENIED;
2695                 return r_u->status;
2696         }
2697
2698         /* set up the SAMR connect_anon response */
2699
2700         r_u->status = NT_STATUS_OK;
2701
2702         /* associate the user's SID with the new handle. */
2703         if ((info = get_samr_info_by_sid(NULL)) == NULL)
2704                 return NT_STATUS_NO_MEMORY;
2705
2706         /* don't give away the farm but this is probably ok.  The SA_RIGHT_SAM_ENUM_DOMAINS
2707            was observed from a win98 client trying to enumerate users (when configured
2708            user level access control on shares)   --jerry */
2709
2710         if (des_access == MAXIMUM_ALLOWED_ACCESS) {
2711                 /* Map to max possible knowing we're filtered below. */
2712                 des_access = GENERIC_ALL_ACCESS;
2713         }
2714
2715         se_map_generic( &des_access, &sam_generic_mapping );
2716         info->acc_granted = des_access & (SA_RIGHT_SAM_ENUM_DOMAINS|SA_RIGHT_SAM_OPEN_DOMAIN);
2717
2718         info->status = q_u->unknown_0;
2719
2720         /* get a (unique) handle.  open a policy on it. */
2721         if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2722                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2723
2724         return r_u->status;
2725 }
2726
2727 /*******************************************************************
2728  samr_reply_connect
2729  ********************************************************************/
2730
2731 NTSTATUS _samr_connect(pipes_struct *p, SAMR_Q_CONNECT *q_u, SAMR_R_CONNECT *r_u)
2732 {
2733         struct samr_info *info = NULL;
2734         SEC_DESC *psd = NULL;
2735         uint32    acc_granted;
2736         uint32    des_access = q_u->access_mask;
2737         NTSTATUS  nt_status;
2738         size_t    sd_size;
2739
2740
2741         DEBUG(5,("_samr_connect: %d\n", __LINE__));
2742
2743         /* Access check */
2744
2745         if (!pipe_access_check(p)) {
2746                 DEBUG(3, ("access denied to samr_connect\n"));
2747                 r_u->status = NT_STATUS_ACCESS_DENIED;
2748                 return r_u->status;
2749         }
2750
2751         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
2752         se_map_generic(&des_access, &sam_generic_mapping);
2753
2754         nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2755                 NULL, 0, des_access, &acc_granted, "_samr_connect");
2756
2757         if ( !NT_STATUS_IS_OK(nt_status) )
2758                 return nt_status;
2759
2760         r_u->status = NT_STATUS_OK;
2761
2762         /* associate the user's SID and access granted with the new handle. */
2763         if ((info = get_samr_info_by_sid(NULL)) == NULL)
2764                 return NT_STATUS_NO_MEMORY;
2765
2766         info->acc_granted = acc_granted;
2767         info->status = q_u->access_mask;
2768
2769         /* get a (unique) handle.  open a policy on it. */
2770         if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2771                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2772
2773         DEBUG(5,("_samr_connect: %d\n", __LINE__));
2774
2775         return r_u->status;
2776 }
2777
2778 /*******************************************************************
2779  samr_connect4
2780  ********************************************************************/
2781
2782 NTSTATUS _samr_connect4(pipes_struct *p, SAMR_Q_CONNECT4 *q_u, SAMR_R_CONNECT4 *r_u)
2783 {
2784         struct samr_info *info = NULL;
2785         SEC_DESC *psd = NULL;
2786         uint32    acc_granted;
2787         uint32    des_access = q_u->access_mask;
2788         NTSTATUS  nt_status;
2789         size_t    sd_size;
2790
2791
2792         DEBUG(5,("_samr_connect4: %d\n", __LINE__));
2793
2794         /* Access check */
2795
2796         if (!pipe_access_check(p)) {
2797                 DEBUG(3, ("access denied to samr_connect4\n"));
2798                 r_u->status = NT_STATUS_ACCESS_DENIED;
2799                 return r_u->status;
2800         }
2801
2802         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
2803         se_map_generic(&des_access, &sam_generic_mapping);
2804
2805         nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2806                 NULL, 0, des_access, &acc_granted, "_samr_connect4");
2807
2808         if ( !NT_STATUS_IS_OK(nt_status) )
2809                 return nt_status;
2810
2811         r_u->status = NT_STATUS_OK;
2812
2813         /* associate the user's SID and access granted with the new handle. */
2814         if ((info = get_samr_info_by_sid(NULL)) == NULL)
2815                 return NT_STATUS_NO_MEMORY;
2816
2817         info->acc_granted = acc_granted;
2818         info->status = q_u->access_mask;
2819
2820         /* get a (unique) handle.  open a policy on it. */
2821         if (!create_policy_hnd(p, &r_u->connect_pol, free_samr_info, (void *)info))
2822                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2823
2824         DEBUG(5,("_samr_connect: %d\n", __LINE__));
2825
2826         return r_u->status;
2827 }
2828
2829 /*******************************************************************
2830  samr_connect5
2831  ********************************************************************/
2832
2833 NTSTATUS _samr_connect5(pipes_struct *p, SAMR_Q_CONNECT5 *q_u, SAMR_R_CONNECT5 *r_u)
2834 {
2835         struct samr_info *info = NULL;
2836         SEC_DESC *psd = NULL;
2837         uint32    acc_granted;
2838         uint32    des_access = q_u->access_mask;
2839         NTSTATUS  nt_status;
2840         POLICY_HND pol;
2841         size_t    sd_size;
2842
2843
2844         DEBUG(5,("_samr_connect5: %d\n", __LINE__));
2845
2846         ZERO_STRUCTP(r_u);
2847
2848         /* Access check */
2849
2850         if (!pipe_access_check(p)) {
2851                 DEBUG(3, ("access denied to samr_connect5\n"));
2852                 r_u->status = NT_STATUS_ACCESS_DENIED;
2853                 return r_u->status;
2854         }
2855
2856         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
2857         se_map_generic(&des_access, &sam_generic_mapping);
2858
2859         nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2860                 NULL, 0, des_access, &acc_granted, "_samr_connect5");
2861
2862         if ( !NT_STATUS_IS_OK(nt_status) )
2863                 return nt_status;
2864
2865         /* associate the user's SID and access granted with the new handle. */
2866         if ((info = get_samr_info_by_sid(NULL)) == NULL)
2867                 return NT_STATUS_NO_MEMORY;
2868
2869         info->acc_granted = acc_granted;
2870         info->status = q_u->access_mask;
2871
2872         /* get a (unique) handle.  open a policy on it. */
2873         if (!create_policy_hnd(p, &pol, free_samr_info, (void *)info))
2874                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2875
2876         DEBUG(5,("_samr_connect: %d\n", __LINE__));
2877
2878         init_samr_r_connect5(r_u, &pol, NT_STATUS_OK);
2879
2880         return r_u->status;
2881 }
2882
2883 /**********************************************************************
2884  api_samr_lookup_domain
2885  **********************************************************************/
2886
2887 NTSTATUS _samr_lookup_domain(pipes_struct *p, SAMR_Q_LOOKUP_DOMAIN *q_u, SAMR_R_LOOKUP_DOMAIN *r_u)
2888 {
2889         struct samr_info *info;
2890         fstring domain_name;
2891         DOM_SID sid;
2892
2893         r_u->status = NT_STATUS_OK;
2894
2895         if (!find_policy_by_hnd(p, &q_u->connect_pol, (void**)(void *)&info))
2896                 return NT_STATUS_INVALID_HANDLE;
2897
2898         /* win9x user manager likes to use SA_RIGHT_SAM_ENUM_DOMAINS here.
2899            Reverted that change so we will work with RAS servers again */
2900
2901         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted,
2902                 SA_RIGHT_SAM_OPEN_DOMAIN, "_samr_lookup_domain")))
2903         {
2904                 return r_u->status;
2905         }
2906
2907         rpcstr_pull(domain_name, q_u->uni_domain.buffer, sizeof(domain_name), q_u->uni_domain.uni_str_len*2, 0);
2908
2909         ZERO_STRUCT(sid);
2910
2911         if (strequal(domain_name, builtin_domain_name())) {
2912                 sid_copy(&sid, &global_sid_Builtin);
2913         } else {
2914                 if (!secrets_fetch_domain_sid(domain_name, &sid)) {
2915                         r_u->status = NT_STATUS_NO_SUCH_DOMAIN;
2916                 }
2917         }
2918
2919         DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name, sid_string_static(&sid)));
2920
2921         init_samr_r_lookup_domain(r_u, &sid, r_u->status);
2922
2923         return r_u->status;
2924 }
2925
2926 /******************************************************************
2927 makes a SAMR_R_ENUM_DOMAINS structure.
2928 ********************************************************************/
2929
2930 static BOOL make_enum_domains(TALLOC_CTX *ctx, SAM_ENTRY **pp_sam,
2931                         UNISTR2 **pp_uni_name, uint32 num_sam_entries, fstring doms[])
2932 {
2933         uint32 i;
2934         SAM_ENTRY *sam;
2935         UNISTR2 *uni_name;
2936
2937         DEBUG(5, ("make_enum_domains\n"));
2938
2939         *pp_sam = NULL;
2940         *pp_uni_name = NULL;
2941
2942         if (num_sam_entries == 0)
2943                 return True;
2944
2945         sam = TALLOC_ZERO_ARRAY(ctx, SAM_ENTRY, num_sam_entries);
2946         uni_name = TALLOC_ZERO_ARRAY(ctx, UNISTR2, num_sam_entries);
2947
2948         if (sam == NULL || uni_name == NULL)
2949                 return False;
2950
2951         for (i = 0; i < num_sam_entries; i++) {
2952                 init_unistr2(&uni_name[i], doms[i], UNI_FLAGS_NONE);
2953                 init_sam_entry(&sam[i], &uni_name[i], 0);
2954         }
2955
2956         *pp_sam = sam;
2957         *pp_uni_name = uni_name;
2958
2959         return True;
2960 }
2961
2962 /**********************************************************************
2963  api_samr_enum_domains
2964  **********************************************************************/
2965
2966 NTSTATUS _samr_enum_domains(pipes_struct *p, SAMR_Q_ENUM_DOMAINS *q_u, SAMR_R_ENUM_DOMAINS *r_u)
2967 {
2968         struct samr_info *info;
2969         uint32 num_entries = 2;
2970         fstring dom[2];
2971         const char *name;
2972
2973         r_u->status = NT_STATUS_OK;
2974
2975         if (!find_policy_by_hnd(p, &q_u->pol, (void**)(void *)&info))
2976                 return NT_STATUS_INVALID_HANDLE;
2977
2978         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(info->acc_granted, SA_RIGHT_SAM_ENUM_DOMAINS, "_samr_enum_domains"))) {
2979                 return r_u->status;
2980         }
2981
2982         name = get_global_sam_name();
2983
2984         fstrcpy(dom[0],name);
2985         strupper_m(dom[0]);
2986         fstrcpy(dom[1],"Builtin");
2987
2988         if (!make_enum_domains(p->mem_ctx, &r_u->sam, &r_u->uni_dom_name, num_entries, dom))
2989                 return NT_STATUS_NO_MEMORY;
2990
2991         init_samr_r_enum_domains(r_u, q_u->start_idx + num_entries, num_entries);
2992
2993         return r_u->status;
2994 }
2995
2996 /*******************************************************************
2997  api_samr_open_alias
2998  ********************************************************************/
2999
3000 NTSTATUS _samr_open_alias(pipes_struct *p, SAMR_Q_OPEN_ALIAS *q_u, SAMR_R_OPEN_ALIAS *r_u)
3001 {
3002         DOM_SID sid;
3003         POLICY_HND domain_pol = q_u->dom_pol;
3004         uint32 alias_rid = q_u->rid_alias;
3005         POLICY_HND *alias_pol = &r_u->pol;
3006         struct    samr_info *info = NULL;
3007         SEC_DESC *psd = NULL;
3008         uint32    acc_granted;
3009         uint32    des_access = q_u->access_mask;
3010         size_t    sd_size;
3011         NTSTATUS  status;
3012         SE_PRIV se_rights;
3013
3014         r_u->status = NT_STATUS_OK;
3015
3016         /* find the domain policy and get the SID / access bits stored in the domain policy */
3017
3018         if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted, NULL) )
3019                 return NT_STATUS_INVALID_HANDLE;
3020
3021         status = access_check_samr_function(acc_granted,
3022                 SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_alias");
3023
3024         if ( !NT_STATUS_IS_OK(status) )
3025                 return status;
3026
3027         /* append the alias' RID to it */
3028
3029         if (!sid_append_rid(&sid, alias_rid))
3030                 return NT_STATUS_NO_SUCH_ALIAS;
3031
3032         /*check if access can be granted as requested by client. */
3033
3034         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
3035         se_map_generic(&des_access,&ali_generic_mapping);
3036
3037         se_priv_copy( &se_rights, &se_add_users );
3038
3039
3040         status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3041                 &se_rights, GENERIC_RIGHTS_ALIAS_WRITE, des_access,
3042                 &acc_granted, "_samr_open_alias");
3043
3044         if ( !NT_STATUS_IS_OK(status) )
3045                 return status;
3046
3047         {
3048                 /* Check we actually have the requested alias */
3049                 enum lsa_SidType type;
3050                 BOOL result;
3051                 gid_t gid;
3052
3053                 become_root();
3054                 result = lookup_sid(NULL, &sid, NULL, NULL, &type);
3055                 unbecome_root();
3056
3057                 if (!result || (type != SID_NAME_ALIAS)) {
3058                         return NT_STATUS_NO_SUCH_ALIAS;
3059                 }
3060
3061                 /* make sure there is a mapping */
3062
3063                 if ( !sid_to_gid( &sid, &gid ) ) {
3064                         return NT_STATUS_NO_SUCH_ALIAS;
3065                 }
3066
3067         }
3068
3069         /* associate the alias SID with the new handle. */
3070         if ((info = get_samr_info_by_sid(&sid)) == NULL)
3071                 return NT_STATUS_NO_MEMORY;
3072
3073         info->acc_granted = acc_granted;
3074
3075         /* get a (unique) handle.  open a policy on it. */
3076         if (!create_policy_hnd(p, alias_pol, free_samr_info, (void *)info))
3077                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3078
3079         return r_u->status;
3080 }
3081
3082 /*******************************************************************
3083  set_user_info_7
3084  ********************************************************************/
3085 static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
3086                                 const SAM_USER_INFO_7 *id7, struct samu *pwd)
3087 {
3088         fstring new_name;
3089         NTSTATUS rc;
3090
3091         if (id7 == NULL) {
3092                 DEBUG(5, ("set_user_info_7: NULL id7\n"));
3093                 TALLOC_FREE(pwd);
3094                 return NT_STATUS_ACCESS_DENIED;
3095         }
3096
3097         if(!rpcstr_pull(new_name, id7->uni_name.buffer, sizeof(new_name), id7->uni_name.uni_str_len*2, 0)) {
3098                 DEBUG(5, ("set_user_info_7: failed to get new username\n"));
3099                 TALLOC_FREE(pwd);
3100                 return NT_STATUS_ACCESS_DENIED;
3101         }
3102
3103         /* check to see if the new username already exists.  Note: we can't
3104            reliably lock all backends, so there is potentially the
3105            possibility that a user can be created in between this check and
3106            the rename.  The rename should fail, but may not get the
3107            exact same failure status code.  I think this is small enough
3108            of a window for this type of operation and the results are
3109            simply that the rename fails with a slightly different status
3110            code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3111
3112         rc = can_create(mem_ctx, new_name);
3113         if (!NT_STATUS_IS_OK(rc)) {
3114                 return rc;
3115         }
3116
3117         rc = pdb_rename_sam_account(pwd, new_name);
3118
3119         TALLOC_FREE(pwd);
3120         return rc;
3121 }
3122
3123 /*******************************************************************
3124  set_user_info_16
3125  ********************************************************************/
3126
3127 static BOOL set_user_info_16(const SAM_USER_INFO_16 *id16, struct samu *pwd)
3128 {
3129         if (id16 == NULL) {
3130                 DEBUG(5, ("set_user_info_16: NULL id16\n"));
3131                 TALLOC_FREE(pwd);
3132                 return False;
3133         }
3134
3135         /* FIX ME: check if the value is really changed --metze */
3136         if (!pdb_set_acct_ctrl(pwd, id16->acb_info, PDB_CHANGED)) {
3137                 TALLOC_FREE(pwd);
3138                 return False;
3139         }
3140
3141         if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3142                 TALLOC_FREE(pwd);
3143                 return False;
3144         }
3145
3146         TALLOC_FREE(pwd);
3147
3148         return True;
3149 }
3150
3151 /*******************************************************************
3152  set_user_info_18
3153  ********************************************************************/
3154
3155 static BOOL set_user_info_18(SAM_USER_INFO_18 *id18, struct samu *pwd)
3156 {
3157
3158         if (id18 == NULL) {
3159                 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
3160                 TALLOC_FREE(pwd);
3161                 return False;
3162         }
3163
3164         if (!pdb_set_lanman_passwd (pwd, id18->lm_pwd, PDB_CHANGED)) {
3165                 TALLOC_FREE(pwd);
3166                 return False;
3167         }
3168         if (!pdb_set_nt_passwd     (pwd, id18->nt_pwd, PDB_CHANGED)) {
3169                 TALLOC_FREE(pwd);
3170                 return False;
3171         }
3172         if (!pdb_set_pass_last_set_time (pwd, time(NULL), PDB_CHANGED)) {
3173                 TALLOC_FREE(pwd);
3174                 return False;
3175         }
3176
3177         if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3178                 TALLOC_FREE(pwd);
3179                 return False;
3180         }
3181
3182         TALLOC_FREE(pwd);
3183         return True;
3184 }
3185
3186 /*******************************************************************
3187  set_user_info_20
3188  ********************************************************************/
3189
3190 static BOOL set_user_info_20(SAM_USER_INFO_20 *id20, struct samu *pwd)
3191 {
3192         if (id20 == NULL) {
3193                 DEBUG(5, ("set_user_info_20: NULL id20\n"));
3194                 return False;
3195         }
3196
3197         copy_id20_to_sam_passwd(pwd, id20);
3198
3199         /* write the change out */
3200         if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3201                 TALLOC_FREE(pwd);
3202                 return False;
3203         }
3204
3205         TALLOC_FREE(pwd);
3206
3207         return True;
3208 }
3209 /*******************************************************************
3210  set_user_info_21
3211  ********************************************************************/
3212
3213 static NTSTATUS set_user_info_21(TALLOC_CTX *mem_ctx, SAM_USER_INFO_21 *id21,
3214                                  struct samu *pwd)
3215 {
3216         fstring new_name;
3217         NTSTATUS status;
3218
3219         if (id21 == NULL) {
3220                 DEBUG(5, ("set_user_info_21: NULL id21\n"));
3221                 return NT_STATUS_INVALID_PARAMETER;
3222         }
3223
3224         /* we need to separately check for an account rename first */
3225
3226         if (rpcstr_pull(new_name, id21->uni_user_name.buffer,
3227                 sizeof(new_name), id21->uni_user_name.uni_str_len*2, 0)
3228                 && (!strequal(new_name, pdb_get_username(pwd))))
3229         {
3230
3231                 /* check to see if the new username already exists.  Note: we can't
3232                    reliably lock all backends, so there is potentially the
3233                    possibility that a user can be created in between this check and
3234                    the rename.  The rename should fail, but may not get the
3235                    exact same failure status code.  I think this is small enough
3236                    of a window for this type of operation and the results are
3237                    simply that the rename fails with a slightly different status
3238                    code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3239
3240                 status = can_create(mem_ctx, new_name);
3241                 if (!NT_STATUS_IS_OK(status)) {
3242                         return status;
3243                 }
3244
3245                 status = pdb_rename_sam_account(pwd, new_name);
3246
3247                 if (!NT_STATUS_IS_OK(status)) {
3248                         DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
3249                                 nt_errstr(status)));
3250                         TALLOC_FREE(pwd);
3251                         return status;
3252                 }
3253
3254                 /* set the new username so that later
3255                    functions can work on the new account */
3256                 pdb_set_username(pwd, new_name, PDB_SET);
3257         }
3258
3259         copy_id21_to_sam_passwd(pwd, id21);
3260
3261         /*
3262          * The funny part about the previous two calls is
3263          * that pwd still has the password hashes from the
3264          * passdb entry.  These have not been updated from
3265          * id21.  I don't know if they need to be set.    --jerry
3266          */
3267
3268         if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
3269                 status = pdb_set_unix_primary_group(mem_ctx, pwd);
3270                 if ( !NT_STATUS_IS_OK(status) ) {
3271                         return status;
3272                 }
3273         }
3274
3275         /* Don't worry about writing out the user account since the
3276            primary group SID is generated solely from the user's Unix
3277            primary group. */
3278
3279         /* write the change out */
3280         if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3281                 TALLOC_FREE(pwd);
3282                 return status;
3283         }
3284
3285         TALLOC_FREE(pwd);
3286
3287         return NT_STATUS_OK;
3288 }
3289
3290 /*******************************************************************
3291  set_user_info_23
3292  ********************************************************************/
3293
3294 static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx, SAM_USER_INFO_23 *id23,
3295                                  struct samu *pwd)
3296 {
3297         pstring plaintext_buf;
3298         uint32 len;
3299         uint16 acct_ctrl;
3300         NTSTATUS status;
3301
3302         if (id23 == NULL) {
3303                 DEBUG(5, ("set_user_info_23: NULL id23\n"));
3304                 return NT_STATUS_INVALID_PARAMETER;
3305         }
3306
3307         DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
3308                   pdb_get_username(pwd)));
3309
3310         acct_ctrl = pdb_get_acct_ctrl(pwd);
3311
3312         if (!decode_pw_buffer(id23->pass, plaintext_buf, 256, &len, STR_UNICODE)) {
3313                 TALLOC_FREE(pwd);
3314                 return NT_STATUS_INVALID_PARAMETER;
3315         }
3316
3317         if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
3318                 TALLOC_FREE(pwd);
3319                 return NT_STATUS_ACCESS_DENIED;
3320         }
3321
3322         copy_id23_to_sam_passwd(pwd, id23);
3323
3324         /* if it's a trust account, don't update /etc/passwd */
3325         if (    ( (acct_ctrl &  ACB_DOMTRUST) == ACB_DOMTRUST ) ||
3326                 ( (acct_ctrl &  ACB_WSTRUST) ==  ACB_WSTRUST) ||
3327                 ( (acct_ctrl &  ACB_SVRTRUST) ==  ACB_SVRTRUST) ) {
3328                 DEBUG(5, ("Changing trust account.  Not updating /etc/passwd\n"));
3329         } else  {
3330                 /* update the UNIX password */
3331                 if (lp_unix_password_sync() ) {
3332                         struct passwd *passwd;
3333                         if (pdb_get_username(pwd) == NULL) {
3334                                 DEBUG(1, ("chgpasswd: User without name???\n"));
3335                                 TALLOC_FREE(pwd);
3336                                 return NT_STATUS_ACCESS_DENIED;
3337                         }
3338
3339                         if ((passwd = Get_Pwnam(pdb_get_username(pwd))) == NULL) {
3340                                 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3341                         }
3342
3343                         if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
3344                                 TALLOC_FREE(pwd);
3345                                 return NT_STATUS_ACCESS_DENIED;
3346                         }
3347                 }
3348         }
3349
3350         ZERO_STRUCT(plaintext_buf);
3351
3352         if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) &&
3353             (!NT_STATUS_IS_OK(status =  pdb_set_unix_primary_group(mem_ctx,
3354                                                                    pwd)))) {
3355                 TALLOC_FREE(pwd);
3356                 return status;
3357         }
3358
3359         if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3360                 TALLOC_FREE(pwd);
3361                 return status;
3362         }
3363
3364         TALLOC_FREE(pwd);
3365
3366         return NT_STATUS_OK;
3367 }
3368
3369 /*******************************************************************
3370  set_user_info_pw
3371  ********************************************************************/
3372
3373 static BOOL set_user_info_pw(uint8 *pass, struct samu *pwd,
3374                             int level)
3375 {
3376         uint32 len;
3377         pstring plaintext_buf;
3378         uint32 acct_ctrl;
3379         time_t last_set_time;
3380         enum pdb_value_state last_set_state;
3381
3382         DEBUG(5, ("Attempting administrator password change for user %s\n",
3383                   pdb_get_username(pwd)));
3384
3385         acct_ctrl = pdb_get_acct_ctrl(pwd);
3386         /* we need to know if it's expired, because this is an admin change, not a
3387            user change, so it's still expired when we're done */
3388         last_set_state = pdb_get_init_flags(pwd, PDB_PASSLASTSET);
3389         last_set_time = pdb_get_pass_last_set_time(pwd);
3390
3391         ZERO_STRUCT(plaintext_buf);
3392
3393         if (!decode_pw_buffer(pass, plaintext_buf, 256, &len, STR_UNICODE)) {
3394                 TALLOC_FREE(pwd);
3395                 return False;
3396         }
3397
3398         if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
3399                 TALLOC_FREE(pwd);
3400                 return False;
3401         }
3402
3403         /* if it's a trust account, don't update /etc/passwd */
3404         if ( ( (acct_ctrl &  ACB_DOMTRUST) == ACB_DOMTRUST ) ||
3405                 ( (acct_ctrl &  ACB_WSTRUST) ==  ACB_WSTRUST) ||
3406                 ( (acct_ctrl &  ACB_SVRTRUST) ==  ACB_SVRTRUST) ) {
3407                 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
3408         } else {
3409                 /* update the UNIX password */
3410                 if (lp_unix_password_sync()) {
3411                         struct passwd *passwd;
3412
3413                         if (pdb_get_username(pwd) == NULL) {
3414                                 DEBUG(1, ("chgpasswd: User without name???\n"));
3415                                 TALLOC_FREE(pwd);
3416                                 return False;
3417                         }
3418
3419                         if ((passwd = Get_Pwnam(pdb_get_username(pwd))) == NULL) {
3420                                 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3421                         }
3422
3423                         if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
3424                                 TALLOC_FREE(pwd);
3425                                 return False;
3426                         }
3427                 }
3428         }
3429
3430         ZERO_STRUCT(plaintext_buf);
3431
3432         /*
3433          * A level 25 change does reset the pwdlastset field, a level 24
3434          * change does not. I know this is probably not the full story, but
3435          * it is needed to make XP join LDAP correctly, without it the later
3436          * auth2 check can fail with PWD_MUST_CHANGE.
3437          */
3438         if (level != 25) {
3439                 /*
3440                  * restore last set time as this is an admin change, not a
3441                  * user pw change
3442                  */
3443                 pdb_set_pass_last_set_time (pwd, last_set_time,
3444                                             last_set_state);
3445         }
3446
3447         DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
3448
3449         /* update the SAMBA password */
3450         if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3451                 TALLOC_FREE(pwd);
3452                 return False;
3453         }
3454
3455         TALLOC_FREE(pwd);
3456
3457         return True;
3458 }
3459
3460 /*******************************************************************
3461  set_user_info_25
3462  ********************************************************************/
3463
3464 static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx, SAM_USER_INFO_25 *id25,
3465                                  struct samu *pwd)
3466 {
3467         NTSTATUS status;
3468
3469         if (id25 == NULL) {
3470                 DEBUG(5, ("set_user_info_25: NULL id25\n"));
3471                 return NT_STATUS_INVALID_PARAMETER;
3472         }
3473
3474         copy_id25_to_sam_passwd(pwd, id25);
3475
3476         /* write the change out */
3477         if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3478                 TALLOC_FREE(pwd);
3479                 return status;
3480         }
3481
3482         /*
3483          * We need to "pdb_update_sam_account" before the unix primary group
3484          * is set, because the idealx scripts would also change the
3485          * sambaPrimaryGroupSid using the ldap replace method. pdb_ldap uses
3486          * the delete explicit / add explicit, which would then fail to find
3487          * the previous primaryGroupSid value.
3488          */
3489
3490         if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
3491                 status = pdb_set_unix_primary_group(mem_ctx, pwd);
3492                 if ( !NT_STATUS_IS_OK(status) ) {
3493                         return status;
3494                 }
3495         }
3496
3497         /* WARNING: No TALLOC_FREE(pwd), we are about to set the password
3498          * hereafter! */
3499
3500         return NT_STATUS_OK;
3501 }
3502
3503 /*******************************************************************
3504  samr_reply_set_userinfo
3505  ********************************************************************/
3506
3507 NTSTATUS _samr_set_userinfo(pipes_struct *p, SAMR_Q_SET_USERINFO *q_u, SAMR_R_SET_USERINFO *r_u)
3508 {
3509         struct samu *pwd = NULL;
3510         DOM_SID sid;
3511         POLICY_HND *pol = &q_u->pol;
3512         uint16 switch_value = q_u->switch_value;
3513         SAM_USERINFO_CTR *ctr = q_u->ctr;
3514         uint32 acc_granted;
3515         uint32 acc_required;
3516         BOOL ret;
3517         BOOL has_enough_rights = False;
3518         uint32 acb_info;
3519         DISP_INFO *disp_info = NULL;
3520
3521         DEBUG(5, ("_samr_set_userinfo: %d\n", __LINE__));
3522
3523         r_u->status = NT_STATUS_OK;
3524
3525         /* find the policy handle.  open a policy on it. */
3526         if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info))
3527                 return NT_STATUS_INVALID_HANDLE;
3528
3529         /* This is tricky.  A WinXP domain join sets
3530           (SA_RIGHT_USER_SET_PASSWORD|SA_RIGHT_USER_SET_ATTRIBUTES|SA_RIGHT_USER_ACCT_FLAGS_EXPIRY)
3531           The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser().  But the
3532           standard Win32 API calls just ask for SA_RIGHT_USER_SET_PASSWORD in the SamrOpenUser().
3533           This should be enough for levels 18, 24, 25,& 26.  Info level 23 can set more so
3534           we'll use the set from the WinXP join as the basis. */
3535
3536         switch (switch_value) {
3537         case 18:
3538         case 24:
3539         case 25:
3540         case 26:
3541                 acc_required = SA_RIGHT_USER_SET_PASSWORD;
3542                 break;
3543         default:
3544                 acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
3545                 break;
3546         }
3547
3548         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo"))) {
3549                 return r_u->status;
3550         }
3551
3552         DEBUG(5, ("_samr_set_userinfo: sid:%s, level:%d\n", sid_string_static(&sid), switch_value));
3553
3554         if (ctr == NULL) {
3555                 DEBUG(5, ("_samr_set_userinfo: NULL info level\n"));
3556                 return NT_STATUS_INVALID_INFO_CLASS;
3557         }
3558
3559         if ( !(pwd = samu_new( NULL )) ) {
3560                 return NT_STATUS_NO_MEMORY;
3561         }
3562
3563         become_root();
3564         ret = pdb_getsampwsid(pwd, &sid);
3565         unbecome_root();
3566
3567         if ( !ret ) {
3568                 TALLOC_FREE(pwd);
3569                 return NT_STATUS_NO_SUCH_USER;
3570         }
3571
3572         /* deal with machine password changes differently from userinfo changes */
3573         /* check to see if we have the sufficient rights */
3574
3575         acb_info = pdb_get_acct_ctrl(pwd);
3576         if ( acb_info & ACB_WSTRUST )
3577                 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account);
3578         else if ( acb_info & ACB_NORMAL )
3579                 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
3580         else if ( acb_info & (ACB_SVRTRUST|ACB_DOMTRUST) ) {
3581                 if ( lp_enable_privileges() )
3582                         has_enough_rights = nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS );
3583         }
3584
3585         DEBUG(5, ("_samr_set_userinfo: %s does%s possess sufficient rights\n",
3586                   uidtoname(p->pipe_user.ut.uid),
3587                   has_enough_rights ? "" : " not"));
3588
3589         /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
3590
3591         if ( has_enough_rights )
3592                 become_root();
3593
3594         /* ok!  user info levels (lots: see MSDEV help), off we go... */
3595
3596         switch (switch_value) {
3597                 case 18:
3598                         if (!set_user_info_18(ctr->info.id18, pwd))
3599                                 r_u->status = NT_STATUS_ACCESS_DENIED;
3600                         break;
3601
3602                 case 24:
3603                         if (!p->session_key.length) {
3604                                 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
3605                         }
3606                         SamOEMhashBlob(ctr->info.id24->pass, 516, &p->session_key);
3607
3608                         dump_data(100, (char *)ctr->info.id24->pass, 516);
3609
3610                         if (!set_user_info_pw(ctr->info.id24->pass, pwd,
3611                                               switch_value))
3612                                 r_u->status = NT_STATUS_ACCESS_DENIED;
3613                         break;
3614
3615                 case 25:
3616                         if (!p->session_key.length) {
3617                                 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
3618                         }
3619                         encode_or_decode_arc4_passwd_buffer(ctr->info.id25->pass, &p->session_key);
3620
3621                         dump_data(100, (char *)ctr->info.id25->pass, 532);
3622
3623                         r_u->status = set_user_info_25(p->mem_ctx,
3624                                                        ctr->info.id25, pwd);
3625                         if (!NT_STATUS_IS_OK(r_u->status)) {
3626                                 goto done;
3627                         }
3628                         if (!set_user_info_pw(ctr->info.id25->pass, pwd,
3629                                               switch_value))
3630                                 r_u->status = NT_STATUS_ACCESS_DENIED;
3631                         break;
3632
3633                 case 26:
3634                         if (!p->session_key.length) {
3635                                 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
3636                         }
3637                         encode_or_decode_arc4_passwd_buffer(ctr->info.id26->pass, &p->session_key);
3638
3639                         dump_data(100, (char *)ctr->info.id26->pass, 516);
3640
3641                         if (!set_user_info_pw(ctr->info.id26->pass, pwd,
3642                                               switch_value))
3643                                 r_u->status = NT_STATUS_ACCESS_DENIED;
3644                         break;
3645
3646                 case 23:
3647                         if (!p->session_key.length) {
3648                                 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
3649                         }
3650                         SamOEMhashBlob(ctr->info.id23->pass, 516, &p->session_key);
3651
3652                         dump_data(100, (char *)ctr->info.id23->pass, 516);
3653
3654                         r_u->status = set_user_info_23(p->mem_ctx,
3655                                                        ctr->info.id23, pwd);
3656                         break;
3657
3658                 default:
3659                         r_u->status = NT_STATUS_INVALID_INFO_CLASS;
3660         }
3661
3662  done:
3663
3664         if ( has_enough_rights )
3665                 unbecome_root();
3666
3667         /* ================ END SeMachineAccountPrivilege BLOCK ================ */
3668
3669         if (NT_STATUS_IS_OK(r_u->status)) {
3670                 force_flush_samr_cache(disp_info);
3671         }
3672
3673         return r_u->status;
3674 }
3675
3676 /*******************************************************************
3677  samr_reply_set_userinfo2
3678  ********************************************************************/
3679
3680 NTSTATUS _samr_set_userinfo2(pipes_struct *p, SAMR_Q_SET_USERINFO2 *q_u, SAMR_R_SET_USERINFO2 *r_u)
3681 {
3682         struct samu *pwd = NULL;
3683         DOM_SID sid;
3684         SAM_USERINFO_CTR *ctr = q_u->ctr;
3685         POLICY_HND *pol = &q_u->pol;
3686         uint16 switch_value = q_u->switch_value;
3687         uint32 acc_granted;
3688         uint32 acc_required;
3689         BOOL ret;
3690         BOOL has_enough_rights = False;
3691         uint32 acb_info;
3692         DISP_INFO *disp_info = NULL;
3693
3694         DEBUG(5, ("samr_reply_set_userinfo2: %d\n", __LINE__));
3695
3696         r_u->status = NT_STATUS_OK;
3697
3698         /* find the policy handle.  open a policy on it. */
3699         if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info))
3700                 return NT_STATUS_INVALID_HANDLE;
3701
3702
3703 #if 0   /* this really should be applied on a per info level basis   --jerry */
3704
3705         /* observed when joining XP client to Samba domain */
3706         acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
3707 #else
3708         acc_required = SA_RIGHT_USER_SET_ATTRIBUTES;
3709 #endif
3710
3711         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, acc_required, "_samr_set_userinfo2"))) {
3712                 return r_u->status;
3713         }
3714
3715         DEBUG(5, ("samr_reply_set_userinfo2: sid:%s\n", sid_string_static(&sid)));
3716
3717         if (ctr == NULL) {
3718                 DEBUG(5, ("samr_reply_set_userinfo2: NULL info level\n"));
3719                 return NT_STATUS_INVALID_INFO_CLASS;
3720         }
3721
3722         switch_value=ctr->switch_value;
3723
3724         if ( !(pwd = samu_new( NULL )) ) {
3725                 return NT_STATUS_NO_MEMORY;
3726         }
3727
3728         become_root();
3729         ret = pdb_getsampwsid(pwd, &sid);
3730         unbecome_root();
3731
3732         if ( !ret ) {
3733                 TALLOC_FREE(pwd);
3734                 return NT_STATUS_NO_SUCH_USER;
3735         }
3736
3737         acb_info = pdb_get_acct_ctrl(pwd);
3738         if ( acb_info & ACB_WSTRUST )
3739                 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account);
3740         else if ( acb_info & ACB_NORMAL )
3741                 has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
3742         else if ( acb_info & (ACB_SVRTRUST|ACB_DOMTRUST) ) {
3743                 if ( lp_enable_privileges() )
3744                         has_enough_rights = nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS );
3745         }
3746
3747         DEBUG(5, ("_samr_set_userinfo2: %s does%s possess sufficient rights\n",
3748                   uidtoname(p->pipe_user.ut.uid),
3749                   has_enough_rights ? "" : " not"));
3750
3751         /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
3752
3753         if ( has_enough_rights )
3754                 become_root();
3755
3756         /* ok!  user info levels (lots: see MSDEV help), off we go... */
3757
3758         switch (switch_value) {
3759                 case 7:
3760                         r_u->status = set_user_info_7(p->mem_ctx,
3761                                                       ctr->info.id7, pwd);
3762                         break;
3763                 case 16:
3764                         if (!set_user_info_16(ctr->info.id16, pwd))
3765                                 r_u->status = NT_STATUS_ACCESS_DENIED;
3766                         break;
3767                 case 18:
3768                         /* Used by AS/U JRA. */
3769                         if (!set_user_info_18(ctr->info.id18, pwd))
3770                                 r_u->status = NT_STATUS_ACCESS_DENIED;
3771                         break;
3772                 case 20:
3773                         if (!set_user_info_20(ctr->info.id20, pwd))
3774                                 r_u->status = NT_STATUS_ACCESS_DENIED;
3775                         break;
3776                 case 21:
3777                         r_u->status = set_user_info_21(p->mem_ctx,
3778                                                        ctr->info.id21, pwd);
3779                         break;
3780                 case 23:
3781                         if (!p->session_key.length) {
3782                                 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
3783                         }
3784                         SamOEMhashBlob(ctr->info.id23->pass, 516, &p->session_key);
3785
3786                         dump_data(100, (char *)ctr->info.id23->pass, 516);
3787
3788                         r_u->status = set_user_info_23(p->mem_ctx,
3789                                                        ctr->info.id23, pwd);
3790                         break;
3791                 case 26:
3792                         if (!p->session_key.length) {
3793                                 r_u->status = NT_STATUS_NO_USER_SESSION_KEY;
3794                         }
3795                         encode_or_decode_arc4_passwd_buffer(ctr->info.id26->pass, &p->session_key);
3796
3797                         dump_data(100, (char *)ctr->info.id26->pass, 516);
3798
3799                         if (!set_user_info_pw(ctr->info.id26->pass, pwd,
3800                                               switch_value))
3801                                 r_u->status = NT_STATUS_ACCESS_DENIED;
3802                         break;
3803                 default:
3804                         r_u->status = NT_STATUS_INVALID_INFO_CLASS;
3805         }
3806
3807         if ( has_enough_rights )
3808                 unbecome_root();
3809
3810         /* ================ END SeMachineAccountPrivilege BLOCK ================ */
3811
3812         if (NT_STATUS_IS_OK(r_u->status)) {
3813                 force_flush_samr_cache(disp_info);
3814         }
3815
3816         return r_u->status;
3817 }
3818
3819 /*********************************************************************
3820  _samr_query_aliasmem
3821 *********************************************************************/
3822
3823 NTSTATUS _samr_query_useraliases(pipes_struct *p, SAMR_Q_QUERY_USERALIASES *q_u, SAMR_R_QUERY_USERALIASES *r_u)
3824 {
3825         size_t num_alias_rids;
3826         uint32 *alias_rids;
3827         struct samr_info *info = NULL;
3828         size_t i;
3829
3830         NTSTATUS ntstatus1;
3831         NTSTATUS ntstatus2;
3832
3833         DOM_SID *members;
3834
3835         r_u->status = NT_STATUS_OK;
3836
3837         DEBUG(5,("_samr_query_useraliases: %d\n", __LINE__));
3838
3839         /* find the policy handle.  open a policy on it. */
3840         if (!find_policy_by_hnd(p, &q_u->pol, (void **)(void *)&info))
3841                 return NT_STATUS_INVALID_HANDLE;
3842
3843         ntstatus1 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM, "_samr_query_useraliases");
3844         ntstatus2 = access_check_samr_function(info->acc_granted, SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_query_useraliases");
3845
3846         if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
3847                 if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
3848                     !(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus1))) {
3849                         return (NT_STATUS_IS_OK(ntstatus1)) ? ntstatus2 : ntstatus1;
3850                 }
3851         }
3852
3853         if (!sid_check_is_domain(&info->sid) &&
3854             !sid_check_is_builtin(&info->sid))
3855                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
3856
3857         if (q_u->num_sids1) {
3858                 members = TALLOC_ARRAY(p->mem_ctx, DOM_SID, q_u->num_sids1);
3859
3860                 if (members == NULL)
3861                         return NT_STATUS_NO_MEMORY;
3862         } else {
3863                 members = NULL;
3864         }
3865
3866         for (i=0; i<q_u->num_sids1; i++)
3867                 sid_copy(&members[i], &q_u->sid[i].sid);
3868
3869         alias_rids = NULL;
3870         num_alias_rids = 0;
3871
3872         become_root();
3873         ntstatus1 = pdb_enum_alias_memberships(p->mem_ctx, &info->sid, members,
3874                                                q_u->num_sids1,
3875                                                &alias_rids, &num_alias_rids);
3876         unbecome_root();
3877
3878         if (!NT_STATUS_IS_OK(ntstatus1)) {
3879                 return ntstatus1;
3880         }
3881
3882         init_samr_r_query_useraliases(r_u, num_alias_rids, alias_rids,
3883                                       NT_STATUS_OK);
3884         return NT_STATUS_OK;
3885 }
3886
3887 /*********************************************************************
3888  _samr_query_aliasmem
3889 *********************************************************************/
3890
3891 NTSTATUS _samr_query_aliasmem(pipes_struct *p, SAMR_Q_QUERY_ALIASMEM *q_u, SAMR_R_QUERY_ALIASMEM *r_u)
3892 {
3893         NTSTATUS status;
3894         size_t i;
3895         size_t num_sids = 0;
3896         DOM_SID2 *sid;
3897         DOM_SID *sids=NULL;
3898
3899         DOM_SID alias_sid;
3900
3901         uint32 acc_granted;
3902
3903         /* find the policy handle.  open a policy on it. */
3904         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted, NULL))
3905                 return NT_STATUS_INVALID_HANDLE;
3906
3907         if (!NT_STATUS_IS_OK(r_u->status =
3908                 access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_GET_MEMBERS, "_samr_query_aliasmem"))) {
3909                 return r_u->status;
3910         }
3911
3912         DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
3913
3914         become_root();
3915         status = pdb_enum_aliasmem(&alias_sid, &sids, &num_sids);
3916         unbecome_root();
3917
3918         if (!NT_STATUS_IS_OK(status)) {
3919                 return status;
3920         }
3921
3922         if (num_sids) {
3923                 sid = TALLOC_ZERO_ARRAY(p->mem_ctx, DOM_SID2, num_sids);
3924                 if (sid == NULL) {
3925                         SAFE_FREE(sids);
3926                         return NT_STATUS_NO_MEMORY;
3927                 }
3928         } else {
3929                 sid = NULL;
3930         }
3931
3932         for (i = 0; i < num_sids; i++) {
3933                 init_dom_sid2(&sid[i], &sids[i]);
3934         }
3935
3936         init_samr_r_query_aliasmem(r_u, num_sids, sid, NT_STATUS_OK);
3937
3938         TALLOC_FREE(sids);
3939
3940         return NT_STATUS_OK;
3941 }
3942
3943 /*********************************************************************
3944  _samr_query_groupmem
3945 *********************************************************************/
3946
3947 NTSTATUS _samr_query_groupmem(pipes_struct *p, SAMR_Q_QUERY_GROUPMEM *q_u, SAMR_R_QUERY_GROUPMEM *r_u)
3948 {
3949         DOM_SID group_sid;
3950         fstring group_sid_str;
3951         size_t i, num_members;
3952
3953         uint32 *rid=NULL;
3954         uint32 *attr=NULL;
3955
3956         uint32 acc_granted;
3957
3958         NTSTATUS result;
3959
3960         /* find the policy handle.  open a policy on it. */
3961         if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted, NULL))
3962                 return NT_STATUS_INVALID_HANDLE;
3963
3964         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_GET_MEMBERS, "_samr_query_groupmem"))) {
3965                 return r_u->status;
3966         }
3967
3968         sid_to_string(group_sid_str, &group_sid);
3969         DEBUG(10, ("sid is %s\n", group_sid_str));
3970
3971         if (!sid_check_is_in_our_domain(&group_sid)) {
3972                 DEBUG(3, ("sid %s is not in our domain\n", group_sid_str));
3973                 return NT_STATUS_NO_SUCH_GROUP;
3974         }
3975
3976         DEBUG(10, ("lookup on Domain SID\n"));
3977
3978         become_root();
3979         result = pdb_enum_group_members(p->mem_ctx, &group_sid,
3980                                         &rid, &num_members);
3981         unbecome_root();
3982
3983         if (!NT_STATUS_IS_OK(result))
3984                 return result;
3985
3986         if (num_members) {
3987                 attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_members);
3988                 if (attr == NULL) {
3989                         return NT_STATUS_NO_MEMORY;
3990                 }
3991         } else {
3992                 attr = NULL;
3993         }
3994
3995         for (i=0; i<num_members; i++)
3996                 attr[i] = SID_NAME_USER;
3997
3998         init_samr_r_query_groupmem(r_u, num_members, rid, attr, NT_STATUS_OK);
3999
4000         return NT_STATUS_OK;
4001 }
4002
4003 /*********************************************************************
4004  _samr_add_aliasmem
4005 *********************************************************************/
4006
4007 NTSTATUS _samr_add_aliasmem(pipes_struct *p, SAMR_Q_ADD_ALIASMEM *q_u, SAMR_R_ADD_ALIASMEM *r_u)
4008 {
4009         DOM_SID alias_sid;
4010         uint32 acc_granted;
4011         SE_PRIV se_rights;
4012         BOOL can_add_accounts;
4013         NTSTATUS ret;
4014         DISP_INFO *disp_info = NULL;
4015
4016         /* Find the policy handle. Open a policy on it. */
4017         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted, &disp_info))
4018                 return NT_STATUS_INVALID_HANDLE;
4019
4020         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_ADD_MEMBER, "_samr_add_aliasmem"))) {
4021                 return r_u->status;
4022         }
4023
4024         DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
4025
4026         se_priv_copy( &se_rights, &se_add_users );
4027         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4028
4029         /******** BEGIN SeAddUsers BLOCK *********/
4030
4031         if ( can_add_accounts )
4032                 become_root();
4033
4034         ret = pdb_add_aliasmem(&alias_sid, &q_u->sid.sid);
4035
4036         if ( can_add_accounts )
4037                 unbecome_root();
4038
4039         /******** END SeAddUsers BLOCK *********/
4040
4041         if (NT_STATUS_IS_OK(ret)) {
4042                 force_flush_samr_cache(disp_info);
4043         }
4044
4045         return ret;
4046 }
4047
4048 /*********************************************************************
4049  _samr_del_aliasmem
4050 *********************************************************************/
4051
4052 NTSTATUS _samr_del_aliasmem(pipes_struct *p, SAMR_Q_DEL_ALIASMEM *q_u, SAMR_R_DEL_ALIASMEM *r_u)
4053 {
4054         DOM_SID alias_sid;
4055         uint32 acc_granted;
4056         SE_PRIV se_rights;
4057         BOOL can_add_accounts;
4058         NTSTATUS ret;
4059         DISP_INFO *disp_info = NULL;
4060
4061         /* Find the policy handle. Open a policy on it. */
4062         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted, &disp_info))
4063                 return NT_STATUS_INVALID_HANDLE;
4064
4065         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_REMOVE_MEMBER, "_samr_del_aliasmem"))) {
4066                 return r_u->status;
4067         }
4068
4069         DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
4070                    sid_string_static(&alias_sid)));
4071
4072         se_priv_copy( &se_rights, &se_add_users );
4073         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4074
4075         /******** BEGIN SeAddUsers BLOCK *********/
4076
4077         if ( can_add_accounts )
4078                 become_root();
4079
4080         ret = pdb_del_aliasmem(&alias_sid, &q_u->sid.sid);
4081
4082         if ( can_add_accounts )
4083                 unbecome_root();
4084
4085         /******** END SeAddUsers BLOCK *********/
4086
4087         if (NT_STATUS_IS_OK(ret)) {
4088                 force_flush_samr_cache(disp_info);
4089         }
4090
4091         return ret;
4092 }
4093
4094 /*********************************************************************
4095  _samr_add_groupmem
4096 *********************************************************************/
4097
4098 NTSTATUS _samr_add_groupmem(pipes_struct *p, SAMR_Q_ADD_GROUPMEM *q_u, SAMR_R_ADD_GROUPMEM *r_u)
4099 {
4100         DOM_SID group_sid;
4101         uint32 group_rid;
4102         uint32 acc_granted;
4103         SE_PRIV se_rights;
4104         BOOL can_add_accounts;
4105         DISP_INFO *disp_info = NULL;
4106
4107         /* Find the policy handle. Open a policy on it. */
4108         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted, &disp_info))
4109                 return NT_STATUS_INVALID_HANDLE;
4110
4111         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_ADD_MEMBER, "_samr_add_groupmem"))) {
4112                 return r_u->status;
4113         }
4114
4115         DEBUG(10, ("sid is %s\n", sid_string_static(&group_sid)));
4116
4117         if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4118                                 &group_rid)) {
4119                 return NT_STATUS_INVALID_HANDLE;
4120         }
4121
4122         se_priv_copy( &se_rights, &se_add_users );
4123         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4124
4125         /******** BEGIN SeAddUsers BLOCK *********/
4126
4127         if ( can_add_accounts )
4128                 become_root();
4129
4130         r_u->status = pdb_add_groupmem(p->mem_ctx, group_rid, q_u->rid);
4131
4132         if ( can_add_accounts )
4133                 unbecome_root();
4134
4135         /******** END SeAddUsers BLOCK *********/
4136
4137         force_flush_samr_cache(disp_info);
4138
4139         return r_u->status;
4140 }
4141
4142 /*********************************************************************
4143  _samr_del_groupmem
4144 *********************************************************************/
4145
4146 NTSTATUS _samr_del_groupmem(pipes_struct *p, SAMR_Q_DEL_GROUPMEM *q_u, SAMR_R_DEL_GROUPMEM *r_u)
4147 {
4148         DOM_SID group_sid;
4149         uint32 group_rid;
4150         uint32 acc_granted;
4151         SE_PRIV se_rights;
4152         BOOL can_add_accounts;
4153         DISP_INFO *disp_info = NULL;
4154
4155         /*
4156          * delete the group member named q_u->rid
4157          * who is a member of the sid associated with the handle
4158          * the rid is a user's rid as the group is a domain group.
4159          */
4160
4161         /* Find the policy handle. Open a policy on it. */
4162         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted, &disp_info))
4163                 return NT_STATUS_INVALID_HANDLE;
4164
4165         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_REMOVE_MEMBER, "_samr_del_groupmem"))) {
4166                 return r_u->status;
4167         }
4168
4169         if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4170                                 &group_rid)) {
4171                 return NT_STATUS_INVALID_HANDLE;
4172         }
4173
4174         se_priv_copy( &se_rights, &se_add_users );
4175         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4176
4177         /******** BEGIN SeAddUsers BLOCK *********/
4178
4179         if ( can_add_accounts )
4180                 become_root();
4181
4182         r_u->status = pdb_del_groupmem(p->mem_ctx, group_rid, q_u->rid);
4183
4184         if ( can_add_accounts )
4185                 unbecome_root();
4186
4187         /******** END SeAddUsers BLOCK *********/
4188
4189         force_flush_samr_cache(disp_info);
4190
4191         return r_u->status;
4192 }
4193
4194 /*********************************************************************
4195  _samr_delete_dom_user
4196 *********************************************************************/
4197
4198 NTSTATUS _samr_delete_dom_user(pipes_struct *p, SAMR_Q_DELETE_DOM_USER *q_u, SAMR_R_DELETE_DOM_USER *r_u )
4199 {
4200         DOM_SID user_sid;
4201         struct samu *sam_pass=NULL;
4202         uint32 acc_granted;
4203         BOOL can_add_accounts;
4204         uint32 acb_info;
4205         DISP_INFO *disp_info = NULL;
4206         BOOL ret;
4207
4208         DEBUG(5, ("_samr_delete_dom_user: %d\n", __LINE__));
4209
4210         /* Find the policy handle. Open a policy on it. */
4211         if (!get_lsa_policy_samr_sid(p, &q_u->user_pol, &user_sid, &acc_granted, &disp_info))
4212                 return NT_STATUS_INVALID_HANDLE;
4213
4214         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_user"))) {
4215                 return r_u->status;
4216         }
4217
4218         if (!sid_check_is_in_our_domain(&user_sid))
4219                 return NT_STATUS_CANNOT_DELETE;
4220
4221         /* check if the user exists before trying to delete */
4222         if ( !(sam_pass = samu_new( NULL )) ) {
4223                 return NT_STATUS_NO_MEMORY;
4224         }
4225
4226         become_root();
4227         ret = pdb_getsampwsid(sam_pass, &user_sid);
4228         unbecome_root();
4229
4230         if( !ret ) {
4231                 DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n",
4232                         sid_string_static(&user_sid)));
4233                 TALLOC_FREE(sam_pass);
4234                 return NT_STATUS_NO_SUCH_USER;
4235         }
4236
4237         acb_info = pdb_get_acct_ctrl(sam_pass);
4238
4239         /* For machine accounts it's the SeMachineAccountPrivilege that counts. */
4240         if ( acb_info & ACB_WSTRUST ) {
4241                 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account );
4242         } else {
4243                 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
4244         }
4245
4246         /******** BEGIN SeAddUsers BLOCK *********/
4247
4248         if ( can_add_accounts )
4249                 become_root();
4250
4251         r_u->status = pdb_delete_user(p->mem_ctx, sam_pass);
4252
4253         if ( can_add_accounts )
4254                 unbecome_root();
4255
4256         /******** END SeAddUsers BLOCK *********/
4257
4258         if ( !NT_STATUS_IS_OK(r_u->status) ) {
4259                 DEBUG(5,("_samr_delete_dom_user: Failed to delete entry for "
4260                          "user %s: %s.\n", pdb_get_username(sam_pass),
4261                          nt_errstr(r_u->status)));
4262                 TALLOC_FREE(sam_pass);
4263                 return r_u->status;
4264         }
4265
4266
4267         TALLOC_FREE(sam_pass);
4268
4269         if (!close_policy_hnd(p, &q_u->user_pol))
4270                 return NT_STATUS_OBJECT_NAME_INVALID;
4271
4272         force_flush_samr_cache(disp_info);
4273
4274         return NT_STATUS_OK;
4275 }
4276
4277 /*********************************************************************
4278  _samr_delete_dom_group
4279 *********************************************************************/
4280
4281 NTSTATUS _samr_delete_dom_group(pipes_struct *p, SAMR_Q_DELETE_DOM_GROUP *q_u, SAMR_R_DELETE_DOM_GROUP *r_u)
4282 {
4283         DOM_SID group_sid;
4284         uint32 group_rid;
4285         uint32 acc_granted;
4286         SE_PRIV se_rights;
4287         BOOL can_add_accounts;
4288         DISP_INFO *disp_info = NULL;
4289
4290         DEBUG(5, ("samr_delete_dom_group: %d\n", __LINE__));
4291
4292         /* Find the policy handle. Open a policy on it. */
4293         if (!get_lsa_policy_samr_sid(p, &q_u->group_pol, &group_sid, &acc_granted, &disp_info))
4294                 return NT_STATUS_INVALID_HANDLE;
4295
4296         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_group"))) {
4297                 return r_u->status;
4298         }
4299
4300         DEBUG(10, ("sid is %s\n", sid_string_static(&group_sid)));
4301
4302         if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4303                                 &group_rid)) {
4304                 return NT_STATUS_NO_SUCH_GROUP;
4305         }
4306
4307         se_priv_copy( &se_rights, &se_add_users );
4308         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4309
4310         /******** BEGIN SeAddUsers BLOCK *********/
4311
4312         if ( can_add_accounts )
4313                 become_root();
4314
4315         r_u->status = pdb_delete_dom_group(p->mem_ctx, group_rid);
4316
4317         if ( can_add_accounts )
4318                 unbecome_root();
4319
4320         /******** END SeAddUsers BLOCK *********/
4321
4322         if ( !NT_STATUS_IS_OK(r_u->status) ) {
4323                 DEBUG(5,("_samr_delete_dom_group: Failed to delete mapping "
4324                          "entry for group %s: %s\n",
4325                          sid_string_static(&group_sid),
4326                          nt_errstr(r_u->status)));
4327                 return r_u->status;
4328         }
4329
4330         if (!close_policy_hnd(p, &q_u->group_pol))
4331                 return NT_STATUS_OBJECT_NAME_INVALID;
4332
4333         force_flush_samr_cache(disp_info);
4334
4335         return NT_STATUS_OK;
4336 }
4337
4338 /*********************************************************************
4339  _samr_delete_dom_alias
4340 *********************************************************************/
4341
4342 NTSTATUS _samr_delete_dom_alias(pipes_struct *p, SAMR_Q_DELETE_DOM_ALIAS *q_u, SAMR_R_DELETE_DOM_ALIAS *r_u)
4343 {
4344         DOM_SID alias_sid;
4345         uint32 acc_granted;
4346         SE_PRIV se_rights;
4347         BOOL can_add_accounts;
4348         BOOL ret;
4349         DISP_INFO *disp_info = NULL;
4350
4351         DEBUG(5, ("_samr_delete_dom_alias: %d\n", __LINE__));
4352
4353         /* Find the policy handle. Open a policy on it. */
4354         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &alias_sid, &acc_granted, &disp_info))
4355                 return NT_STATUS_INVALID_HANDLE;
4356
4357         /* copy the handle to the outgoing reply */
4358
4359         memcpy( &r_u->pol, &q_u->alias_pol, sizeof(r_u->pol) );
4360
4361         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS, "_samr_delete_dom_alias"))) {
4362                 return r_u->status;
4363         }
4364
4365         DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid)));
4366
4367         /* Don't let Windows delete builtin groups */
4368
4369         if ( sid_check_is_in_builtin( &alias_sid ) ) {
4370                 return NT_STATUS_SPECIAL_ACCOUNT;
4371         }
4372
4373         if (!sid_check_is_in_our_domain(&alias_sid))
4374                 return NT_STATUS_NO_SUCH_ALIAS;
4375
4376         DEBUG(10, ("lookup on Local SID\n"));
4377
4378         se_priv_copy( &se_rights, &se_add_users );
4379         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4380
4381         /******** BEGIN SeAddUsers BLOCK *********/
4382
4383         if ( can_add_accounts )
4384                 become_root();
4385
4386         /* Have passdb delete the alias */
4387         ret = pdb_delete_alias(&alias_sid);
4388
4389         if ( can_add_accounts )
4390                 unbecome_root();
4391
4392         /******** END SeAddUsers BLOCK *********/
4393
4394         if ( !ret )
4395                 return NT_STATUS_ACCESS_DENIED;
4396
4397         if (!close_policy_hnd(p, &q_u->alias_pol))
4398                 return NT_STATUS_OBJECT_NAME_INVALID;
4399
4400         force_flush_samr_cache(disp_info);
4401
4402         return NT_STATUS_OK;
4403 }
4404
4405 /*********************************************************************
4406  _samr_create_dom_group
4407 *********************************************************************/
4408
4409 NTSTATUS _samr_create_dom_group(pipes_struct *p, SAMR_Q_CREATE_DOM_GROUP *q_u, SAMR_R_CREATE_DOM_GROUP *r_u)
4410 {
4411         DOM_SID dom_sid;
4412         DOM_SID info_sid;
4413         const char *name;
4414         struct samr_info *info;
4415         uint32 acc_granted;
4416         SE_PRIV se_rights;
4417         BOOL can_add_accounts;
4418         DISP_INFO *disp_info = NULL;
4419
4420         /* Find the policy handle. Open a policy on it. */
4421         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &dom_sid, &acc_granted, &disp_info))
4422                 return NT_STATUS_INVALID_HANDLE;
4423
4424         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_GROUP, "_samr_create_dom_group"))) {
4425                 return r_u->status;
4426         }
4427
4428         if (!sid_equal(&dom_sid, get_global_sam_sid()))
4429                 return NT_STATUS_ACCESS_DENIED;
4430
4431         name = rpcstr_pull_unistr2_talloc(p->mem_ctx, &q_u->uni_acct_desc);
4432         if (name == NULL) {
4433                 return NT_STATUS_NO_MEMORY;
4434         }
4435
4436         r_u->status = can_create(p->mem_ctx, name);
4437         if (!NT_STATUS_IS_OK(r_u->status)) {
4438                 return r_u->status;
4439         }
4440
4441         se_priv_copy( &se_rights, &se_add_users );
4442         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4443
4444         /******** BEGIN SeAddUsers BLOCK *********/
4445
4446         if ( can_add_accounts )
4447                 become_root();
4448
4449         /* check that we successfully create the UNIX group */
4450
4451         r_u->status = pdb_create_dom_group(p->mem_ctx, name, &r_u->rid);
4452
4453         if ( can_add_accounts )
4454                 unbecome_root();
4455
4456         /******** END SeAddUsers BLOCK *********/
4457
4458         /* check if we should bail out here */
4459
4460         if ( !NT_STATUS_IS_OK(r_u->status) )
4461                 return r_u->status;
4462
4463         sid_compose(&info_sid, get_global_sam_sid(), r_u->rid);
4464
4465         if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
4466                 return NT_STATUS_NO_MEMORY;
4467
4468         /* they created it; let the user do what he wants with it */
4469
4470         info->acc_granted = GENERIC_RIGHTS_GROUP_ALL_ACCESS;
4471
4472         /* get a (unique) handle.  open a policy on it. */
4473         if (!create_policy_hnd(p, &r_u->pol, free_samr_info, (void *)info))
4474                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4475
4476         force_flush_samr_cache(disp_info);
4477
4478         return NT_STATUS_OK;
4479 }
4480
4481 /*********************************************************************
4482  _samr_create_dom_alias
4483 *********************************************************************/
4484
4485 NTSTATUS _samr_create_dom_alias(pipes_struct *p, SAMR_Q_CREATE_DOM_ALIAS *q_u, SAMR_R_CREATE_DOM_ALIAS *r_u)
4486 {
4487         DOM_SID dom_sid;
4488         DOM_SID info_sid;
4489         fstring name;
4490         struct samr_info *info;
4491         uint32 acc_granted;
4492         gid_t gid;
4493         NTSTATUS result;
4494         SE_PRIV se_rights;
4495         BOOL can_add_accounts;
4496         DISP_INFO *disp_info = NULL;
4497
4498         /* Find the policy handle. Open a policy on it. */
4499         if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &dom_sid, &acc_granted, &disp_info))
4500                 return NT_STATUS_INVALID_HANDLE;
4501
4502         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_DOMAIN_CREATE_ALIAS, "_samr_create_alias"))) {
4503                 return r_u->status;
4504         }
4505
4506         if (!sid_equal(&dom_sid, get_global_sam_sid()))
4507                 return NT_STATUS_ACCESS_DENIED;
4508
4509         unistr2_to_ascii(name, &q_u->uni_acct_desc, sizeof(name)-1);
4510
4511         se_priv_copy( &se_rights, &se_add_users );
4512         can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4513
4514         result = can_create(p->mem_ctx, name);
4515         if (!NT_STATUS_IS_OK(result)) {
4516                 return result;
4517         }
4518
4519         /******** BEGIN SeAddUsers BLOCK *********/
4520
4521         if ( can_add_accounts )
4522                 become_root();
4523
4524         /* Have passdb create the alias */
4525         result = pdb_create_alias(name, &r_u->rid);
4526
4527         if ( can_add_accounts )
4528                 unbecome_root();
4529
4530         /******** END SeAddUsers BLOCK *********/
4531
4532         if (!NT_STATUS_IS_OK(result)) {
4533                 DEBUG(10, ("pdb_create_alias failed: %s\n",
4534                            nt_errstr(result)));
4535                 return result;
4536         }
4537
4538         sid_copy(&info_sid, get_global_sam_sid());
4539         sid_append_rid(&info_sid, r_u->rid);
4540
4541         if (!sid_to_gid(&info_sid, &gid)) {
4542                 DEBUG(10, ("Could not find alias just created\n"));
4543                 return NT_STATUS_ACCESS_DENIED;
4544         }
4545
4546         /* check if the group has been successfully created */
4547         if ( getgrgid(gid) == NULL ) {
4548                 DEBUG(10, ("getgrgid(%d) of just created alias failed\n",
4549                            gid));
4550                 return NT_STATUS_ACCESS_DENIED;
4551         }
4552
4553         if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
4554                 return NT_STATUS_NO_MEMORY;
4555
4556         /* they created it; let the user do what he wants with it */
4557
4558         info->acc_granted = GENERIC_RIGHTS_ALIAS_ALL_ACCESS;
4559
4560         /* get a (unique) handle.  open a policy on it. */
4561         if (!create_policy_hnd(p, &r_u->alias_pol, free_samr_info, (void *)info))
4562                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4563
4564         force_flush_samr_cache(disp_info);
4565
4566         return NT_STATUS_OK;
4567 }
4568
4569 /*********************************************************************
4570  _samr_query_groupinfo
4571
4572 sends the name/comment pair of a domain group
4573 level 1 send also the number of users of that group
4574 *********************************************************************/
4575
4576 NTSTATUS _samr_query_groupinfo(pipes_struct *p, SAMR_Q_QUERY_GROUPINFO *q_u, SAMR_R_QUERY_GROUPINFO *r_u)
4577 {
4578         DOM_SID group_sid;
4579         GROUP_MAP map;
4580         GROUP_INFO_CTR *ctr;
4581         uint32 acc_granted;
4582         BOOL ret;
4583
4584         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted, NULL))
4585                 return NT_STATUS_INVALID_HANDLE;
4586
4587         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_LOOKUP_INFO, "_samr_query_groupinfo"))) {
4588                 return r_u->status;
4589         }
4590
4591         become_root();
4592         ret = get_domain_group_from_sid(group_sid, &map);
4593         unbecome_root();
4594         if (!ret)
4595                 return NT_STATUS_INVALID_HANDLE;
4596
4597         ctr=TALLOC_ZERO_P(p->mem_ctx, GROUP_INFO_CTR);
4598         if (ctr==NULL)
4599                 return NT_STATUS_NO_MEMORY;
4600
4601         switch (q_u->switch_level) {
4602                 case 1: {
4603                         uint32 *members;
4604                         size_t num_members;
4605
4606                         ctr->switch_value1 = 1;
4607
4608                         become_root();
4609                         r_u->status = pdb_enum_group_members(
4610                                 p->mem_ctx, &group_sid, &members, &num_members);
4611                         unbecome_root();
4612
4613                         if (!NT_STATUS_IS_OK(r_u->status)) {
4614                                 return r_u->status;
4615                         }
4616
4617                         init_samr_group_info1(&ctr->group.info1, map.nt_name,
4618                                       map.comment, num_members);
4619                         break;
4620                 }
4621                 case 2:
4622                         ctr->switch_value1 = 2;
4623                         init_samr_group_info2(&ctr->group.info2, map.nt_name);
4624                         break;
4625                 case 3:
4626                         ctr->switch_value1 = 3;
4627                         init_samr_group_info3(&ctr->group.info3);
4628                         break;
4629                 case 4:
4630                         ctr->switch_value1 = 4;
4631                         init_samr_group_info4(&ctr->group.info4, map.comment);
4632                         break;
4633                 case 5: {
4634                         /*
4635                         uint32 *members;
4636                         size_t num_members;
4637                         */
4638
4639                         ctr->switch_value1 = 5;
4640
4641                         /*
4642                         become_root();
4643                         r_u->status = pdb_enum_group_members(
4644                                 p->mem_ctx, &group_sid, &members, &num_members);
4645                         unbecome_root();
4646
4647                         if (!NT_STATUS_IS_OK(r_u->status)) {
4648                                 return r_u->status;
4649                         }
4650                         */
4651                         init_samr_group_info5(&ctr->group.info5, map.nt_name,
4652                                       map.comment, 0 /* num_members */); /* in w2k3 this is always 0 */
4653                         break;
4654                 }
4655                 default:
4656                         return NT_STATUS_INVALID_INFO_CLASS;
4657         }
4658
4659         init_samr_r_query_groupinfo(r_u, ctr, NT_STATUS_OK);
4660
4661         return NT_STATUS_OK;
4662 }
4663
4664 /*********************************************************************
4665  _samr_set_groupinfo
4666
4667  update a domain group's comment.
4668 *********************************************************************/
4669
4670 NTSTATUS _samr_set_groupinfo(pipes_struct *p, SAMR_Q_SET_GROUPINFO *q_u, SAMR_R_SET_GROUPINFO *r_u)
4671 {
4672         DOM_SID group_sid;
4673         GROUP_MAP map;
4674         GROUP_INFO_CTR *ctr;
4675         uint32 acc_granted;
4676         NTSTATUS ret;
4677         BOOL result;
4678         BOOL can_mod_accounts;
4679         DISP_INFO *disp_info = NULL;
4680
4681         if (!get_lsa_policy_samr_sid(p, &q_u->pol, &group_sid, &acc_granted, &disp_info))
4682                 return NT_STATUS_INVALID_HANDLE;
4683
4684         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_GROUP_SET_INFO, "_samr_set_groupinfo"))) {
4685                 return r_u->status;
4686         }
4687
4688         become_root();
4689         result = get_domain_group_from_sid(group_sid, &map);
4690         unbecome_root();
4691         if (!result)
4692                 return NT_STATUS_NO_SUCH_GROUP;
4693
4694         ctr=q_u->ctr;
4695
4696         switch (ctr->switch_value1) {
4697                 case 1:
4698                         unistr2_to_ascii(map.comment, &(ctr->group.info1.uni_acct_desc), sizeof(map.comment)-1);
4699                         break;
4700                 case 4:
4701                         unistr2_to_ascii(map.comment, &(ctr->group.info4.uni_acct_desc), sizeof(map.comment)-1);
4702                         break;
4703                 default:
4704                         return NT_STATUS_INVALID_INFO_CLASS;
4705         }
4706
4707         can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
4708
4709         /******** BEGIN SeAddUsers BLOCK *********/
4710
4711         if ( can_mod_accounts )
4712                 become_root();
4713
4714         ret = pdb_update_group_mapping_entry(&map);
4715
4716         if ( can_mod_accounts )
4717                 unbecome_root();
4718
4719         /******** End SeAddUsers BLOCK *********/
4720
4721         if (NT_STATUS_IS_OK(ret)) {
4722                 force_flush_samr_cache(disp_info);
4723         }
4724
4725         return ret;
4726 }
4727
4728 /*********************************************************************
4729  _samr_set_aliasinfo
4730
4731  update an alias's comment.
4732 *********************************************************************/
4733
4734 NTSTATUS _samr_set_aliasinfo(pipes_struct *p, SAMR_Q_SET_ALIASINFO *q_u, SAMR_R_SET_ALIASINFO *r_u)
4735 {
4736         DOM_SID group_sid;
4737         struct acct_info info;
4738         ALIAS_INFO_CTR *ctr;
4739         uint32 acc_granted;
4740         BOOL ret;
4741         BOOL can_mod_accounts;
4742         DISP_INFO *disp_info = NULL;
4743
4744         if (!get_lsa_policy_samr_sid(p, &q_u->alias_pol, &group_sid, &acc_granted, &disp_info))
4745                 return NT_STATUS_INVALID_HANDLE;
4746
4747         if (!NT_STATUS_IS_OK(r_u->status = access_check_samr_function(acc_granted, SA_RIGHT_ALIAS_SET_INFO, "_samr_set_aliasinfo"))) {
4748                 return r_u->status;
4749         }
4750
4751         ctr=&q_u->ctr;
4752
4753         /* get the current group information */
4754
4755         become_root();
4756         ret = pdb_get_aliasinfo( &group_sid, &info );
4757         unbecome_root();
4758
4759         if ( !ret ) {
4760                 return NT_STATUS_NO_SUCH_ALIAS;
4761         }
4762
4763         switch (ctr->level) {
4764                 case 2:
4765                 {
4766                         fstring group_name, acct_name;
4767                         NTSTATUS status;
4768
4769                         /* We currently do not support renaming groups in the
4770                            the BUILTIN domain.  Refer to util_builtin.c to understand
4771                            why.  The eventually needs to be fixed to be like Windows
4772                            where you can rename builtin groups, just not delete them */
4773
4774                         if ( sid_check_is_in_builtin( &group_sid ) ) {
4775                                 return NT_STATUS_SPECIAL_ACCOUNT;
4776                         }
4777
4778                         /* There has to be a valid name (and it has to be different) */
4779
4780                         if ( !ctr->alias.info2.name.string )
4781                                 return NT_STATUS_INVALID_PARAMETER;
4782
4783                         unistr2_to_ascii( acct_name, ctr->alias.info2.name.string,
4784                                 sizeof(acct_name)-1 );
4785
4786                         /* If the name is the same just reply "ok".  Yes this
4787                            doesn't allow you to change the case of a group name. */
4788
4789                         if ( strequal( acct_name, info.acct_name ) )
4790                                 return NT_STATUS_OK;
4791
4792                         fstrcpy( info.acct_name, acct_name );
4793
4794                         /* make sure the name doesn't already exist as a user
4795                            or local group */
4796
4797                         fstr_sprintf( group_name, "%s\\%s", global_myname(), info.acct_name );
4798                         status = can_create( p->mem_ctx, group_name );
4799                         if ( !NT_STATUS_IS_OK( status ) )
4800                                 return status;
4801                         break;
4802                         }
4803                 case 3:
4804                         if ( ctr->alias.info3.description.string ) {
4805                                 unistr2_to_ascii( info.acct_desc,
4806                                         ctr->alias.info3.description.string,
4807                                         sizeof(info.acct_desc)-1 );
4808                         }
4809                         else
4810                                 fstrcpy( info.acct_desc, "" );
4811                         break;
4812                 default:
4813                         return NT_STATUS_INVALID_INFO_CLASS;
4814         }
4815
4816         can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
4817
4818         /******** BEGIN SeAddUsers BLOCK *********/
4819
4820         if ( can_mod_accounts )
4821                 become_root();
4822
4823         ret = pdb_set_aliasinfo( &group_sid, &info );
4824
4825         if ( can_mod_accounts )
4826                 unbecome_root();
4827
4828         /******** End SeAddUsers BLOCK *********/
4829
4830         if (ret) {
4831                 force_flush_samr_cache(disp_info);
4832         }
4833
4834         return ret ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
4835 }
4836
4837 /*********************************************************************
4838  _samr_get_dom_pwinfo
4839 *********************************************************************/
4840
4841 NTSTATUS _samr_get_dom_pwinfo(pipes_struct *p, SAMR_Q_GET_DOM_PWINFO *q_u, SAMR_R_GET_DOM_PWINFO *r_u)
4842 {
4843         /* Perform access check.  Since this rpc does not require a
4844            policy handle it will not be caught by the access checks on
4845            SAMR_CONNECT or SAMR_CONNECT_ANON. */
4846
4847         if (!pipe_access_check(p)) {
4848                 DEBUG(3, ("access denied to samr_get_dom_pwinfo\n"));
4849                 r_u->status = NT_STATUS_ACCESS_DENIED;
4850                 return r_u->status;
4851         }
4852
4853         /* Actually, returning zeros here works quite well :-). */
4854
4855         return NT_STATUS_OK;
4856 }
4857
4858 /*********************************************************************
4859  _samr_open_group
4860 *********************************************************************/
4861
4862 NTSTATUS _samr_open_group(pipes_struct *p, SAMR_Q_OPEN_GROUP *q_u, SAMR_R_OPEN_GROUP *r_u)
4863 {
4864         DOM_SID sid;
4865         DOM_SID info_sid;
4866         GROUP_MAP map;
4867         struct samr_info *info;
4868         SEC_DESC         *psd = NULL;
4869         uint32            acc_granted;
4870         uint32            des_access = q_u->access_mask;
4871         size_t            sd_size;
4872         NTSTATUS          status;
4873         fstring sid_string;
4874         BOOL ret;
4875         SE_PRIV se_rights;
4876
4877         if (!get_lsa_policy_samr_sid(p, &q_u->domain_pol, &sid, &acc_granted, NULL))
4878                 return NT_STATUS_INVALID_HANDLE;
4879
4880         status = access_check_samr_function(acc_granted,
4881                 SA_RIGHT_DOMAIN_OPEN_ACCOUNT, "_samr_open_group");
4882
4883         if ( !NT_STATUS_IS_OK(status) )
4884                 return status;
4885
4886         /*check if access can be granted as requested by client. */
4887         make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
4888         se_map_generic(&des_access,&grp_generic_mapping);
4889
4890         se_priv_copy( &se_rights, &se_add_users );
4891
4892         status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
4893                 &se_rights, GENERIC_RIGHTS_GROUP_WRITE, des_access,
4894                 &acc_granted, "_samr_open_group");
4895
4896         if ( !NT_STATUS_IS_OK(status) )
4897                 return status;
4898
4899         /* this should not be hard-coded like this */
4900
4901         if (!sid_equal(&sid, get_global_sam_sid()))
4902                 return NT_STATUS_ACCESS_DENIED;
4903
4904         sid_copy(&info_sid, get_global_sam_sid());
4905         sid_append_rid(&info_sid, q_u->rid_group);
4906         sid_to_string(sid_string, &info_sid);
4907
4908         if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
4909                 return NT_STATUS_NO_MEMORY;
4910
4911         info->acc_granted = acc_granted;
4912
4913         DEBUG(10, ("_samr_open_group:Opening SID: %s\n", sid_string));
4914
4915         /* check if that group really exists */
4916         become_root();
4917         ret = get_domain_group_from_sid(info->sid, &map);
4918         unbecome_root();
4919         if (!ret)
4920                 return NT_STATUS_NO_SUCH_GROUP;
4921
4922         /* get a (unique) handle.  open a policy on it. */
4923         if (!create_policy_hnd(p, &r_u->pol, free_samr_info, (void *)info))
4924                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
4925
4926         return NT_STATUS_OK;
4927 }
4928
4929 /*********************************************************************
4930  _samr_remove_sid_foreign_domain
4931 *********************************************************************/
4932
4933 NTSTATUS _samr_remove_sid_foreign_domain(pipes_struct *p,
4934                                           SAMR_Q_REMOVE_SID_FOREIGN_DOMAIN *q_u,
4935                                           SAMR_R_REMOVE_SID_FOREIGN_DOMAIN *r_u)
4936 {
4937         DOM_SID                 delete_sid, domain_sid;
4938         uint32                  acc_granted;
4939         NTSTATUS                result;
4940         DISP_INFO *disp_info = NULL;
4941
4942         sid_copy( &delete_sid, &q_u->sid.sid );
4943
4944         DEBUG(5,("_samr_remove_sid_foreign_domain: removing SID [%s]\n",
4945                 sid_string_static(&delete_sid)));
4946
4947         /* Find the policy handle. Open a policy on it. */
4948
4949         if (!get_lsa_policy_samr_sid(p, &q_u->dom_pol, &domain_sid,
4950                                      &acc_granted, &disp_info))
4951                 return NT_STATUS_INVALID_HANDLE;
4952
4953         result = access_check_samr_function(acc_granted, STD_RIGHT_DELETE_ACCESS,
4954                 "_samr_remove_sid_foreign_domain");
4955
4956         if (!NT_STATUS_IS_OK(result))
4957                 return result;
4958
4959         DEBUG(8, ("_samr_remove_sid_foreign_domain:sid is %s\n",
4960                 sid_string_static(&domain_sid)));
4961
4962         /* we can only delete a user from a group since we don't have
4963            nested groups anyways.  So in the latter case, just say OK */
4964
4965         /* TODO: The above comment nowadays is bogus. Since we have nested
4966          * groups now, and aliases members are never reported out of the unix
4967          * group membership, the "just say OK" makes this call a no-op. For
4968          * us. This needs fixing however. */
4969
4970         /* I've only ever seen this in the wild when deleting a user from
4971          * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
4972          * is the user about to be deleted. I very much suspect this is the
4973          * only application of this call. To verify this, let people report
4974          * other cases. */
4975
4976         if (!sid_check_is_builtin(&domain_sid)) {
4977                 DEBUG(1,("_samr_remove_sid_foreign_domain: domain_sid = %s, "
4978                          "global_sam_sid() = %s\n",
4979                          sid_string_static(&domain_sid),
4980                          sid_string_static(get_global_sam_sid())));
4981                 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
4982                 return NT_STATUS_OK;
4983         }
4984
4985         force_flush_samr_cache(disp_info);
4986
4987         result = NT_STATUS_OK;
4988
4989         return result;
4990 }
4991
4992 /*******************************************************************
4993  _samr_query_domain_info2
4994  ********************************************************************/
4995
4996 NTSTATUS _samr_query_domain_info2(pipes_struct *p,
4997                                   SAMR_Q_QUERY_DOMAIN_INFO2 *q_u,
4998                                   SAMR_R_QUERY_DOMAIN_INFO2 *r_u)
4999 {
5000         SAMR_Q_QUERY_DOMAIN_INFO q;
5001         SAMR_R_QUERY_DOMAIN_INFO r;
5002
5003         ZERO_STRUCT(q);
5004         ZERO_STRUCT(r);
5005
5006         DEBUG(5,("_samr_query_domain_info2: %d\n", __LINE__));
5007
5008         q.domain_pol = q_u->domain_pol;
5009         q.switch_value = q_u->switch_value;
5010
5011         r_u->status = _samr_query_domain_info(p, &q, &r);
5012
5013         r_u->ptr_0              = r.ptr_0;
5014         r_u->switch_value       = r.switch_value;
5015         r_u->ctr                = r.ctr;
5016
5017         return r_u->status;
5018 }
5019
5020 /*******************************************************************
5021  _samr_set_dom_info
5022  ********************************************************************/
5023
5024 NTSTATUS _samr_set_dom_info(pipes_struct *p, SAMR_Q_SET_DOMAIN_INFO *q_u, SAMR_R_SET_DOMAIN_INFO *r_u)
5025 {
5026         time_t u_expire, u_min_age;
5027         time_t u_logout;
5028         time_t u_lock_duration, u_reset_time;
5029
5030         r_u->status = NT_STATUS_OK;
5031
5032         DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__));
5033
5034         /* find the policy handle.  open a policy on it. */
5035         if (!find_policy_by_hnd(p, &q_u->domain_pol, NULL))
5036                 return NT_STATUS_INVALID_HANDLE;
5037
5038         DEBUG(5,("_samr_set_dom_info: switch_value: %d\n", q_u->switch_value));
5039
5040         switch (q_u->switch_value) {
5041                 case 0x01:
5042                         u_expire=nt_time_to_unix_abs(&q_u->ctr->info.inf1.expire);
5043                         u_min_age=nt_time_to_unix_abs(&q_u->ctr->info.inf1.min_passwordage);
5044
5045                         pdb_set_account_policy(AP_MIN_PASSWORD_LEN, (uint32)q_u->ctr->info.inf1.min_length_password);
5046                         pdb_set_account_policy(AP_PASSWORD_HISTORY, (uint32)q_u->ctr->info.inf1.password_history);
5047                         pdb_set_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, (uint32)q_u->ctr->info.inf1.password_properties);
5048                         pdb_set_account_policy(AP_MAX_PASSWORD_AGE, (int)u_expire);
5049                         pdb_set_account_policy(AP_MIN_PASSWORD_AGE, (int)u_min_age);
5050                         break;
5051                 case 0x02:
5052                         break;
5053                 case 0x03:
5054                         u_logout=nt_time_to_unix_abs(&q_u->ctr->info.inf3.logout);
5055                         pdb_set_account_policy(AP_TIME_TO_LOGOUT, (int)u_logout);
5056                         break;
5057                 case 0x05:
5058                         break;
5059                 case 0x06:
5060                         break;
5061                 case 0x07:
5062                         break;
5063                 case 0x0c:
5064                         u_lock_duration=nt_time_to_unix_abs(&q_u->ctr->info.inf12.duration);
5065                         if (u_lock_duration != -1)
5066                                 u_lock_duration /= 60;
5067
5068                         u_reset_time=nt_time_to_unix_abs(&q_u->ctr->info.inf12.reset_count)/60;
5069
5070                         pdb_set_account_policy(AP_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
5071                         pdb_set_account_policy(AP_RESET_COUNT_TIME, (int)u_reset_time);
5072                         pdb_set_account_policy(AP_BAD_ATTEMPT_LOCKOUT, (uint32)q_u->ctr->info.inf12.bad_attempt_lockout);
5073                         break;
5074                 default:
5075                         return NT_STATUS_INVALID_INFO_CLASS;
5076         }
5077
5078         init_samr_r_set_domain_info(r_u, NT_STATUS_OK);
5079
5080         DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__));
5081
5082         return r_u->status;
5083 }
5084
5085 /*******************************************************************
5086  _samr_get_dispenum_index
5087  ********************************************************************/
5088
5089 NTSTATUS _samr_get_dispenum_index(pipes_struct *p, SAMR_Q_GET_DISPENUM_INDEX *q_u, SAMR_R_GET_DISPENUM_INDEX *r_u)
5090 {
5091         struct samr_info *info = NULL;
5092         uint32 max_entries = (uint32) -1;
5093         uint32 enum_context = 0;
5094         int i;
5095         uint32 num_account = 0;
5096         struct samr_displayentry *entries = NULL;
5097         fstring account_name;
5098
5099         DEBUG(5, ("_samr_get_dispenum_index: %d\n", __LINE__));
5100
5101         r_u->status = NT_STATUS_UNSUCCESSFUL;
5102
5103         /* find the policy handle.  open a policy on it. */
5104         if (!find_policy_by_hnd(p, &q_u->domain_pol, (void **)(void *)&info))
5105                 return NT_STATUS_INVALID_HANDLE;
5106
5107         if ((q_u->switch_level < 1) || (q_u->switch_level > 3)) {
5108                 DEBUG(0,("_samr_get_dispenum_index: Unknown info level (%u)\n",
5109                          (unsigned int)q_u->switch_level ));
5110                 return NT_STATUS_INVALID_INFO_CLASS;
5111         }
5112
5113         if (!rpcstr_pull_unistr2_fstring(account_name, &q_u->name.unistring)) {
5114                 return NT_STATUS_NO_MEMORY;
5115         }
5116
5117         become_root();
5118
5119         /* The following done as ROOT. Don't return without unbecome_root(). */
5120
5121         switch (q_u->switch_level) {
5122         case 0x1:
5123                 if (info->disp_info->users == NULL) {
5124                         info->disp_info->users = pdb_search_users(ACB_NORMAL);
5125                         if (info->disp_info->users == NULL) {
5126                                 unbecome_root();
5127                                 return NT_STATUS_ACCESS_DENIED;
5128                         }
5129                         DEBUG(10,("_samr_get_dispenum_index: starting user enumeration at index %u\n",
5130                                 (unsigned  int)enum_context ));
5131                 } else {
5132                         DEBUG(10,("_samr_get_dispenum_index: using cached user enumeration at index %u\n",
5133                                 (unsigned  int)enum_context ));
5134                 }
5135
5136                 num_account = pdb_search_entries(info->disp_info->users,
5137                                                  enum_context, max_entries,
5138                                                  &entries);
5139                 break;
5140         case 0x2:
5141                 if (info->disp_info->machines == NULL) {
5142                         info->disp_info->machines =
5143                                 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
5144                         if (info->disp_info->machines == NULL) {
5145                                 unbecome_root();
5146                                 return NT_STATUS_ACCESS_DENIED;
5147                         }
5148                         DEBUG(10,("_samr_get_dispenum_index: starting machine enumeration at index %u\n",
5149                                 (unsigned  int)enum_context ));
5150                 } else {
5151                         DEBUG(10,("_samr_get_dispenum_index: using cached machine enumeration at index %u\n",
5152                                 (unsigned  int)enum_context ));
5153                 }
5154
5155                 num_account = pdb_search_entries(info->disp_info->machines,
5156                                                  enum_context, max_entries,
5157                                                  &entries);
5158                 break;
5159         case 0x3:
5160                 if (info->disp_info->groups == NULL) {
5161                         info->disp_info->groups = pdb_search_groups();
5162                         if (info->disp_info->groups == NULL) {
5163                                 unbecome_root();
5164                                 return NT_STATUS_ACCESS_DENIED;
5165                         }
5166                         DEBUG(10,("_samr_get_dispenum_index: starting group enumeration at index %u\n",
5167                                 (unsigned  int)enum_context ));
5168                 } else {
5169                         DEBUG(10,("_samr_get_dispenum_index: using cached group enumeration at index %u\n",
5170                                 (unsigned  int)enum_context ));
5171                 }
5172
5173                 num_account = pdb_search_entries(info->disp_info->groups,
5174                                                  enum_context, max_entries,
5175                                                  &entries);
5176                 break;
5177         default:
5178                 unbecome_root();
5179                 smb_panic("info class changed");
5180                 break;
5181         }
5182         unbecome_root();
5183
5184         /* Ensure we cache this enumeration. */
5185         set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
5186
5187         DEBUG(10,("_samr_get_dispenum_index: looking for :%s\n", account_name));
5188
5189         for (i=0; i<num_account; i++) {
5190                 if (strequal(entries[i].account_name, account_name)) {
5191                         DEBUG(10,("_samr_get_dispenum_index: found %s at idx %d\n",
5192                                 account_name, i));
5193
5194                         init_samr_r_get_dispenum_index(r_u, i);
5195
5196                         return NT_STATUS_OK;
5197                 }
5198         }
5199
5200         /* assuming account_name lives at the very end */
5201         init_samr_r_get_dispenum_index(r_u, num_account);
5202
5203         return NT_STATUS_OK;
5204 }