2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Jeremy Allison 2001, 2006.
8 * Copyright (C) Rafal Szczesniak 2002,
9 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
10 * Copyright (C) Simo Sorce 2003.
11 * Copyright (C) Gerald (Jerry) Carter 2005.
12 * Copyright (C) Volker Lendecke 2005.
13 * Copyright (C) Guenther Deschner 2008.
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 3 of the License, or
18 * (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23 * GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, see <http://www.gnu.org/licenses/>.
29 /* This is the implementation of the lsa server code. */
34 #define DBGC_CLASS DBGC_RPC_SRV
43 const struct generic_mapping lsa_generic_mapping
= {
50 /***************************************************************************
51 init_lsa_ref_domain_list - adds a domain if it's not already in, returns the index.
52 ***************************************************************************/
54 static int init_lsa_ref_domain_list(TALLOC_CTX
*mem_ctx
,
55 struct lsa_RefDomainList
*ref
,
61 if (dom_name
!= NULL
) {
62 for (num
= 0; num
< ref
->count
; num
++) {
63 if (sid_equal(dom_sid
, ref
->domains
[num
].sid
)) {
71 if (num
>= MAX_REF_DOMAINS
) {
72 /* index not found, already at maximum domain limit */
77 ref
->max_size
= MAX_REF_DOMAINS
;
79 ref
->domains
= TALLOC_REALLOC_ARRAY(mem_ctx
, ref
->domains
,
80 struct lsa_DomainInfo
, ref
->count
);
85 ZERO_STRUCT(ref
->domains
[num
]);
87 init_lsa_StringLarge(&ref
->domains
[num
].name
, dom_name
);
88 ref
->domains
[num
].sid
= sid_dup_talloc(mem_ctx
, dom_sid
);
89 if (!ref
->domains
[num
].sid
) {
97 /*******************************************************************
98 Function to free the per handle data.
99 ********************************************************************/
101 static void free_lsa_info(void *ptr
)
103 struct lsa_info
*lsa
= (struct lsa_info
*)ptr
;
108 /***************************************************************************
109 initialize a lsa_DomainInfo structure.
110 ***************************************************************************/
112 static void init_dom_query_3(struct lsa_DomainInfo
*r
,
116 init_lsa_StringLarge(&r
->name
, name
);
120 /***************************************************************************
121 initialize a lsa_DomainInfo structure.
122 ***************************************************************************/
124 static void init_dom_query_5(struct lsa_DomainInfo
*r
,
128 init_lsa_StringLarge(&r
->name
, name
);
132 /***************************************************************************
133 lookup_lsa_rids. Must be called as root for lookup_name to work.
134 ***************************************************************************/
136 static NTSTATUS
lookup_lsa_rids(TALLOC_CTX
*mem_ctx
,
137 struct lsa_RefDomainList
*ref
,
138 struct lsa_TranslatedSid
*prid
,
139 uint32_t num_entries
,
140 struct lsa_String
*name
,
142 uint32_t *pmapped_count
)
144 uint32 mapped_count
, i
;
146 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
151 for (i
= 0; i
< num_entries
; i
++) {
155 const char *full_name
;
157 enum lsa_SidType type
= SID_NAME_UNKNOWN
;
159 /* Split name into domain and user component */
161 full_name
= name
[i
].string
;
162 if (full_name
== NULL
) {
163 return NT_STATUS_NO_MEMORY
;
166 DEBUG(5, ("lookup_lsa_rids: looking up name %s\n", full_name
));
168 /* We can ignore the result of lookup_name, it will not touch
169 "type" if it's not successful */
171 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
176 case SID_NAME_DOM_GRP
:
177 case SID_NAME_DOMAIN
:
179 case SID_NAME_WKN_GRP
:
180 DEBUG(5, ("init_lsa_rids: %s found\n", full_name
));
181 /* Leave these unchanged */
184 /* Don't hand out anything but the list above */
185 DEBUG(5, ("init_lsa_rids: %s not found\n", full_name
));
186 type
= SID_NAME_UNKNOWN
;
193 if (type
!= SID_NAME_UNKNOWN
) {
194 sid_split_rid(&sid
, &rid
);
195 dom_idx
= init_lsa_ref_domain_list(mem_ctx
, ref
, domain
, &sid
);
199 init_lsa_translated_sid(&prid
[i
], type
, rid
, dom_idx
);
202 *pmapped_count
= mapped_count
;
206 /***************************************************************************
207 lookup_lsa_sids. Must be called as root for lookup_name to work.
208 ***************************************************************************/
210 static NTSTATUS
lookup_lsa_sids(TALLOC_CTX
*mem_ctx
,
211 struct lsa_RefDomainList
*ref
,
212 struct lsa_TranslatedSid3
*trans_sids
,
213 uint32_t num_entries
,
214 struct lsa_String
*name
,
216 uint32
*pmapped_count
)
218 uint32 mapped_count
, i
;
220 SMB_ASSERT(num_entries
<= MAX_LOOKUP_SIDS
);
225 for (i
= 0; i
< num_entries
; i
++) {
229 const char *full_name
;
231 enum lsa_SidType type
= SID_NAME_UNKNOWN
;
235 /* Split name into domain and user component */
237 full_name
= name
[i
].string
;
238 if (full_name
== NULL
) {
239 return NT_STATUS_NO_MEMORY
;
242 DEBUG(5, ("init_lsa_sids: looking up name %s\n", full_name
));
244 /* We can ignore the result of lookup_name, it will not touch
245 "type" if it's not successful */
247 lookup_name(mem_ctx
, full_name
, flags
, &domain
, NULL
,
252 case SID_NAME_DOM_GRP
:
253 case SID_NAME_DOMAIN
:
255 case SID_NAME_WKN_GRP
:
256 DEBUG(5, ("init_lsa_sids: %s found\n", full_name
));
257 /* Leave these unchanged */
260 /* Don't hand out anything but the list above */
261 DEBUG(5, ("init_lsa_sids: %s not found\n", full_name
));
262 type
= SID_NAME_UNKNOWN
;
269 if (type
!= SID_NAME_UNKNOWN
) {
271 sid_copy(&domain_sid
, &sid
);
272 sid_split_rid(&domain_sid
, &rid
);
273 dom_idx
= init_lsa_ref_domain_list(mem_ctx
, ref
, domain
, &domain_sid
);
277 /* Initialize the lsa_TranslatedSid3 return. */
278 trans_sids
[i
].sid_type
= type
;
279 trans_sids
[i
].sid
= sid_dup_talloc(mem_ctx
, &sid
);
280 trans_sids
[i
].sid_index
= dom_idx
;
283 *pmapped_count
= mapped_count
;
287 static NTSTATUS
lsa_get_generic_sd(TALLOC_CTX
*mem_ctx
, SEC_DESC
**sd
, size_t *sd_size
)
289 DOM_SID local_adm_sid
;
297 init_sec_access(&mask
, LSA_POLICY_EXECUTE
);
298 init_sec_ace(&ace
[0], &global_sid_World
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
300 sid_copy(&adm_sid
, get_global_sam_sid());
301 sid_append_rid(&adm_sid
, DOMAIN_GROUP_RID_ADMINS
);
302 init_sec_access(&mask
, LSA_POLICY_ALL_ACCESS
);
303 init_sec_ace(&ace
[1], &adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
305 sid_copy(&local_adm_sid
, &global_sid_Builtin
);
306 sid_append_rid(&local_adm_sid
, BUILTIN_ALIAS_RID_ADMINS
);
307 init_sec_access(&mask
, LSA_POLICY_ALL_ACCESS
);
308 init_sec_ace(&ace
[2], &local_adm_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
310 if((psa
= make_sec_acl(mem_ctx
, NT4_ACL_REVISION
, 3, ace
)) == NULL
)
311 return NT_STATUS_NO_MEMORY
;
313 if((*sd
= make_sec_desc(mem_ctx
, SECURITY_DESCRIPTOR_REVISION_1
,
314 SEC_DESC_SELF_RELATIVE
, &adm_sid
, NULL
, NULL
,
315 psa
, sd_size
)) == NULL
)
316 return NT_STATUS_NO_MEMORY
;
321 #if 0 /* AD DC work in ongoing in Samba 4 */
323 /***************************************************************************
325 ***************************************************************************/
327 static void init_dns_dom_info(LSA_DNS_DOM_INFO
*r_l
, const char *nb_name
,
328 const char *dns_name
, const char *forest_name
,
329 struct GUID
*dom_guid
, DOM_SID
*dom_sid
)
331 if (nb_name
&& *nb_name
) {
332 init_unistr2(&r_l
->uni_nb_dom_name
, nb_name
, UNI_FLAGS_NONE
);
333 init_uni_hdr(&r_l
->hdr_nb_dom_name
, &r_l
->uni_nb_dom_name
);
334 r_l
->hdr_nb_dom_name
.uni_max_len
+= 2;
335 r_l
->uni_nb_dom_name
.uni_max_len
+= 1;
338 if (dns_name
&& *dns_name
) {
339 init_unistr2(&r_l
->uni_dns_dom_name
, dns_name
, UNI_FLAGS_NONE
);
340 init_uni_hdr(&r_l
->hdr_dns_dom_name
, &r_l
->uni_dns_dom_name
);
341 r_l
->hdr_dns_dom_name
.uni_max_len
+= 2;
342 r_l
->uni_dns_dom_name
.uni_max_len
+= 1;
345 if (forest_name
&& *forest_name
) {
346 init_unistr2(&r_l
->uni_forest_name
, forest_name
, UNI_FLAGS_NONE
);
347 init_uni_hdr(&r_l
->hdr_forest_name
, &r_l
->uni_forest_name
);
348 r_l
->hdr_forest_name
.uni_max_len
+= 2;
349 r_l
->uni_forest_name
.uni_max_len
+= 1;
352 /* how do we init the guid ? probably should write an init fn */
354 memcpy(&r_l
->dom_guid
, dom_guid
, sizeof(struct GUID
));
358 r_l
->ptr_dom_sid
= 1;
359 init_dom_sid2(&r_l
->dom_sid
, dom_sid
);
362 #endif /* AD DC work in ongoing in Samba 4 */
365 /***************************************************************************
367 ***************************************************************************/
369 NTSTATUS
_lsa_OpenPolicy2(pipes_struct
*p
,
370 struct lsa_OpenPolicy2
*r
)
372 struct lsa_info
*info
;
373 SEC_DESC
*psd
= NULL
;
375 uint32 des_access
= r
->in
.access_mask
;
380 /* map the generic bits to the lsa policy ones */
381 se_map_generic(&des_access
, &lsa_generic_mapping
);
383 /* get the generic lsa policy SD until we store it */
384 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
386 if(!se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
, &status
)) {
387 if (p
->pipe_user
.ut
.uid
!= sec_initial_uid()) {
390 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
391 acc_granted
, des_access
));
392 DEBUGADD(4,("but overwritten by euid == 0\n"));
395 /* This is needed for lsa_open_account and rpcclient .... :-) */
397 if (p
->pipe_user
.ut
.uid
== sec_initial_uid())
398 acc_granted
= LSA_POLICY_ALL_ACCESS
;
400 /* associate the domain SID with the (unique) handle. */
401 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
402 return NT_STATUS_NO_MEMORY
;
405 sid_copy(&info
->sid
,get_global_sam_sid());
406 info
->access
= acc_granted
;
408 /* set up the LSA QUERY INFO response */
409 if (!create_policy_hnd(p
, r
->out
.handle
, free_lsa_info
, (void *)info
))
410 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
415 /***************************************************************************
417 ***************************************************************************/
419 NTSTATUS
_lsa_OpenPolicy(pipes_struct
*p
,
420 struct lsa_OpenPolicy
*r
)
422 struct lsa_info
*info
;
423 SEC_DESC
*psd
= NULL
;
425 uint32 des_access
= r
->in
.access_mask
;
430 /* map the generic bits to the lsa policy ones */
431 se_map_generic(&des_access
, &lsa_generic_mapping
);
433 /* get the generic lsa policy SD until we store it */
434 lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
436 if(!se_access_check(psd
, p
->pipe_user
.nt_user_token
, des_access
, &acc_granted
, &status
)) {
437 if (p
->pipe_user
.ut
.uid
!= sec_initial_uid()) {
440 DEBUG(4,("ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
441 acc_granted
, des_access
));
442 DEBUGADD(4,("but overwritten by euid == 0\n"));
443 acc_granted
= des_access
;
446 /* associate the domain SID with the (unique) handle. */
447 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
448 return NT_STATUS_NO_MEMORY
;
451 sid_copy(&info
->sid
,get_global_sam_sid());
452 info
->access
= acc_granted
;
454 /* set up the LSA QUERY INFO response */
455 if (!create_policy_hnd(p
, r
->out
.handle
, free_lsa_info
, (void *)info
))
456 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
461 /***************************************************************************
462 _lsa_EnumTrustDom - this needs fixing to do more than return NULL ! JRA.
464 ***************************************************************************/
466 NTSTATUS
_lsa_EnumTrustDom(pipes_struct
*p
,
467 struct lsa_EnumTrustDom
*r
)
469 struct lsa_info
*info
;
471 struct trustdom_info
**domains
;
472 struct lsa_DomainInfo
*lsa_domains
= NULL
;
476 * preferred length is set to 5 as a "our" preferred length
477 * nt sets this parameter to 2
478 * update (20.08.2002): it's not preferred length, but preferred size!
479 * it needs further investigation how to optimally choose this value
481 uint32 max_num_domains
=
482 r
->in
.max_size
< 5 ? r
->in
.max_size
: 10;
487 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
488 return NT_STATUS_INVALID_HANDLE
;
490 /* check if the user have enough rights */
491 if (!(info
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
492 return NT_STATUS_ACCESS_DENIED
;
495 nt_status
= pdb_enum_trusteddoms(p
->mem_ctx
, &num_domains
, &domains
);
498 if (!NT_STATUS_IS_OK(nt_status
)) {
502 if (*r
->in
.resume_handle
< num_domains
) {
503 num_thistime
= MIN(num_domains
, max_num_domains
);
505 nt_status
= STATUS_MORE_ENTRIES
;
507 if (*r
->in
.resume_handle
+ num_thistime
> num_domains
) {
508 num_thistime
= num_domains
- *r
->in
.resume_handle
;
509 nt_status
= NT_STATUS_OK
;
512 next_idx
= *r
->in
.resume_handle
+ num_thistime
;
515 next_idx
= 0xffffffff;
516 nt_status
= NT_STATUS_NO_MORE_ENTRIES
;
519 /* set up the lsa_enum_trust_dom response */
521 lsa_domains
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_DomainInfo
,
524 return NT_STATUS_NO_MEMORY
;
527 for (i
=0; i
<num_thistime
; i
++) {
528 init_lsa_StringLarge(&lsa_domains
[i
].name
, domains
[i
]->name
);
529 lsa_domains
[i
].sid
= &domains
[i
]->sid
;
532 *r
->out
.resume_handle
= next_idx
;
533 r
->out
.domains
->count
= num_thistime
;
534 r
->out
.domains
->domains
= lsa_domains
;
539 #define LSA_AUDIT_NUM_CATEGORIES_NT4 7
540 #define LSA_AUDIT_NUM_CATEGORIES_WIN2K 9
541 #define LSA_AUDIT_NUM_CATEGORIES LSA_AUDIT_NUM_CATEGORIES_NT4
543 /***************************************************************************
545 ***************************************************************************/
547 NTSTATUS
_lsa_QueryInfoPolicy(pipes_struct
*p
,
548 struct lsa_QueryInfoPolicy
*r
)
550 NTSTATUS status
= NT_STATUS_OK
;
551 struct lsa_info
*handle
;
555 union lsa_PolicyInformation
*info
= NULL
;
557 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
558 return NT_STATUS_INVALID_HANDLE
;
560 info
= TALLOC_ZERO_P(p
->mem_ctx
, union lsa_PolicyInformation
);
562 return NT_STATUS_NO_MEMORY
;
565 switch (r
->in
.level
) {
569 uint32 policy_def
= LSA_AUDIT_POLICY_ALL
;
571 /* check if the user have enough rights */
572 if (!(handle
->access
& LSA_POLICY_VIEW_AUDIT_INFORMATION
)) {
573 DEBUG(10,("_lsa_QueryInfoPolicy: insufficient access rights\n"));
574 return NT_STATUS_ACCESS_DENIED
;
577 /* fake info: We audit everything. ;) */
579 info
->audit_events
.auditing_mode
= true;
580 info
->audit_events
.count
= LSA_AUDIT_NUM_CATEGORIES
;
581 info
->audit_events
.settings
= TALLOC_ZERO_ARRAY(p
->mem_ctx
,
582 enum lsa_PolicyAuditPolicy
,
583 info
->audit_events
.count
);
584 if (!info
->audit_events
.settings
) {
585 return NT_STATUS_NO_MEMORY
;
588 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_ACCOUNT_MANAGEMENT
] = policy_def
;
589 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_FILE_AND_OBJECT_ACCESS
] = policy_def
;
590 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_LOGON
] = policy_def
;
591 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_PROCCESS_TRACKING
] = policy_def
;
592 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_SECURITY_POLICY_CHANGES
] = policy_def
;
593 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_SYSTEM
] = policy_def
;
594 info
->audit_events
.settings
[LSA_AUDIT_CATEGORY_USE_OF_USER_RIGHTS
] = policy_def
;
599 /* check if the user have enough rights */
600 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
601 return NT_STATUS_ACCESS_DENIED
;
603 /* Request PolicyPrimaryDomainInformation. */
604 switch (lp_server_role()) {
605 case ROLE_DOMAIN_PDC
:
606 case ROLE_DOMAIN_BDC
:
607 name
= get_global_sam_name();
608 sid
= sid_dup_talloc(p
->mem_ctx
, get_global_sam_sid());
610 return NT_STATUS_NO_MEMORY
;
613 case ROLE_DOMAIN_MEMBER
:
614 name
= lp_workgroup();
615 /* We need to return the Domain SID here. */
616 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid
)) {
617 sid
= sid_dup_talloc(p
->mem_ctx
, &domain_sid
);
619 return NT_STATUS_NO_MEMORY
;
622 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
625 case ROLE_STANDALONE
:
626 name
= lp_workgroup();
630 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
632 init_dom_query_3(&info
->domain
, name
, sid
);
635 /* check if the user have enough rights */
636 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
637 return NT_STATUS_ACCESS_DENIED
;
639 /* Request PolicyAccountDomainInformation. */
640 name
= get_global_sam_name();
641 sid
= get_global_sam_sid();
643 init_dom_query_5(&info
->account_domain
, name
, sid
);
646 /* check if the user have enough rights */
647 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
648 return NT_STATUS_ACCESS_DENIED
;
650 switch (lp_server_role()) {
651 case ROLE_DOMAIN_BDC
:
653 * only a BDC is a backup controller
654 * of the domain, it controls.
660 * any other role is a primary
661 * of the domain, it controls.
668 DEBUG(0,("_lsa_QueryInfoPolicy: unknown info level in Lsa Query: %d\n",
670 status
= NT_STATUS_INVALID_INFO_CLASS
;
679 /***************************************************************************
680 _lsa_lookup_sids_internal
681 ***************************************************************************/
683 static NTSTATUS
_lsa_lookup_sids_internal(pipes_struct
*p
,
685 uint16_t level
, /* input */
686 int num_sids
, /* input */
687 struct lsa_SidPtr
*sid
, /* input */
688 struct lsa_RefDomainList
**pp_ref
, /* input/output */
689 struct lsa_TranslatedName2
**pp_names
,/* input/output */
690 uint32_t *pp_mapped_count
) /* input/output */
694 const DOM_SID
**sids
= NULL
;
695 struct lsa_RefDomainList
*ref
= NULL
;
696 uint32 mapped_count
= 0;
697 struct lsa_dom_info
*dom_infos
= NULL
;
698 struct lsa_name_info
*name_infos
= NULL
;
699 struct lsa_TranslatedName2
*names
= NULL
;
701 *pp_mapped_count
= 0;
709 sids
= TALLOC_ARRAY(p
->mem_ctx
, const DOM_SID
*, num_sids
);
710 ref
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_RefDomainList
);
712 if (sids
== NULL
|| ref
== NULL
) {
713 return NT_STATUS_NO_MEMORY
;
716 for (i
=0; i
<num_sids
; i
++) {
717 sids
[i
] = sid
[i
].sid
;
720 status
= lookup_sids(p
->mem_ctx
, num_sids
, sids
, level
,
721 &dom_infos
, &name_infos
);
723 if (!NT_STATUS_IS_OK(status
)) {
727 names
= TALLOC_ARRAY(p
->mem_ctx
, struct lsa_TranslatedName2
, num_sids
);
729 return NT_STATUS_NO_MEMORY
;
732 for (i
=0; i
<MAX_REF_DOMAINS
; i
++) {
734 if (!dom_infos
[i
].valid
) {
738 if (init_lsa_ref_domain_list(mem_ctx
, ref
,
740 &dom_infos
[i
].sid
) != i
) {
741 DEBUG(0, ("Domain %s mentioned twice??\n",
743 return NT_STATUS_INTERNAL_ERROR
;
747 for (i
=0; i
<num_sids
; i
++) {
748 struct lsa_name_info
*name
= &name_infos
[i
];
750 if (name
->type
== SID_NAME_UNKNOWN
) {
753 /* Unknown sids should return the string
754 * representation of the SID. Windows 2003 behaves
755 * rather erratic here, in many cases it returns the
756 * RID as 8 bytes hex, in others it returns the full
757 * SID. We (Jerry/VL) could not figure out which the
758 * hard cases are, so leave it with the SID. */
759 name
->name
= talloc_asprintf(p
->mem_ctx
, "%s",
762 if (name
->name
== NULL
) {
763 return NT_STATUS_NO_MEMORY
;
769 init_lsa_translated_name2(&names
[i
], name
->type
,
770 name
->name
, name
->dom_idx
, 0);
773 status
= NT_STATUS_NONE_MAPPED
;
774 if (mapped_count
> 0) {
775 status
= (mapped_count
< num_sids
) ?
776 STATUS_SOME_UNMAPPED
: NT_STATUS_OK
;
779 DEBUG(10, ("num_sids %d, mapped_count %d, status %s\n",
780 num_sids
, mapped_count
, nt_errstr(status
)));
782 *pp_mapped_count
= mapped_count
;
789 /***************************************************************************
791 ***************************************************************************/
793 NTSTATUS
_lsa_LookupSids(pipes_struct
*p
,
794 struct lsa_LookupSids
*r
)
797 struct lsa_info
*handle
;
798 int num_sids
= r
->in
.sids
->num_sids
;
799 uint32 mapped_count
= 0;
800 struct lsa_RefDomainList
*domains
= NULL
;
801 struct lsa_TranslatedName
*names_out
= NULL
;
802 struct lsa_TranslatedName2
*names
= NULL
;
805 if ((r
->in
.level
< 1) || (r
->in
.level
> 6)) {
806 return NT_STATUS_INVALID_PARAMETER
;
809 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
810 return NT_STATUS_INVALID_HANDLE
;
813 /* check if the user has enough rights */
814 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
815 return NT_STATUS_ACCESS_DENIED
;
818 if (num_sids
> MAX_LOOKUP_SIDS
) {
819 DEBUG(5,("_lsa_LookupSids: limit of %d exceeded, requested %d\n",
820 MAX_LOOKUP_SIDS
, num_sids
));
821 return NT_STATUS_NONE_MAPPED
;
824 status
= _lsa_lookup_sids_internal(p
,
833 if (NT_STATUS_IS_ERR(status
)) {
837 /* Convert from lsa_TranslatedName2 to lsa_TranslatedName */
838 names_out
= TALLOC_ARRAY(p
->mem_ctx
, struct lsa_TranslatedName
,
841 return NT_STATUS_NO_MEMORY
;
844 for (i
=0; i
<num_sids
; i
++) {
845 names_out
[i
].sid_type
= names
[i
].sid_type
;
846 names_out
[i
].name
= names
[i
].name
;
847 names_out
[i
].sid_index
= names
[i
].sid_index
;
850 *r
->out
.domains
= domains
;
851 r
->out
.names
->count
= num_sids
;
852 r
->out
.names
->names
= names_out
;
853 *r
->out
.count
= mapped_count
;
858 /***************************************************************************
860 ***************************************************************************/
862 NTSTATUS
_lsa_LookupSids2(pipes_struct
*p
,
863 struct lsa_LookupSids2
*r
)
866 struct lsa_info
*handle
;
867 int num_sids
= r
->in
.sids
->num_sids
;
868 uint32 mapped_count
= 0;
869 struct lsa_RefDomainList
*domains
= NULL
;
870 struct lsa_TranslatedName2
*names
= NULL
;
871 bool check_policy
= true;
873 switch (p
->hdr_req
.opnum
) {
874 case NDR_LSA_LOOKUPSIDS3
:
875 check_policy
= false;
877 case NDR_LSA_LOOKUPSIDS2
:
882 if ((r
->in
.level
< 1) || (r
->in
.level
> 6)) {
883 return NT_STATUS_INVALID_PARAMETER
;
887 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
888 return NT_STATUS_INVALID_HANDLE
;
891 /* check if the user have enough rights */
892 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
893 return NT_STATUS_ACCESS_DENIED
;
897 if (num_sids
> MAX_LOOKUP_SIDS
) {
898 DEBUG(5,("_lsa_LookupSids2: limit of %d exceeded, requested %d\n",
899 MAX_LOOKUP_SIDS
, num_sids
));
900 return NT_STATUS_NONE_MAPPED
;
903 status
= _lsa_lookup_sids_internal(p
,
912 *r
->out
.domains
= domains
;
913 r
->out
.names
->count
= num_sids
;
914 r
->out
.names
->names
= names
;
915 *r
->out
.count
= mapped_count
;
920 /***************************************************************************
922 ***************************************************************************/
924 NTSTATUS
_lsa_LookupSids3(pipes_struct
*p
,
925 struct lsa_LookupSids3
*r
)
927 struct lsa_LookupSids2 q
;
929 /* No policy handle on this call. Restrict to crypto connections. */
930 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
931 DEBUG(0,("_lsa_LookupSids3: client %s not using schannel for netlogon\n",
932 get_remote_machine_name() ));
933 return NT_STATUS_INVALID_PARAMETER
;
937 q
.in
.sids
= r
->in
.sids
;
938 q
.in
.level
= r
->in
.level
;
939 q
.in
.unknown1
= r
->in
.unknown1
;
940 q
.in
.unknown2
= r
->in
.unknown2
;
941 q
.in
.names
= r
->in
.names
;
942 q
.in
.count
= r
->in
.count
;
944 q
.out
.domains
= r
->out
.domains
;
945 q
.out
.names
= r
->out
.names
;
946 q
.out
.count
= r
->out
.count
;
948 return _lsa_LookupSids2(p
, &q
);
951 /***************************************************************************
952 ***************************************************************************/
954 static int lsa_lookup_level_to_flags(uint16 level
)
960 flags
= LOOKUP_NAME_ALL
;
963 flags
= LOOKUP_NAME_DOMAIN
|LOOKUP_NAME_REMOTE
|LOOKUP_NAME_ISOLATED
;
966 flags
= LOOKUP_NAME_DOMAIN
|LOOKUP_NAME_ISOLATED
;
972 flags
= LOOKUP_NAME_NONE
;
979 /***************************************************************************
981 ***************************************************************************/
983 NTSTATUS
_lsa_LookupNames(pipes_struct
*p
,
984 struct lsa_LookupNames
*r
)
986 NTSTATUS status
= NT_STATUS_NONE_MAPPED
;
987 struct lsa_info
*handle
;
988 struct lsa_String
*names
= r
->in
.names
;
989 uint32 num_entries
= r
->in
.num_names
;
990 struct lsa_RefDomainList
*domains
= NULL
;
991 struct lsa_TranslatedSid
*rids
= NULL
;
992 uint32 mapped_count
= 0;
995 if (num_entries
> MAX_LOOKUP_SIDS
) {
996 num_entries
= MAX_LOOKUP_SIDS
;
997 DEBUG(5,("_lsa_LookupNames: truncating name lookup list to %d\n",
1001 flags
= lsa_lookup_level_to_flags(r
->in
.level
);
1003 domains
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_RefDomainList
);
1005 return NT_STATUS_NO_MEMORY
;
1009 rids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_TranslatedSid
,
1012 return NT_STATUS_NO_MEMORY
;
1018 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
1019 status
= NT_STATUS_INVALID_HANDLE
;
1023 /* check if the user have enough rights */
1024 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
1025 status
= NT_STATUS_ACCESS_DENIED
;
1029 /* set up the LSA Lookup RIDs response */
1030 become_root(); /* lookup_name can require root privs */
1031 status
= lookup_lsa_rids(p
->mem_ctx
, domains
, rids
, num_entries
,
1032 names
, flags
, &mapped_count
);
1037 if (NT_STATUS_IS_OK(status
) && (num_entries
!= 0) ) {
1038 if (mapped_count
== 0) {
1039 status
= NT_STATUS_NONE_MAPPED
;
1040 } else if (mapped_count
!= num_entries
) {
1041 status
= STATUS_SOME_UNMAPPED
;
1045 *r
->out
.count
= mapped_count
;
1046 *r
->out
.domains
= domains
;
1047 r
->out
.sids
->sids
= rids
;
1048 r
->out
.sids
->count
= num_entries
;
1053 /***************************************************************************
1055 ***************************************************************************/
1057 NTSTATUS
_lsa_LookupNames2(pipes_struct
*p
,
1058 struct lsa_LookupNames2
*r
)
1061 struct lsa_LookupNames q
;
1062 struct lsa_TransSidArray2
*sid_array2
= r
->in
.sids
;
1063 struct lsa_TransSidArray
*sid_array
= NULL
;
1066 sid_array
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_TransSidArray
);
1068 return NT_STATUS_NO_MEMORY
;
1071 q
.in
.handle
= r
->in
.handle
;
1072 q
.in
.num_names
= r
->in
.num_names
;
1073 q
.in
.names
= r
->in
.names
;
1074 q
.in
.level
= r
->in
.level
;
1075 q
.in
.sids
= sid_array
;
1076 q
.in
.count
= r
->in
.count
;
1077 /* we do not know what this is for */
1078 /* = r->in.unknown1; */
1079 /* = r->in.unknown2; */
1081 q
.out
.domains
= r
->out
.domains
;
1082 q
.out
.sids
= sid_array
;
1083 q
.out
.count
= r
->out
.count
;
1085 status
= _lsa_LookupNames(p
, &q
);
1087 sid_array2
->sids
= TALLOC_ARRAY(p
->mem_ctx
, struct lsa_TranslatedSid2
, sid_array
->count
);
1088 if (!sid_array2
->sids
) {
1089 return NT_STATUS_NO_MEMORY
;
1092 for (i
=0; i
<sid_array
->count
; i
++) {
1093 sid_array2
->sids
[i
].sid_type
= sid_array
->sids
[i
].sid_type
;
1094 sid_array2
->sids
[i
].rid
= sid_array
->sids
[i
].rid
;
1095 sid_array2
->sids
[i
].sid_index
= sid_array
->sids
[i
].sid_index
;
1096 sid_array2
->sids
[i
].unknown
= 0;
1099 r
->out
.sids
= sid_array2
;
1104 /***************************************************************************
1106 ***************************************************************************/
1108 NTSTATUS
_lsa_LookupNames3(pipes_struct
*p
,
1109 struct lsa_LookupNames3
*r
)
1112 struct lsa_info
*handle
;
1113 struct lsa_String
*names
= r
->in
.names
;
1114 uint32 num_entries
= r
->in
.num_names
;
1115 struct lsa_RefDomainList
*domains
= NULL
;
1116 struct lsa_TranslatedSid3
*trans_sids
= NULL
;
1117 uint32 mapped_count
= 0;
1119 bool check_policy
= true;
1121 switch (p
->hdr_req
.opnum
) {
1122 case NDR_LSA_LOOKUPNAMES4
:
1123 check_policy
= false;
1125 case NDR_LSA_LOOKUPNAMES3
:
1127 check_policy
= true;
1130 if (num_entries
> MAX_LOOKUP_SIDS
) {
1131 num_entries
= MAX_LOOKUP_SIDS
;
1132 DEBUG(5,("_lsa_LookupNames3: truncating name lookup list to %d\n", num_entries
));
1135 /* Probably the lookup_level is some sort of bitmask. */
1136 if (r
->in
.level
== 1) {
1137 flags
= LOOKUP_NAME_ALL
;
1140 domains
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_RefDomainList
);
1142 return NT_STATUS_NO_MEMORY
;
1146 trans_sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_TranslatedSid3
,
1149 return NT_STATUS_NO_MEMORY
;
1157 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
)) {
1158 status
= NT_STATUS_INVALID_HANDLE
;
1162 /* check if the user have enough rights */
1163 if (!(handle
->access
& LSA_POLICY_LOOKUP_NAMES
)) {
1164 status
= NT_STATUS_ACCESS_DENIED
;
1169 /* set up the LSA Lookup SIDs response */
1170 become_root(); /* lookup_name can require root privs */
1171 status
= lookup_lsa_sids(p
->mem_ctx
, domains
, trans_sids
, num_entries
,
1172 names
, flags
, &mapped_count
);
1177 if (NT_STATUS_IS_OK(status
)) {
1178 if (mapped_count
== 0) {
1179 status
= NT_STATUS_NONE_MAPPED
;
1180 } else if (mapped_count
!= num_entries
) {
1181 status
= STATUS_SOME_UNMAPPED
;
1185 *r
->out
.count
= mapped_count
;
1186 *r
->out
.domains
= domains
;
1187 r
->out
.sids
->sids
= trans_sids
;
1188 r
->out
.sids
->count
= num_entries
;
1193 /***************************************************************************
1195 ***************************************************************************/
1197 NTSTATUS
_lsa_LookupNames4(pipes_struct
*p
,
1198 struct lsa_LookupNames4
*r
)
1200 struct lsa_LookupNames3 q
;
1202 /* No policy handle on this call. Restrict to crypto connections. */
1203 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SCHANNEL
) {
1204 DEBUG(0,("_lsa_lookup_names4: client %s not using schannel for netlogon\n",
1205 get_remote_machine_name() ));
1206 return NT_STATUS_INVALID_PARAMETER
;
1210 q
.in
.num_names
= r
->in
.num_names
;
1211 q
.in
.names
= r
->in
.names
;
1212 q
.in
.level
= r
->in
.level
;
1213 q
.in
.unknown1
= r
->in
.unknown1
;
1214 q
.in
.unknown2
= r
->in
.unknown2
;
1215 q
.in
.sids
= r
->in
.sids
;
1216 q
.in
.count
= r
->in
.count
;
1218 q
.out
.domains
= r
->out
.domains
;
1219 q
.out
.sids
= r
->out
.sids
;
1220 q
.out
.count
= r
->out
.count
;
1222 return _lsa_LookupNames3(p
, &q
);
1225 /***************************************************************************
1226 _lsa_close. Also weird - needs to check if lsa handle is correct. JRA.
1227 ***************************************************************************/
1229 NTSTATUS
_lsa_Close(pipes_struct
*p
, struct lsa_Close
*r
)
1231 if (!find_policy_by_hnd(p
, r
->in
.handle
, NULL
)) {
1232 return NT_STATUS_INVALID_HANDLE
;
1235 close_policy_hnd(p
, r
->in
.handle
);
1236 ZERO_STRUCTP(r
->out
.handle
);
1237 return NT_STATUS_OK
;
1240 /***************************************************************************
1241 ***************************************************************************/
1243 NTSTATUS
_lsa_OpenSecret(pipes_struct
*p
, struct lsa_OpenSecret
*r
)
1245 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1248 /***************************************************************************
1249 ***************************************************************************/
1251 NTSTATUS
_lsa_OpenTrustedDomain(pipes_struct
*p
, struct lsa_OpenTrustedDomain
*r
)
1253 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1256 /***************************************************************************
1257 ***************************************************************************/
1259 NTSTATUS
_lsa_CreateTrustedDomain(pipes_struct
*p
, struct lsa_CreateTrustedDomain
*r
)
1261 return NT_STATUS_ACCESS_DENIED
;
1264 /***************************************************************************
1265 ***************************************************************************/
1267 NTSTATUS
_lsa_CreateSecret(pipes_struct
*p
, struct lsa_CreateSecret
*r
)
1269 return NT_STATUS_ACCESS_DENIED
;
1272 /***************************************************************************
1273 ***************************************************************************/
1275 NTSTATUS
_lsa_SetSecret(pipes_struct
*p
, struct lsa_SetSecret
*r
)
1277 return NT_STATUS_ACCESS_DENIED
;
1280 /***************************************************************************
1282 ***************************************************************************/
1284 NTSTATUS
_lsa_DeleteObject(pipes_struct
*p
,
1285 struct lsa_DeleteObject
*r
)
1287 return NT_STATUS_ACCESS_DENIED
;
1290 /***************************************************************************
1292 ***************************************************************************/
1294 NTSTATUS
_lsa_EnumPrivs(pipes_struct
*p
,
1295 struct lsa_EnumPrivs
*r
)
1297 struct lsa_info
*handle
;
1299 uint32 enum_context
= *r
->in
.resume_handle
;
1300 int num_privs
= count_all_privileges();
1301 struct lsa_PrivEntry
*entries
= NULL
;
1304 /* remember that the enum_context starts at 0 and not 1 */
1306 if ( enum_context
>= num_privs
)
1307 return NT_STATUS_NO_MORE_ENTRIES
;
1309 DEBUG(10,("_lsa_EnumPrivs: enum_context:%d total entries:%d\n",
1310 enum_context
, num_privs
));
1312 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1313 return NT_STATUS_INVALID_HANDLE
;
1315 /* check if the user have enough rights
1316 I don't know if it's the right one. not documented. */
1318 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1319 return NT_STATUS_ACCESS_DENIED
;
1322 entries
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_PrivEntry
, num_privs
);
1324 return NT_STATUS_NO_MEMORY
;
1330 for (i
= 0; i
< num_privs
; i
++) {
1331 if( i
< enum_context
) {
1333 init_lsa_StringLarge(&entries
[i
].name
, NULL
);
1335 entries
[i
].luid
.low
= 0;
1336 entries
[i
].luid
.high
= 0;
1339 init_lsa_StringLarge(&entries
[i
].name
, privs
[i
].name
);
1341 luid
= get_privilege_luid( &privs
[i
].se_priv
);
1343 entries
[i
].luid
.low
= luid
.luid
.low
;
1344 entries
[i
].luid
.high
= luid
.luid
.high
;
1348 enum_context
= num_privs
;
1350 *r
->out
.resume_handle
= enum_context
;
1351 r
->out
.privs
->count
= num_privs
;
1352 r
->out
.privs
->privs
= entries
;
1354 return NT_STATUS_OK
;
1357 /***************************************************************************
1358 _lsa_LookupPrivDisplayName
1359 ***************************************************************************/
1361 NTSTATUS
_lsa_LookupPrivDisplayName(pipes_struct
*p
,
1362 struct lsa_LookupPrivDisplayName
*r
)
1364 struct lsa_info
*handle
;
1365 const char *description
;
1366 struct lsa_StringLarge
*lsa_name
;
1368 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1369 return NT_STATUS_INVALID_HANDLE
;
1371 /* check if the user have enough rights */
1374 * I don't know if it's the right one. not documented.
1376 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1377 return NT_STATUS_ACCESS_DENIED
;
1379 DEBUG(10,("_lsa_LookupPrivDisplayName: name = %s\n", r
->in
.name
->string
));
1381 description
= get_privilege_dispname(r
->in
.name
->string
);
1383 DEBUG(10,("_lsa_LookupPrivDisplayName: doesn't exist\n"));
1384 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1387 DEBUG(10,("_lsa_LookupPrivDisplayName: display name = %s\n", description
));
1389 lsa_name
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_StringLarge
);
1391 return NT_STATUS_NO_MEMORY
;
1394 init_lsa_StringLarge(lsa_name
, description
);
1396 *r
->out
.returned_language_id
= r
->in
.language_id
;
1397 *r
->out
.disp_name
= lsa_name
;
1399 return NT_STATUS_OK
;
1402 /***************************************************************************
1404 ***************************************************************************/
1406 NTSTATUS
_lsa_EnumAccounts(pipes_struct
*p
,
1407 struct lsa_EnumAccounts
*r
)
1409 struct lsa_info
*handle
;
1411 int i
, j
, num_entries
;
1413 struct lsa_SidPtr
*sids
= NULL
;
1415 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1416 return NT_STATUS_INVALID_HANDLE
;
1418 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1419 return NT_STATUS_ACCESS_DENIED
;
1424 /* The only way we can currently find out all the SIDs that have been
1425 privileged is to scan all privileges */
1427 status
= privilege_enumerate_accounts(&sid_list
, &num_entries
);
1428 if (!NT_STATUS_IS_OK(status
)) {
1432 if (*r
->in
.resume_handle
>= num_entries
) {
1433 return NT_STATUS_NO_MORE_ENTRIES
;
1436 if (num_entries
- *r
->in
.resume_handle
) {
1437 sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_SidPtr
,
1438 num_entries
- *r
->in
.resume_handle
);
1440 SAFE_FREE(sid_list
);
1441 return NT_STATUS_NO_MEMORY
;
1444 for (i
= *r
->in
.resume_handle
, j
= 0; i
< num_entries
; i
++, j
++) {
1445 sids
[j
].sid
= sid_dup_talloc(p
->mem_ctx
, &sid_list
[i
]);
1447 SAFE_FREE(sid_list
);
1448 return NT_STATUS_NO_MEMORY
;
1453 talloc_free(sid_list
);
1455 *r
->out
.resume_handle
= num_entries
;
1456 r
->out
.sids
->num_sids
= num_entries
;
1457 r
->out
.sids
->sids
= sids
;
1459 return NT_STATUS_OK
;
1462 /***************************************************************************
1464 ***************************************************************************/
1466 NTSTATUS
_lsa_GetUserName(pipes_struct
*p
,
1467 struct lsa_GetUserName
*r
)
1469 const char *username
, *domname
;
1470 user_struct
*vuser
= get_valid_user_struct(p
->vuid
);
1471 struct lsa_String
*account_name
= NULL
;
1472 struct lsa_String
*authority_name
= NULL
;
1475 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1479 * I'm 99% sure this is not the right place to do this,
1480 * global_sid_Anonymous should probably be put into the token
1481 * instead of the guest id -- vl
1483 if (!lookup_sid(p
->mem_ctx
, &global_sid_Anonymous
,
1484 &domname
, &username
, NULL
)) {
1485 return NT_STATUS_NO_MEMORY
;
1488 username
= vuser
->user
.smb_name
;
1489 domname
= vuser
->user
.domain
;
1492 account_name
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_String
);
1493 if (!account_name
) {
1494 return NT_STATUS_NO_MEMORY
;
1497 authority_name
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_String
);
1498 if (!authority_name
) {
1499 return NT_STATUS_NO_MEMORY
;
1502 init_lsa_String(account_name
, username
);
1503 init_lsa_String(authority_name
, domname
);
1505 *r
->out
.account_name
= account_name
;
1506 *r
->out
.authority_name
= authority_name
;
1508 return NT_STATUS_OK
;
1511 /***************************************************************************
1513 ***************************************************************************/
1515 NTSTATUS
_lsa_CreateAccount(pipes_struct
*p
,
1516 struct lsa_CreateAccount
*r
)
1518 struct lsa_info
*handle
;
1519 struct lsa_info
*info
;
1521 /* find the connection policy handle. */
1522 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1523 return NT_STATUS_INVALID_HANDLE
;
1525 /* check if the user have enough rights */
1528 * I don't know if it's the right one. not documented.
1529 * but guessed with rpcclient.
1531 if (!(handle
->access
& LSA_POLICY_GET_PRIVATE_INFORMATION
))
1532 return NT_STATUS_ACCESS_DENIED
;
1534 /* check to see if the pipe_user is a Domain Admin since
1535 account_pol.tdb was already opened as root, this is all we have */
1537 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1538 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1539 return NT_STATUS_ACCESS_DENIED
;
1541 if ( is_privileged_sid( r
->in
.sid
) )
1542 return NT_STATUS_OBJECT_NAME_COLLISION
;
1544 /* associate the user/group SID with the (unique) handle. */
1546 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1547 return NT_STATUS_NO_MEMORY
;
1550 info
->sid
= *r
->in
.sid
;
1551 info
->access
= r
->in
.access_mask
;
1553 /* get a (unique) handle. open a policy on it. */
1554 if (!create_policy_hnd(p
, r
->out
.acct_handle
, free_lsa_info
, (void *)info
))
1555 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1557 return privilege_create_account( &info
->sid
);
1561 /***************************************************************************
1563 ***************************************************************************/
1565 NTSTATUS
_lsa_OpenAccount(pipes_struct
*p
,
1566 struct lsa_OpenAccount
*r
)
1568 struct lsa_info
*handle
;
1569 struct lsa_info
*info
;
1571 /* find the connection policy handle. */
1572 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1573 return NT_STATUS_INVALID_HANDLE
;
1575 /* check if the user have enough rights */
1578 * I don't know if it's the right one. not documented.
1579 * but guessed with rpcclient.
1581 if (!(handle
->access
& LSA_POLICY_GET_PRIVATE_INFORMATION
))
1582 return NT_STATUS_ACCESS_DENIED
;
1584 /* TODO: Fis the parsing routine before reenabling this check! */
1586 if (!lookup_sid(&handle
->sid
, dom_name
, name
, &type
))
1587 return NT_STATUS_ACCESS_DENIED
;
1589 /* associate the user/group SID with the (unique) handle. */
1590 if ((info
= SMB_MALLOC_P(struct lsa_info
)) == NULL
)
1591 return NT_STATUS_NO_MEMORY
;
1594 info
->sid
= *r
->in
.sid
;
1595 info
->access
= r
->in
.access_mask
;
1597 /* get a (unique) handle. open a policy on it. */
1598 if (!create_policy_hnd(p
, r
->out
.acct_handle
, free_lsa_info
, (void *)info
))
1599 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1601 return NT_STATUS_OK
;
1604 /***************************************************************************
1605 _lsa_EnumPrivsAccount
1606 For a given SID, enumerate all the privilege this account has.
1607 ***************************************************************************/
1609 NTSTATUS
_lsa_EnumPrivsAccount(pipes_struct
*p
,
1610 struct lsa_EnumPrivsAccount
*r
)
1612 NTSTATUS status
= NT_STATUS_OK
;
1613 struct lsa_info
*info
=NULL
;
1615 PRIVILEGE_SET privileges
;
1616 struct lsa_PrivilegeSet
*priv_set
= NULL
;
1617 struct lsa_LUIDAttribute
*luid_attrs
= NULL
;
1620 /* find the connection policy handle. */
1621 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1622 return NT_STATUS_INVALID_HANDLE
;
1624 if (!(info
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1625 return NT_STATUS_ACCESS_DENIED
;
1627 if ( !get_privileges_for_sids( &mask
, &info
->sid
, 1 ) )
1628 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1630 privilege_set_init( &privileges
);
1632 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
1634 DEBUG(10,("_lsa_EnumPrivsAccount: %s has %d privileges\n",
1635 sid_string_dbg(&info
->sid
),
1638 priv_set
= TALLOC_ZERO_P(p
->mem_ctx
, struct lsa_PrivilegeSet
);
1640 status
= NT_STATUS_NO_MEMORY
;
1644 luid_attrs
= TALLOC_ZERO_ARRAY(p
->mem_ctx
,
1645 struct lsa_LUIDAttribute
,
1648 status
= NT_STATUS_NO_MEMORY
;
1652 for (i
=0; i
<privileges
.count
; i
++) {
1653 luid_attrs
[i
].luid
.low
= privileges
.set
[i
].luid
.low
;
1654 luid_attrs
[i
].luid
.high
= privileges
.set
[i
].luid
.high
;
1655 luid_attrs
[i
].attribute
= privileges
.set
[i
].attr
;
1658 priv_set
->count
= privileges
.count
;
1659 priv_set
->unknown
= 0;
1660 priv_set
->set
= luid_attrs
;
1662 *r
->out
.privs
= priv_set
;
1664 status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
1668 privilege_set_free( &privileges
);
1673 /***************************************************************************
1674 _lsa_GetSystemAccessAccount
1675 ***************************************************************************/
1677 NTSTATUS
_lsa_GetSystemAccessAccount(pipes_struct
*p
,
1678 struct lsa_GetSystemAccessAccount
*r
)
1680 struct lsa_info
*info
=NULL
;
1682 /* find the connection policy handle. */
1684 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1685 return NT_STATUS_INVALID_HANDLE
;
1687 if (!(info
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1688 return NT_STATUS_ACCESS_DENIED
;
1690 if (!lookup_sid(p
->mem_ctx
, &info
->sid
, NULL
, NULL
, NULL
))
1691 return NT_STATUS_ACCESS_DENIED
;
1694 0x01 -> Log on locally
1695 0x02 -> Access this computer from network
1696 0x04 -> Log on as a batch job
1697 0x10 -> Log on as a service
1699 they can be ORed together
1702 *r
->out
.access_mask
= PR_LOG_ON_LOCALLY
| PR_ACCESS_FROM_NETWORK
;
1704 return NT_STATUS_OK
;
1707 /***************************************************************************
1708 update the systemaccount information
1709 ***************************************************************************/
1711 NTSTATUS
_lsa_SetSystemAccessAccount(pipes_struct
*p
,
1712 struct lsa_SetSystemAccessAccount
*r
)
1714 struct lsa_info
*info
=NULL
;
1717 /* find the connection policy handle. */
1718 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1719 return NT_STATUS_INVALID_HANDLE
;
1721 /* check to see if the pipe_user is a Domain Admin since
1722 account_pol.tdb was already opened as root, this is all we have */
1724 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1725 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1726 return NT_STATUS_ACCESS_DENIED
;
1728 if (!pdb_getgrsid(&map
, info
->sid
))
1729 return NT_STATUS_NO_SUCH_GROUP
;
1731 return pdb_update_group_mapping_entry(&map
);
1734 /***************************************************************************
1735 _lsa_AddPrivilegesToAccount
1736 For a given SID, add some privileges.
1737 ***************************************************************************/
1739 NTSTATUS
_lsa_AddPrivilegesToAccount(pipes_struct
*p
,
1740 struct lsa_AddPrivilegesToAccount
*r
)
1742 struct lsa_info
*info
= NULL
;
1744 struct lsa_PrivilegeSet
*set
= NULL
;
1746 /* find the connection policy handle. */
1747 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1748 return NT_STATUS_INVALID_HANDLE
;
1750 /* check to see if the pipe_user is root or a Domain Admin since
1751 account_pol.tdb was already opened as root, this is all we have */
1753 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1754 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1756 return NT_STATUS_ACCESS_DENIED
;
1760 if ( !privilege_set_to_se_priv( &mask
, set
) )
1761 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1763 if ( !grant_privilege( &info
->sid
, &mask
) ) {
1764 DEBUG(3,("_lsa_AddPrivilegesToAccount: grant_privilege(%s) failed!\n",
1765 sid_string_dbg(&info
->sid
) ));
1766 DEBUG(3,("Privilege mask:\n"));
1767 dump_se_priv( DBGC_ALL
, 3, &mask
);
1768 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1771 return NT_STATUS_OK
;
1774 /***************************************************************************
1775 _lsa_RemovePrivilegesFromAccount
1776 For a given SID, remove some privileges.
1777 ***************************************************************************/
1779 NTSTATUS
_lsa_RemovePrivilegesFromAccount(pipes_struct
*p
,
1780 struct lsa_RemovePrivilegesFromAccount
*r
)
1782 struct lsa_info
*info
= NULL
;
1784 struct lsa_PrivilegeSet
*set
= NULL
;
1786 /* find the connection policy handle. */
1787 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1788 return NT_STATUS_INVALID_HANDLE
;
1790 /* check to see if the pipe_user is root or a Domain Admin since
1791 account_pol.tdb was already opened as root, this is all we have */
1793 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1794 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1796 return NT_STATUS_ACCESS_DENIED
;
1801 if ( !privilege_set_to_se_priv( &mask
, set
) )
1802 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1804 if ( !revoke_privilege( &info
->sid
, &mask
) ) {
1805 DEBUG(3,("_lsa_RemovePrivilegesFromAccount: revoke_privilege(%s) failed!\n",
1806 sid_string_dbg(&info
->sid
) ));
1807 DEBUG(3,("Privilege mask:\n"));
1808 dump_se_priv( DBGC_ALL
, 3, &mask
);
1809 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1812 return NT_STATUS_OK
;
1815 /***************************************************************************
1817 ***************************************************************************/
1819 NTSTATUS
_lsa_QuerySecurity(pipes_struct
*p
,
1820 struct lsa_QuerySecurity
*r
)
1822 struct lsa_info
*handle
=NULL
;
1823 SEC_DESC
*psd
= NULL
;
1827 /* find the connection policy handle. */
1828 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&handle
))
1829 return NT_STATUS_INVALID_HANDLE
;
1831 /* check if the user have enough rights */
1832 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1833 return NT_STATUS_ACCESS_DENIED
;
1835 switch (r
->in
.sec_info
) {
1837 /* SD contains only the owner */
1839 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1840 if(!NT_STATUS_IS_OK(status
))
1841 return NT_STATUS_NO_MEMORY
;
1844 if((*r
->out
.sdbuf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1845 return NT_STATUS_NO_MEMORY
;
1848 /* SD contains only the ACL */
1850 status
=lsa_get_generic_sd(p
->mem_ctx
, &psd
, &sd_size
);
1851 if(!NT_STATUS_IS_OK(status
))
1852 return NT_STATUS_NO_MEMORY
;
1854 if((*r
->out
.sdbuf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
1855 return NT_STATUS_NO_MEMORY
;
1858 return NT_STATUS_INVALID_LEVEL
;
1864 #if 0 /* AD DC work in ongoing in Samba 4 */
1866 /***************************************************************************
1867 ***************************************************************************/
1869 NTSTATUS
_lsa_query_info2(pipes_struct
*p
, LSA_Q_QUERY_INFO2
*q_u
, LSA_R_QUERY_INFO2
*r_u
)
1871 struct lsa_info
*handle
;
1872 const char *nb_name
;
1873 char *dns_name
= NULL
;
1874 char *forest_name
= NULL
;
1875 DOM_SID
*sid
= NULL
;
1880 r_u
->status
= NT_STATUS_OK
;
1882 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&handle
))
1883 return NT_STATUS_INVALID_HANDLE
;
1885 switch (q_u
->info_class
) {
1887 /* check if the user have enough rights */
1888 if (!(handle
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
1889 return NT_STATUS_ACCESS_DENIED
;
1891 /* Request PolicyPrimaryDomainInformation. */
1892 switch (lp_server_role()) {
1893 case ROLE_DOMAIN_PDC
:
1894 case ROLE_DOMAIN_BDC
:
1895 nb_name
= get_global_sam_name();
1896 /* ugly temp hack for these next two */
1898 /* This should be a 'netbios domain -> DNS domain' mapping */
1899 dnsdomname
= get_mydnsdomname(p
->mem_ctx
);
1900 if (!dnsdomname
|| !*dnsdomname
) {
1901 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1903 strlower_m(dnsdomname
);
1905 dns_name
= dnsdomname
;
1906 forest_name
= dnsdomname
;
1908 sid
= get_global_sam_sid();
1909 secrets_fetch_domain_guid(lp_workgroup(), &guid
);
1912 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
1914 init_dns_dom_info(&r_u
->info
.dns_dom_info
, nb_name
, dns_name
,
1915 forest_name
,&guid
,sid
);
1918 DEBUG(0,("_lsa_query_info2: unknown info level in Lsa Query: %d\n", q_u
->info_class
));
1919 r_u
->status
= NT_STATUS_INVALID_INFO_CLASS
;
1923 if (NT_STATUS_IS_OK(r_u
->status
)) {
1925 r_u
->info_class
= q_u
->info_class
;
1930 #endif /* AD DC work in ongoing in Samba 4 */
1932 /***************************************************************************
1933 _lsa_AddAccountRights
1934 ***************************************************************************/
1936 NTSTATUS
_lsa_AddAccountRights(pipes_struct
*p
,
1937 struct lsa_AddAccountRights
*r
)
1939 struct lsa_info
*info
= NULL
;
1943 /* find the connection policy handle. */
1944 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1945 return NT_STATUS_INVALID_HANDLE
;
1947 /* check to see if the pipe_user is a Domain Admin since
1948 account_pol.tdb was already opened as root, this is all we have */
1950 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
1951 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
1953 return NT_STATUS_ACCESS_DENIED
;
1956 /* according to an NT4 PDC, you can add privileges to SIDs even without
1957 call_lsa_create_account() first. And you can use any arbitrary SID. */
1959 sid_copy( &sid
, r
->in
.sid
);
1961 for ( i
=0; i
< r
->in
.rights
->count
; i
++ ) {
1963 const char *privname
= r
->in
.rights
->names
[i
].string
;
1965 /* only try to add non-null strings */
1970 if ( !grant_privilege_by_name( &sid
, privname
) ) {
1971 DEBUG(2,("_lsa_AddAccountRights: Failed to add privilege [%s]\n",
1973 return NT_STATUS_NO_SUCH_PRIVILEGE
;
1977 return NT_STATUS_OK
;
1980 /***************************************************************************
1981 _lsa_RemoveAccountRights
1982 ***************************************************************************/
1984 NTSTATUS
_lsa_RemoveAccountRights(pipes_struct
*p
,
1985 struct lsa_RemoveAccountRights
*r
)
1987 struct lsa_info
*info
= NULL
;
1990 const char *privname
= NULL
;
1992 /* find the connection policy handle. */
1993 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
1994 return NT_STATUS_INVALID_HANDLE
;
1996 /* check to see if the pipe_user is a Domain Admin since
1997 account_pol.tdb was already opened as root, this is all we have */
1999 if ( p
->pipe_user
.ut
.uid
!= sec_initial_uid()
2000 && !nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
) )
2002 return NT_STATUS_ACCESS_DENIED
;
2005 sid_copy( &sid
, r
->in
.sid
);
2007 if ( r
->in
.remove_all
) {
2008 if ( !revoke_all_privileges( &sid
) )
2009 return NT_STATUS_ACCESS_DENIED
;
2011 return NT_STATUS_OK
;
2014 for ( i
=0; i
< r
->in
.rights
->count
; i
++ ) {
2016 privname
= r
->in
.rights
->names
[i
].string
;
2018 /* only try to add non-null strings */
2023 if ( !revoke_privilege_by_name( &sid
, privname
) ) {
2024 DEBUG(2,("_lsa_RemoveAccountRights: Failed to revoke privilege [%s]\n",
2026 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2030 return NT_STATUS_OK
;
2033 /*******************************************************************
2034 ********************************************************************/
2036 static NTSTATUS
init_lsa_right_set(TALLOC_CTX
*mem_ctx
,
2037 struct lsa_RightSet
*r
,
2038 PRIVILEGE_SET
*privileges
)
2041 const char *privname
;
2042 const char **privname_array
= NULL
;
2045 for (i
=0; i
<privileges
->count
; i
++) {
2047 privname
= luid_to_privilege_name(&privileges
->set
[i
].luid
);
2049 if (!add_string_to_array(mem_ctx
, privname
,
2050 &privname_array
, &num_priv
)) {
2051 return NT_STATUS_NO_MEMORY
;
2058 r
->names
= TALLOC_ZERO_ARRAY(mem_ctx
, struct lsa_StringLarge
,
2061 return NT_STATUS_NO_MEMORY
;
2064 for (i
=0; i
<num_priv
; i
++) {
2065 init_lsa_StringLarge(&r
->names
[i
], privname_array
[i
]);
2068 r
->count
= num_priv
;
2071 return NT_STATUS_OK
;
2074 /***************************************************************************
2075 _lsa_EnumAccountRights
2076 ***************************************************************************/
2078 NTSTATUS
_lsa_EnumAccountRights(pipes_struct
*p
,
2079 struct lsa_EnumAccountRights
*r
)
2082 struct lsa_info
*info
= NULL
;
2084 PRIVILEGE_SET privileges
;
2087 /* find the connection policy handle. */
2089 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
2090 return NT_STATUS_INVALID_HANDLE
;
2092 if (!(info
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
2093 return NT_STATUS_ACCESS_DENIED
;
2095 /* according to an NT4 PDC, you can add privileges to SIDs even without
2096 call_lsa_create_account() first. And you can use any arbitrary SID. */
2098 sid_copy( &sid
, r
->in
.sid
);
2100 if ( !get_privileges_for_sids( &mask
, &sid
, 1 ) )
2101 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2103 privilege_set_init( &privileges
);
2105 if ( se_priv_to_privilege_set( &privileges
, &mask
) ) {
2107 DEBUG(10,("_lsa_EnumAccountRights: %s has %d privileges\n",
2108 sid_string_dbg(&sid
), privileges
.count
));
2110 status
= init_lsa_right_set(p
->mem_ctx
, r
->out
.rights
, &privileges
);
2112 status
= NT_STATUS_NO_SUCH_PRIVILEGE
;
2115 privilege_set_free( &privileges
);
2120 /***************************************************************************
2121 _lsa_LookupPrivValue
2122 ***************************************************************************/
2124 NTSTATUS
_lsa_LookupPrivValue(pipes_struct
*p
,
2125 struct lsa_LookupPrivValue
*r
)
2127 struct lsa_info
*info
= NULL
;
2128 const char *name
= NULL
;
2129 LUID_ATTR priv_luid
;
2132 /* find the connection policy handle. */
2134 if (!find_policy_by_hnd(p
, r
->in
.handle
, (void **)(void *)&info
))
2135 return NT_STATUS_INVALID_HANDLE
;
2137 if (!(info
->access
& LSA_POLICY_VIEW_LOCAL_INFORMATION
))
2138 return NT_STATUS_ACCESS_DENIED
;
2140 name
= r
->in
.name
->string
;
2142 DEBUG(10,("_lsa_lookup_priv_value: name = %s\n", name
));
2144 if ( !se_priv_from_name( name
, &mask
) )
2145 return NT_STATUS_NO_SUCH_PRIVILEGE
;
2147 priv_luid
= get_privilege_luid( &mask
);
2149 r
->out
.luid
->low
= priv_luid
.luid
.low
;
2150 r
->out
.luid
->high
= priv_luid
.luid
.high
;
2152 return NT_STATUS_OK
;
2156 * From here on the server routines are just dummy ones to make smbd link with
2157 * librpc/gen_ndr/srv_lsa.c. These routines are actually never called, we are
2158 * pulling the server stubs across one by one.
2161 NTSTATUS
_lsa_Delete(pipes_struct
*p
, struct lsa_Delete
*r
)
2163 p
->rng_fault_state
= True
;
2164 return NT_STATUS_NOT_IMPLEMENTED
;
2167 NTSTATUS
_lsa_SetSecObj(pipes_struct
*p
, struct lsa_SetSecObj
*r
)
2169 p
->rng_fault_state
= True
;
2170 return NT_STATUS_NOT_IMPLEMENTED
;
2173 NTSTATUS
_lsa_ChangePassword(pipes_struct
*p
, struct lsa_ChangePassword
*r
)
2175 p
->rng_fault_state
= True
;
2176 return NT_STATUS_NOT_IMPLEMENTED
;
2179 NTSTATUS
_lsa_SetInfoPolicy(pipes_struct
*p
, struct lsa_SetInfoPolicy
*r
)
2181 p
->rng_fault_state
= True
;
2182 return NT_STATUS_NOT_IMPLEMENTED
;
2185 NTSTATUS
_lsa_ClearAuditLog(pipes_struct
*p
, struct lsa_ClearAuditLog
*r
)
2187 p
->rng_fault_state
= True
;
2188 return NT_STATUS_NOT_IMPLEMENTED
;
2191 NTSTATUS
_lsa_GetQuotasForAccount(pipes_struct
*p
, struct lsa_GetQuotasForAccount
*r
)
2193 p
->rng_fault_state
= True
;
2194 return NT_STATUS_NOT_IMPLEMENTED
;
2197 NTSTATUS
_lsa_SetQuotasForAccount(pipes_struct
*p
, struct lsa_SetQuotasForAccount
*r
)
2199 p
->rng_fault_state
= True
;
2200 return NT_STATUS_NOT_IMPLEMENTED
;
2203 NTSTATUS
_lsa_QueryTrustedDomainInfo(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfo
*r
)
2205 p
->rng_fault_state
= True
;
2206 return NT_STATUS_NOT_IMPLEMENTED
;
2209 NTSTATUS
_lsa_SetInformationTrustedDomain(pipes_struct
*p
, struct lsa_SetInformationTrustedDomain
*r
)
2211 p
->rng_fault_state
= True
;
2212 return NT_STATUS_NOT_IMPLEMENTED
;
2215 NTSTATUS
_lsa_QuerySecret(pipes_struct
*p
, struct lsa_QuerySecret
*r
)
2217 p
->rng_fault_state
= True
;
2218 return NT_STATUS_NOT_IMPLEMENTED
;
2221 NTSTATUS
_lsa_LookupPrivName(pipes_struct
*p
, struct lsa_LookupPrivName
*r
)
2223 p
->rng_fault_state
= True
;
2224 return NT_STATUS_NOT_IMPLEMENTED
;
2227 NTSTATUS
_lsa_EnumAccountsWithUserRight(pipes_struct
*p
, struct lsa_EnumAccountsWithUserRight
*r
)
2229 p
->rng_fault_state
= True
;
2230 return NT_STATUS_NOT_IMPLEMENTED
;
2233 NTSTATUS
_lsa_QueryTrustedDomainInfoBySid(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfoBySid
*r
)
2235 p
->rng_fault_state
= True
;
2236 return NT_STATUS_NOT_IMPLEMENTED
;
2239 NTSTATUS
_lsa_SetTrustedDomainInfo(pipes_struct
*p
, struct lsa_SetTrustedDomainInfo
*r
)
2241 p
->rng_fault_state
= True
;
2242 return NT_STATUS_NOT_IMPLEMENTED
;
2245 NTSTATUS
_lsa_DeleteTrustedDomain(pipes_struct
*p
, struct lsa_DeleteTrustedDomain
*r
)
2247 p
->rng_fault_state
= True
;
2248 return NT_STATUS_NOT_IMPLEMENTED
;
2251 NTSTATUS
_lsa_StorePrivateData(pipes_struct
*p
, struct lsa_StorePrivateData
*r
)
2253 p
->rng_fault_state
= True
;
2254 return NT_STATUS_NOT_IMPLEMENTED
;
2257 NTSTATUS
_lsa_RetrievePrivateData(pipes_struct
*p
, struct lsa_RetrievePrivateData
*r
)
2259 p
->rng_fault_state
= True
;
2260 return NT_STATUS_NOT_IMPLEMENTED
;
2263 NTSTATUS
_lsa_QueryInfoPolicy2(pipes_struct
*p
, struct lsa_QueryInfoPolicy2
*r
)
2265 p
->rng_fault_state
= True
;
2266 return NT_STATUS_NOT_IMPLEMENTED
;
2269 NTSTATUS
_lsa_SetInfoPolicy2(pipes_struct
*p
, struct lsa_SetInfoPolicy2
*r
)
2271 p
->rng_fault_state
= True
;
2272 return NT_STATUS_NOT_IMPLEMENTED
;
2275 NTSTATUS
_lsa_QueryTrustedDomainInfoByName(pipes_struct
*p
, struct lsa_QueryTrustedDomainInfoByName
*r
)
2277 p
->rng_fault_state
= True
;
2278 return NT_STATUS_NOT_IMPLEMENTED
;
2281 NTSTATUS
_lsa_SetTrustedDomainInfoByName(pipes_struct
*p
, struct lsa_SetTrustedDomainInfoByName
*r
)
2283 p
->rng_fault_state
= True
;
2284 return NT_STATUS_NOT_IMPLEMENTED
;
2287 NTSTATUS
_lsa_EnumTrustedDomainsEx(pipes_struct
*p
, struct lsa_EnumTrustedDomainsEx
*r
)
2289 p
->rng_fault_state
= True
;
2290 return NT_STATUS_NOT_IMPLEMENTED
;
2293 NTSTATUS
_lsa_CreateTrustedDomainEx(pipes_struct
*p
, struct lsa_CreateTrustedDomainEx
*r
)
2295 p
->rng_fault_state
= True
;
2296 return NT_STATUS_NOT_IMPLEMENTED
;
2299 NTSTATUS
_lsa_CloseTrustedDomainEx(pipes_struct
*p
, struct lsa_CloseTrustedDomainEx
*r
)
2301 p
->rng_fault_state
= True
;
2302 return NT_STATUS_NOT_IMPLEMENTED
;
2305 NTSTATUS
_lsa_QueryDomainInformationPolicy(pipes_struct
*p
, struct lsa_QueryDomainInformationPolicy
*r
)
2307 p
->rng_fault_state
= True
;
2308 return NT_STATUS_NOT_IMPLEMENTED
;
2311 NTSTATUS
_lsa_SetDomainInformationPolicy(pipes_struct
*p
, struct lsa_SetDomainInformationPolicy
*r
)
2313 p
->rng_fault_state
= True
;
2314 return NT_STATUS_NOT_IMPLEMENTED
;
2317 NTSTATUS
_lsa_OpenTrustedDomainByName(pipes_struct
*p
, struct lsa_OpenTrustedDomainByName
*r
)
2319 p
->rng_fault_state
= True
;
2320 return NT_STATUS_NOT_IMPLEMENTED
;
2323 NTSTATUS
_lsa_TestCall(pipes_struct
*p
, struct lsa_TestCall
*r
)
2325 p
->rng_fault_state
= True
;
2326 return NT_STATUS_NOT_IMPLEMENTED
;
2329 NTSTATUS
_lsa_CreateTrustedDomainEx2(pipes_struct
*p
, struct lsa_CreateTrustedDomainEx2
*r
)
2331 p
->rng_fault_state
= True
;
2332 return NT_STATUS_NOT_IMPLEMENTED
;
2335 NTSTATUS
_lsa_CREDRWRITE(pipes_struct
*p
, struct lsa_CREDRWRITE
*r
)
2337 p
->rng_fault_state
= True
;
2338 return NT_STATUS_NOT_IMPLEMENTED
;
2341 NTSTATUS
_lsa_CREDRREAD(pipes_struct
*p
, struct lsa_CREDRREAD
*r
)
2343 p
->rng_fault_state
= True
;
2344 return NT_STATUS_NOT_IMPLEMENTED
;
2347 NTSTATUS
_lsa_CREDRENUMERATE(pipes_struct
*p
, struct lsa_CREDRENUMERATE
*r
)
2349 p
->rng_fault_state
= True
;
2350 return NT_STATUS_NOT_IMPLEMENTED
;
2353 NTSTATUS
_lsa_CREDRWRITEDOMAINCREDENTIALS(pipes_struct
*p
, struct lsa_CREDRWRITEDOMAINCREDENTIALS
*r
)
2355 p
->rng_fault_state
= True
;
2356 return NT_STATUS_NOT_IMPLEMENTED
;
2359 NTSTATUS
_lsa_CREDRREADDOMAINCREDENTIALS(pipes_struct
*p
, struct lsa_CREDRREADDOMAINCREDENTIALS
*r
)
2361 p
->rng_fault_state
= True
;
2362 return NT_STATUS_NOT_IMPLEMENTED
;
2365 NTSTATUS
_lsa_CREDRDELETE(pipes_struct
*p
, struct lsa_CREDRDELETE
*r
)
2367 p
->rng_fault_state
= True
;
2368 return NT_STATUS_NOT_IMPLEMENTED
;
2371 NTSTATUS
_lsa_CREDRGETTARGETINFO(pipes_struct
*p
, struct lsa_CREDRGETTARGETINFO
*r
)
2373 p
->rng_fault_state
= True
;
2374 return NT_STATUS_NOT_IMPLEMENTED
;
2377 NTSTATUS
_lsa_CREDRPROFILELOADED(pipes_struct
*p
, struct lsa_CREDRPROFILELOADED
*r
)
2379 p
->rng_fault_state
= True
;
2380 return NT_STATUS_NOT_IMPLEMENTED
;
2383 NTSTATUS
_lsa_CREDRGETSESSIONTYPES(pipes_struct
*p
, struct lsa_CREDRGETSESSIONTYPES
*r
)
2385 p
->rng_fault_state
= True
;
2386 return NT_STATUS_NOT_IMPLEMENTED
;
2389 NTSTATUS
_lsa_LSARREGISTERAUDITEVENT(pipes_struct
*p
, struct lsa_LSARREGISTERAUDITEVENT
*r
)
2391 p
->rng_fault_state
= True
;
2392 return NT_STATUS_NOT_IMPLEMENTED
;
2395 NTSTATUS
_lsa_LSARGENAUDITEVENT(pipes_struct
*p
, struct lsa_LSARGENAUDITEVENT
*r
)
2397 p
->rng_fault_state
= True
;
2398 return NT_STATUS_NOT_IMPLEMENTED
;
2401 NTSTATUS
_lsa_LSARUNREGISTERAUDITEVENT(pipes_struct
*p
, struct lsa_LSARUNREGISTERAUDITEVENT
*r
)
2403 p
->rng_fault_state
= True
;
2404 return NT_STATUS_NOT_IMPLEMENTED
;
2407 NTSTATUS
_lsa_lsaRQueryForestTrustInformation(pipes_struct
*p
, struct lsa_lsaRQueryForestTrustInformation
*r
)
2409 p
->rng_fault_state
= True
;
2410 return NT_STATUS_NOT_IMPLEMENTED
;
2413 NTSTATUS
_lsa_LSARSETFORESTTRUSTINFORMATION(pipes_struct
*p
, struct lsa_LSARSETFORESTTRUSTINFORMATION
*r
)
2415 p
->rng_fault_state
= True
;
2416 return NT_STATUS_NOT_IMPLEMENTED
;
2419 NTSTATUS
_lsa_CREDRRENAME(pipes_struct
*p
, struct lsa_CREDRRENAME
*r
)
2421 p
->rng_fault_state
= True
;
2422 return NT_STATUS_NOT_IMPLEMENTED
;
2425 NTSTATUS
_lsa_LSAROPENPOLICYSCE(pipes_struct
*p
, struct lsa_LSAROPENPOLICYSCE
*r
)
2427 p
->rng_fault_state
= True
;
2428 return NT_STATUS_NOT_IMPLEMENTED
;
2431 NTSTATUS
_lsa_LSARADTREGISTERSECURITYEVENTSOURCE(pipes_struct
*p
, struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE
*r
)
2433 p
->rng_fault_state
= True
;
2434 return NT_STATUS_NOT_IMPLEMENTED
;
2437 NTSTATUS
_lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE(pipes_struct
*p
, struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE
*r
)
2439 p
->rng_fault_state
= True
;
2440 return NT_STATUS_NOT_IMPLEMENTED
;
2443 NTSTATUS
_lsa_LSARADTREPORTSECURITYEVENT(pipes_struct
*p
, struct lsa_LSARADTREPORTSECURITYEVENT
*r
)
2445 p
->rng_fault_state
= True
;
2446 return NT_STATUS_NOT_IMPLEMENTED
;