?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix bug #5986 - Editing a stream is broken (rename problems).
[Samba.git] / source / rpc_server / srv_samr_nt.c
blobe2cf8cdee031054fc1566108c56dba35d765911c
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Marc Jacobsen 1999,
8 * Copyright (C) Jeremy Allison 2001-2008,
9 * Copyright (C) Jean François Micouleau 1998-2001,
10 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
11 * Copyright (C) Gerald (Jerry) Carter 2003-2004,
12 * Copyright (C) Simo Sorce 2003.
13 * Copyright (C) Volker Lendecke 2005.
14 * Copyright (C) Guenther Deschner 2008.
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 3 of the License, or
19 * (at your option) any later version.
20 *
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
25 *
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
28 */
29
30 /*
31 * This is the implementation of the SAMR code.
32 */
33
34 #include "includes.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_RPC_SRV
38
39 #define SAMR_USR_RIGHTS_WRITE_PW \
40 ( READ_CONTROL_ACCESS | \
41 SA_RIGHT_USER_CHANGE_PASSWORD | \
42 SA_RIGHT_USER_SET_LOC_COM )
43 #define SAMR_USR_RIGHTS_CANT_WRITE_PW \
44 ( READ_CONTROL_ACCESS | SA_RIGHT_USER_SET_LOC_COM )
45
46 #define DISP_INFO_CACHE_TIMEOUT 10
47
48 typedef struct disp_info {
49 DOM_SID sid; /* identify which domain this is. */
50 bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
51 struct pdb_search *users; /* querydispinfo 1 and 4 */
52 struct pdb_search *machines; /* querydispinfo 2 */
53 struct pdb_search *groups; /* querydispinfo 3 and 5, enumgroups */
54 struct pdb_search *aliases; /* enumaliases */
55
56 uint16 enum_acb_mask;
57 struct pdb_search *enum_users; /* enumusers with a mask */
58
59 struct timed_event *cache_timeout_event; /* cache idle timeout
60 * handler. */
61 } DISP_INFO;
62
63 /* We keep a static list of these by SID as modern clients close down
64 all resources between each request in a complete enumeration. */
65
66 struct samr_info {
67 /* for use by the \PIPE\samr policy */
68 DOM_SID sid;
69 bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
70 uint32 status; /* some sort of flag. best to record it. comes from opnum 0x39 */
71 uint32 acc_granted;
72 DISP_INFO *disp_info;
73 TALLOC_CTX *mem_ctx;
74 };
75
76 static const struct generic_mapping sam_generic_mapping = {
77 GENERIC_RIGHTS_SAM_READ,
78 GENERIC_RIGHTS_SAM_WRITE,
79 GENERIC_RIGHTS_SAM_EXECUTE,
80 GENERIC_RIGHTS_SAM_ALL_ACCESS};
81 static const struct generic_mapping dom_generic_mapping = {
82 GENERIC_RIGHTS_DOMAIN_READ,
83 GENERIC_RIGHTS_DOMAIN_WRITE,
84 GENERIC_RIGHTS_DOMAIN_EXECUTE,
85 GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
86 static const struct generic_mapping usr_generic_mapping = {
87 GENERIC_RIGHTS_USER_READ,
88 GENERIC_RIGHTS_USER_WRITE,
89 GENERIC_RIGHTS_USER_EXECUTE,
90 GENERIC_RIGHTS_USER_ALL_ACCESS};
91 static const struct generic_mapping usr_nopwchange_generic_mapping = {
92 GENERIC_RIGHTS_USER_READ,
93 GENERIC_RIGHTS_USER_WRITE,
94 GENERIC_RIGHTS_USER_EXECUTE & ~SA_RIGHT_USER_CHANGE_PASSWORD,
95 GENERIC_RIGHTS_USER_ALL_ACCESS};
96 static const struct generic_mapping grp_generic_mapping = {
97 GENERIC_RIGHTS_GROUP_READ,
98 GENERIC_RIGHTS_GROUP_WRITE,
99 GENERIC_RIGHTS_GROUP_EXECUTE,
100 GENERIC_RIGHTS_GROUP_ALL_ACCESS};
101 static const struct generic_mapping ali_generic_mapping = {
102 GENERIC_RIGHTS_ALIAS_READ,
103 GENERIC_RIGHTS_ALIAS_WRITE,
104 GENERIC_RIGHTS_ALIAS_EXECUTE,
105 GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
106
107 /*******************************************************************
108 *******************************************************************/
109
110 static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size,
111 const struct generic_mapping *map,
112 DOM_SID *sid, uint32 sid_access )
113 {
114 DOM_SID domadmin_sid;
115 SEC_ACE ace[5]; /* at most 5 entries */
116 SEC_ACCESS mask;
117 size_t i = 0;
118
119 SEC_ACL *psa = NULL;
120
121 /* basic access for Everyone */
122
123 init_sec_access(&mask, map->generic_execute | map->generic_read );
124 init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
125
126 /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
127
128 init_sec_access(&mask, map->generic_all);
129
130 init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
131 init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
132
133 /* Add Full Access for Domain Admins if we are a DC */
134
135 if ( IS_DC ) {
136 sid_copy( &domadmin_sid, get_global_sam_sid() );
137 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
138 init_sec_ace(&ace[i++], &domadmin_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
139 }
140
141 /* if we have a sid, give it some special access */
142
143 if ( sid ) {
144 init_sec_access( &mask, sid_access );
145 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
146 }
147
148 /* create the security descriptor */
149
150 if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
151 return NT_STATUS_NO_MEMORY;
152
153 if ((*psd = make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
154 SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL,
155 psa, sd_size)) == NULL)
156 return NT_STATUS_NO_MEMORY;
157
158 return NT_STATUS_OK;
159 }
160
161 /*******************************************************************
162 Checks if access to an object should be granted, and returns that
163 level of access for further checks.
164 ********************************************************************/
165
166 static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
167 SE_PRIV *rights, uint32 rights_mask,
168 uint32 des_access, uint32 *acc_granted,
169 const char *debug )
170 {
171 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
172 uint32 saved_mask = 0;
173
174 /* check privileges; certain SAM access bits should be overridden
175 by privileges (mostly having to do with creating/modifying/deleting
176 users and groups) */
177
178 if ( rights && user_has_any_privilege( token, rights ) ) {
179
180 saved_mask = (des_access & rights_mask);
181 des_access &= ~saved_mask;
182
183 DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
184 rights_mask));
185 }
186
187
188 /* check the security descriptor first */
189
190 if ( se_access_check(psd, token, des_access, acc_granted, &status) )
191 goto done;
192
193 /* give root a free pass */
194
195 if ( geteuid() == sec_initial_uid() ) {
196
197 DEBUG(4,("%s: ACCESS should be DENIED (requested: %#010x)\n", debug, des_access));
198 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
199
200 *acc_granted = des_access;
201
202 status = NT_STATUS_OK;
203 goto done;
204 }
205
206
207 done:
208 /* add in any bits saved during the privilege check (only
209 matters is status is ok) */
210
211 *acc_granted |= rights_mask;
212
213 DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
214 debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED",
215 des_access, *acc_granted));
216
217 return status;
218 }
219
220 /*******************************************************************
221 Checks if access to a function can be granted
222 ********************************************************************/
223
224 static NTSTATUS access_check_samr_function(uint32 acc_granted, uint32 acc_required, const char *debug)
225 {
226 DEBUG(5,("%s: access check ((granted: %#010x; required: %#010x)\n",
227 debug, acc_granted, acc_required));
228
229 /* check the security descriptor first */
230
231 if ( (acc_granted&acc_required) == acc_required )
232 return NT_STATUS_OK;
233
234 /* give root a free pass */
235
236 if (geteuid() == sec_initial_uid()) {
237
238 DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
239 debug, acc_granted, acc_required));
240 DEBUGADD(4,("but overwritten by euid == 0\n"));
241
242 return NT_STATUS_OK;
243 }
244
245 DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: %#010x)\n",
246 debug, acc_granted, acc_required));
247
248 return NT_STATUS_ACCESS_DENIED;
249 }
250
251 /*******************************************************************
252 Map any MAXIMUM_ALLOWED_ACCESS request to a valid access set.
253 ********************************************************************/
254
255 static void map_max_allowed_access(const NT_USER_TOKEN *token,
256 uint32_t *pacc_requested)
257 {
258 if (!((*pacc_requested) & MAXIMUM_ALLOWED_ACCESS)) {
259 return;
260 }
261 *pacc_requested &= ~MAXIMUM_ALLOWED_ACCESS;
262
263 /* At least try for generic read. */
264 *pacc_requested = GENERIC_READ_ACCESS;
265
266 /* root gets anything. */
267 if (geteuid() == sec_initial_uid()) {
268 *pacc_requested |= GENERIC_ALL_ACCESS;
269 return;
270 }
271
272 /* Full Access for 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
273
274 if (is_sid_in_token(token, &global_sid_Builtin_Administrators) ||
275 is_sid_in_token(token, &global_sid_Builtin_Account_Operators)) {
276 *pacc_requested |= GENERIC_ALL_ACCESS;
277 return;
278 }
279
280 /* Full access for DOMAIN\Domain Admins. */
281 if ( IS_DC ) {
282 DOM_SID domadmin_sid;
283 sid_copy( &domadmin_sid, get_global_sam_sid() );
284 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
285 if (is_sid_in_token(token, &domadmin_sid)) {
286 *pacc_requested |= GENERIC_ALL_ACCESS;
287 return;
288 }
289 }
290 /* TODO ! Check privileges. */
291 }
292
293 /*******************************************************************
294 Fetch or create a dispinfo struct.
295 ********************************************************************/
296
297 static DISP_INFO *get_samr_dispinfo_by_sid(DOM_SID *psid)
298 {
299 /*
300 * We do a static cache for DISP_INFO's here. Explanation can be found
301 * in Jeremy's checkin message to r11793:
302 *
303 * Fix the SAMR cache so it works across completely insane
304 * client behaviour (ie.:
305 * open pipe/open SAMR handle/enumerate 0 - 1024
306 * close SAMR handle, close pipe.
307 * open pipe/open SAMR handle/enumerate 1024 - 2048...
308 * close SAMR handle, close pipe.
309 * And on ad-nausium. Amazing.... probably object-oriented
310 * client side programming in action yet again.
311 * This change should *massively* improve performance when
312 * enumerating users from an LDAP database.
313 * Jeremy.
314 *
315 * "Our" and the builtin domain are the only ones where we ever
316 * enumerate stuff, so just cache 2 entries.
317 */
318
319 static struct disp_info builtin_dispinfo;
320 static struct disp_info domain_dispinfo;
321
322 /* There are two cases to consider here:
323 1) The SID is a domain SID and we look for an equality match, or
324 2) This is an account SID and so we return the DISP_INFO* for our
325 domain */
326
327 if (psid == NULL) {
328 return NULL;
329 }
330
331 if (sid_check_is_builtin(psid) || sid_check_is_in_builtin(psid)) {
332 /*
333 * Necessary only once, but it does not really hurt.
334 */
335 sid_copy(&builtin_dispinfo.sid, &global_sid_Builtin);
336
337 return &builtin_dispinfo;
338 }
339
340 if (sid_check_is_domain(psid) || sid_check_is_in_our_domain(psid)) {
341 /*
342 * Necessary only once, but it does not really hurt.
343 */
344 sid_copy(&domain_dispinfo.sid, get_global_sam_sid());
345
346 return &domain_dispinfo;
347 }
348
349 return NULL;
350 }
351
352 /*******************************************************************
353 Create a samr_info struct.
354 ********************************************************************/
355
356 static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
357 {
358 struct samr_info *info;
359 fstring sid_str;
360 TALLOC_CTX *mem_ctx;
361
362 if (psid) {
363 sid_to_fstring(sid_str, psid);
364 } else {
365 fstrcpy(sid_str,"(NULL)");
366 }
367
368 mem_ctx = talloc_init("samr_info for domain sid %s", sid_str);
369
370 if ((info = TALLOC_ZERO_P(mem_ctx, struct samr_info)) == NULL)
371 return NULL;
372
373 DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str));
374 if (psid) {
375 sid_copy( &info->sid, psid);
376 info->builtin_domain = sid_check_is_builtin(psid);
377 } else {
378 DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
379 info->builtin_domain = False;
380 }
381 info->mem_ctx = mem_ctx;
382
383 info->disp_info = get_samr_dispinfo_by_sid(psid);
384
385 return info;
386 }
387
388 /*******************************************************************
389 Function to free the per SID data.
390 ********************************************************************/
391
392 static void free_samr_cache(DISP_INFO *disp_info)
393 {
394 DEBUG(10, ("free_samr_cache: deleting cache for SID %s\n",
395 sid_string_dbg(&disp_info->sid)));
396
397 /* We need to become root here because the paged search might have to
398 * tell the LDAP server we're not interested in the rest anymore. */
399
400 become_root();
401
402 if (disp_info->users) {
403 DEBUG(10,("free_samr_cache: deleting users cache\n"));
404 pdb_search_destroy(disp_info->users);
405 disp_info->users = NULL;
406 }
407 if (disp_info->machines) {
408 DEBUG(10,("free_samr_cache: deleting machines cache\n"));
409 pdb_search_destroy(disp_info->machines);
410 disp_info->machines = NULL;
411 }
412 if (disp_info->groups) {
413 DEBUG(10,("free_samr_cache: deleting groups cache\n"));
414 pdb_search_destroy(disp_info->groups);
415 disp_info->groups = NULL;
416 }
417 if (disp_info->aliases) {
418 DEBUG(10,("free_samr_cache: deleting aliases cache\n"));
419 pdb_search_destroy(disp_info->aliases);
420 disp_info->aliases = NULL;
421 }
422 if (disp_info->enum_users) {
423 DEBUG(10,("free_samr_cache: deleting enum_users cache\n"));
424 pdb_search_destroy(disp_info->enum_users);
425 disp_info->enum_users = NULL;
426 }
427 disp_info->enum_acb_mask = 0;
428
429 unbecome_root();
430 }
431
432 /*******************************************************************
433 Function to free the per handle data.
434 ********************************************************************/
435
436 static void free_samr_info(void *ptr)
437 {
438 struct samr_info *info=(struct samr_info *) ptr;
439
440 /* Only free the dispinfo cache if no one bothered to set up
441 a timeout. */
442
443 if (info->disp_info && info->disp_info->cache_timeout_event == NULL) {
444 free_samr_cache(info->disp_info);
445 }
446
447 talloc_destroy(info->mem_ctx);
448 }
449
450 /*******************************************************************
451 Idle event handler. Throw away the disp info cache.
452 ********************************************************************/
453
454 static void disp_info_cache_idle_timeout_handler(struct event_context *ev_ctx,
455 struct timed_event *te,
456 const struct timeval *now,
457 void *private_data)
458 {
459 DISP_INFO *disp_info = (DISP_INFO *)private_data;
460
461 TALLOC_FREE(disp_info->cache_timeout_event);
462
463 DEBUG(10, ("disp_info_cache_idle_timeout_handler: caching timed "
464 "out\n"));
465 free_samr_cache(disp_info);
466 }
467
468 /*******************************************************************
469 Setup cache removal idle event handler.
470 ********************************************************************/
471
472 static void set_disp_info_cache_timeout(DISP_INFO *disp_info, time_t secs_fromnow)
473 {
474 /* Remove any pending timeout and update. */
475
476 TALLOC_FREE(disp_info->cache_timeout_event);
477
478 DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for "
479 "SID %s for %u seconds\n", sid_string_dbg(&disp_info->sid),
480 (unsigned int)secs_fromnow ));
481
482 disp_info->cache_timeout_event = event_add_timed(
483 smbd_event_context(), NULL,
484 timeval_current_ofs(secs_fromnow, 0),
485 "disp_info_cache_idle_timeout_handler",
486 disp_info_cache_idle_timeout_handler, (void *)disp_info);
487 }
488
489 /*******************************************************************
490 Force flush any cache. We do this on any samr_set_xxx call.
491 We must also remove the timeout handler.
492 ********************************************************************/
493
494 static void force_flush_samr_cache(DISP_INFO *disp_info)
495 {
496 if ((disp_info == NULL) || (disp_info->cache_timeout_event == NULL)) {
497 return;
498 }
499
500 DEBUG(10,("force_flush_samr_cache: clearing idle event\n"));
501 TALLOC_FREE(disp_info->cache_timeout_event);
502 free_samr_cache(disp_info);
503 }
504
505 /*******************************************************************
506 Ensure password info is never given out. Paranioa... JRA.
507 ********************************************************************/
508
509 static void samr_clear_sam_passwd(struct samu *sam_pass)
510 {
511
512 if (!sam_pass)
513 return;
514
515 /* These now zero out the old password */
516
517 pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
518 pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
519 }
520
521 static uint32 count_sam_users(struct disp_info *info, uint32 acct_flags)
522 {
523 struct samr_displayentry *entry;
524
525 if (info->builtin_domain) {
526 /* No users in builtin. */
527 return 0;
528 }
529
530 if (info->users == NULL) {
531 info->users = pdb_search_users(acct_flags);
532 if (info->users == NULL) {
533 return 0;
534 }
535 }
536 /* Fetch the last possible entry, thus trigger an enumeration */
537 pdb_search_entries(info->users, 0xffffffff, 1, &entry);
538
539 /* Ensure we cache this enumeration. */
540 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
541
542 return info->users->num_entries;
543 }
544
545 static uint32 count_sam_groups(struct disp_info *info)
546 {
547 struct samr_displayentry *entry;
548
549 if (info->builtin_domain) {
550 /* No groups in builtin. */
551 return 0;
552 }
553
554 if (info->groups == NULL) {
555 info->groups = pdb_search_groups();
556 if (info->groups == NULL) {
557 return 0;
558 }
559 }
560 /* Fetch the last possible entry, thus trigger an enumeration */
561 pdb_search_entries(info->groups, 0xffffffff, 1, &entry);
562
563 /* Ensure we cache this enumeration. */
564 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
565
566 return info->groups->num_entries;
567 }
568
569 static uint32 count_sam_aliases(struct disp_info *info)
570 {
571 struct samr_displayentry *entry;
572
573 if (info->aliases == NULL) {
574 info->aliases = pdb_search_aliases(&info->sid);
575 if (info->aliases == NULL) {
576 return 0;
577 }
578 }
579 /* Fetch the last possible entry, thus trigger an enumeration */
580 pdb_search_entries(info->aliases, 0xffffffff, 1, &entry);
581
582 /* Ensure we cache this enumeration. */
583 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
584
585 return info->aliases->num_entries;
586 }
587
588 /*******************************************************************
589 _samr_Close
590 ********************************************************************/
591
592 NTSTATUS _samr_Close(pipes_struct *p, struct samr_Close *r)
593 {
594 if (!close_policy_hnd(p, r->in.handle)) {
595 return NT_STATUS_INVALID_HANDLE;
596 }
597
598 ZERO_STRUCTP(r->out.handle);
599
600 return NT_STATUS_OK;
601 }
602
603 /*******************************************************************
604 _samr_OpenDomain
605 ********************************************************************/
606
607 NTSTATUS _samr_OpenDomain(pipes_struct *p,
608 struct samr_OpenDomain *r)
609 {
610 struct samr_info *info;
611 SEC_DESC *psd = NULL;
612 uint32 acc_granted;
613 uint32 des_access = r->in.access_mask;
614 NTSTATUS status;
615 size_t sd_size;
616 SE_PRIV se_rights;
617
618 /* find the connection policy handle. */
619
620 if ( !find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info) )
621 return NT_STATUS_INVALID_HANDLE;
622
623 status = access_check_samr_function(info->acc_granted,
624 SA_RIGHT_SAM_OPEN_DOMAIN,
625 "_samr_OpenDomain" );
626
627 if ( !NT_STATUS_IS_OK(status) )
628 return status;
629
630 /*check if access can be granted as requested by client. */
631 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
632
633 make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
634 se_map_generic( &des_access, &dom_generic_mapping );
635
636 se_priv_copy( &se_rights, &se_machine_account );
637 se_priv_add( &se_rights, &se_add_users );
638
639 status = access_check_samr_object( psd, p->pipe_user.nt_user_token,
640 &se_rights, GENERIC_RIGHTS_DOMAIN_WRITE, des_access,
641 &acc_granted, "_samr_OpenDomain" );
642
643 if ( !NT_STATUS_IS_OK(status) )
644 return status;
645
646 if (!sid_check_is_domain(r->in.sid) &&
647 !sid_check_is_builtin(r->in.sid)) {
648 return NT_STATUS_NO_SUCH_DOMAIN;
649 }
650
651 /* associate the domain SID with the (unique) handle. */
652 if ((info = get_samr_info_by_sid(r->in.sid))==NULL)
653 return NT_STATUS_NO_MEMORY;
654 info->acc_granted = acc_granted;
655
656 /* get a (unique) handle. open a policy on it. */
657 if (!create_policy_hnd(p, r->out.domain_handle, free_samr_info, (void *)info))
658 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
659
660 DEBUG(5,("_samr_OpenDomain: %d\n", __LINE__));
661
662 return NT_STATUS_OK;
663 }
664
665 /*******************************************************************
666 _samr_GetUserPwInfo
667 ********************************************************************/
668
669 NTSTATUS _samr_GetUserPwInfo(pipes_struct *p,
670 struct samr_GetUserPwInfo *r)
671 {
672 struct samr_info *info = NULL;
673 enum lsa_SidType sid_type;
674 uint32_t min_password_length = 0;
675 uint32_t password_properties = 0;
676 bool ret = false;
677 NTSTATUS status;
678
679 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
680
681 /* find the policy handle. open a policy on it. */
682 if (!find_policy_by_hnd(p, r->in.user_handle, (void **)(void *)&info)) {
683 return NT_STATUS_INVALID_HANDLE;
684 }
685
686 status = access_check_samr_function(info->acc_granted,
687 SAMR_USER_ACCESS_GET_ATTRIBUTES,
688 "_samr_GetUserPwInfo" );
689 if (!NT_STATUS_IS_OK(status)) {
690 return status;
691 }
692
693 if (!sid_check_is_in_our_domain(&info->sid)) {
694 return NT_STATUS_OBJECT_TYPE_MISMATCH;
695 }
696
697 become_root();
698 ret = lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, &sid_type);
699 unbecome_root();
700 if (ret == false) {
701 return NT_STATUS_NO_SUCH_USER;
702 }
703
704 switch (sid_type) {
705 case SID_NAME_USER:
706 become_root();
707 pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
708 &min_password_length);
709 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
710 &password_properties);
711 unbecome_root();
712
713 if (lp_check_password_script() && *lp_check_password_script()) {
714 password_properties |= DOMAIN_PASSWORD_COMPLEX;
715 }
716
717 break;
718 default:
719 break;
720 }
721
722 r->out.info->min_password_length = min_password_length;
723 r->out.info->password_properties = password_properties;
724
725 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
726
727 return NT_STATUS_OK;
728 }
729
730 /*******************************************************************
731 ********************************************************************/
732
733 static bool get_lsa_policy_samr_sid( pipes_struct *p, POLICY_HND *pol,
734 DOM_SID *sid, uint32 *acc_granted,
735 DISP_INFO **ppdisp_info)
736 {
737 struct samr_info *info = NULL;
738
739 /* find the policy handle. open a policy on it. */
740 if (!find_policy_by_hnd(p, pol, (void **)(void *)&info))
741 return False;
742
743 if (!info)
744 return False;
745
746 *sid = info->sid;
747 *acc_granted = info->acc_granted;
748 if (ppdisp_info) {
749 *ppdisp_info = info->disp_info;
750 }
751
752 return True;
753 }
754
755 /*******************************************************************
756 _samr_SetSecurity
757 ********************************************************************/
758
759 NTSTATUS _samr_SetSecurity(pipes_struct *p,
760 struct samr_SetSecurity *r)
761 {
762 DOM_SID pol_sid;
763 uint32 acc_granted, i;
764 SEC_ACL *dacl;
765 bool ret;
766 struct samu *sampass=NULL;
767 NTSTATUS status;
768
769 if (!get_lsa_policy_samr_sid(p, r->in.handle, &pol_sid, &acc_granted, NULL))
770 return NT_STATUS_INVALID_HANDLE;
771
772 if (!(sampass = samu_new( p->mem_ctx))) {
773 DEBUG(0,("No memory!\n"));
774 return NT_STATUS_NO_MEMORY;
775 }
776
777 /* get the user record */
778 become_root();
779 ret = pdb_getsampwsid(sampass, &pol_sid);
780 unbecome_root();
781
782 if (!ret) {
783 DEBUG(4, ("User %s not found\n", sid_string_dbg(&pol_sid)));
784 TALLOC_FREE(sampass);
785 return NT_STATUS_INVALID_HANDLE;
786 }
787
788 dacl = r->in.sdbuf->sd->dacl;
789 for (i=0; i < dacl->num_aces; i++) {
790 if (sid_equal(&pol_sid, &dacl->aces[i].trustee)) {
791 ret = pdb_set_pass_can_change(sampass,
792 (dacl->aces[i].access_mask &
793 SA_RIGHT_USER_CHANGE_PASSWORD) ?
794 True: False);
795 break;
796 }
797 }
798
799 if (!ret) {
800 TALLOC_FREE(sampass);
801 return NT_STATUS_ACCESS_DENIED;
802 }
803
804 status = access_check_samr_function(acc_granted,
805 SA_RIGHT_USER_SET_ATTRIBUTES,
806 "_samr_SetSecurity");
807 if (NT_STATUS_IS_OK(status)) {
808 become_root();
809 status = pdb_update_sam_account(sampass);
810 unbecome_root();
811 }
812
813 TALLOC_FREE(sampass);
814
815 return status;
816 }
817
818 /*******************************************************************
819 build correct perms based on policies and password times for _samr_query_sec_obj
820 *******************************************************************/
821 static bool check_change_pw_access(TALLOC_CTX *mem_ctx, DOM_SID *user_sid)
822 {
823 struct samu *sampass=NULL;
824 bool ret;
825
826 if ( !(sampass = samu_new( mem_ctx )) ) {
827 DEBUG(0,("No memory!\n"));
828 return False;
829 }
830
831 become_root();
832 ret = pdb_getsampwsid(sampass, user_sid);
833 unbecome_root();
834
835 if (ret == False) {
836 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
837 TALLOC_FREE(sampass);
838 return False;
839 }
840
841 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass) ));
842
843 if (pdb_get_pass_can_change(sampass)) {
844 TALLOC_FREE(sampass);
845 return True;
846 }
847 TALLOC_FREE(sampass);
848 return False;
849 }
850
851
852 /*******************************************************************
853 _samr_QuerySecurity
854 ********************************************************************/
855
856 NTSTATUS _samr_QuerySecurity(pipes_struct *p,
857 struct samr_QuerySecurity *r)
858 {
859 NTSTATUS status;
860 DOM_SID pol_sid;
861 SEC_DESC * psd = NULL;
862 uint32 acc_granted;
863 size_t sd_size;
864
865 /* Get the SID. */
866 if (!get_lsa_policy_samr_sid(p, r->in.handle, &pol_sid, &acc_granted, NULL))
867 return NT_STATUS_INVALID_HANDLE;
868
869 DEBUG(10,("_samr_QuerySecurity: querying security on SID: %s\n",
870 sid_string_dbg(&pol_sid)));
871
872 status = access_check_samr_function(acc_granted,
873 STD_RIGHT_READ_CONTROL_ACCESS,
874 "_samr_QuerySecurity");
875 if (!NT_STATUS_IS_OK(status)) {
876 return status;
877 }
878
879 /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
880
881 /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
882 if (pol_sid.sid_rev_num == 0) {
883 DEBUG(5,("_samr_QuerySecurity: querying security on SAM\n"));
884 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
885 } else if (sid_equal(&pol_sid,get_global_sam_sid())) {
886 /* check if it is our domain SID */
887 DEBUG(5,("_samr_QuerySecurity: querying security on Domain "
888 "with SID: %s\n", sid_string_dbg(&pol_sid)));
889 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
890 } else if (sid_equal(&pol_sid,&global_sid_Builtin)) {
891 /* check if it is the Builtin Domain */
892 /* TODO: Builtin probably needs a different SD with restricted write access*/
893 DEBUG(5,("_samr_QuerySecurity: querying security on Builtin "
894 "Domain with SID: %s\n", sid_string_dbg(&pol_sid)));
895 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
896 } else if (sid_check_is_in_our_domain(&pol_sid) ||
897 sid_check_is_in_builtin(&pol_sid)) {
898 /* TODO: different SDs have to be generated for aliases groups and users.
899 Currently all three get a default user SD */
900 DEBUG(10,("_samr_QuerySecurity: querying security on Object "
901 "with SID: %s\n", sid_string_dbg(&pol_sid)));
902 if (check_change_pw_access(p->mem_ctx, &pol_sid)) {
903 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
904 &pol_sid, SAMR_USR_RIGHTS_WRITE_PW);
905 } else {
906 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_nopwchange_generic_mapping,
907 &pol_sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
908 }
909 } else {
910 return NT_STATUS_OBJECT_TYPE_MISMATCH;
911 }
912
913 if ((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
914 return NT_STATUS_NO_MEMORY;
915
916 return status;
917 }
918
919 /*******************************************************************
920 makes a SAM_ENTRY / UNISTR2* structure from a user list.
921 ********************************************************************/
922
923 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx,
924 struct samr_SamEntry **sam_pp,
925 uint32_t num_entries,
926 uint32_t start_idx,
927 struct samr_displayentry *entries)
928 {
929 uint32_t i;
930 struct samr_SamEntry *sam;
931
932 *sam_pp = NULL;
933
934 if (num_entries == 0) {
935 return NT_STATUS_OK;
936 }
937
938 sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_entries);
939 if (sam == NULL) {
940 DEBUG(0, ("make_user_sam_entry_list: TALLOC_ZERO failed!\n"));
941 return NT_STATUS_NO_MEMORY;
942 }
943
944 for (i = 0; i < num_entries; i++) {
945 #if 0
946 /*
947 * usrmgr expects a non-NULL terminated string with
948 * trust relationships
949 */
950 if (entries[i].acct_flags & ACB_DOMTRUST) {
951 init_unistr2(&uni_temp_name, entries[i].account_name,
952 UNI_FLAGS_NONE);
953 } else {
954 init_unistr2(&uni_temp_name, entries[i].account_name,
955 UNI_STR_TERMINATE);
956 }
957 #endif
958 init_lsa_String(&sam[i].name, entries[i].account_name);
959 sam[i].idx = entries[i].rid;
960 }
961
962 *sam_pp = sam;
963
964 return NT_STATUS_OK;
965 }
966
967 #define MAX_SAM_ENTRIES MAX_SAM_ENTRIES_W2K
968
969 /*******************************************************************
970 _samr_EnumDomainUsers
971 ********************************************************************/
972
973 NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
974 struct samr_EnumDomainUsers *r)
975 {
976 NTSTATUS status;
977 struct samr_info *info = NULL;
978 int num_account;
979 uint32 enum_context = *r->in.resume_handle;
980 enum remote_arch_types ra_type = get_remote_arch();
981 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
982 uint32 max_entries = max_sam_entries;
983 struct samr_displayentry *entries = NULL;
984 struct samr_SamArray *samr_array = NULL;
985 struct samr_SamEntry *samr_entries = NULL;
986
987 /* find the policy handle. open a policy on it. */
988 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
989 return NT_STATUS_INVALID_HANDLE;
990
991 status = access_check_samr_function(info->acc_granted,
992 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
993 "_samr_EnumDomainUsers");
994 if (!NT_STATUS_IS_OK(status)) {
995 return status;
996 }
997
998 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
999
1000 if (info->builtin_domain) {
1001 /* No users in builtin. */
1002 *r->out.resume_handle = *r->in.resume_handle;
1003 DEBUG(5,("_samr_EnumDomainUsers: No users in BUILTIN\n"));
1004 return status;
1005 }
1006
1007 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1008 if (!samr_array) {
1009 return NT_STATUS_NO_MEMORY;
1010 }
1011
1012 become_root();
1013
1014 /* AS ROOT !!!! */
1015
1016 if ((info->disp_info->enum_users != NULL) &&
1017 (info->disp_info->enum_acb_mask != r->in.acct_flags)) {
1018 pdb_search_destroy(info->disp_info->enum_users);
1019 info->disp_info->enum_users = NULL;
1020 }
1021
1022 if (info->disp_info->enum_users == NULL) {
1023 info->disp_info->enum_users = pdb_search_users(r->in.acct_flags);
1024 info->disp_info->enum_acb_mask = r->in.acct_flags;
1025 }
1026
1027 if (info->disp_info->enum_users == NULL) {
1028 /* END AS ROOT !!!! */
1029 unbecome_root();
1030 return NT_STATUS_ACCESS_DENIED;
1031 }
1032
1033 num_account = pdb_search_entries(info->disp_info->enum_users,
1034 enum_context, max_entries,
1035 &entries);
1036
1037 /* END AS ROOT !!!! */
1038
1039 unbecome_root();
1040
1041 if (num_account == 0) {
1042 DEBUG(5, ("_samr_EnumDomainUsers: enumeration handle over "
1043 "total entries\n"));
1044 *r->out.resume_handle = *r->in.resume_handle;
1045 return NT_STATUS_OK;
1046 }
1047
1048 status = make_user_sam_entry_list(p->mem_ctx, &samr_entries,
1049 num_account, enum_context,
1050 entries);
1051 if (!NT_STATUS_IS_OK(status)) {
1052 return status;
1053 }
1054
1055 if (max_entries <= num_account) {
1056 status = STATUS_MORE_ENTRIES;
1057 } else {
1058 status = NT_STATUS_OK;
1059 }
1060
1061 /* Ensure we cache this enumeration. */
1062 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1063
1064 DEBUG(5, ("_samr_EnumDomainUsers: %d\n", __LINE__));
1065
1066 samr_array->count = num_account;
1067 samr_array->entries = samr_entries;
1068
1069 *r->out.resume_handle = *r->in.resume_handle + num_account;
1070 *r->out.sam = samr_array;
1071 *r->out.num_entries = num_account;
1072
1073 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
1074
1075 return status;
1076 }
1077
1078 /*******************************************************************
1079 makes a SAM_ENTRY / UNISTR2* structure from a group list.
1080 ********************************************************************/
1081
1082 static void make_group_sam_entry_list(TALLOC_CTX *ctx,
1083 struct samr_SamEntry **sam_pp,
1084 uint32_t num_sam_entries,
1085 struct samr_displayentry *entries)
1086 {
1087 struct samr_SamEntry *sam;
1088 uint32_t i;
1089
1090 *sam_pp = NULL;
1091
1092 if (num_sam_entries == 0) {
1093 return;
1094 }
1095
1096 sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_sam_entries);
1097 if (sam == NULL) {
1098 return;
1099 }
1100
1101 for (i = 0; i < num_sam_entries; i++) {
1102 /*
1103 * JRA. I think this should include the null. TNG does not.
1104 */
1105 init_lsa_String(&sam[i].name, entries[i].account_name);
1106 sam[i].idx = entries[i].rid;
1107 }
1108
1109 *sam_pp = sam;
1110 }
1111
1112 /*******************************************************************
1113 _samr_EnumDomainGroups
1114 ********************************************************************/
1115
1116 NTSTATUS _samr_EnumDomainGroups(pipes_struct *p,
1117 struct samr_EnumDomainGroups *r)
1118 {
1119 NTSTATUS status;
1120 struct samr_info *info = NULL;
1121 struct samr_displayentry *groups;
1122 uint32 num_groups;
1123 struct samr_SamArray *samr_array = NULL;
1124 struct samr_SamEntry *samr_entries = NULL;
1125
1126 /* find the policy handle. open a policy on it. */
1127 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1128 return NT_STATUS_INVALID_HANDLE;
1129
1130 status = access_check_samr_function(info->acc_granted,
1131 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
1132 "_samr_EnumDomainGroups");
1133 if (!NT_STATUS_IS_OK(status)) {
1134 return status;
1135 }
1136
1137 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1138
1139 if (info->builtin_domain) {
1140 /* No groups in builtin. */
1141 *r->out.resume_handle = *r->in.resume_handle;
1142 DEBUG(5,("_samr_EnumDomainGroups: No groups in BUILTIN\n"));
1143 return status;
1144 }
1145
1146 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1147 if (!samr_array) {
1148 return NT_STATUS_NO_MEMORY;
1149 }
1150
1151 /* the domain group array is being allocated in the function below */
1152
1153 become_root();
1154
1155 if (info->disp_info->groups == NULL) {
1156 info->disp_info->groups = pdb_search_groups();
1157
1158 if (info->disp_info->groups == NULL) {
1159 unbecome_root();
1160 return NT_STATUS_ACCESS_DENIED;
1161 }
1162 }
1163
1164 num_groups = pdb_search_entries(info->disp_info->groups,
1165 *r->in.resume_handle,
1166 MAX_SAM_ENTRIES, &groups);
1167 unbecome_root();
1168
1169 /* Ensure we cache this enumeration. */
1170 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1171
1172 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1173 num_groups, groups);
1174
1175 samr_array->count = num_groups;
1176 samr_array->entries = samr_entries;
1177
1178 *r->out.sam = samr_array;
1179 *r->out.num_entries = num_groups;
1180 /* this was missing, IMHO:
1181 *r->out.resume_handle = num_groups + *r->in.resume_handle;
1182 */
1183
1184 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1185
1186 return status;
1187 }
1188
1189 /*******************************************************************
1190 _samr_EnumDomainAliases
1191 ********************************************************************/
1192
1193 NTSTATUS _samr_EnumDomainAliases(pipes_struct *p,
1194 struct samr_EnumDomainAliases *r)
1195 {
1196 NTSTATUS status;
1197 struct samr_info *info;
1198 struct samr_displayentry *aliases;
1199 uint32 num_aliases = 0;
1200 struct samr_SamArray *samr_array = NULL;
1201 struct samr_SamEntry *samr_entries = NULL;
1202
1203 /* find the policy handle. open a policy on it. */
1204 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1205 return NT_STATUS_INVALID_HANDLE;
1206
1207 DEBUG(5,("_samr_EnumDomainAliases: sid %s\n",
1208 sid_string_dbg(&info->sid)));
1209
1210 status = access_check_samr_function(info->acc_granted,
1211 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
1212 "_samr_EnumDomainAliases");
1213 if (!NT_STATUS_IS_OK(status)) {
1214 return status;
1215 }
1216
1217 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1218 if (!samr_array) {
1219 return NT_STATUS_NO_MEMORY;
1220 }
1221
1222 become_root();
1223
1224 if (info->disp_info->aliases == NULL) {
1225 info->disp_info->aliases = pdb_search_aliases(&info->sid);
1226 if (info->disp_info->aliases == NULL) {
1227 unbecome_root();
1228 return NT_STATUS_ACCESS_DENIED;
1229 }
1230 }
1231
1232 num_aliases = pdb_search_entries(info->disp_info->aliases,
1233 *r->in.resume_handle,
1234 MAX_SAM_ENTRIES, &aliases);
1235 unbecome_root();
1236
1237 /* Ensure we cache this enumeration. */
1238 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1239
1240 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1241 num_aliases, aliases);
1242
1243 DEBUG(5,("_samr_EnumDomainAliases: %d\n", __LINE__));
1244
1245 samr_array->count = num_aliases;
1246 samr_array->entries = samr_entries;
1247
1248 *r->out.sam = samr_array;
1249 *r->out.num_entries = num_aliases;
1250 *r->out.resume_handle = num_aliases + *r->in.resume_handle;
1251
1252 return status;
1253 }
1254
1255 /*******************************************************************
1256 inits a samr_DispInfoGeneral structure.
1257 ********************************************************************/
1258
1259 static NTSTATUS init_samr_dispinfo_1(TALLOC_CTX *ctx,
1260 struct samr_DispInfoGeneral *r,
1261 uint32_t num_entries,
1262 uint32_t start_idx,
1263 struct samr_displayentry *entries)
1264 {
1265 uint32 i;
1266
1267 DEBUG(10, ("init_samr_dispinfo_1: num_entries: %d\n", num_entries));
1268
1269 if (num_entries == 0) {
1270 return NT_STATUS_OK;
1271 }
1272
1273 r->count = num_entries;
1274
1275 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryGeneral, num_entries);
1276 if (!r->entries) {
1277 return NT_STATUS_NO_MEMORY;
1278 }
1279
1280 for (i = 0; i < num_entries ; i++) {
1281
1282 init_lsa_String(&r->entries[i].account_name,
1283 entries[i].account_name);
1284
1285 init_lsa_String(&r->entries[i].description,
1286 entries[i].description);
1287
1288 init_lsa_String(&r->entries[i].full_name,
1289 entries[i].fullname);
1290
1291 r->entries[i].rid = entries[i].rid;
1292 r->entries[i].acct_flags = entries[i].acct_flags;
1293 r->entries[i].idx = start_idx+i+1;
1294 }
1295
1296 return NT_STATUS_OK;
1297 }
1298
1299 /*******************************************************************
1300 inits a samr_DispInfoFull structure.
1301 ********************************************************************/
1302
1303 static NTSTATUS init_samr_dispinfo_2(TALLOC_CTX *ctx,
1304 struct samr_DispInfoFull *r,
1305 uint32_t num_entries,
1306 uint32_t start_idx,
1307 struct samr_displayentry *entries)
1308 {
1309 uint32_t i;
1310
1311 DEBUG(10, ("init_samr_dispinfo_2: num_entries: %d\n", num_entries));
1312
1313 if (num_entries == 0) {
1314 return NT_STATUS_OK;
1315 }
1316
1317 r->count = num_entries;
1318
1319 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFull, num_entries);
1320 if (!r->entries) {
1321 return NT_STATUS_NO_MEMORY;
1322 }
1323
1324 for (i = 0; i < num_entries ; i++) {
1325
1326 init_lsa_String(&r->entries[i].account_name,
1327 entries[i].account_name);
1328
1329 init_lsa_String(&r->entries[i].description,
1330 entries[i].description);
1331
1332 r->entries[i].rid = entries[i].rid;
1333 r->entries[i].acct_flags = entries[i].acct_flags;
1334 r->entries[i].idx = start_idx+i+1;
1335 }
1336
1337 return NT_STATUS_OK;
1338 }
1339
1340 /*******************************************************************
1341 inits a samr_DispInfoFullGroups structure.
1342 ********************************************************************/
1343
1344 static NTSTATUS init_samr_dispinfo_3(TALLOC_CTX *ctx,
1345 struct samr_DispInfoFullGroups *r,
1346 uint32_t num_entries,
1347 uint32_t start_idx,
1348 struct samr_displayentry *entries)
1349 {
1350 uint32_t i;
1351
1352 DEBUG(5, ("init_samr_dispinfo_3: num_entries: %d\n", num_entries));
1353
1354 if (num_entries == 0) {
1355 return NT_STATUS_OK;
1356 }
1357
1358 r->count = num_entries;
1359
1360 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFullGroup, num_entries);
1361 if (!r->entries) {
1362 return NT_STATUS_NO_MEMORY;
1363 }
1364
1365 for (i = 0; i < num_entries ; i++) {
1366
1367 init_lsa_String(&r->entries[i].account_name,
1368 entries[i].account_name);
1369
1370 init_lsa_String(&r->entries[i].description,
1371 entries[i].description);
1372
1373 r->entries[i].rid = entries[i].rid;
1374 r->entries[i].acct_flags = entries[i].acct_flags;
1375 r->entries[i].idx = start_idx+i+1;
1376 }
1377
1378 return NT_STATUS_OK;
1379 }
1380
1381 /*******************************************************************
1382 inits a samr_DispInfoAscii structure.
1383 ********************************************************************/
1384
1385 static NTSTATUS init_samr_dispinfo_4(TALLOC_CTX *ctx,
1386 struct samr_DispInfoAscii *r,
1387 uint32_t num_entries,
1388 uint32_t start_idx,
1389 struct samr_displayentry *entries)
1390 {
1391 uint32_t i;
1392
1393 DEBUG(5, ("init_samr_dispinfo_4: num_entries: %d\n", num_entries));
1394
1395 if (num_entries == 0) {
1396 return NT_STATUS_OK;
1397 }
1398
1399 r->count = num_entries;
1400
1401 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1402 if (!r->entries) {
1403 return NT_STATUS_NO_MEMORY;
1404 }
1405
1406 for (i = 0; i < num_entries ; i++) {
1407
1408 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1409 entries[i].account_name);
1410
1411 r->entries[i].idx = start_idx+i+1;
1412 }
1413
1414 return NT_STATUS_OK;
1415 }
1416
1417 /*******************************************************************
1418 inits a samr_DispInfoAscii structure.
1419 ********************************************************************/
1420
1421 static NTSTATUS init_samr_dispinfo_5(TALLOC_CTX *ctx,
1422 struct samr_DispInfoAscii *r,
1423 uint32_t num_entries,
1424 uint32_t start_idx,
1425 struct samr_displayentry *entries)
1426 {
1427 uint32_t i;
1428
1429 DEBUG(5, ("init_samr_dispinfo_5: num_entries: %d\n", num_entries));
1430
1431 if (num_entries == 0) {
1432 return NT_STATUS_OK;
1433 }
1434
1435 r->count = num_entries;
1436
1437 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1438 if (!r->entries) {
1439 return NT_STATUS_NO_MEMORY;
1440 }
1441
1442 for (i = 0; i < num_entries ; i++) {
1443
1444 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1445 entries[i].account_name);
1446
1447 r->entries[i].idx = start_idx+i+1;
1448 }
1449
1450 return NT_STATUS_OK;
1451 }
1452
1453 /*******************************************************************
1454 _samr_QueryDisplayInfo
1455 ********************************************************************/
1456
1457 NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
1458 struct samr_QueryDisplayInfo *r)
1459 {
1460 NTSTATUS status;
1461 struct samr_info *info = NULL;
1462 uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
1463
1464 uint32 max_entries = r->in.max_entries;
1465 uint32 enum_context = r->in.start_idx;
1466 uint32 max_size = r->in.buf_size;
1467
1468 union samr_DispInfo *disp_info = r->out.info;
1469
1470 uint32 temp_size=0, total_data_size=0;
1471 NTSTATUS disp_ret = NT_STATUS_UNSUCCESSFUL;
1472 uint32 num_account = 0;
1473 enum remote_arch_types ra_type = get_remote_arch();
1474 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
1475 struct samr_displayentry *entries = NULL;
1476
1477 DEBUG(5,("_samr_QueryDisplayInfo: %d\n", __LINE__));
1478
1479 /* find the policy handle. open a policy on it. */
1480 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1481 return NT_STATUS_INVALID_HANDLE;
1482
1483 status = access_check_samr_function(info->acc_granted,
1484 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
1485 "_samr_QueryDisplayInfo");
1486 if (!NT_STATUS_IS_OK(status)) {
1487 return status;
1488 }
1489
1490 /*
1491 * calculate how many entries we will return.
1492 * based on
1493 * - the number of entries the client asked
1494 * - our limit on that
1495 * - the starting point (enumeration context)
1496 * - the buffer size the client will accept
1497 */
1498
1499 /*
1500 * We are a lot more like W2K. Instead of reading the SAM
1501 * each time to find the records we need to send back,
1502 * we read it once and link that copy to the sam handle.
1503 * For large user list (over the MAX_SAM_ENTRIES)
1504 * it's a definitive win.
1505 * second point to notice: between enumerations
1506 * our sam is now the same as it's a snapshoot.
1507 * third point: got rid of the static SAM_USER_21 struct
1508 * no more intermediate.
1509 * con: it uses much more memory, as a full copy is stored
1510 * in memory.
1511 *
1512 * If you want to change it, think twice and think
1513 * of the second point , that's really important.
1514 *
1515 * JFM, 12/20/2001
1516 */
1517
1518 if ((r->in.level < 1) || (r->in.level > 5)) {
1519 DEBUG(0,("_samr_QueryDisplayInfo: Unknown info level (%u)\n",
1520 (unsigned int)r->in.level ));
1521 return NT_STATUS_INVALID_INFO_CLASS;
1522 }
1523
1524 /* first limit the number of entries we will return */
1525 if(max_entries > max_sam_entries) {
1526 DEBUG(5, ("_samr_QueryDisplayInfo: client requested %d "
1527 "entries, limiting to %d\n", max_entries,
1528 max_sam_entries));
1529 max_entries = max_sam_entries;
1530 }
1531
1532 /* calculate the size and limit on the number of entries we will
1533 * return */
1534
1535 temp_size=max_entries*struct_size;
1536
1537 if (temp_size>max_size) {
1538 max_entries=MIN((max_size/struct_size),max_entries);;
1539 DEBUG(5, ("_samr_QueryDisplayInfo: buffer size limits to "
1540 "only %d entries\n", max_entries));
1541 }
1542
1543 become_root();
1544
1545 /* THe following done as ROOT. Don't return without unbecome_root(). */
1546
1547 switch (r->in.level) {
1548 case 0x1:
1549 case 0x4:
1550 if (info->disp_info->users == NULL) {
1551 info->disp_info->users = pdb_search_users(ACB_NORMAL);
1552 if (info->disp_info->users == NULL) {
1553 unbecome_root();
1554 return NT_STATUS_ACCESS_DENIED;
1555 }
1556 DEBUG(10,("_samr_QueryDisplayInfo: starting user enumeration at index %u\n",
1557 (unsigned int)enum_context ));
1558 } else {
1559 DEBUG(10,("_samr_QueryDisplayInfo: using cached user enumeration at index %u\n",
1560 (unsigned int)enum_context ));
1561 }
1562
1563 num_account = pdb_search_entries(info->disp_info->users,
1564 enum_context, max_entries,
1565 &entries);
1566 break;
1567 case 0x2:
1568 if (info->disp_info->machines == NULL) {
1569 info->disp_info->machines =
1570 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
1571 if (info->disp_info->machines == NULL) {
1572 unbecome_root();
1573 return NT_STATUS_ACCESS_DENIED;
1574 }
1575 DEBUG(10,("_samr_QueryDisplayInfo: starting machine enumeration at index %u\n",
1576 (unsigned int)enum_context ));
1577 } else {
1578 DEBUG(10,("_samr_QueryDisplayInfo: using cached machine enumeration at index %u\n",
1579 (unsigned int)enum_context ));
1580 }
1581
1582 num_account = pdb_search_entries(info->disp_info->machines,
1583 enum_context, max_entries,
1584 &entries);
1585 break;
1586 case 0x3:
1587 case 0x5:
1588 if (info->disp_info->groups == NULL) {
1589 info->disp_info->groups = pdb_search_groups();
1590 if (info->disp_info->groups == NULL) {
1591 unbecome_root();
1592 return NT_STATUS_ACCESS_DENIED;
1593 }
1594 DEBUG(10,("_samr_QueryDisplayInfo: starting group enumeration at index %u\n",
1595 (unsigned int)enum_context ));
1596 } else {
1597 DEBUG(10,("_samr_QueryDisplayInfo: using cached group enumeration at index %u\n",
1598 (unsigned int)enum_context ));
1599 }
1600
1601 num_account = pdb_search_entries(info->disp_info->groups,
1602 enum_context, max_entries,
1603 &entries);
1604 break;
1605 default:
1606 unbecome_root();
1607 smb_panic("info class changed");
1608 break;
1609 }
1610 unbecome_root();
1611
1612
1613 /* Now create reply structure */
1614 switch (r->in.level) {
1615 case 0x1:
1616 disp_ret = init_samr_dispinfo_1(p->mem_ctx, &disp_info->info1,
1617 num_account, enum_context,
1618 entries);
1619 break;
1620 case 0x2:
1621 disp_ret = init_samr_dispinfo_2(p->mem_ctx, &disp_info->info2,
1622 num_account, enum_context,
1623 entries);
1624 break;
1625 case 0x3:
1626 disp_ret = init_samr_dispinfo_3(p->mem_ctx, &disp_info->info3,
1627 num_account, enum_context,
1628 entries);
1629 break;
1630 case 0x4:
1631 disp_ret = init_samr_dispinfo_4(p->mem_ctx, &disp_info->info4,
1632 num_account, enum_context,
1633 entries);
1634 break;
1635 case 0x5:
1636 disp_ret = init_samr_dispinfo_5(p->mem_ctx, &disp_info->info5,
1637 num_account, enum_context,
1638 entries);
1639 break;
1640 default:
1641 smb_panic("info class changed");
1642 break;
1643 }
1644
1645 if (!NT_STATUS_IS_OK(disp_ret))
1646 return disp_ret;
1647
1648 /* calculate the total size */
1649 total_data_size=num_account*struct_size;
1650
1651 if (max_entries <= num_account) {
1652 status = STATUS_MORE_ENTRIES;
1653 } else {
1654 status = NT_STATUS_OK;
1655 }
1656
1657 /* Ensure we cache this enumeration. */
1658 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1659
1660 DEBUG(5, ("_samr_QueryDisplayInfo: %d\n", __LINE__));
1661
1662 *r->out.total_size = total_data_size;
1663 *r->out.returned_size = temp_size;
1664
1665 return status;
1666 }
1667
1668 /****************************************************************
1669 _samr_QueryDisplayInfo2
1670 ****************************************************************/
1671
1672 NTSTATUS _samr_QueryDisplayInfo2(pipes_struct *p,
1673 struct samr_QueryDisplayInfo2 *r)
1674 {
1675 struct samr_QueryDisplayInfo q;
1676
1677 q.in.domain_handle = r->in.domain_handle;
1678 q.in.level = r->in.level;
1679 q.in.start_idx = r->in.start_idx;
1680 q.in.max_entries = r->in.max_entries;
1681 q.in.buf_size = r->in.buf_size;
1682
1683 q.out.total_size = r->out.total_size;
1684 q.out.returned_size = r->out.returned_size;
1685 q.out.info = r->out.info;
1686
1687 return _samr_QueryDisplayInfo(p, &q);
1688 }
1689
1690 /****************************************************************
1691 _samr_QueryDisplayInfo3
1692 ****************************************************************/
1693
1694 NTSTATUS _samr_QueryDisplayInfo3(pipes_struct *p,
1695 struct samr_QueryDisplayInfo3 *r)
1696 {
1697 struct samr_QueryDisplayInfo q;
1698
1699 q.in.domain_handle = r->in.domain_handle;
1700 q.in.level = r->in.level;
1701 q.in.start_idx = r->in.start_idx;
1702 q.in.max_entries = r->in.max_entries;
1703 q.in.buf_size = r->in.buf_size;
1704
1705 q.out.total_size = r->out.total_size;
1706 q.out.returned_size = r->out.returned_size;
1707 q.out.info = r->out.info;
1708
1709 return _samr_QueryDisplayInfo(p, &q);
1710 }
1711
1712 /*******************************************************************
1713 _samr_QueryAliasInfo
1714 ********************************************************************/
1715
1716 NTSTATUS _samr_QueryAliasInfo(pipes_struct *p,
1717 struct samr_QueryAliasInfo *r)
1718 {
1719 DOM_SID sid;
1720 struct acct_info info;
1721 uint32 acc_granted;
1722 NTSTATUS status;
1723 union samr_AliasInfo *alias_info = NULL;
1724 const char *alias_name = NULL;
1725 const char *alias_description = NULL;
1726
1727 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1728
1729 alias_info = TALLOC_ZERO_P(p->mem_ctx, union samr_AliasInfo);
1730 if (!alias_info) {
1731 return NT_STATUS_NO_MEMORY;
1732 }
1733
1734 /* find the policy handle. open a policy on it. */
1735 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &sid, &acc_granted, NULL))
1736 return NT_STATUS_INVALID_HANDLE;
1737
1738 status = access_check_samr_function(acc_granted,
1739 SA_RIGHT_ALIAS_LOOKUP_INFO,
1740 "_samr_QueryAliasInfo");
1741 if (!NT_STATUS_IS_OK(status)) {
1742 return status;
1743 }
1744
1745 become_root();
1746 status = pdb_get_aliasinfo(&sid, &info);
1747 unbecome_root();
1748
1749 if ( !NT_STATUS_IS_OK(status))
1750 return status;
1751
1752 /* FIXME: info contains fstrings */
1753 alias_name = talloc_strdup(r, info.acct_name);
1754 alias_description = talloc_strdup(r, info.acct_desc);
1755
1756 switch (r->in.level) {
1757 case ALIASINFOALL:
1758 init_samr_alias_info1(&alias_info->all,
1759 alias_name,
1760 1,
1761 alias_description);
1762 break;
1763 case ALIASINFODESCRIPTION:
1764 init_samr_alias_info3(&alias_info->description,
1765 alias_description);
1766 break;
1767 default:
1768 return NT_STATUS_INVALID_INFO_CLASS;
1769 }
1770
1771 *r->out.info = alias_info;
1772
1773 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1774
1775 return NT_STATUS_OK;
1776 }
1777
1778 #if 0
1779 /*******************************************************************
1780 samr_reply_lookup_ids
1781 ********************************************************************/
1782
1783 uint32 _samr_lookup_ids(pipes_struct *p, SAMR_Q_LOOKUP_IDS *q_u, SAMR_R_LOOKUP_IDS *r_u)
1784 {
1785 uint32 rid[MAX_SAM_ENTRIES];
1786 int num_rids = q_u->num_sids1;
1787
1788 r_u->status = NT_STATUS_OK;
1789
1790 DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1791
1792 if (num_rids > MAX_SAM_ENTRIES) {
1793 num_rids = MAX_SAM_ENTRIES;
1794 DEBUG(5,("_samr_lookup_ids: truncating entries to %d\n", num_rids));
1795 }
1796
1797 #if 0
1798 int i;
1799 SMB_ASSERT_ARRAY(q_u->uni_user_name, num_rids);
1800
1801 for (i = 0; i < num_rids && status == 0; i++)
1802 {
1803 struct sam_passwd *sam_pass;
1804 fstring user_name;
1805
1806
1807 fstrcpy(user_name, unistrn2(q_u->uni_user_name[i].buffer,
1808 q_u->uni_user_name[i].uni_str_len));
1809
1810 /* find the user account */
1811 become_root();
1812 sam_pass = get_smb21pwd_entry(user_name, 0);
1813 unbecome_root();
1814
1815 if (sam_pass == NULL)
1816 {
1817 status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
1818 rid[i] = 0;
1819 }
1820 else
1821 {
1822 rid[i] = sam_pass->user_rid;
1823 }
1824 }
1825 #endif
1826
1827 num_rids = 1;
1828 rid[0] = BUILTIN_ALIAS_RID_USERS;
1829
1830 init_samr_r_lookup_ids(&r_u, num_rids, rid, NT_STATUS_OK);
1831
1832 DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1833
1834 return r_u->status;
1835 }
1836 #endif
1837
1838 /*******************************************************************
1839 _samr_LookupNames
1840 ********************************************************************/
1841
1842 NTSTATUS _samr_LookupNames(pipes_struct *p,
1843 struct samr_LookupNames *r)
1844 {
1845 NTSTATUS status;
1846 uint32 *rid;
1847 enum lsa_SidType *type;
1848 int i;
1849 int num_rids = r->in.num_names;
1850 DOM_SID pol_sid;
1851 uint32 acc_granted;
1852 struct samr_Ids rids, types;
1853 uint32_t num_mapped = 0;
1854
1855 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1856
1857 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL)) {
1858 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1859 }
1860
1861 status = access_check_samr_function(acc_granted,
1862 0, /* Don't know the acc_bits yet */
1863 "_samr_LookupNames");
1864 if (!NT_STATUS_IS_OK(status)) {
1865 return status;
1866 }
1867
1868 if (num_rids > MAX_SAM_ENTRIES) {
1869 num_rids = MAX_SAM_ENTRIES;
1870 DEBUG(5,("_samr_LookupNames: truncating entries to %d\n", num_rids));
1871 }
1872
1873 rid = talloc_array(p->mem_ctx, uint32, num_rids);
1874 NT_STATUS_HAVE_NO_MEMORY(rid);
1875
1876 type = talloc_array(p->mem_ctx, enum lsa_SidType, num_rids);
1877 NT_STATUS_HAVE_NO_MEMORY(type);
1878
1879 DEBUG(5,("_samr_LookupNames: looking name on SID %s\n",
1880 sid_string_dbg(&pol_sid)));
1881
1882 for (i = 0; i < num_rids; i++) {
1883
1884 status = NT_STATUS_NONE_MAPPED;
1885 type[i] = SID_NAME_UNKNOWN;
1886
1887 rid[i] = 0xffffffff;
1888
1889 if (sid_check_is_builtin(&pol_sid)) {
1890 if (lookup_builtin_name(r->in.names[i].string,
1891 &rid[i]))
1892 {
1893 type[i] = SID_NAME_ALIAS;
1894 }
1895 } else {
1896 lookup_global_sam_name(r->in.names[i].string, 0,
1897 &rid[i], &type[i]);
1898 }
1899
1900 if (type[i] != SID_NAME_UNKNOWN) {
1901 num_mapped++;
1902 }
1903 }
1904
1905 if (num_mapped == num_rids) {
1906 status = NT_STATUS_OK;
1907 } else if (num_mapped == 0) {
1908 status = NT_STATUS_NONE_MAPPED;
1909 } else {
1910 status = STATUS_SOME_UNMAPPED;
1911 }
1912
1913 rids.count = num_rids;
1914 rids.ids = rid;
1915
1916 types.count = num_rids;
1917 types.ids = type;
1918
1919 *r->out.rids = rids;
1920 *r->out.types = types;
1921
1922 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1923
1924 return status;
1925 }
1926
1927 /*******************************************************************
1928 _samr_ChangePasswordUser2
1929 ********************************************************************/
1930
1931 NTSTATUS _samr_ChangePasswordUser2(pipes_struct *p,
1932 struct samr_ChangePasswordUser2 *r)
1933 {
1934 NTSTATUS status;
1935 fstring user_name;
1936 fstring wks;
1937
1938 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1939
1940 fstrcpy(user_name, r->in.account->string);
1941 fstrcpy(wks, r->in.server->string);
1942
1943 DEBUG(5,("_samr_ChangePasswordUser2: user: %s wks: %s\n", user_name, wks));
1944
1945 /*
1946 * Pass the user through the NT -> unix user mapping
1947 * function.
1948 */
1949
1950 (void)map_username(user_name);
1951
1952 /*
1953 * UNIX username case mangling not required, pass_oem_change
1954 * is case insensitive.
1955 */
1956
1957 status = pass_oem_change(user_name,
1958 r->in.lm_password->data,
1959 r->in.lm_verifier->hash,
1960 r->in.nt_password->data,
1961 r->in.nt_verifier->hash,
1962 NULL);
1963
1964 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1965
1966 return status;
1967 }
1968
1969 /*******************************************************************
1970 _samr_ChangePasswordUser3
1971 ********************************************************************/
1972
1973 NTSTATUS _samr_ChangePasswordUser3(pipes_struct *p,
1974 struct samr_ChangePasswordUser3 *r)
1975 {
1976 NTSTATUS status;
1977 fstring user_name;
1978 const char *wks = NULL;
1979 uint32 reject_reason;
1980 struct samr_DomInfo1 *dominfo = NULL;
1981 struct samr_ChangeReject *reject = NULL;
1982
1983 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
1984
1985 fstrcpy(user_name, r->in.account->string);
1986 if (r->in.server && r->in.server->string) {
1987 wks = r->in.server->string;
1988 }
1989
1990 DEBUG(5,("_samr_ChangePasswordUser3: user: %s wks: %s\n", user_name, wks));
1991
1992 /*
1993 * Pass the user through the NT -> unix user mapping
1994 * function.
1995 */
1996
1997 (void)map_username(user_name);
1998
1999 /*
2000 * UNIX username case mangling not required, pass_oem_change
2001 * is case insensitive.
2002 */
2003
2004 status = pass_oem_change(user_name,
2005 r->in.lm_password->data,
2006 r->in.lm_verifier->hash,
2007 r->in.nt_password->data,
2008 r->in.nt_verifier->hash,
2009 &reject_reason);
2010
2011 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) ||
2012 NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_RESTRICTION)) {
2013
2014 uint32 min_pass_len,pass_hist,password_properties;
2015 time_t u_expire, u_min_age;
2016 NTTIME nt_expire, nt_min_age;
2017 uint32 account_policy_temp;
2018
2019 dominfo = TALLOC_ZERO_P(p->mem_ctx, struct samr_DomInfo1);
2020 if (!dominfo) {
2021 return NT_STATUS_NO_MEMORY;
2022 }
2023
2024 reject = TALLOC_ZERO_P(p->mem_ctx, struct samr_ChangeReject);
2025 if (!reject) {
2026 return NT_STATUS_NO_MEMORY;
2027 }
2028
2029 become_root();
2030
2031 /* AS ROOT !!! */
2032
2033 pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp);
2034 min_pass_len = account_policy_temp;
2035
2036 pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
2037 pass_hist = account_policy_temp;
2038
2039 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
2040 password_properties = account_policy_temp;
2041
2042 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
2043 u_expire = account_policy_temp;
2044
2045 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
2046 u_min_age = account_policy_temp;
2047
2048 /* !AS ROOT */
2049
2050 unbecome_root();
2051
2052 unix_to_nt_time_abs(&nt_expire, u_expire);
2053 unix_to_nt_time_abs(&nt_min_age, u_min_age);
2054
2055 if (lp_check_password_script() && *lp_check_password_script()) {
2056 password_properties |= DOMAIN_PASSWORD_COMPLEX;
2057 }
2058
2059 init_samr_DomInfo1(dominfo,
2060 min_pass_len,
2061 pass_hist,
2062 password_properties,
2063 u_expire,
2064 u_min_age);
2065
2066 reject->reason = reject_reason;
2067
2068 *r->out.dominfo = dominfo;
2069 *r->out.reject = reject;
2070 }
2071
2072 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
2073
2074 return status;
2075 }
2076
2077 /*******************************************************************
2078 makes a SAMR_R_LOOKUP_RIDS structure.
2079 ********************************************************************/
2080
2081 static bool make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
2082 const char **names,
2083 struct lsa_String **lsa_name_array_p)
2084 {
2085 struct lsa_String *lsa_name_array = NULL;
2086 uint32_t i;
2087
2088 *lsa_name_array_p = NULL;
2089
2090 if (num_names != 0) {
2091 lsa_name_array = TALLOC_ZERO_ARRAY(ctx, struct lsa_String, num_names);
2092 if (!lsa_name_array) {
2093 return false;
2094 }
2095 }
2096
2097 for (i = 0; i < num_names; i++) {
2098 DEBUG(10, ("names[%d]:%s\n", i, names[i] && *names[i] ? names[i] : ""));
2099 init_lsa_String(&lsa_name_array[i], names[i]);
2100 }
2101
2102 *lsa_name_array_p = lsa_name_array;
2103
2104 return true;
2105 }
2106
2107 /*******************************************************************
2108 _samr_LookupRids
2109 ********************************************************************/
2110
2111 NTSTATUS _samr_LookupRids(pipes_struct *p,
2112 struct samr_LookupRids *r)
2113 {
2114 NTSTATUS status;
2115 const char **names;
2116 enum lsa_SidType *attrs = NULL;
2117 uint32 *wire_attrs = NULL;
2118 DOM_SID pol_sid;
2119 int num_rids = (int)r->in.num_rids;
2120 uint32 acc_granted;
2121 int i;
2122 struct lsa_Strings names_array;
2123 struct samr_Ids types_array;
2124 struct lsa_String *lsa_names = NULL;
2125
2126 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2127
2128 /* find the policy handle. open a policy on it. */
2129 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL))
2130 return NT_STATUS_INVALID_HANDLE;
2131
2132 status = access_check_samr_function(acc_granted,
2133 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
2134 "_samr__LookupRids");
2135 if (!NT_STATUS_IS_OK(status)) {
2136 return status;
2137 }
2138
2139 if (num_rids > 1000) {
2140 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
2141 "to samba4 idl this is not possible\n", num_rids));
2142 return NT_STATUS_UNSUCCESSFUL;
2143 }
2144
2145 if (num_rids) {
2146 names = TALLOC_ZERO_ARRAY(p->mem_ctx, const char *, num_rids);
2147 attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, enum lsa_SidType, num_rids);
2148 wire_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids);
2149
2150 if ((names == NULL) || (attrs == NULL) || (wire_attrs==NULL))
2151 return NT_STATUS_NO_MEMORY;
2152 } else {
2153 names = NULL;
2154 attrs = NULL;
2155 wire_attrs = NULL;
2156 }
2157
2158 become_root(); /* lookup_sid can require root privs */
2159 status = pdb_lookup_rids(&pol_sid, num_rids, r->in.rids,
2160 names, attrs);
2161 unbecome_root();
2162
2163 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) && (num_rids == 0)) {
2164 status = NT_STATUS_OK;
2165 }
2166
2167 if (!make_samr_lookup_rids(p->mem_ctx, num_rids, names,
2168 &lsa_names)) {
2169 return NT_STATUS_NO_MEMORY;
2170 }
2171
2172 /* Convert from enum lsa_SidType to uint32 for wire format. */
2173 for (i = 0; i < num_rids; i++) {
2174 wire_attrs[i] = (uint32)attrs[i];
2175 }
2176
2177 names_array.count = num_rids;
2178 names_array.names = lsa_names;
2179
2180 types_array.count = num_rids;
2181 types_array.ids = wire_attrs;
2182
2183 *r->out.names = names_array;
2184 *r->out.types = types_array;
2185
2186 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2187
2188 return status;
2189 }
2190
2191 /*******************************************************************
2192 _samr_OpenUser
2193 ********************************************************************/
2194
2195 NTSTATUS _samr_OpenUser(pipes_struct *p,
2196 struct samr_OpenUser *r)
2197 {
2198 struct samu *sampass=NULL;
2199 DOM_SID sid;
2200 POLICY_HND domain_pol = *r->in.domain_handle;
2201 POLICY_HND *user_pol = r->out.user_handle;
2202 struct samr_info *info = NULL;
2203 SEC_DESC *psd = NULL;
2204 uint32 acc_granted;
2205 uint32 des_access = r->in.access_mask;
2206 size_t sd_size;
2207 bool ret;
2208 NTSTATUS nt_status;
2209 SE_PRIV se_rights;
2210
2211 /* find the domain policy handle and get domain SID / access bits in the domain policy. */
2212
2213 if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted, NULL) )
2214 return NT_STATUS_INVALID_HANDLE;
2215
2216 nt_status = access_check_samr_function(acc_granted,
2217 SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
2218 "_samr_OpenUser" );
2219
2220 if ( !NT_STATUS_IS_OK(nt_status) )
2221 return nt_status;
2222
2223 if ( !(sampass = samu_new( p->mem_ctx )) ) {
2224 return NT_STATUS_NO_MEMORY;
2225 }
2226
2227 /* append the user's RID to it */
2228
2229 if (!sid_append_rid(&sid, r->in.rid))
2230 return NT_STATUS_NO_SUCH_USER;
2231
2232 /* check if access can be granted as requested by client. */
2233
2234 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
2235
2236 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
2237 se_map_generic(&des_access, &usr_generic_mapping);
2238
2239 se_priv_copy( &se_rights, &se_machine_account );
2240 se_priv_add( &se_rights, &se_add_users );
2241
2242 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2243 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
2244 &acc_granted, "_samr_OpenUser");
2245
2246 if ( !NT_STATUS_IS_OK(nt_status) )
2247 return nt_status;
2248
2249 become_root();
2250 ret=pdb_getsampwsid(sampass, &sid);
2251 unbecome_root();
2252
2253 /* check that the SID exists in our domain. */
2254 if (ret == False) {
2255 return NT_STATUS_NO_SUCH_USER;
2256 }
2257
2258 TALLOC_FREE(sampass);
2259
2260 /* associate the user's SID and access bits with the new handle. */
2261 if ((info = get_samr_info_by_sid(&sid)) == NULL)
2262 return NT_STATUS_NO_MEMORY;
2263 info->acc_granted = acc_granted;
2264
2265 /* get a (unique) handle. open a policy on it. */
2266 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info))
2267 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2268
2269 return NT_STATUS_OK;
2270 }
2271
2272 /*************************************************************************
2273 *************************************************************************/
2274
2275 static NTSTATUS init_samr_parameters_string(TALLOC_CTX *mem_ctx,
2276 DATA_BLOB *blob,
2277 struct lsa_BinaryString **_r)
2278 {
2279 struct lsa_BinaryString *r;
2280
2281 if (!blob || !_r) {
2282 return NT_STATUS_INVALID_PARAMETER;
2283 }
2284
2285 r = TALLOC_ZERO_P(mem_ctx, struct lsa_BinaryString);
2286 if (!r) {
2287 return NT_STATUS_NO_MEMORY;
2288 }
2289
2290 r->array = TALLOC_ZERO_ARRAY(mem_ctx, uint16_t, blob->length/2);
2291 if (!r->array) {
2292 return NT_STATUS_NO_MEMORY;
2293 }
2294 memcpy(r->array, blob->data, blob->length);
2295 r->size = blob->length;
2296 r->length = blob->length;
2297
2298 if (!r->array) {
2299 return NT_STATUS_NO_MEMORY;
2300 }
2301
2302 *_r = r;
2303
2304 return NT_STATUS_OK;
2305 }
2306
2307 /*************************************************************************
2308 get_user_info_7. Safe. Only gives out account_name.
2309 *************************************************************************/
2310
2311 static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx,
2312 struct samr_UserInfo7 *r,
2313 DOM_SID *user_sid)
2314 {
2315 struct samu *smbpass=NULL;
2316 bool ret;
2317 const char *account_name = NULL;
2318
2319 ZERO_STRUCTP(r);
2320
2321 if ( !(smbpass = samu_new( mem_ctx )) ) {
2322 return NT_STATUS_NO_MEMORY;
2323 }
2324
2325 become_root();
2326 ret = pdb_getsampwsid(smbpass, user_sid);
2327 unbecome_root();
2328
2329 if ( !ret ) {
2330 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2331 return NT_STATUS_NO_SUCH_USER;
2332 }
2333
2334 account_name = talloc_strdup(mem_ctx, pdb_get_username(smbpass));
2335 if (!account_name) {
2336 TALLOC_FREE(smbpass);
2337 return NT_STATUS_NO_MEMORY;
2338 }
2339 TALLOC_FREE(smbpass);
2340
2341 DEBUG(3,("User:[%s]\n", account_name));
2342
2343 init_samr_user_info7(r, account_name);
2344
2345 return NT_STATUS_OK;
2346 }
2347
2348 /*************************************************************************
2349 get_user_info_9. Only gives out primary group SID.
2350 *************************************************************************/
2351
2352 static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx,
2353 struct samr_UserInfo9 *r,
2354 DOM_SID *user_sid)
2355 {
2356 struct samu *smbpass=NULL;
2357 bool ret;
2358
2359 ZERO_STRUCTP(r);
2360
2361 if ( !(smbpass = samu_new( mem_ctx )) ) {
2362 return NT_STATUS_NO_MEMORY;
2363 }
2364
2365 become_root();
2366 ret = pdb_getsampwsid(smbpass, user_sid);
2367 unbecome_root();
2368
2369 if (ret==False) {
2370 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2371 TALLOC_FREE(smbpass);
2372 return NT_STATUS_NO_SUCH_USER;
2373 }
2374
2375 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
2376
2377 init_samr_user_info9(r, pdb_get_group_rid(smbpass));
2378
2379 TALLOC_FREE(smbpass);
2380
2381 return NT_STATUS_OK;
2382 }
2383
2384 /*************************************************************************
2385 get_user_info_16. Safe. Only gives out acb bits.
2386 *************************************************************************/
2387
2388 static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx,
2389 struct samr_UserInfo16 *r,
2390 DOM_SID *user_sid)
2391 {
2392 struct samu *smbpass=NULL;
2393 bool ret;
2394
2395 ZERO_STRUCTP(r);
2396
2397 if ( !(smbpass = samu_new( mem_ctx )) ) {
2398 return NT_STATUS_NO_MEMORY;
2399 }
2400
2401 become_root();
2402 ret = pdb_getsampwsid(smbpass, user_sid);
2403 unbecome_root();
2404
2405 if (ret==False) {
2406 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2407 TALLOC_FREE(smbpass);
2408 return NT_STATUS_NO_SUCH_USER;
2409 }
2410
2411 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
2412
2413 init_samr_user_info16(r, pdb_get_acct_ctrl(smbpass));
2414
2415 TALLOC_FREE(smbpass);
2416
2417 return NT_STATUS_OK;
2418 }
2419
2420 /*************************************************************************
2421 get_user_info_18. OK - this is the killer as it gives out password info.
2422 Ensure that this is only allowed on an encrypted connection with a root
2423 user. JRA.
2424 *************************************************************************/
2425
2426 static NTSTATUS get_user_info_18(pipes_struct *p,
2427 TALLOC_CTX *mem_ctx,
2428 struct samr_UserInfo18 *r,
2429 DOM_SID *user_sid)
2430 {
2431 struct samu *smbpass=NULL;
2432 bool ret;
2433
2434 ZERO_STRUCTP(r);
2435
2436 if (p->auth.auth_type != PIPE_AUTH_TYPE_NTLMSSP || p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) {
2437 return NT_STATUS_ACCESS_DENIED;
2438 }
2439
2440 if (p->auth.auth_level != PIPE_AUTH_LEVEL_PRIVACY) {
2441 return NT_STATUS_ACCESS_DENIED;
2442 }
2443
2444 /*
2445 * Do *NOT* do become_root()/unbecome_root() here ! JRA.
2446 */
2447
2448 if ( !(smbpass = samu_new( mem_ctx )) ) {
2449 return NT_STATUS_NO_MEMORY;
2450 }
2451
2452 ret = pdb_getsampwsid(smbpass, user_sid);
2453
2454 if (ret == False) {
2455 DEBUG(4, ("User %s not found\n", sid_string_dbg(user_sid)));
2456 TALLOC_FREE(smbpass);
2457 return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
2458 }
2459
2460 DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
2461
2462 if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
2463 TALLOC_FREE(smbpass);
2464 return NT_STATUS_ACCOUNT_DISABLED;
2465 }
2466
2467 init_samr_user_info18(r, pdb_get_lanman_passwd(smbpass),
2468 pdb_get_nt_passwd(smbpass));
2469
2470 TALLOC_FREE(smbpass);
2471
2472 return NT_STATUS_OK;
2473 }
2474
2475 /*************************************************************************
2476 get_user_info_20
2477 *************************************************************************/
2478
2479 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
2480 struct samr_UserInfo20 *r,
2481 DOM_SID *user_sid)
2482 {
2483 struct samu *sampass=NULL;
2484 bool ret;
2485 const char *munged_dial = NULL;
2486 DATA_BLOB blob;
2487 NTSTATUS status;
2488 struct lsa_BinaryString *parameters = NULL;
2489
2490 ZERO_STRUCTP(r);
2491
2492 if ( !(sampass = samu_new( mem_ctx )) ) {
2493 return NT_STATUS_NO_MEMORY;
2494 }
2495
2496 become_root();
2497 ret = pdb_getsampwsid(sampass, user_sid);
2498 unbecome_root();
2499
2500 if (ret == False) {
2501 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2502 TALLOC_FREE(sampass);
2503 return NT_STATUS_NO_SUCH_USER;
2504 }
2505
2506 munged_dial = pdb_get_munged_dial(sampass);
2507
2508 samr_clear_sam_passwd(sampass);
2509
2510 DEBUG(3,("User:[%s] has [%s] (length: %d)\n", pdb_get_username(sampass),
2511 munged_dial, (int)strlen(munged_dial)));
2512
2513 if (munged_dial) {
2514 blob = base64_decode_data_blob(munged_dial);
2515 } else {
2516 blob = data_blob_string_const("");
2517 }
2518
2519 status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
2520 data_blob_free(&blob);
2521 TALLOC_FREE(sampass);
2522 if (!NT_STATUS_IS_OK(status)) {
2523 return status;
2524 }
2525
2526 init_samr_user_info20(r, parameters);
2527
2528 return NT_STATUS_OK;
2529 }
2530
2531
2532 /*************************************************************************
2533 get_user_info_21
2534 *************************************************************************/
2535
2536 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
2537 struct samr_UserInfo21 *r,
2538 DOM_SID *user_sid,
2539 DOM_SID *domain_sid)
2540 {
2541 NTSTATUS status;
2542 struct samu *pw = NULL;
2543 bool ret;
2544 const DOM_SID *sid_user, *sid_group;
2545 uint32_t rid, primary_gid;
2546 NTTIME last_logon, last_logoff, last_password_change,
2547 acct_expiry, allow_password_change, force_password_change;
2548 time_t must_change_time;
2549 uint8_t password_expired;
2550 const char *account_name, *full_name, *home_directory, *home_drive,
2551 *logon_script, *profile_path, *description,
2552 *workstations, *comment;
2553 struct samr_LogonHours logon_hours;
2554 struct lsa_BinaryString *parameters = NULL;
2555 const char *munged_dial = NULL;
2556 DATA_BLOB blob;
2557
2558 ZERO_STRUCTP(r);
2559
2560 if (!(pw = samu_new(mem_ctx))) {
2561 return NT_STATUS_NO_MEMORY;
2562 }
2563
2564 become_root();
2565 ret = pdb_getsampwsid(pw, user_sid);
2566 unbecome_root();
2567
2568 if (ret == False) {
2569 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2570 TALLOC_FREE(pw);
2571 return NT_STATUS_NO_SUCH_USER;
2572 }
2573
2574 samr_clear_sam_passwd(pw);
2575
2576 DEBUG(3,("User:[%s]\n", pdb_get_username(pw)));
2577
2578 sid_user = pdb_get_user_sid(pw);
2579
2580 if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2581 DEBUG(0, ("get_user_info_21: User %s has SID %s, \nwhich conflicts with "
2582 "the domain sid %s. Failing operation.\n",
2583 pdb_get_username(pw), sid_string_dbg(sid_user),
2584 sid_string_dbg(domain_sid)));
2585 TALLOC_FREE(pw);
2586 return NT_STATUS_UNSUCCESSFUL;
2587 }
2588
2589 become_root();
2590 sid_group = pdb_get_group_sid(pw);
2591 unbecome_root();
2592
2593 if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2594 DEBUG(0, ("get_user_info_21: User %s has Primary Group SID %s, \n"
2595 "which conflicts with the domain sid %s. Failing operation.\n",
2596 pdb_get_username(pw), sid_string_dbg(sid_group),
2597 sid_string_dbg(domain_sid)));
2598 TALLOC_FREE(pw);
2599 return NT_STATUS_UNSUCCESSFUL;
2600 }
2601
2602 unix_to_nt_time(&last_logon, pdb_get_logon_time(pw));
2603 unix_to_nt_time(&last_logoff, pdb_get_logoff_time(pw));
2604 unix_to_nt_time(&acct_expiry, pdb_get_kickoff_time(pw));
2605 unix_to_nt_time(&last_password_change, pdb_get_pass_last_set_time(pw));
2606 unix_to_nt_time(&allow_password_change, pdb_get_pass_can_change_time(pw));
2607
2608 must_change_time = pdb_get_pass_must_change_time(pw);
2609 if (must_change_time == get_time_t_max()) {
2610 unix_to_nt_time_abs(&force_password_change, must_change_time);
2611 } else {
2612 unix_to_nt_time(&force_password_change, must_change_time);
2613 }
2614
2615 if (pdb_get_pass_must_change_time(pw) == 0) {
2616 password_expired = PASS_MUST_CHANGE_AT_NEXT_LOGON;
2617 } else {
2618 password_expired = 0;
2619 }
2620
2621 munged_dial = pdb_get_munged_dial(pw);
2622 if (munged_dial) {
2623 blob = base64_decode_data_blob(munged_dial);
2624 } else {
2625 blob = data_blob_string_const("");
2626 }
2627
2628 status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
2629 data_blob_free(&blob);
2630 if (!NT_STATUS_IS_OK(status)) {
2631 TALLOC_FREE(pw);
2632 return status;
2633 }
2634
2635 account_name = talloc_strdup(mem_ctx, pdb_get_username(pw));
2636 full_name = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2637 home_directory = talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2638 home_drive = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2639 logon_script = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2640 profile_path = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2641 description = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2642 workstations = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2643 comment = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2644
2645 logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
2646 #if 0
2647
2648 /*
2649 Look at a user on a real NT4 PDC with usrmgr, press
2650 'ok'. Then you will see that fields_present is set to
2651 0x08f827fa. Look at the user immediately after that again,
2652 and you will see that 0x00fffff is returned. This solves
2653 the problem that you get access denied after having looked
2654 at the user.
2655 -- Volker
2656 */
2657
2658 #endif
2659
2660 init_samr_user_info21(r,
2661 last_logon,
2662 last_logoff,
2663 last_password_change,
2664 acct_expiry,
2665 allow_password_change,
2666 force_password_change,
2667 account_name,
2668 full_name,
2669 home_directory,
2670 home_drive,
2671 logon_script,
2672 profile_path,
2673 description,
2674 workstations,
2675 comment,
2676 parameters,
2677 rid,
2678 primary_gid,
2679 pdb_get_acct_ctrl(pw),
2680 pdb_build_fields_present(pw),
2681 logon_hours,
2682 pdb_get_bad_password_count(pw),
2683 pdb_get_logon_count(pw),
2684 0, /* country_code */
2685 0, /* code_page */
2686 0, /* nt_password_set */
2687 0, /* lm_password_set */
2688 password_expired);
2689 TALLOC_FREE(pw);
2690
2691 return NT_STATUS_OK;
2692 }
2693
2694 /*******************************************************************
2695 _samr_QueryUserInfo
2696 ********************************************************************/
2697
2698 NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
2699 struct samr_QueryUserInfo *r)
2700 {
2701 NTSTATUS status;
2702 union samr_UserInfo *user_info = NULL;
2703 struct samr_info *info = NULL;
2704 DOM_SID domain_sid;
2705 uint32 rid;
2706
2707 /* search for the handle */
2708 if (!find_policy_by_hnd(p, r->in.user_handle, (void **)(void *)&info))
2709 return NT_STATUS_INVALID_HANDLE;
2710
2711 status = access_check_samr_function(info->acc_granted,
2712 SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
2713 "_samr_QueryUserInfo");
2714 if (!NT_STATUS_IS_OK(status)) {
2715 return status;
2716 }
2717
2718 domain_sid = info->sid;
2719
2720 sid_split_rid(&domain_sid, &rid);
2721
2722 if (!sid_check_is_in_our_domain(&info->sid))
2723 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2724
2725 DEBUG(5,("_samr_QueryUserInfo: sid:%s\n",
2726 sid_string_dbg(&info->sid)));
2727
2728 user_info = TALLOC_ZERO_P(p->mem_ctx, union samr_UserInfo);
2729 if (!user_info) {
2730 return NT_STATUS_NO_MEMORY;
2731 }
2732
2733 DEBUG(5,("_samr_QueryUserInfo: user info level: %d\n", r->in.level));
2734
2735 switch (r->in.level) {
2736 case 7:
2737 status = get_user_info_7(p->mem_ctx, &user_info->info7, &info->sid);
2738 if (!NT_STATUS_IS_OK(status)) {
2739 return status;
2740 }
2741 break;
2742 case 9:
2743 status = get_user_info_9(p->mem_ctx, &user_info->info9, &info->sid);
2744 if (!NT_STATUS_IS_OK(status)) {
2745 return status;
2746 }
2747 break;
2748 case 16:
2749 status = get_user_info_16(p->mem_ctx, &user_info->info16, &info->sid);
2750 if (!NT_STATUS_IS_OK(status)) {
2751 return status;
2752 }
2753 break;
2754
2755 case 18:
2756 status = get_user_info_18(p, p->mem_ctx, &user_info->info18, &info->sid);
2757 if (!NT_STATUS_IS_OK(status)) {
2758 return status;
2759 }
2760 break;
2761
2762 case 20:
2763 status = get_user_info_20(p->mem_ctx, &user_info->info20, &info->sid);
2764 if (!NT_STATUS_IS_OK(status)) {
2765 return status;
2766 }
2767 break;
2768
2769 case 21:
2770 status = get_user_info_21(p->mem_ctx, &user_info->info21,
2771 &info->sid, &domain_sid);
2772 if (!NT_STATUS_IS_OK(status)) {
2773 return status;
2774 }
2775 break;
2776
2777 default:
2778 return NT_STATUS_INVALID_INFO_CLASS;
2779 }
2780
2781 *r->out.info = user_info;
2782
2783 DEBUG(5,("_samr_QueryUserInfo: %d\n", __LINE__));
2784
2785 return status;
2786 }
2787
2788 /*******************************************************************
2789 _samr_GetGroupsForUser
2790 ********************************************************************/
2791
2792 NTSTATUS _samr_GetGroupsForUser(pipes_struct *p,
2793 struct samr_GetGroupsForUser *r)
2794 {
2795 struct samu *sam_pass=NULL;
2796 DOM_SID sid;
2797 DOM_SID *sids;
2798 struct samr_RidWithAttribute dom_gid;
2799 struct samr_RidWithAttribute *gids = NULL;
2800 uint32 primary_group_rid;
2801 size_t num_groups = 0;
2802 gid_t *unix_gids;
2803 size_t i, num_gids;
2804 uint32 acc_granted;
2805 bool ret;
2806 NTSTATUS result;
2807 bool success = False;
2808
2809 struct samr_RidWithAttributeArray *rids = NULL;
2810
2811 /*
2812 * from the SID in the request:
2813 * we should send back the list of DOMAIN GROUPS
2814 * the user is a member of
2815 *
2816 * and only the DOMAIN GROUPS
2817 * no ALIASES !!! neither aliases of the domain
2818 * nor aliases of the builtin SID
2819 *
2820 * JFM, 12/2/2001
2821 */
2822
2823 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
2824
2825 rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidWithAttributeArray);
2826 if (!rids) {
2827 return NT_STATUS_NO_MEMORY;
2828 }
2829
2830 /* find the policy handle. open a policy on it. */
2831 if (!get_lsa_policy_samr_sid(p, r->in.user_handle, &sid, &acc_granted, NULL))
2832 return NT_STATUS_INVALID_HANDLE;
2833
2834 result = access_check_samr_function(acc_granted,
2835 SA_RIGHT_USER_GET_GROUPS,
2836 "_samr_GetGroupsForUser");
2837 if (!NT_STATUS_IS_OK(result)) {
2838 return result;
2839 }
2840
2841 if (!sid_check_is_in_our_domain(&sid))
2842 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2843
2844 if ( !(sam_pass = samu_new( p->mem_ctx )) ) {
2845 return NT_STATUS_NO_MEMORY;
2846 }
2847
2848 become_root();
2849 ret = pdb_getsampwsid(sam_pass, &sid);
2850 unbecome_root();
2851
2852 if (!ret) {
2853 DEBUG(10, ("pdb_getsampwsid failed for %s\n",
2854 sid_string_dbg(&sid)));
2855 return NT_STATUS_NO_SUCH_USER;
2856 }
2857
2858 sids = NULL;
2859
2860 /* make both calls inside the root block */
2861 become_root();
2862 result = pdb_enum_group_memberships(p->mem_ctx, sam_pass,
2863 &sids, &unix_gids, &num_groups);
2864 if ( NT_STATUS_IS_OK(result) ) {
2865 success = sid_peek_check_rid(get_global_sam_sid(),
2866 pdb_get_group_sid(sam_pass),
2867 &primary_group_rid);
2868 }
2869 unbecome_root();
2870
2871 if (!NT_STATUS_IS_OK(result)) {
2872 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
2873 sid_string_dbg(&sid)));
2874 return result;
2875 }
2876
2877 if ( !success ) {
2878 DEBUG(5, ("Group sid %s for user %s not in our domain\n",
2879 sid_string_dbg(pdb_get_group_sid(sam_pass)),
2880 pdb_get_username(sam_pass)));
2881 TALLOC_FREE(sam_pass);
2882 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2883 }
2884
2885 gids = NULL;
2886 num_gids = 0;
2887
2888 dom_gid.attributes = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
2889 SE_GROUP_ENABLED);
2890 dom_gid.rid = primary_group_rid;
2891 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
2892
2893 for (i=0; i<num_groups; i++) {
2894
2895 if (!sid_peek_check_rid(get_global_sam_sid(),
2896 &(sids[i]), &dom_gid.rid)) {
2897 DEBUG(10, ("Found sid %s not in our domain\n",
2898 sid_string_dbg(&sids[i])));
2899 continue;
2900 }
2901
2902 if (dom_gid.rid == primary_group_rid) {
2903 /* We added the primary group directly from the
2904 * sam_account. The other SIDs are unique from
2905 * enum_group_memberships */
2906 continue;
2907 }
2908
2909 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
2910 }
2911
2912 rids->count = num_gids;
2913 rids->rids = gids;
2914
2915 *r->out.rids = rids;
2916
2917 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
2918
2919 return result;
2920 }
2921
2922 /*******************************************************************
2923 _samr_QueryDomainInfo
2924 ********************************************************************/
2925
2926 NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
2927 struct samr_QueryDomainInfo *r)
2928 {
2929 NTSTATUS status = NT_STATUS_OK;
2930 struct samr_info *info = NULL;
2931 union samr_DomainInfo *dom_info;
2932 uint32 min_pass_len,pass_hist,password_properties;
2933 time_t u_expire, u_min_age;
2934 NTTIME nt_expire, nt_min_age;
2935
2936 time_t u_lock_duration, u_reset_time;
2937 NTTIME nt_lock_duration, nt_reset_time;
2938 uint32 lockout;
2939 time_t u_logout;
2940 NTTIME nt_logout;
2941
2942 uint32 account_policy_temp;
2943
2944 time_t seq_num;
2945 uint32 server_role;
2946
2947 uint32 num_users=0, num_groups=0, num_aliases=0;
2948
2949 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
2950
2951 dom_info = TALLOC_ZERO_P(p->mem_ctx, union samr_DomainInfo);
2952 if (!dom_info) {
2953 return NT_STATUS_NO_MEMORY;
2954 }
2955
2956 /* find the policy handle. open a policy on it. */
2957 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
2958 return NT_STATUS_INVALID_HANDLE;
2959 }
2960
2961 status = access_check_samr_function(info->acc_granted,
2962 SA_RIGHT_SAM_OPEN_DOMAIN,
2963 "_samr_QueryDomainInfo" );
2964
2965 if ( !NT_STATUS_IS_OK(status) )
2966 return status;
2967
2968 switch (r->in.level) {
2969 case 0x01:
2970
2971 become_root();
2972
2973 /* AS ROOT !!! */
2974
2975 pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp);
2976 min_pass_len = account_policy_temp;
2977
2978 pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
2979 pass_hist = account_policy_temp;
2980
2981 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
2982 password_properties = account_policy_temp;
2983
2984 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
2985 u_expire = account_policy_temp;
2986
2987 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
2988 u_min_age = account_policy_temp;
2989
2990 /* !AS ROOT */
2991
2992 unbecome_root();
2993
2994 unix_to_nt_time_abs(&nt_expire, u_expire);
2995 unix_to_nt_time_abs(&nt_min_age, u_min_age);
2996
2997 if (lp_check_password_script() && *lp_check_password_script()) {
2998 password_properties |= DOMAIN_PASSWORD_COMPLEX;
2999 }
3000
3001 init_samr_DomInfo1(&dom_info->info1,
3002 (uint16)min_pass_len,
3003 (uint16)pass_hist,
3004 password_properties,
3005 nt_expire,
3006 nt_min_age);
3007 break;
3008 case 0x02:
3009
3010 become_root();
3011
3012 /* AS ROOT !!! */
3013
3014 num_users = count_sam_users(info->disp_info, ACB_NORMAL);
3015 num_groups = count_sam_groups(info->disp_info);
3016 num_aliases = count_sam_aliases(info->disp_info);
3017
3018 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &account_policy_temp);
3019 u_logout = account_policy_temp;
3020
3021 unix_to_nt_time_abs(&nt_logout, u_logout);
3022
3023 if (!pdb_get_seq_num(&seq_num))
3024 seq_num = time(NULL);
3025
3026 /* !AS ROOT */
3027
3028 unbecome_root();
3029
3030 server_role = ROLE_DOMAIN_PDC;
3031 if (lp_server_role() == ROLE_DOMAIN_BDC)
3032 server_role = ROLE_DOMAIN_BDC;
3033
3034 init_samr_DomInfo2(&dom_info->info2,
3035 nt_logout,
3036 lp_serverstring(),
3037 lp_workgroup(),
3038 global_myname(),
3039 seq_num,
3040 1,
3041 server_role,
3042 1,
3043 num_users,
3044 num_groups,
3045 num_aliases);
3046 break;
3047 case 0x03:
3048
3049 become_root();
3050
3051 /* AS ROOT !!! */
3052
3053 {
3054 uint32 ul;
3055 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &ul);
3056 u_logout = (time_t)ul;
3057 }
3058
3059 /* !AS ROOT */
3060
3061 unbecome_root();
3062
3063 unix_to_nt_time_abs(&nt_logout, u_logout);
3064
3065 init_samr_DomInfo3(&dom_info->info3,
3066 nt_logout);
3067
3068 break;
3069 case 0x04:
3070 init_samr_DomInfo4(&dom_info->info4,
3071 lp_serverstring());
3072 break;
3073 case 0x05:
3074 init_samr_DomInfo5(&dom_info->info5,
3075 get_global_sam_name());
3076 break;
3077 case 0x06:
3078 /* NT returns its own name when a PDC. win2k and later
3079 * only the name of the PDC if itself is a BDC (samba4
3080 * idl) */
3081 init_samr_DomInfo6(&dom_info->info6,
3082 global_myname());
3083 break;
3084 case 0x07:
3085 server_role = ROLE_DOMAIN_PDC;
3086 if (lp_server_role() == ROLE_DOMAIN_BDC)
3087 server_role = ROLE_DOMAIN_BDC;
3088
3089 init_samr_DomInfo7(&dom_info->info7,
3090 server_role);
3091 break;
3092 case 0x08:
3093
3094 become_root();
3095
3096 /* AS ROOT !!! */
3097
3098 if (!pdb_get_seq_num(&seq_num)) {
3099 seq_num = time(NULL);
3100 }
3101
3102 /* !AS ROOT */
3103
3104 unbecome_root();
3105
3106 init_samr_DomInfo8(&dom_info->info8,
3107 seq_num,
3108 0);
3109 break;
3110 case 0x0c:
3111
3112 become_root();
3113
3114 /* AS ROOT !!! */
3115
3116 pdb_get_account_policy(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
3117 u_lock_duration = account_policy_temp;
3118 if (u_lock_duration != -1) {
3119 u_lock_duration *= 60;
3120 }
3121
3122 pdb_get_account_policy(AP_RESET_COUNT_TIME, &account_policy_temp);
3123 u_reset_time = account_policy_temp * 60;
3124
3125 pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
3126 lockout = account_policy_temp;
3127
3128 /* !AS ROOT */
3129
3130 unbecome_root();
3131
3132 unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
3133 unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
3134
3135 init_samr_DomInfo12(&dom_info->info12,
3136 nt_lock_duration,
3137 nt_reset_time,
3138 (uint16)lockout);
3139 break;
3140 default:
3141 return NT_STATUS_INVALID_INFO_CLASS;
3142 }
3143
3144 *r->out.info = dom_info;
3145
3146 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
3147
3148 return status;
3149 }
3150
3151 /* W2k3 seems to use the same check for all 3 objects that can be created via
3152 * SAMR, if you try to create for example "Dialup" as an alias it says
3153 * "NT_STATUS_USER_EXISTS". This is racy, but we can't really lock the user
3154 * database. */
3155
3156 static NTSTATUS can_create(TALLOC_CTX *mem_ctx, const char *new_name)
3157 {
3158 enum lsa_SidType type;
3159 bool result;
3160
3161 DEBUG(10, ("Checking whether [%s] can be created\n", new_name));
3162
3163 become_root();
3164 /* Lookup in our local databases (LOOKUP_NAME_REMOTE not set)
3165 * whether the name already exists */
3166 result = lookup_name(mem_ctx, new_name, LOOKUP_NAME_LOCAL,
3167 NULL, NULL, NULL, &type);
3168 unbecome_root();
3169
3170 if (!result) {
3171 DEBUG(10, ("%s does not exist, can create it\n", new_name));
3172 return NT_STATUS_OK;
3173 }
3174
3175 DEBUG(5, ("trying to create %s, exists as %s\n",
3176 new_name, sid_type_lookup(type)));
3177
3178 if (type == SID_NAME_DOM_GRP) {
3179 return NT_STATUS_GROUP_EXISTS;
3180 }
3181 if (type == SID_NAME_ALIAS) {
3182 return NT_STATUS_ALIAS_EXISTS;
3183 }
3184
3185 /* Yes, the default is NT_STATUS_USER_EXISTS */
3186 return NT_STATUS_USER_EXISTS;
3187 }
3188
3189 /*******************************************************************
3190 _samr_CreateUser2
3191 ********************************************************************/
3192
3193 NTSTATUS _samr_CreateUser2(pipes_struct *p,
3194 struct samr_CreateUser2 *r)
3195 {
3196 const char *account = NULL;
3197 DOM_SID sid;
3198 POLICY_HND dom_pol = *r->in.domain_handle;
3199 uint32_t acb_info = r->in.acct_flags;
3200 POLICY_HND *user_pol = r->out.user_handle;
3201 struct samr_info *info = NULL;
3202 NTSTATUS nt_status;
3203 uint32 acc_granted;
3204 SEC_DESC *psd;
3205 size_t sd_size;
3206 /* check this, when giving away 'add computer to domain' privs */
3207 uint32 des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
3208 bool can_add_account = False;
3209 SE_PRIV se_rights;
3210 DISP_INFO *disp_info = NULL;
3211
3212 /* Get the domain SID stored in the domain policy */
3213 if (!get_lsa_policy_samr_sid(p, &dom_pol, &sid, &acc_granted,
3214 &disp_info))
3215 return NT_STATUS_INVALID_HANDLE;
3216
3217 nt_status = access_check_samr_function(acc_granted,
3218 SA_RIGHT_DOMAIN_CREATE_USER,
3219 "_samr_CreateUser2");
3220 if (!NT_STATUS_IS_OK(nt_status)) {
3221 return nt_status;
3222 }
3223
3224 if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST ||
3225 acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
3226 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
3227 this parameter is not an account type */
3228 return NT_STATUS_INVALID_PARAMETER;
3229 }
3230
3231 account = r->in.account_name->string;
3232 if (account == NULL) {
3233 return NT_STATUS_NO_MEMORY;
3234 }
3235
3236 nt_status = can_create(p->mem_ctx, account);
3237 if (!NT_STATUS_IS_OK(nt_status)) {
3238 return nt_status;
3239 }
3240
3241 /* determine which user right we need to check based on the acb_info */
3242
3243 if ( acb_info & ACB_WSTRUST )
3244 {
3245 se_priv_copy( &se_rights, &se_machine_account );
3246 can_add_account = user_has_privileges(
3247 p->pipe_user.nt_user_token, &se_rights );
3248 }
3249 /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
3250 account for domain trusts and changes the ACB flags later */
3251 else if ( acb_info & ACB_NORMAL &&
3252 (account[strlen(account)-1] != '$') )
3253 {
3254 se_priv_copy( &se_rights, &se_add_users );
3255 can_add_account = user_has_privileges(
3256 p->pipe_user.nt_user_token, &se_rights );
3257 }
3258 else /* implicit assumption of a BDC or domain trust account here
3259 * (we already check the flags earlier) */
3260 {
3261 if ( lp_enable_privileges() ) {
3262 /* only Domain Admins can add a BDC or domain trust */
3263 se_priv_copy( &se_rights, &se_priv_none );
3264 can_add_account = nt_token_check_domain_rid(
3265 p->pipe_user.nt_user_token,
3266 DOMAIN_GROUP_RID_ADMINS );
3267 }
3268 }
3269
3270 DEBUG(5, ("_samr_CreateUser2: %s can add this account : %s\n",
3271 uidtoname(p->pipe_user.ut.uid),
3272 can_add_account ? "True":"False" ));
3273
3274 /********** BEGIN Admin BLOCK **********/
3275
3276 if ( can_add_account )
3277 become_root();
3278
3279 nt_status = pdb_create_user(p->mem_ctx, account, acb_info,
3280 r->out.rid);
3281
3282 if ( can_add_account )
3283 unbecome_root();
3284
3285 /********** END Admin BLOCK **********/
3286
3287 /* now check for failure */
3288
3289 if ( !NT_STATUS_IS_OK(nt_status) )
3290 return nt_status;
3291
3292 /* Get the user's SID */
3293
3294 sid_compose(&sid, get_global_sam_sid(), *r->out.rid);
3295
3296 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3297
3298 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
3299 &sid, SAMR_USR_RIGHTS_WRITE_PW);
3300 se_map_generic(&des_access, &usr_generic_mapping);
3301
3302 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3303 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
3304 &acc_granted, "_samr_CreateUser2");
3305
3306 if ( !NT_STATUS_IS_OK(nt_status) ) {
3307 return nt_status;
3308 }
3309
3310 /* associate the user's SID with the new handle. */
3311 if ((info = get_samr_info_by_sid(&sid)) == NULL) {
3312 return NT_STATUS_NO_MEMORY;
3313 }
3314
3315 ZERO_STRUCTP(info);
3316 info->sid = sid;
3317 info->acc_granted = acc_granted;
3318
3319 /* get a (unique) handle. open a policy on it. */
3320 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info)) {
3321 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3322 }
3323
3324 /* After a "set" ensure we have no cached display info. */
3325 force_flush_samr_cache(info->disp_info);
3326
3327 *r->out.access_granted = acc_granted;
3328
3329 return NT_STATUS_OK;
3330 }
3331
3332 /*******************************************************************
3333 _samr_Connect
3334 ********************************************************************/
3335
3336 NTSTATUS _samr_Connect(pipes_struct *p,
3337 struct samr_Connect *r)
3338 {
3339 struct samr_info *info = NULL;
3340 uint32 des_access = r->in.access_mask;
3341
3342 /* Access check */
3343
3344 if (!pipe_access_check(p)) {
3345 DEBUG(3, ("access denied to _samr_Connect\n"));
3346 return NT_STATUS_ACCESS_DENIED;
3347 }
3348
3349 /* set up the SAMR connect_anon response */
3350
3351 /* associate the user's SID with the new handle. */
3352 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3353 return NT_STATUS_NO_MEMORY;
3354
3355 /* don't give away the farm but this is probably ok. The SA_RIGHT_SAM_ENUM_DOMAINS
3356 was observed from a win98 client trying to enumerate users (when configured
3357 user level access control on shares) --jerry */
3358
3359 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3360
3361 se_map_generic( &des_access, &sam_generic_mapping );
3362 info->acc_granted = des_access & (SA_RIGHT_SAM_ENUM_DOMAINS|SA_RIGHT_SAM_OPEN_DOMAIN);
3363
3364 /* get a (unique) handle. open a policy on it. */
3365 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3366 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3367
3368 return NT_STATUS_OK;
3369 }
3370
3371 /*******************************************************************
3372 _samr_Connect2
3373 ********************************************************************/
3374
3375 NTSTATUS _samr_Connect2(pipes_struct *p,
3376 struct samr_Connect2 *r)
3377 {
3378 struct samr_info *info = NULL;
3379 SEC_DESC *psd = NULL;
3380 uint32 acc_granted;
3381 uint32 des_access = r->in.access_mask;
3382 NTSTATUS nt_status;
3383 size_t sd_size;
3384
3385
3386 DEBUG(5,("_samr_Connect2: %d\n", __LINE__));
3387
3388 /* Access check */
3389
3390 if (!pipe_access_check(p)) {
3391 DEBUG(3, ("access denied to _samr_Connect2\n"));
3392 return NT_STATUS_ACCESS_DENIED;
3393 }
3394
3395 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3396
3397 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3398 se_map_generic(&des_access, &sam_generic_mapping);
3399
3400 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3401 NULL, 0, des_access, &acc_granted, "_samr_Connect2");
3402
3403 if ( !NT_STATUS_IS_OK(nt_status) )
3404 return nt_status;
3405
3406 /* associate the user's SID and access granted with the new handle. */
3407 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3408 return NT_STATUS_NO_MEMORY;
3409
3410 info->acc_granted = acc_granted;
3411 info->status = r->in.access_mask; /* this looks so wrong... - gd */
3412
3413 /* get a (unique) handle. open a policy on it. */
3414 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3415 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3416
3417 DEBUG(5,("_samr_Connect2: %d\n", __LINE__));
3418
3419 return nt_status;
3420 }
3421
3422 /*******************************************************************
3423 _samr_Connect4
3424 ********************************************************************/
3425
3426 NTSTATUS _samr_Connect4(pipes_struct *p,
3427 struct samr_Connect4 *r)
3428 {
3429 struct samr_info *info = NULL;
3430 SEC_DESC *psd = NULL;
3431 uint32 acc_granted;
3432 uint32 des_access = r->in.access_mask;
3433 NTSTATUS nt_status;
3434 size_t sd_size;
3435
3436
3437 DEBUG(5,("_samr_Connect4: %d\n", __LINE__));
3438
3439 /* Access check */
3440
3441 if (!pipe_access_check(p)) {
3442 DEBUG(3, ("access denied to samr_Connect4\n"));
3443 return NT_STATUS_ACCESS_DENIED;
3444 }
3445
3446 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3447
3448 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3449 se_map_generic(&des_access, &sam_generic_mapping);
3450
3451 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3452 NULL, 0, des_access, &acc_granted, "_samr_Connect4");
3453
3454 if ( !NT_STATUS_IS_OK(nt_status) )
3455 return nt_status;
3456
3457 /* associate the user's SID and access granted with the new handle. */
3458 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3459 return NT_STATUS_NO_MEMORY;
3460
3461 info->acc_granted = acc_granted;
3462 info->status = r->in.access_mask; /* ??? */
3463
3464 /* get a (unique) handle. open a policy on it. */
3465 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3466 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3467
3468 DEBUG(5,("_samr_Connect4: %d\n", __LINE__));
3469
3470 return NT_STATUS_OK;
3471 }
3472
3473 /*******************************************************************
3474 _samr_Connect5
3475 ********************************************************************/
3476
3477 NTSTATUS _samr_Connect5(pipes_struct *p,
3478 struct samr_Connect5 *r)
3479 {
3480 struct samr_info *info = NULL;
3481 SEC_DESC *psd = NULL;
3482 uint32 acc_granted;
3483 uint32 des_access = r->in.access_mask;
3484 NTSTATUS nt_status;
3485 size_t sd_size;
3486 struct samr_ConnectInfo1 info1;
3487
3488 DEBUG(5,("_samr_Connect5: %d\n", __LINE__));
3489
3490 /* Access check */
3491
3492 if (!pipe_access_check(p)) {
3493 DEBUG(3, ("access denied to samr_Connect5\n"));
3494 return NT_STATUS_ACCESS_DENIED;
3495 }
3496
3497 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3498
3499 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3500 se_map_generic(&des_access, &sam_generic_mapping);
3501
3502 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3503 NULL, 0, des_access, &acc_granted, "_samr_Connect5");
3504
3505 if ( !NT_STATUS_IS_OK(nt_status) )
3506 return nt_status;
3507
3508 /* associate the user's SID and access granted with the new handle. */
3509 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3510 return NT_STATUS_NO_MEMORY;
3511
3512 info->acc_granted = acc_granted;
3513 info->status = r->in.access_mask; /* ??? */
3514
3515 /* get a (unique) handle. open a policy on it. */
3516 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3517 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3518
3519 DEBUG(5,("_samr_Connect5: %d\n", __LINE__));
3520
3521 info1.client_version = SAMR_CONNECT_AFTER_W2K;
3522 info1.unknown2 = 0;
3523
3524 *r->out.level_out = 1;
3525 r->out.info_out->info1 = info1;
3526
3527 return NT_STATUS_OK;
3528 }
3529
3530 /**********************************************************************
3531 _samr_LookupDomain
3532 **********************************************************************/
3533
3534 NTSTATUS _samr_LookupDomain(pipes_struct *p,
3535 struct samr_LookupDomain *r)
3536 {
3537 NTSTATUS status = NT_STATUS_OK;
3538 struct samr_info *info;
3539 const char *domain_name;
3540 DOM_SID *sid = NULL;
3541
3542 if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
3543 return NT_STATUS_INVALID_HANDLE;
3544
3545 /* win9x user manager likes to use SA_RIGHT_SAM_ENUM_DOMAINS here.
3546 Reverted that change so we will work with RAS servers again */
3547
3548 status = access_check_samr_function(info->acc_granted,
3549 SA_RIGHT_SAM_OPEN_DOMAIN,
3550 "_samr_LookupDomain");
3551 if (!NT_STATUS_IS_OK(status)) {
3552 return status;
3553 }
3554
3555 domain_name = r->in.domain_name->string;
3556
3557 sid = TALLOC_ZERO_P(p->mem_ctx, struct dom_sid2);
3558 if (!sid) {
3559 return NT_STATUS_NO_MEMORY;
3560 }
3561
3562 if (strequal(domain_name, builtin_domain_name())) {
3563 sid_copy(sid, &global_sid_Builtin);
3564 } else {
3565 if (!secrets_fetch_domain_sid(domain_name, sid)) {
3566 status = NT_STATUS_NO_SUCH_DOMAIN;
3567 }
3568 }
3569
3570 DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name,
3571 sid_string_dbg(sid)));
3572
3573 *r->out.sid = sid;
3574
3575 return status;
3576 }
3577
3578 /**********************************************************************
3579 _samr_EnumDomains
3580 **********************************************************************/
3581
3582 NTSTATUS _samr_EnumDomains(pipes_struct *p,
3583 struct samr_EnumDomains *r)
3584 {
3585 NTSTATUS status;
3586 struct samr_info *info;
3587 uint32_t num_entries = 2;
3588 struct samr_SamEntry *entry_array = NULL;
3589 struct samr_SamArray *sam;
3590
3591 if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
3592 return NT_STATUS_INVALID_HANDLE;
3593
3594 status = access_check_samr_function(info->acc_granted,
3595 SA_RIGHT_SAM_ENUM_DOMAINS,
3596 "_samr_EnumDomains");
3597 if (!NT_STATUS_IS_OK(status)) {
3598 return status;
3599 }
3600
3601 sam = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
3602 if (!sam) {
3603 return NT_STATUS_NO_MEMORY;
3604 }
3605
3606 entry_array = TALLOC_ZERO_ARRAY(p->mem_ctx,
3607 struct samr_SamEntry,
3608 num_entries);
3609 if (!entry_array) {
3610 return NT_STATUS_NO_MEMORY;
3611 }
3612
3613 entry_array[0].idx = 0;
3614 init_lsa_String(&entry_array[0].name, get_global_sam_name());
3615
3616 entry_array[1].idx = 1;
3617 init_lsa_String(&entry_array[1].name, "Builtin");
3618
3619 sam->count = num_entries;
3620 sam->entries = entry_array;
3621
3622 *r->out.sam = sam;
3623 *r->out.num_entries = num_entries;
3624
3625 return status;
3626 }
3627
3628 /*******************************************************************
3629 _samr_OpenAlias
3630 ********************************************************************/
3631
3632 NTSTATUS _samr_OpenAlias(pipes_struct *p,
3633 struct samr_OpenAlias *r)
3634 {
3635 DOM_SID sid;
3636 POLICY_HND domain_pol = *r->in.domain_handle;
3637 uint32 alias_rid = r->in.rid;
3638 POLICY_HND *alias_pol = r->out.alias_handle;
3639 struct samr_info *info = NULL;
3640 SEC_DESC *psd = NULL;
3641 uint32 acc_granted;
3642 uint32 des_access = r->in.access_mask;
3643 size_t sd_size;
3644 NTSTATUS status;
3645 SE_PRIV se_rights;
3646
3647 /* find the domain policy and get the SID / access bits stored in the domain policy */
3648
3649 if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted, NULL) )
3650 return NT_STATUS_INVALID_HANDLE;
3651
3652 status = access_check_samr_function(acc_granted,
3653 SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
3654 "_samr_OpenAlias");
3655
3656 if ( !NT_STATUS_IS_OK(status) )
3657 return status;
3658
3659 /* append the alias' RID to it */
3660
3661 if (!sid_append_rid(&sid, alias_rid))
3662 return NT_STATUS_NO_SUCH_ALIAS;
3663
3664 /*check if access can be granted as requested by client. */
3665
3666 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3667
3668 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
3669 se_map_generic(&des_access,&ali_generic_mapping);
3670
3671 se_priv_copy( &se_rights, &se_add_users );
3672
3673
3674 status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3675 &se_rights, GENERIC_RIGHTS_ALIAS_WRITE, des_access,
3676 &acc_granted, "_samr_OpenAlias");
3677
3678 if ( !NT_STATUS_IS_OK(status) )
3679 return status;
3680
3681 {
3682 /* Check we actually have the requested alias */
3683 enum lsa_SidType type;
3684 bool result;
3685 gid_t gid;
3686
3687 become_root();
3688 result = lookup_sid(NULL, &sid, NULL, NULL, &type);
3689 unbecome_root();
3690
3691 if (!result || (type != SID_NAME_ALIAS)) {
3692 return NT_STATUS_NO_SUCH_ALIAS;
3693 }
3694
3695 /* make sure there is a mapping */
3696
3697 if ( !sid_to_gid( &sid, &gid ) ) {
3698 return NT_STATUS_NO_SUCH_ALIAS;
3699 }
3700
3701 }
3702
3703 /* associate the alias SID with the new handle. */
3704 if ((info = get_samr_info_by_sid(&sid)) == NULL)
3705 return NT_STATUS_NO_MEMORY;
3706
3707 info->acc_granted = acc_granted;
3708
3709 /* get a (unique) handle. open a policy on it. */
3710 if (!create_policy_hnd(p, alias_pol, free_samr_info, (void *)info))
3711 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3712
3713 return NT_STATUS_OK;
3714 }
3715
3716 /*******************************************************************
3717 set_user_info_7
3718 ********************************************************************/
3719
3720 static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
3721 struct samr_UserInfo7 *id7,
3722 struct samu *pwd)
3723 {
3724 NTSTATUS rc;
3725
3726 if (id7 == NULL) {
3727 DEBUG(5, ("set_user_info_7: NULL id7\n"));
3728 TALLOC_FREE(pwd);
3729 return NT_STATUS_ACCESS_DENIED;
3730 }
3731
3732 if (!id7->account_name.string) {
3733 DEBUG(5, ("set_user_info_7: failed to get new username\n"));
3734 TALLOC_FREE(pwd);
3735 return NT_STATUS_ACCESS_DENIED;
3736 }
3737
3738 /* check to see if the new username already exists. Note: we can't
3739 reliably lock all backends, so there is potentially the
3740 possibility that a user can be created in between this check and
3741 the rename. The rename should fail, but may not get the
3742 exact same failure status code. I think this is small enough
3743 of a window for this type of operation and the results are
3744 simply that the rename fails with a slightly different status
3745 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3746
3747 rc = can_create(mem_ctx, id7->account_name.string);
3748 if (!NT_STATUS_IS_OK(rc)) {
3749 return rc;
3750 }
3751
3752 rc = pdb_rename_sam_account(pwd, id7->account_name.string);
3753
3754 TALLOC_FREE(pwd);
3755 return rc;
3756 }
3757
3758 /*******************************************************************
3759 set_user_info_16
3760 ********************************************************************/
3761
3762 static bool set_user_info_16(struct samr_UserInfo16 *id16,
3763 struct samu *pwd)
3764 {
3765 if (id16 == NULL) {
3766 DEBUG(5, ("set_user_info_16: NULL id16\n"));
3767 TALLOC_FREE(pwd);
3768 return False;
3769 }
3770
3771 /* FIX ME: check if the value is really changed --metze */
3772 if (!pdb_set_acct_ctrl(pwd, id16->acct_flags, PDB_CHANGED)) {
3773 TALLOC_FREE(pwd);
3774 return False;
3775 }
3776
3777 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3778 TALLOC_FREE(pwd);
3779 return False;
3780 }
3781
3782 TALLOC_FREE(pwd);
3783
3784 return True;
3785 }
3786
3787 /*******************************************************************
3788 set_user_info_18
3789 ********************************************************************/
3790
3791 static bool set_user_info_18(struct samr_UserInfo18 *id18,
3792 struct samu *pwd)
3793 {
3794 if (id18 == NULL) {
3795 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
3796 TALLOC_FREE(pwd);
3797 return False;
3798 }
3799
3800 if (!pdb_set_lanman_passwd (pwd, id18->lm_pwd.hash, PDB_CHANGED)) {
3801 TALLOC_FREE(pwd);
3802 return False;
3803 }
3804 if (!pdb_set_nt_passwd (pwd, id18->nt_pwd.hash, PDB_CHANGED)) {
3805 TALLOC_FREE(pwd);
3806 return False;
3807 }
3808 if (!pdb_set_pass_last_set_time (pwd, time(NULL), PDB_CHANGED)) {
3809 TALLOC_FREE(pwd);
3810 return False;
3811 }
3812
3813 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3814 TALLOC_FREE(pwd);
3815 return False;
3816 }
3817
3818 TALLOC_FREE(pwd);
3819 return True;
3820 }
3821
3822 /*******************************************************************
3823 set_user_info_20
3824 ********************************************************************/
3825
3826 static bool set_user_info_20(struct samr_UserInfo20 *id20,
3827 struct samu *pwd)
3828 {
3829 if (id20 == NULL) {
3830 DEBUG(5, ("set_user_info_20: NULL id20\n"));
3831 return False;
3832 }
3833
3834 copy_id20_to_sam_passwd(pwd, id20);
3835
3836 /* write the change out */
3837 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3838 TALLOC_FREE(pwd);
3839 return False;
3840 }
3841
3842 TALLOC_FREE(pwd);
3843
3844 return True;
3845 }
3846
3847 /*******************************************************************
3848 set_user_info_21
3849 ********************************************************************/
3850
3851 static NTSTATUS set_user_info_21(TALLOC_CTX *mem_ctx,
3852 struct samr_UserInfo21 *id21,
3853 struct samu *pwd)
3854 {
3855 NTSTATUS status;
3856
3857 if (id21 == NULL) {
3858 DEBUG(5, ("set_user_info_21: NULL id21\n"));
3859 return NT_STATUS_INVALID_PARAMETER;
3860 }
3861
3862 /* we need to separately check for an account rename first */
3863
3864 if (id21->account_name.string &&
3865 (!strequal(id21->account_name.string, pdb_get_username(pwd))))
3866 {
3867
3868 /* check to see if the new username already exists. Note: we can't
3869 reliably lock all backends, so there is potentially the
3870 possibility that a user can be created in between this check and
3871 the rename. The rename should fail, but may not get the
3872 exact same failure status code. I think this is small enough
3873 of a window for this type of operation and the results are
3874 simply that the rename fails with a slightly different status
3875 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3876
3877 status = can_create(mem_ctx, id21->account_name.string);
3878 if (!NT_STATUS_IS_OK(status)) {
3879 return status;
3880 }
3881
3882 status = pdb_rename_sam_account(pwd, id21->account_name.string);
3883
3884 if (!NT_STATUS_IS_OK(status)) {
3885 DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
3886 nt_errstr(status)));
3887 TALLOC_FREE(pwd);
3888 return status;
3889 }
3890
3891 /* set the new username so that later
3892 functions can work on the new account */
3893 pdb_set_username(pwd, id21->account_name.string, PDB_SET);
3894 }
3895
3896 copy_id21_to_sam_passwd("INFO_21", pwd, id21);
3897
3898 /*
3899 * The funny part about the previous two calls is
3900 * that pwd still has the password hashes from the
3901 * passdb entry. These have not been updated from
3902 * id21. I don't know if they need to be set. --jerry
3903 */
3904
3905 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
3906 status = pdb_set_unix_primary_group(mem_ctx, pwd);
3907 if ( !NT_STATUS_IS_OK(status) ) {
3908 return status;
3909 }
3910 }
3911
3912 /* Don't worry about writing out the user account since the
3913 primary group SID is generated solely from the user's Unix
3914 primary group. */
3915
3916 /* write the change out */
3917 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3918 TALLOC_FREE(pwd);
3919 return status;
3920 }
3921
3922 TALLOC_FREE(pwd);
3923
3924 return NT_STATUS_OK;
3925 }
3926
3927 /*******************************************************************
3928 set_user_info_23
3929 ********************************************************************/
3930
3931 static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
3932 struct samr_UserInfo23 *id23,
3933 struct samu *pwd)
3934 {
3935 char *plaintext_buf = NULL;
3936 uint32 len = 0;
3937 uint16 acct_ctrl;
3938 NTSTATUS status;
3939
3940 if (id23 == NULL) {
3941 DEBUG(5, ("set_user_info_23: NULL id23\n"));
3942 return NT_STATUS_INVALID_PARAMETER;
3943 }
3944
3945 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
3946 pdb_get_username(pwd)));
3947
3948 acct_ctrl = pdb_get_acct_ctrl(pwd);
3949
3950 if (!decode_pw_buffer(mem_ctx,
3951 id23->password.data,
3952 &plaintext_buf,
3953 &len,
3954 STR_UNICODE)) {
3955 TALLOC_FREE(pwd);
3956 return NT_STATUS_INVALID_PARAMETER;
3957 }
3958
3959 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
3960 TALLOC_FREE(pwd);
3961 return NT_STATUS_ACCESS_DENIED;
3962 }
3963
3964 copy_id23_to_sam_passwd(pwd, id23);
3965
3966 /* if it's a trust account, don't update /etc/passwd */
3967 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
3968 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
3969 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
3970 DEBUG(5, ("Changing trust account. Not updating /etc/passwd\n"));
3971 } else {
3972 /* update the UNIX password */
3973 if (lp_unix_password_sync() ) {
3974 struct passwd *passwd;
3975 if (pdb_get_username(pwd) == NULL) {
3976 DEBUG(1, ("chgpasswd: User without name???\n"));
3977 TALLOC_FREE(pwd);
3978 return NT_STATUS_ACCESS_DENIED;
3979 }
3980
3981 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
3982 if (passwd == NULL) {
3983 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3984 }
3985
3986 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
3987 TALLOC_FREE(pwd);
3988 return NT_STATUS_ACCESS_DENIED;
3989 }
3990 TALLOC_FREE(passwd);
3991 }
3992 }
3993
3994 memset(plaintext_buf, '\0', strlen(plaintext_buf));
3995
3996 if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) &&
3997 (!NT_STATUS_IS_OK(status = pdb_set_unix_primary_group(mem_ctx,
3998 pwd)))) {
3999 TALLOC_FREE(pwd);
4000 return status;
4001 }
4002
4003 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4004 TALLOC_FREE(pwd);
4005 return status;
4006 }
4007
4008 TALLOC_FREE(pwd);
4009
4010 return NT_STATUS_OK;
4011 }
4012
4013 /*******************************************************************
4014 set_user_info_pw
4015 ********************************************************************/
4016
4017 static bool set_user_info_pw(uint8 *pass, struct samu *pwd,
4018 int level)
4019 {
4020 uint32 len = 0;
4021 char *plaintext_buf = NULL;
4022 uint32 acct_ctrl;
4023 time_t last_set_time;
4024 enum pdb_value_state last_set_state;
4025
4026 DEBUG(5, ("Attempting administrator password change for user %s\n",
4027 pdb_get_username(pwd)));
4028
4029 acct_ctrl = pdb_get_acct_ctrl(pwd);
4030 /* we need to know if it's expired, because this is an admin change, not a
4031 user change, so it's still expired when we're done */
4032 last_set_state = pdb_get_init_flags(pwd, PDB_PASSLASTSET);
4033 last_set_time = pdb_get_pass_last_set_time(pwd);
4034
4035 if (!decode_pw_buffer(talloc_tos(),
4036 pass,
4037 &plaintext_buf,
4038 &len,
4039 STR_UNICODE)) {
4040 TALLOC_FREE(pwd);
4041 return False;
4042 }
4043
4044 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
4045 TALLOC_FREE(pwd);
4046 return False;
4047 }
4048
4049 /* if it's a trust account, don't update /etc/passwd */
4050 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
4051 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
4052 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
4053 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
4054 } else {
4055 /* update the UNIX password */
4056 if (lp_unix_password_sync()) {
4057 struct passwd *passwd;
4058
4059 if (pdb_get_username(pwd) == NULL) {
4060 DEBUG(1, ("chgpasswd: User without name???\n"));
4061 TALLOC_FREE(pwd);
4062 return False;
4063 }
4064
4065 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
4066 if (passwd == NULL) {
4067 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
4068 }
4069
4070 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
4071 TALLOC_FREE(pwd);
4072 return False;
4073 }
4074 TALLOC_FREE(passwd);
4075 }
4076 }
4077
4078 memset(plaintext_buf, '\0', strlen(plaintext_buf));
4079
4080 /*
4081 * A level 25 change does reset the pwdlastset field, a level 24
4082 * change does not. I know this is probably not the full story, but
4083 * it is needed to make XP join LDAP correctly, without it the later
4084 * auth2 check can fail with PWD_MUST_CHANGE.
4085 */
4086 if (level != 25) {
4087 /*
4088 * restore last set time as this is an admin change, not a
4089 * user pw change
4090 */
4091 pdb_set_pass_last_set_time (pwd, last_set_time,
4092 last_set_state);
4093 }
4094
4095 DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
4096
4097 /* update the SAMBA password */
4098 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
4099 TALLOC_FREE(pwd);
4100 return False;
4101 }
4102
4103 TALLOC_FREE(pwd);
4104
4105 return True;
4106 }
4107
4108 /*******************************************************************
4109 set_user_info_25
4110 ********************************************************************/
4111
4112 static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx,
4113 struct samr_UserInfo25 *id25,
4114 struct samu *pwd)
4115 {
4116 NTSTATUS status;
4117
4118 if (id25 == NULL) {
4119 DEBUG(5, ("set_user_info_25: NULL id25\n"));
4120 return NT_STATUS_INVALID_PARAMETER;
4121 }
4122
4123 copy_id25_to_sam_passwd(pwd, id25);
4124
4125 /* write the change out */
4126 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4127 TALLOC_FREE(pwd);
4128 return status;
4129 }
4130
4131 /*
4132 * We need to "pdb_update_sam_account" before the unix primary group
4133 * is set, because the idealx scripts would also change the
4134 * sambaPrimaryGroupSid using the ldap replace method. pdb_ldap uses
4135 * the delete explicit / add explicit, which would then fail to find
4136 * the previous primaryGroupSid value.
4137 */
4138
4139 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
4140 status = pdb_set_unix_primary_group(mem_ctx, pwd);
4141 if ( !NT_STATUS_IS_OK(status) ) {
4142 return status;
4143 }
4144 }
4145
4146 /* WARNING: No TALLOC_FREE(pwd), we are about to set the password
4147 * hereafter! */
4148
4149 return NT_STATUS_OK;
4150 }
4151
4152 /*******************************************************************
4153 samr_SetUserInfo
4154 ********************************************************************/
4155
4156 NTSTATUS _samr_SetUserInfo(pipes_struct *p,
4157 struct samr_SetUserInfo *r)
4158 {
4159 NTSTATUS status;
4160 struct samu *pwd = NULL;
4161 DOM_SID sid;
4162 POLICY_HND *pol = r->in.user_handle;
4163 union samr_UserInfo *info = r->in.info;
4164 uint16_t switch_value = r->in.level;
4165 uint32_t acc_granted;
4166 uint32_t acc_required;
4167 bool ret;
4168 bool has_enough_rights = False;
4169 uint32_t acb_info;
4170 DISP_INFO *disp_info = NULL;
4171
4172 DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__));
4173
4174 /* find the policy handle. open a policy on it. */
4175 if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info)) {
4176 return NT_STATUS_INVALID_HANDLE;
4177 }
4178
4179 /* This is tricky. A WinXP domain join sets
4180 (SA_RIGHT_USER_SET_PASSWORD|SA_RIGHT_USER_SET_ATTRIBUTES|SA_RIGHT_USER_ACCT_FLAGS_EXPIRY)
4181 The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser(). But the
4182 standard Win32 API calls just ask for SA_RIGHT_USER_SET_PASSWORD in the SamrOpenUser().
4183 This should be enough for levels 18, 24, 25,& 26. Info level 23 can set more so
4184 we'll use the set from the WinXP join as the basis. */
4185
4186 switch (switch_value) {
4187 case 18:
4188 case 24:
4189 case 25:
4190 case 26:
4191 acc_required = SA_RIGHT_USER_SET_PASSWORD;
4192 break;
4193 default:
4194 acc_required = SA_RIGHT_USER_SET_PASSWORD |
4195 SA_RIGHT_USER_SET_ATTRIBUTES |
4196 SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
4197 break;
4198 }
4199
4200 status = access_check_samr_function(acc_granted,
4201 acc_required,
4202 "_samr_SetUserInfo");
4203 if (!NT_STATUS_IS_OK(status)) {
4204 return status;
4205 }
4206
4207 DEBUG(5, ("_samr_SetUserInfo: sid:%s, level:%d\n",
4208 sid_string_dbg(&sid), switch_value));
4209
4210 if (info == NULL) {
4211 DEBUG(5, ("_samr_SetUserInfo: NULL info level\n"));
4212 return NT_STATUS_INVALID_INFO_CLASS;
4213 }
4214
4215 if (!(pwd = samu_new(NULL))) {
4216 return NT_STATUS_NO_MEMORY;
4217 }
4218
4219 become_root();
4220 ret = pdb_getsampwsid(pwd, &sid);
4221 unbecome_root();
4222
4223 if (!ret) {
4224 TALLOC_FREE(pwd);
4225 return NT_STATUS_NO_SUCH_USER;
4226 }
4227
4228 /* deal with machine password changes differently from userinfo changes */
4229 /* check to see if we have the sufficient rights */
4230
4231 acb_info = pdb_get_acct_ctrl(pwd);
4232 if (acb_info & ACB_WSTRUST)
4233 has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
4234 &se_machine_account);
4235 else if (acb_info & ACB_NORMAL)
4236 has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
4237 &se_add_users);
4238 else if (acb_info & (ACB_SVRTRUST|ACB_DOMTRUST)) {
4239 if (lp_enable_privileges()) {
4240 has_enough_rights = nt_token_check_domain_rid(p->pipe_user.nt_user_token,
4241 DOMAIN_GROUP_RID_ADMINS);
4242 }
4243 }
4244
4245 DEBUG(5, ("_samr_SetUserInfo: %s does%s possess sufficient rights\n",
4246 uidtoname(p->pipe_user.ut.uid),
4247 has_enough_rights ? "" : " not"));
4248
4249 /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
4250
4251 if (has_enough_rights) {
4252 become_root();
4253 }
4254
4255 /* ok! user info levels (lots: see MSDEV help), off we go... */
4256
4257 switch (switch_value) {
4258
4259 case 7:
4260 status = set_user_info_7(p->mem_ctx,
4261 &info->info7, pwd);
4262 break;
4263
4264 case 16:
4265 if (!set_user_info_16(&info->info16, pwd)) {
4266 status = NT_STATUS_ACCESS_DENIED;
4267 }
4268 break;
4269
4270 case 18:
4271 /* Used by AS/U JRA. */
4272 if (!set_user_info_18(&info->info18, pwd)) {
4273 status = NT_STATUS_ACCESS_DENIED;
4274 }
4275 break;
4276
4277 case 20:
4278 if (!set_user_info_20(&info->info20, pwd)) {
4279 status = NT_STATUS_ACCESS_DENIED;
4280 }
4281 break;
4282
4283 case 21:
4284 status = set_user_info_21(p->mem_ctx,
4285 &info->info21, pwd);
4286 break;
4287
4288 case 23:
4289 if (!p->session_key.length) {
4290 status = NT_STATUS_NO_USER_SESSION_KEY;
4291 }
4292 SamOEMhashBlob(info->info23.password.data, 516,
4293 &p->session_key);
4294
4295 dump_data(100, info->info23.password.data, 516);
4296
4297 status = set_user_info_23(p->mem_ctx,
4298 &info->info23, pwd);
4299 break;
4300
4301 case 24:
4302 if (!p->session_key.length) {
4303 status = NT_STATUS_NO_USER_SESSION_KEY;
4304 }
4305 SamOEMhashBlob(info->info24.password.data,
4306 516,
4307 &p->session_key);
4308
4309 dump_data(100, info->info24.password.data, 516);
4310
4311 if (!set_user_info_pw(info->info24.password.data, pwd,
4312 switch_value)) {
4313 status = NT_STATUS_ACCESS_DENIED;
4314 }
4315 break;
4316
4317 case 25:
4318 if (!p->session_key.length) {
4319 status = NT_STATUS_NO_USER_SESSION_KEY;
4320 }
4321 encode_or_decode_arc4_passwd_buffer(info->info25.password.data,
4322 &p->session_key);
4323
4324 dump_data(100, info->info25.password.data, 532);
4325
4326 status = set_user_info_25(p->mem_ctx,
4327 &info->info25, pwd);
4328 if (!NT_STATUS_IS_OK(status)) {
4329 goto done;
4330 }
4331 if (!set_user_info_pw(info->info25.password.data, pwd,
4332 switch_value)) {
4333 status = NT_STATUS_ACCESS_DENIED;
4334 }
4335 break;
4336
4337 case 26:
4338 if (!p->session_key.length) {
4339 status = NT_STATUS_NO_USER_SESSION_KEY;
4340 }
4341 encode_or_decode_arc4_passwd_buffer(info->info26.password.data,
4342 &p->session_key);
4343
4344 dump_data(100, info->info26.password.data, 516);
4345
4346 if (!set_user_info_pw(info->info26.password.data, pwd,
4347 switch_value)) {
4348 status = NT_STATUS_ACCESS_DENIED;
4349 }
4350 break;
4351
4352 default:
4353 status = NT_STATUS_INVALID_INFO_CLASS;
4354 }
4355
4356 done:
4357
4358 if (has_enough_rights) {
4359 unbecome_root();
4360 }
4361
4362 /* ================ END SeMachineAccountPrivilege BLOCK ================ */
4363
4364 if (NT_STATUS_IS_OK(status)) {
4365 force_flush_samr_cache(disp_info);
4366 }
4367
4368 return status;
4369 }
4370
4371 /*******************************************************************
4372 _samr_SetUserInfo2
4373 ********************************************************************/
4374
4375 NTSTATUS _samr_SetUserInfo2(pipes_struct *p,
4376 struct samr_SetUserInfo2 *r)
4377 {
4378 struct samr_SetUserInfo q;
4379
4380 q.in.user_handle = r->in.user_handle;
4381 q.in.level = r->in.level;
4382 q.in.info = r->in.info;
4383
4384 return _samr_SetUserInfo(p, &q);
4385 }
4386
4387 /*********************************************************************
4388 _samr_GetAliasMembership
4389 *********************************************************************/
4390
4391 NTSTATUS _samr_GetAliasMembership(pipes_struct *p,
4392 struct samr_GetAliasMembership *r)
4393 {
4394 size_t num_alias_rids;
4395 uint32 *alias_rids;
4396 struct samr_info *info = NULL;
4397 size_t i;
4398
4399 NTSTATUS ntstatus1;
4400 NTSTATUS ntstatus2;
4401
4402 DOM_SID *members;
4403
4404 DEBUG(5,("_samr_GetAliasMembership: %d\n", __LINE__));
4405
4406 /* find the policy handle. open a policy on it. */
4407 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
4408 return NT_STATUS_INVALID_HANDLE;
4409
4410 ntstatus1 = access_check_samr_function(info->acc_granted,
4411 SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM,
4412 "_samr_GetAliasMembership");
4413 ntstatus2 = access_check_samr_function(info->acc_granted,
4414 SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
4415 "_samr_GetAliasMembership");
4416
4417 if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
4418 if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
4419 !(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus1))) {
4420 return (NT_STATUS_IS_OK(ntstatus1)) ? ntstatus2 : ntstatus1;
4421 }
4422 }
4423
4424 if (!sid_check_is_domain(&info->sid) &&
4425 !sid_check_is_builtin(&info->sid))
4426 return NT_STATUS_OBJECT_TYPE_MISMATCH;
4427
4428 if (r->in.sids->num_sids) {
4429 members = TALLOC_ARRAY(p->mem_ctx, DOM_SID, r->in.sids->num_sids);
4430
4431 if (members == NULL)
4432 return NT_STATUS_NO_MEMORY;
4433 } else {
4434 members = NULL;
4435 }
4436
4437 for (i=0; i<r->in.sids->num_sids; i++)
4438 sid_copy(&members[i], r->in.sids->sids[i].sid);
4439
4440 alias_rids = NULL;
4441 num_alias_rids = 0;
4442
4443 become_root();
4444 ntstatus1 = pdb_enum_alias_memberships(p->mem_ctx, &info->sid, members,
4445 r->in.sids->num_sids,
4446 &alias_rids, &num_alias_rids);
4447 unbecome_root();
4448
4449 if (!NT_STATUS_IS_OK(ntstatus1)) {
4450 return ntstatus1;
4451 }
4452
4453 r->out.rids->count = num_alias_rids;
4454 r->out.rids->ids = alias_rids;
4455
4456 return NT_STATUS_OK;
4457 }
4458
4459 /*********************************************************************
4460 _samr_GetMembersInAlias
4461 *********************************************************************/
4462
4463 NTSTATUS _samr_GetMembersInAlias(pipes_struct *p,
4464 struct samr_GetMembersInAlias *r)
4465 {
4466 NTSTATUS status;
4467 size_t i;
4468 size_t num_sids = 0;
4469 struct lsa_SidPtr *sids = NULL;
4470 DOM_SID *pdb_sids = NULL;
4471
4472 DOM_SID alias_sid;
4473
4474 uint32 acc_granted;
4475
4476 /* find the policy handle. open a policy on it. */
4477 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, NULL))
4478 return NT_STATUS_INVALID_HANDLE;
4479
4480 status = access_check_samr_function(acc_granted,
4481 SA_RIGHT_ALIAS_GET_MEMBERS,
4482 "_samr_GetMembersInAlias");
4483 if (!NT_STATUS_IS_OK(status)) {
4484 return status;
4485 }
4486
4487 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4488
4489 become_root();
4490 status = pdb_enum_aliasmem(&alias_sid, &pdb_sids, &num_sids);
4491 unbecome_root();
4492
4493 if (!NT_STATUS_IS_OK(status)) {
4494 return status;
4495 }
4496
4497 if (num_sids) {
4498 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr, num_sids);
4499 if (sids == NULL) {
4500 TALLOC_FREE(pdb_sids);
4501 return NT_STATUS_NO_MEMORY;
4502 }
4503 }
4504
4505 for (i = 0; i < num_sids; i++) {
4506 sids[i].sid = sid_dup_talloc(p->mem_ctx, &pdb_sids[i]);
4507 if (!sids[i].sid) {
4508 TALLOC_FREE(pdb_sids);
4509 return NT_STATUS_NO_MEMORY;
4510 }
4511 }
4512
4513 r->out.sids->num_sids = num_sids;
4514 r->out.sids->sids = sids;
4515
4516 TALLOC_FREE(pdb_sids);
4517
4518 return NT_STATUS_OK;
4519 }
4520
4521 /*********************************************************************
4522 _samr_QueryGroupMember
4523 *********************************************************************/
4524
4525 NTSTATUS _samr_QueryGroupMember(pipes_struct *p,
4526 struct samr_QueryGroupMember *r)
4527 {
4528 DOM_SID group_sid;
4529 size_t i, num_members;
4530
4531 uint32 *rid=NULL;
4532 uint32 *attr=NULL;
4533
4534 uint32 acc_granted;
4535
4536 NTSTATUS status;
4537 struct samr_RidTypeArray *rids = NULL;
4538
4539 rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidTypeArray);
4540 if (!rids) {
4541 return NT_STATUS_NO_MEMORY;
4542 }
4543
4544 /* find the policy handle. open a policy on it. */
4545 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, NULL))
4546 return NT_STATUS_INVALID_HANDLE;
4547
4548 status = access_check_samr_function(acc_granted,
4549 SA_RIGHT_GROUP_GET_MEMBERS,
4550 "_samr_QueryGroupMember");
4551 if (!NT_STATUS_IS_OK(status)) {
4552 return status;
4553 }
4554
4555 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4556
4557 if (!sid_check_is_in_our_domain(&group_sid)) {
4558 DEBUG(3, ("sid %s is not in our domain\n",
4559 sid_string_dbg(&group_sid)));
4560 return NT_STATUS_NO_SUCH_GROUP;
4561 }
4562
4563 DEBUG(10, ("lookup on Domain SID\n"));
4564
4565 become_root();
4566 status = pdb_enum_group_members(p->mem_ctx, &group_sid,
4567 &rid, &num_members);
4568 unbecome_root();
4569
4570 if (!NT_STATUS_IS_OK(status))
4571 return status;
4572
4573 if (num_members) {
4574 attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_members);
4575 if (attr == NULL) {
4576 return NT_STATUS_NO_MEMORY;
4577 }
4578 } else {
4579 attr = NULL;
4580 }
4581
4582 for (i=0; i<num_members; i++)
4583 attr[i] = SID_NAME_USER;
4584
4585 rids->count = num_members;
4586 rids->types = attr;
4587 rids->rids = rid;
4588
4589 *r->out.rids = rids;
4590
4591 return NT_STATUS_OK;
4592 }
4593
4594 /*********************************************************************
4595 _samr_AddAliasMember
4596 *********************************************************************/
4597
4598 NTSTATUS _samr_AddAliasMember(pipes_struct *p,
4599 struct samr_AddAliasMember *r)
4600 {
4601 DOM_SID alias_sid;
4602 uint32 acc_granted;
4603 SE_PRIV se_rights;
4604 bool can_add_accounts;
4605 NTSTATUS status;
4606 DISP_INFO *disp_info = NULL;
4607
4608 /* Find the policy handle. Open a policy on it. */
4609 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4610 return NT_STATUS_INVALID_HANDLE;
4611
4612 status = access_check_samr_function(acc_granted,
4613 SA_RIGHT_ALIAS_ADD_MEMBER,
4614 "_samr_AddAliasMember");
4615 if (!NT_STATUS_IS_OK(status)) {
4616 return status;
4617 }
4618
4619 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4620
4621 se_priv_copy( &se_rights, &se_add_users );
4622 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4623
4624 /******** BEGIN SeAddUsers BLOCK *********/
4625
4626 if ( can_add_accounts )
4627 become_root();
4628
4629 status = pdb_add_aliasmem(&alias_sid, r->in.sid);
4630
4631 if ( can_add_accounts )
4632 unbecome_root();
4633
4634 /******** END SeAddUsers BLOCK *********/
4635
4636 if (NT_STATUS_IS_OK(status)) {
4637 force_flush_samr_cache(disp_info);
4638 }
4639
4640 return status;
4641 }
4642
4643 /*********************************************************************
4644 _samr_DeleteAliasMember
4645 *********************************************************************/
4646
4647 NTSTATUS _samr_DeleteAliasMember(pipes_struct *p,
4648 struct samr_DeleteAliasMember *r)
4649 {
4650 DOM_SID alias_sid;
4651 uint32 acc_granted;
4652 SE_PRIV se_rights;
4653 bool can_add_accounts;
4654 NTSTATUS status;
4655 DISP_INFO *disp_info = NULL;
4656
4657 /* Find the policy handle. Open a policy on it. */
4658 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4659 return NT_STATUS_INVALID_HANDLE;
4660
4661 status = access_check_samr_function(acc_granted,
4662 SA_RIGHT_ALIAS_REMOVE_MEMBER,
4663 "_samr_DeleteAliasMember");
4664 if (!NT_STATUS_IS_OK(status)) {
4665 return status;
4666 }
4667
4668 DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
4669 sid_string_dbg(&alias_sid)));
4670
4671 se_priv_copy( &se_rights, &se_add_users );
4672 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4673
4674 /******** BEGIN SeAddUsers BLOCK *********/
4675
4676 if ( can_add_accounts )
4677 become_root();
4678
4679 status = pdb_del_aliasmem(&alias_sid, r->in.sid);
4680
4681 if ( can_add_accounts )
4682 unbecome_root();
4683
4684 /******** END SeAddUsers BLOCK *********/
4685
4686 if (NT_STATUS_IS_OK(status)) {
4687 force_flush_samr_cache(disp_info);
4688 }
4689
4690 return status;
4691 }
4692
4693 /*********************************************************************
4694 _samr_AddGroupMember
4695 *********************************************************************/
4696
4697 NTSTATUS _samr_AddGroupMember(pipes_struct *p,
4698 struct samr_AddGroupMember *r)
4699 {
4700 NTSTATUS status;
4701 DOM_SID group_sid;
4702 uint32 group_rid;
4703 uint32 acc_granted;
4704 SE_PRIV se_rights;
4705 bool can_add_accounts;
4706 DISP_INFO *disp_info = NULL;
4707
4708 /* Find the policy handle. Open a policy on it. */
4709 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4710 return NT_STATUS_INVALID_HANDLE;
4711
4712 status = access_check_samr_function(acc_granted,
4713 SA_RIGHT_GROUP_ADD_MEMBER,
4714 "_samr_AddGroupMember");
4715 if (!NT_STATUS_IS_OK(status)) {
4716 return status;
4717 }
4718
4719 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4720
4721 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4722 &group_rid)) {
4723 return NT_STATUS_INVALID_HANDLE;
4724 }
4725
4726 se_priv_copy( &se_rights, &se_add_users );
4727 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4728
4729 /******** BEGIN SeAddUsers BLOCK *********/
4730
4731 if ( can_add_accounts )
4732 become_root();
4733
4734 status = pdb_add_groupmem(p->mem_ctx, group_rid, r->in.rid);
4735
4736 if ( can_add_accounts )
4737 unbecome_root();
4738
4739 /******** END SeAddUsers BLOCK *********/
4740
4741 force_flush_samr_cache(disp_info);
4742
4743 return status;
4744 }
4745
4746 /*********************************************************************
4747 _samr_DeleteGroupMember
4748 *********************************************************************/
4749
4750 NTSTATUS _samr_DeleteGroupMember(pipes_struct *p,
4751 struct samr_DeleteGroupMember *r)
4752
4753 {
4754 NTSTATUS status;
4755 DOM_SID group_sid;
4756 uint32 group_rid;
4757 uint32 acc_granted;
4758 SE_PRIV se_rights;
4759 bool can_add_accounts;
4760 DISP_INFO *disp_info = NULL;
4761
4762 /*
4763 * delete the group member named r->in.rid
4764 * who is a member of the sid associated with the handle
4765 * the rid is a user's rid as the group is a domain group.
4766 */
4767
4768 /* Find the policy handle. Open a policy on it. */
4769 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4770 return NT_STATUS_INVALID_HANDLE;
4771
4772 status = access_check_samr_function(acc_granted,
4773 SA_RIGHT_GROUP_REMOVE_MEMBER,
4774 "_samr_DeleteGroupMember");
4775 if (!NT_STATUS_IS_OK(status)) {
4776 return status;
4777 }
4778
4779 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4780 &group_rid)) {
4781 return NT_STATUS_INVALID_HANDLE;
4782 }
4783
4784 se_priv_copy( &se_rights, &se_add_users );
4785 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4786
4787 /******** BEGIN SeAddUsers BLOCK *********/
4788
4789 if ( can_add_accounts )
4790 become_root();
4791
4792 status = pdb_del_groupmem(p->mem_ctx, group_rid, r->in.rid);
4793
4794 if ( can_add_accounts )
4795 unbecome_root();
4796
4797 /******** END SeAddUsers BLOCK *********/
4798
4799 force_flush_samr_cache(disp_info);
4800
4801 return status;
4802 }
4803
4804 /*********************************************************************
4805 _samr_DeleteUser
4806 *********************************************************************/
4807
4808 NTSTATUS _samr_DeleteUser(pipes_struct *p,
4809 struct samr_DeleteUser *r)
4810 {
4811 NTSTATUS status;
4812 DOM_SID user_sid;
4813 struct samu *sam_pass=NULL;
4814 uint32 acc_granted;
4815 bool can_add_accounts;
4816 uint32 acb_info;
4817 DISP_INFO *disp_info = NULL;
4818 bool ret;
4819
4820 DEBUG(5, ("_samr_DeleteUser: %d\n", __LINE__));
4821
4822 /* Find the policy handle. Open a policy on it. */
4823 if (!get_lsa_policy_samr_sid(p, r->in.user_handle, &user_sid, &acc_granted, &disp_info))
4824 return NT_STATUS_INVALID_HANDLE;
4825
4826 status = access_check_samr_function(acc_granted,
4827 STD_RIGHT_DELETE_ACCESS,
4828 "_samr_DeleteUser");
4829 if (!NT_STATUS_IS_OK(status)) {
4830 return status;
4831 }
4832
4833 if (!sid_check_is_in_our_domain(&user_sid))
4834 return NT_STATUS_CANNOT_DELETE;
4835
4836 /* check if the user exists before trying to delete */
4837 if ( !(sam_pass = samu_new( NULL )) ) {
4838 return NT_STATUS_NO_MEMORY;
4839 }
4840
4841 become_root();
4842 ret = pdb_getsampwsid(sam_pass, &user_sid);
4843 unbecome_root();
4844
4845 if( !ret ) {
4846 DEBUG(5,("_samr_DeleteUser: User %s doesn't exist.\n",
4847 sid_string_dbg(&user_sid)));
4848 TALLOC_FREE(sam_pass);
4849 return NT_STATUS_NO_SUCH_USER;
4850 }
4851
4852 acb_info = pdb_get_acct_ctrl(sam_pass);
4853
4854 /* For machine accounts it's the SeMachineAccountPrivilege that counts. */
4855 if ( acb_info & ACB_WSTRUST ) {
4856 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account );
4857 } else {
4858 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
4859 }
4860
4861 /******** BEGIN SeAddUsers BLOCK *********/
4862
4863 if ( can_add_accounts )
4864 become_root();
4865
4866 status = pdb_delete_user(p->mem_ctx, sam_pass);
4867
4868 if ( can_add_accounts )
4869 unbecome_root();
4870
4871 /******** END SeAddUsers BLOCK *********/
4872
4873 if ( !NT_STATUS_IS_OK(status) ) {
4874 DEBUG(5,("_samr_DeleteUser: Failed to delete entry for "
4875 "user %s: %s.\n", pdb_get_username(sam_pass),
4876 nt_errstr(status)));
4877 TALLOC_FREE(sam_pass);
4878 return status;
4879 }
4880
4881
4882 TALLOC_FREE(sam_pass);
4883
4884 if (!close_policy_hnd(p, r->in.user_handle))
4885 return NT_STATUS_OBJECT_NAME_INVALID;
4886
4887 ZERO_STRUCTP(r->out.user_handle);
4888
4889 force_flush_samr_cache(disp_info);
4890
4891 return NT_STATUS_OK;
4892 }
4893
4894 /*********************************************************************
4895 _samr_DeleteDomainGroup
4896 *********************************************************************/
4897
4898 NTSTATUS _samr_DeleteDomainGroup(pipes_struct *p,
4899 struct samr_DeleteDomainGroup *r)
4900 {
4901 NTSTATUS status;
4902 DOM_SID group_sid;
4903 uint32 group_rid;
4904 uint32 acc_granted;
4905 SE_PRIV se_rights;
4906 bool can_add_accounts;
4907 DISP_INFO *disp_info = NULL;
4908
4909 DEBUG(5, ("samr_DeleteDomainGroup: %d\n", __LINE__));
4910
4911 /* Find the policy handle. Open a policy on it. */
4912 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4913 return NT_STATUS_INVALID_HANDLE;
4914
4915 status = access_check_samr_function(acc_granted,
4916 STD_RIGHT_DELETE_ACCESS,
4917 "_samr_DeleteDomainGroup");
4918 if (!NT_STATUS_IS_OK(status)) {
4919 return status;
4920 }
4921
4922 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4923
4924 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4925 &group_rid)) {
4926 return NT_STATUS_NO_SUCH_GROUP;
4927 }
4928
4929 se_priv_copy( &se_rights, &se_add_users );
4930 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4931
4932 /******** BEGIN SeAddUsers BLOCK *********/
4933
4934 if ( can_add_accounts )
4935 become_root();
4936
4937 status = pdb_delete_dom_group(p->mem_ctx, group_rid);
4938
4939 if ( can_add_accounts )
4940 unbecome_root();
4941
4942 /******** END SeAddUsers BLOCK *********/
4943
4944 if ( !NT_STATUS_IS_OK(status) ) {
4945 DEBUG(5,("_samr_DeleteDomainGroup: Failed to delete mapping "
4946 "entry for group %s: %s\n",
4947 sid_string_dbg(&group_sid),
4948 nt_errstr(status)));
4949 return status;
4950 }
4951
4952 if (!close_policy_hnd(p, r->in.group_handle))
4953 return NT_STATUS_OBJECT_NAME_INVALID;
4954
4955 force_flush_samr_cache(disp_info);
4956
4957 return NT_STATUS_OK;
4958 }
4959
4960 /*********************************************************************
4961 _samr_DeleteDomAlias
4962 *********************************************************************/
4963
4964 NTSTATUS _samr_DeleteDomAlias(pipes_struct *p,
4965 struct samr_DeleteDomAlias *r)
4966 {
4967 DOM_SID alias_sid;
4968 uint32 acc_granted;
4969 SE_PRIV se_rights;
4970 bool can_add_accounts;
4971 NTSTATUS status;
4972 DISP_INFO *disp_info = NULL;
4973
4974 DEBUG(5, ("_samr_DeleteDomAlias: %d\n", __LINE__));
4975
4976 /* Find the policy handle. Open a policy on it. */
4977 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4978 return NT_STATUS_INVALID_HANDLE;
4979
4980 /* copy the handle to the outgoing reply */
4981
4982 memcpy(r->out.alias_handle, r->in.alias_handle, sizeof(r->out.alias_handle));
4983
4984 status = access_check_samr_function(acc_granted,
4985 STD_RIGHT_DELETE_ACCESS,
4986 "_samr_DeleteDomAlias");
4987 if (!NT_STATUS_IS_OK(status)) {
4988 return status;
4989 }
4990
4991 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4992
4993 /* Don't let Windows delete builtin groups */
4994
4995 if ( sid_check_is_in_builtin( &alias_sid ) ) {
4996 return NT_STATUS_SPECIAL_ACCOUNT;
4997 }
4998
4999 if (!sid_check_is_in_our_domain(&alias_sid))
5000 return NT_STATUS_NO_SUCH_ALIAS;
5001
5002 DEBUG(10, ("lookup on Local SID\n"));
5003
5004 se_priv_copy( &se_rights, &se_add_users );
5005 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
5006
5007 /******** BEGIN SeAddUsers BLOCK *********/
5008
5009 if ( can_add_accounts )
5010 become_root();
5011
5012 /* Have passdb delete the alias */
5013 status = pdb_delete_alias(&alias_sid);
5014
5015 if ( can_add_accounts )
5016 unbecome_root();
5017
5018 /******** END SeAddUsers BLOCK *********/
5019
5020 if ( !NT_STATUS_IS_OK(status))
5021 return status;
5022
5023 if (!close_policy_hnd(p, r->in.alias_handle))
5024 return NT_STATUS_OBJECT_NAME_INVALID;
5025
5026 force_flush_samr_cache(disp_info);
5027
5028 return NT_STATUS_OK;
5029 }
5030
5031 /*********************************************************************
5032 _samr_CreateDomainGroup
5033 *********************************************************************/
5034
5035 NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
5036 struct samr_CreateDomainGroup *r)
5037
5038 {
5039 NTSTATUS status;
5040 DOM_SID dom_sid;
5041 DOM_SID info_sid;
5042 const char *name;
5043 struct samr_info *info;
5044 uint32 acc_granted;
5045 SE_PRIV se_rights;
5046 bool can_add_accounts;
5047 DISP_INFO *disp_info = NULL;
5048
5049 /* Find the policy handle. Open a policy on it. */
5050 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
5051 return NT_STATUS_INVALID_HANDLE;
5052
5053 status = access_check_samr_function(acc_granted,
5054 SA_RIGHT_DOMAIN_CREATE_GROUP,
5055 "_samr_CreateDomainGroup");
5056 if (!NT_STATUS_IS_OK(status)) {
5057 return status;
5058 }
5059
5060 if (!sid_equal(&dom_sid, get_global_sam_sid()))
5061 return NT_STATUS_ACCESS_DENIED;
5062
5063 name = r->in.name->string;
5064 if (name == NULL) {
5065 return NT_STATUS_NO_MEMORY;
5066 }
5067
5068 status = can_create(p->mem_ctx, name);
5069 if (!NT_STATUS_IS_OK(status)) {
5070 return status;
5071 }
5072
5073 se_priv_copy( &se_rights, &se_add_users );
5074 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
5075
5076 /******** BEGIN SeAddUsers BLOCK *********/
5077
5078 if ( can_add_accounts )
5079 become_root();
5080
5081 /* check that we successfully create the UNIX group */
5082
5083 status = pdb_create_dom_group(p->mem_ctx, name, r->out.rid);
5084
5085 if ( can_add_accounts )
5086 unbecome_root();
5087
5088 /******** END SeAddUsers BLOCK *********/
5089
5090 /* check if we should bail out here */
5091
5092 if ( !NT_STATUS_IS_OK(status) )
5093 return status;
5094
5095 sid_compose(&info_sid, get_global_sam_sid(), *r->out.rid);
5096
5097 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5098 return NT_STATUS_NO_MEMORY;
5099
5100 /* they created it; let the user do what he wants with it */
5101
5102 info->acc_granted = GENERIC_RIGHTS_GROUP_ALL_ACCESS;
5103
5104 /* get a (unique) handle. open a policy on it. */
5105 if (!create_policy_hnd(p, r->out.group_handle, free_samr_info, (void *)info))
5106 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5107
5108 force_flush_samr_cache(disp_info);
5109
5110 return NT_STATUS_OK;
5111 }
5112
5113 /*********************************************************************
5114 _samr_CreateDomAlias
5115 *********************************************************************/
5116
5117 NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
5118 struct samr_CreateDomAlias *r)
5119 {
5120 DOM_SID dom_sid;
5121 DOM_SID info_sid;
5122 const char *name = NULL;
5123 struct samr_info *info;
5124 uint32 acc_granted;
5125 gid_t gid;
5126 NTSTATUS result;
5127 SE_PRIV se_rights;
5128 bool can_add_accounts;
5129 DISP_INFO *disp_info = NULL;
5130
5131 /* Find the policy handle. Open a policy on it. */
5132 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
5133 return NT_STATUS_INVALID_HANDLE;
5134
5135 result = access_check_samr_function(acc_granted,
5136 SA_RIGHT_DOMAIN_CREATE_ALIAS,
5137 "_samr_CreateDomAlias");
5138 if (!NT_STATUS_IS_OK(result)) {
5139 return result;
5140 }
5141
5142 if (!sid_equal(&dom_sid, get_global_sam_sid()))
5143 return NT_STATUS_ACCESS_DENIED;
5144
5145 name = r->in.alias_name->string;
5146
5147 se_priv_copy( &se_rights, &se_add_users );
5148 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
5149
5150 result = can_create(p->mem_ctx, name);
5151 if (!NT_STATUS_IS_OK(result)) {
5152 return result;
5153 }
5154
5155 /******** BEGIN SeAddUsers BLOCK *********/
5156
5157 if ( can_add_accounts )
5158 become_root();
5159
5160 /* Have passdb create the alias */
5161 result = pdb_create_alias(name, r->out.rid);
5162
5163 if ( can_add_accounts )
5164 unbecome_root();
5165
5166 /******** END SeAddUsers BLOCK *********/
5167
5168 if (!NT_STATUS_IS_OK(result)) {
5169 DEBUG(10, ("pdb_create_alias failed: %s\n",
5170 nt_errstr(result)));
5171 return result;
5172 }
5173
5174 sid_copy(&info_sid, get_global_sam_sid());
5175 sid_append_rid(&info_sid, *r->out.rid);
5176
5177 if (!sid_to_gid(&info_sid, &gid)) {
5178 DEBUG(10, ("Could not find alias just created\n"));
5179 return NT_STATUS_ACCESS_DENIED;
5180 }
5181
5182 /* check if the group has been successfully created */
5183 if ( getgrgid(gid) == NULL ) {
5184 DEBUG(10, ("getgrgid(%d) of just created alias failed\n",
5185 gid));
5186 return NT_STATUS_ACCESS_DENIED;
5187 }
5188
5189 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5190 return NT_STATUS_NO_MEMORY;
5191
5192 /* they created it; let the user do what he wants with it */
5193
5194 info->acc_granted = GENERIC_RIGHTS_ALIAS_ALL_ACCESS;
5195
5196 /* get a (unique) handle. open a policy on it. */
5197 if (!create_policy_hnd(p, r->out.alias_handle, free_samr_info, (void *)info))
5198 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5199
5200 force_flush_samr_cache(disp_info);
5201
5202 return NT_STATUS_OK;
5203 }
5204
5205 /*********************************************************************
5206 _samr_QueryGroupInfo
5207 *********************************************************************/
5208
5209 NTSTATUS _samr_QueryGroupInfo(pipes_struct *p,
5210 struct samr_QueryGroupInfo *r)
5211 {
5212 NTSTATUS status;
5213 DOM_SID group_sid;
5214 GROUP_MAP map;
5215 union samr_GroupInfo *info = NULL;
5216 uint32 acc_granted;
5217 bool ret;
5218 uint32_t attributes = SE_GROUP_MANDATORY |
5219 SE_GROUP_ENABLED_BY_DEFAULT |
5220 SE_GROUP_ENABLED;
5221 const char *group_name = NULL;
5222 const char *group_description = NULL;
5223
5224 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, NULL))
5225 return NT_STATUS_INVALID_HANDLE;
5226
5227 status = access_check_samr_function(acc_granted,
5228 SA_RIGHT_GROUP_LOOKUP_INFO,
5229 "_samr_QueryGroupInfo");
5230 if (!NT_STATUS_IS_OK(status)) {
5231 return status;
5232 }
5233
5234 become_root();
5235 ret = get_domain_group_from_sid(group_sid, &map);
5236 unbecome_root();
5237 if (!ret)
5238 return NT_STATUS_INVALID_HANDLE;
5239
5240 /* FIXME: map contains fstrings */
5241 group_name = talloc_strdup(r, map.nt_name);
5242 group_description = talloc_strdup(r, map.comment);
5243
5244 info = TALLOC_ZERO_P(p->mem_ctx, union samr_GroupInfo);
5245 if (!info) {
5246 return NT_STATUS_NO_MEMORY;
5247 }
5248
5249 switch (r->in.level) {
5250 case 1: {
5251 uint32 *members;
5252 size_t num_members;
5253
5254 become_root();
5255 status = pdb_enum_group_members(
5256 p->mem_ctx, &group_sid, &members, &num_members);
5257 unbecome_root();
5258
5259 if (!NT_STATUS_IS_OK(status)) {
5260 return status;
5261 }
5262
5263 init_samr_group_info1(&info->all,
5264 group_name,
5265 attributes,
5266 num_members,
5267 group_description);
5268 break;
5269 }
5270 case 2:
5271 init_samr_group_info2(&info->name,
5272 group_name);
5273 break;
5274 case 3:
5275 init_samr_group_info3(&info->attributes,
5276 attributes);
5277 break;
5278 case 4:
5279 init_samr_group_info4(&info->description,
5280 group_description);
5281 break;
5282 case 5: {
5283 /*
5284 uint32 *members;
5285 size_t num_members;
5286 */
5287
5288 /*
5289 become_root();
5290 status = pdb_enum_group_members(
5291 p->mem_ctx, &group_sid, &members, &num_members);
5292 unbecome_root();
5293
5294 if (!NT_STATUS_IS_OK(status)) {
5295 return status;
5296 }
5297 */
5298 init_samr_group_info5(&info->all2,
5299 group_name,
5300 attributes,
5301 0, /* num_members - in w2k3 this is always 0 */
5302 group_description);
5303
5304 break;
5305 }
5306 default:
5307 return NT_STATUS_INVALID_INFO_CLASS;
5308 }
5309
5310 *r->out.info = info;
5311
5312 return NT_STATUS_OK;
5313 }
5314
5315 /*********************************************************************
5316 _samr_SetGroupInfo
5317 *********************************************************************/
5318
5319 NTSTATUS _samr_SetGroupInfo(pipes_struct *p,
5320 struct samr_SetGroupInfo *r)
5321 {
5322 DOM_SID group_sid;
5323 GROUP_MAP map;
5324 uint32 acc_granted;
5325 NTSTATUS status;
5326 bool ret;
5327 bool can_mod_accounts;
5328 DISP_INFO *disp_info = NULL;
5329
5330 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
5331 return NT_STATUS_INVALID_HANDLE;
5332
5333 status = access_check_samr_function(acc_granted,
5334 SA_RIGHT_GROUP_SET_INFO,
5335 "_samr_SetGroupInfo");
5336 if (!NT_STATUS_IS_OK(status)) {
5337 return status;
5338 }
5339
5340 become_root();
5341 ret = get_domain_group_from_sid(group_sid, &map);
5342 unbecome_root();
5343 if (!ret)
5344 return NT_STATUS_NO_SUCH_GROUP;
5345
5346 switch (r->in.level) {
5347 case 1:
5348 fstrcpy(map.comment, r->in.info->all.description.string);
5349 break;
5350 case 4:
5351 fstrcpy(map.comment, r->in.info->description.string);
5352 break;
5353 default:
5354 return NT_STATUS_INVALID_INFO_CLASS;
5355 }
5356
5357 can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
5358
5359 /******** BEGIN SeAddUsers BLOCK *********/
5360
5361 if ( can_mod_accounts )
5362 become_root();
5363
5364 status = pdb_update_group_mapping_entry(&map);
5365
5366 if ( can_mod_accounts )
5367 unbecome_root();
5368
5369 /******** End SeAddUsers BLOCK *********/
5370
5371 if (NT_STATUS_IS_OK(status)) {
5372 force_flush_samr_cache(disp_info);
5373 }
5374
5375 return status;
5376 }
5377
5378 /*********************************************************************
5379 _samr_SetAliasInfo
5380 *********************************************************************/
5381
5382 NTSTATUS _samr_SetAliasInfo(pipes_struct *p,
5383 struct samr_SetAliasInfo *r)
5384 {
5385 DOM_SID group_sid;
5386 struct acct_info info;
5387 uint32 acc_granted;
5388 bool can_mod_accounts;
5389 NTSTATUS status;
5390 DISP_INFO *disp_info = NULL;
5391
5392 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &group_sid, &acc_granted, &disp_info))
5393 return NT_STATUS_INVALID_HANDLE;
5394
5395 status = access_check_samr_function(acc_granted,
5396 SA_RIGHT_ALIAS_SET_INFO,
5397 "_samr_SetAliasInfo");
5398 if (!NT_STATUS_IS_OK(status)) {
5399 return status;
5400 }
5401
5402 /* get the current group information */
5403
5404 become_root();
5405 status = pdb_get_aliasinfo( &group_sid, &info );
5406 unbecome_root();
5407
5408 if ( !NT_STATUS_IS_OK(status))
5409 return status;
5410
5411 switch (r->in.level) {
5412 case ALIASINFONAME:
5413 {
5414 fstring group_name;
5415
5416 /* We currently do not support renaming groups in the
5417 the BUILTIN domain. Refer to util_builtin.c to understand
5418 why. The eventually needs to be fixed to be like Windows
5419 where you can rename builtin groups, just not delete them */
5420
5421 if ( sid_check_is_in_builtin( &group_sid ) ) {
5422 return NT_STATUS_SPECIAL_ACCOUNT;
5423 }
5424
5425 /* There has to be a valid name (and it has to be different) */
5426
5427 if ( !r->in.info->name.string )
5428 return NT_STATUS_INVALID_PARAMETER;
5429
5430 /* If the name is the same just reply "ok". Yes this
5431 doesn't allow you to change the case of a group name. */
5432
5433 if ( strequal( r->in.info->name.string, info.acct_name ) )
5434 return NT_STATUS_OK;
5435
5436 fstrcpy( info.acct_name, r->in.info->name.string);
5437
5438 /* make sure the name doesn't already exist as a user
5439 or local group */
5440
5441 fstr_sprintf( group_name, "%s\\%s", global_myname(), info.acct_name );
5442 status = can_create( p->mem_ctx, group_name );
5443 if ( !NT_STATUS_IS_OK( status ) )
5444 return status;
5445 break;
5446 }
5447 case ALIASINFODESCRIPTION:
5448 if (r->in.info->description.string) {
5449 fstrcpy(info.acct_desc,
5450 r->in.info->description.string);
5451 } else {
5452 fstrcpy( info.acct_desc, "" );
5453 }
5454 break;
5455 default:
5456 return NT_STATUS_INVALID_INFO_CLASS;
5457 }
5458
5459 can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
5460
5461 /******** BEGIN SeAddUsers BLOCK *********/
5462
5463 if ( can_mod_accounts )
5464 become_root();
5465
5466 status = pdb_set_aliasinfo( &group_sid, &info );
5467
5468 if ( can_mod_accounts )
5469 unbecome_root();
5470
5471 /******** End SeAddUsers BLOCK *********/
5472
5473 if (NT_STATUS_IS_OK(status))
5474 force_flush_samr_cache(disp_info);
5475
5476 return status;
5477 }
5478
5479 /****************************************************************
5480 _samr_GetDomPwInfo
5481 ****************************************************************/
5482
5483 NTSTATUS _samr_GetDomPwInfo(pipes_struct *p,
5484 struct samr_GetDomPwInfo *r)
5485 {
5486 uint32_t min_password_length = 0;
5487 uint32_t password_properties = 0;
5488
5489 /* Perform access check. Since this rpc does not require a
5490 policy handle it will not be caught by the access checks on
5491 SAMR_CONNECT or SAMR_CONNECT_ANON. */
5492
5493 if (!pipe_access_check(p)) {
5494 DEBUG(3, ("access denied to _samr_GetDomPwInfo\n"));
5495 return NT_STATUS_ACCESS_DENIED;
5496 }
5497
5498 become_root();
5499 pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
5500 &min_password_length);
5501 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
5502 &password_properties);
5503 unbecome_root();
5504
5505 if (lp_check_password_script() && *lp_check_password_script()) {
5506 password_properties |= DOMAIN_PASSWORD_COMPLEX;
5507 }
5508
5509 r->out.info->min_password_length = min_password_length;
5510 r->out.info->password_properties = password_properties;
5511
5512 return NT_STATUS_OK;
5513 }
5514
5515 /*********************************************************************
5516 _samr_OpenGroup
5517 *********************************************************************/
5518
5519 NTSTATUS _samr_OpenGroup(pipes_struct *p,
5520 struct samr_OpenGroup *r)
5521
5522 {
5523 DOM_SID sid;
5524 DOM_SID info_sid;
5525 GROUP_MAP map;
5526 struct samr_info *info;
5527 SEC_DESC *psd = NULL;
5528 uint32 acc_granted;
5529 uint32 des_access = r->in.access_mask;
5530 size_t sd_size;
5531 NTSTATUS status;
5532 fstring sid_string;
5533 bool ret;
5534 SE_PRIV se_rights;
5535
5536 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid, &acc_granted, NULL))
5537 return NT_STATUS_INVALID_HANDLE;
5538
5539 status = access_check_samr_function(acc_granted,
5540 SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
5541 "_samr_OpenGroup");
5542
5543 if ( !NT_STATUS_IS_OK(status) )
5544 return status;
5545
5546 /*check if access can be granted as requested by client. */
5547 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
5548
5549 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
5550 se_map_generic(&des_access,&grp_generic_mapping);
5551
5552 se_priv_copy( &se_rights, &se_add_users );
5553
5554 status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
5555 &se_rights, GENERIC_RIGHTS_GROUP_WRITE, des_access,
5556 &acc_granted, "_samr_OpenGroup");
5557
5558 if ( !NT_STATUS_IS_OK(status) )
5559 return status;
5560
5561 /* this should not be hard-coded like this */
5562
5563 if (!sid_equal(&sid, get_global_sam_sid()))
5564 return NT_STATUS_ACCESS_DENIED;
5565
5566 sid_copy(&info_sid, get_global_sam_sid());
5567 sid_append_rid(&info_sid, r->in.rid);
5568 sid_to_fstring(sid_string, &info_sid);
5569
5570 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5571 return NT_STATUS_NO_MEMORY;
5572
5573 info->acc_granted = acc_granted;
5574
5575 DEBUG(10, ("_samr_OpenGroup:Opening SID: %s\n", sid_string));
5576
5577 /* check if that group really exists */
5578 become_root();
5579 ret = get_domain_group_from_sid(info->sid, &map);
5580 unbecome_root();
5581 if (!ret)
5582 return NT_STATUS_NO_SUCH_GROUP;
5583
5584 /* get a (unique) handle. open a policy on it. */
5585 if (!create_policy_hnd(p, r->out.group_handle, free_samr_info, (void *)info))
5586 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5587
5588 return NT_STATUS_OK;
5589 }
5590
5591 /*********************************************************************
5592 _samr_RemoveMemberFromForeignDomain
5593 *********************************************************************/
5594
5595 NTSTATUS _samr_RemoveMemberFromForeignDomain(pipes_struct *p,
5596 struct samr_RemoveMemberFromForeignDomain *r)
5597 {
5598 DOM_SID delete_sid, domain_sid;
5599 uint32 acc_granted;
5600 NTSTATUS result;
5601 DISP_INFO *disp_info = NULL;
5602
5603 sid_copy( &delete_sid, r->in.sid );
5604
5605 DEBUG(5,("_samr_RemoveMemberFromForeignDomain: removing SID [%s]\n",
5606 sid_string_dbg(&delete_sid)));
5607
5608 /* Find the policy handle. Open a policy on it. */
5609
5610 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &domain_sid,
5611 &acc_granted, &disp_info))
5612 return NT_STATUS_INVALID_HANDLE;
5613
5614 result = access_check_samr_function(acc_granted,
5615 STD_RIGHT_DELETE_ACCESS,
5616 "_samr_RemoveMemberFromForeignDomain");
5617
5618 if (!NT_STATUS_IS_OK(result))
5619 return result;
5620
5621 DEBUG(8, ("_samr_RemoveMemberFromForeignDomain: sid is %s\n",
5622 sid_string_dbg(&domain_sid)));
5623
5624 /* we can only delete a user from a group since we don't have
5625 nested groups anyways. So in the latter case, just say OK */
5626
5627 /* TODO: The above comment nowadays is bogus. Since we have nested
5628 * groups now, and aliases members are never reported out of the unix
5629 * group membership, the "just say OK" makes this call a no-op. For
5630 * us. This needs fixing however. */
5631
5632 /* I've only ever seen this in the wild when deleting a user from
5633 * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
5634 * is the user about to be deleted. I very much suspect this is the
5635 * only application of this call. To verify this, let people report
5636 * other cases. */
5637
5638 if (!sid_check_is_builtin(&domain_sid)) {
5639 DEBUG(1,("_samr_RemoveMemberFromForeignDomain: domain_sid = %s, "
5640 "global_sam_sid() = %s\n",
5641 sid_string_dbg(&domain_sid),
5642 sid_string_dbg(get_global_sam_sid())));
5643 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
5644 return NT_STATUS_OK;
5645 }
5646
5647 force_flush_samr_cache(disp_info);
5648
5649 result = NT_STATUS_OK;
5650
5651 return result;
5652 }
5653
5654 /*******************************************************************
5655 _samr_QueryDomainInfo2
5656 ********************************************************************/
5657
5658 NTSTATUS _samr_QueryDomainInfo2(pipes_struct *p,
5659 struct samr_QueryDomainInfo2 *r)
5660 {
5661 struct samr_QueryDomainInfo q;
5662
5663 q.in.domain_handle = r->in.domain_handle;
5664 q.in.level = r->in.level;
5665
5666 q.out.info = r->out.info;
5667
5668 return _samr_QueryDomainInfo(p, &q);
5669 }
5670
5671 /*******************************************************************
5672 _samr_SetDomainInfo
5673 ********************************************************************/
5674
5675 NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
5676 struct samr_SetDomainInfo *r)
5677 {
5678 struct samr_info *info = NULL;
5679 time_t u_expire, u_min_age;
5680 time_t u_logout;
5681 time_t u_lock_duration, u_reset_time;
5682 NTSTATUS result;
5683
5684 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
5685
5686 /* find the policy handle. open a policy on it. */
5687 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
5688 return NT_STATUS_INVALID_HANDLE;
5689
5690 /* We do have different access bits for info
5691 * levels here, but we're really just looking for
5692 * GENERIC_RIGHTS_DOMAIN_WRITE access. Unfortunately
5693 * this maps to different specific bits. So
5694 * assume if we have SA_RIGHT_DOMAIN_SET_INFO_1
5695 * set we are ok. */
5696
5697 result = access_check_samr_function(info->acc_granted,
5698 SA_RIGHT_DOMAIN_SET_INFO_1,
5699 "_samr_SetDomainInfo");
5700
5701 if (!NT_STATUS_IS_OK(result))
5702 return result;
5703
5704 DEBUG(5,("_samr_SetDomainInfo: level: %d\n", r->in.level));
5705
5706 switch (r->in.level) {
5707 case 0x01:
5708 u_expire=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.max_password_age);
5709 u_min_age=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.min_password_age);
5710 pdb_set_account_policy(AP_MIN_PASSWORD_LEN, (uint32)r->in.info->info1.min_password_length);
5711 pdb_set_account_policy(AP_PASSWORD_HISTORY, (uint32)r->in.info->info1.password_history_length);
5712 pdb_set_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, (uint32)r->in.info->info1.password_properties);
5713 pdb_set_account_policy(AP_MAX_PASSWORD_AGE, (int)u_expire);
5714 pdb_set_account_policy(AP_MIN_PASSWORD_AGE, (int)u_min_age);
5715 break;
5716 case 0x02:
5717 break;
5718 case 0x03:
5719 u_logout=nt_time_to_unix_abs((NTTIME *)&r->in.info->info3.force_logoff_time);
5720 pdb_set_account_policy(AP_TIME_TO_LOGOUT, (int)u_logout);
5721 break;
5722 case 0x05:
5723 break;
5724 case 0x06:
5725 break;
5726 case 0x07:
5727 break;
5728 case 0x0c:
5729 u_lock_duration=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_duration);
5730 if (u_lock_duration != -1)
5731 u_lock_duration /= 60;
5732
5733 u_reset_time=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_window)/60;
5734
5735 pdb_set_account_policy(AP_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
5736 pdb_set_account_policy(AP_RESET_COUNT_TIME, (int)u_reset_time);
5737 pdb_set_account_policy(AP_BAD_ATTEMPT_LOCKOUT, (uint32)r->in.info->info12.lockout_threshold);
5738 break;
5739 default:
5740 return NT_STATUS_INVALID_INFO_CLASS;
5741 }
5742
5743 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
5744
5745 return NT_STATUS_OK;
5746 }
5747
5748 /****************************************************************
5749 _samr_GetDisplayEnumerationIndex
5750 ****************************************************************/
5751
5752 NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
5753 struct samr_GetDisplayEnumerationIndex *r)
5754 {
5755 struct samr_info *info = NULL;
5756 uint32_t max_entries = (uint32_t) -1;
5757 uint32_t enum_context = 0;
5758 int i;
5759 uint32_t num_account = 0;
5760 struct samr_displayentry *entries = NULL;
5761 NTSTATUS status;
5762
5763 DEBUG(5,("_samr_GetDisplayEnumerationIndex: %d\n", __LINE__));
5764
5765 /* find the policy handle. open a policy on it. */
5766 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
5767 return NT_STATUS_INVALID_HANDLE;
5768 }
5769
5770 status = access_check_samr_function(info->acc_granted,
5771 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
5772 "_samr_GetDisplayEnumerationIndex");
5773 if (!NT_STATUS_IS_OK(status)) {
5774 return status;
5775 }
5776
5777 if ((r->in.level < 1) || (r->in.level > 3)) {
5778 DEBUG(0,("_samr_GetDisplayEnumerationIndex: "
5779 "Unknown info level (%u)\n",
5780 r->in.level));
5781 return NT_STATUS_INVALID_INFO_CLASS;
5782 }
5783
5784 become_root();
5785
5786 /* The following done as ROOT. Don't return without unbecome_root(). */
5787
5788 switch (r->in.level) {
5789 case 1:
5790 if (info->disp_info->users == NULL) {
5791 info->disp_info->users = pdb_search_users(ACB_NORMAL);
5792 if (info->disp_info->users == NULL) {
5793 unbecome_root();
5794 return NT_STATUS_ACCESS_DENIED;
5795 }
5796 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5797 "starting user enumeration at index %u\n",
5798 (unsigned int)enum_context));
5799 } else {
5800 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5801 "using cached user enumeration at index %u\n",
5802 (unsigned int)enum_context));
5803 }
5804 num_account = pdb_search_entries(info->disp_info->users,
5805 enum_context, max_entries,
5806 &entries);
5807 break;
5808 case 2:
5809 if (info->disp_info->machines == NULL) {
5810 info->disp_info->machines =
5811 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
5812 if (info->disp_info->machines == NULL) {
5813 unbecome_root();
5814 return NT_STATUS_ACCESS_DENIED;
5815 }
5816 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5817 "starting machine enumeration at index %u\n",
5818 (unsigned int)enum_context));
5819 } else {
5820 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5821 "using cached machine enumeration at index %u\n",
5822 (unsigned int)enum_context));
5823 }
5824 num_account = pdb_search_entries(info->disp_info->machines,
5825 enum_context, max_entries,
5826 &entries);
5827 break;
5828 case 3:
5829 if (info->disp_info->groups == NULL) {
5830 info->disp_info->groups = pdb_search_groups();
5831 if (info->disp_info->groups == NULL) {
5832 unbecome_root();
5833 return NT_STATUS_ACCESS_DENIED;
5834 }
5835 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5836 "starting group enumeration at index %u\n",
5837 (unsigned int)enum_context));
5838 } else {
5839 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5840 "using cached group enumeration at index %u\n",
5841 (unsigned int)enum_context));
5842 }
5843 num_account = pdb_search_entries(info->disp_info->groups,
5844 enum_context, max_entries,
5845 &entries);
5846 break;
5847 default:
5848 unbecome_root();
5849 smb_panic("info class changed");
5850 break;
5851 }
5852
5853 unbecome_root();
5854
5855 /* Ensure we cache this enumeration. */
5856 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
5857
5858 DEBUG(10,("_samr_GetDisplayEnumerationIndex: looking for :%s\n",
5859 r->in.name->string));
5860
5861 for (i=0; i<num_account; i++) {
5862 if (strequal(entries[i].account_name, r->in.name->string)) {
5863 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5864 "found %s at idx %d\n",
5865 r->in.name->string, i));
5866 *r->out.idx = i;
5867 return NT_STATUS_OK;
5868 }
5869 }
5870
5871 /* assuming account_name lives at the very end */
5872 *r->out.idx = num_account;
5873
5874 return NT_STATUS_NO_MORE_ENTRIES;
5875 }
5876
5877 /****************************************************************
5878 _samr_GetDisplayEnumerationIndex2
5879 ****************************************************************/
5880
5881 NTSTATUS _samr_GetDisplayEnumerationIndex2(pipes_struct *p,
5882 struct samr_GetDisplayEnumerationIndex2 *r)
5883 {
5884 struct samr_GetDisplayEnumerationIndex q;
5885
5886 q.in.domain_handle = r->in.domain_handle;
5887 q.in.level = r->in.level;
5888 q.in.name = r->in.name;
5889
5890 q.out.idx = r->out.idx;
5891
5892 return _samr_GetDisplayEnumerationIndex(p, &q);
5893 }
5894
5895 /****************************************************************
5896 ****************************************************************/
5897
5898 NTSTATUS _samr_Shutdown(pipes_struct *p,
5899 struct samr_Shutdown *r)
5900 {
5901 p->rng_fault_state = true;
5902 return NT_STATUS_NOT_IMPLEMENTED;
5903 }
5904
5905 /****************************************************************
5906 ****************************************************************/
5907
5908 NTSTATUS _samr_CreateUser(pipes_struct *p,
5909 struct samr_CreateUser *r)
5910 {
5911 p->rng_fault_state = true;
5912 return NT_STATUS_NOT_IMPLEMENTED;
5913 }
5914
5915 /****************************************************************
5916 ****************************************************************/
5917
5918 NTSTATUS _samr_SetMemberAttributesOfGroup(pipes_struct *p,
5919 struct samr_SetMemberAttributesOfGroup *r)
5920 {
5921 p->rng_fault_state = true;
5922 return NT_STATUS_NOT_IMPLEMENTED;
5923 }
5924
5925 /****************************************************************
5926 ****************************************************************/
5927
5928 NTSTATUS _samr_ChangePasswordUser(pipes_struct *p,
5929 struct samr_ChangePasswordUser *r)
5930 {
5931 p->rng_fault_state = true;
5932 return NT_STATUS_NOT_IMPLEMENTED;
5933 }
5934
5935 /****************************************************************
5936 ****************************************************************/
5937
5938 NTSTATUS _samr_TestPrivateFunctionsDomain(pipes_struct *p,
5939 struct samr_TestPrivateFunctionsDomain *r)
5940 {
5941 p->rng_fault_state = true;
5942 return NT_STATUS_NOT_IMPLEMENTED;
5943 }
5944
5945 /****************************************************************
5946 ****************************************************************/
5947
5948 NTSTATUS _samr_TestPrivateFunctionsUser(pipes_struct *p,
5949 struct samr_TestPrivateFunctionsUser *r)
5950 {
5951 p->rng_fault_state = true;
5952 return NT_STATUS_NOT_IMPLEMENTED;
5953 }
5954
5955 /****************************************************************
5956 ****************************************************************/
5957
5958 NTSTATUS _samr_QueryUserInfo2(pipes_struct *p,
5959 struct samr_QueryUserInfo2 *r)
5960 {
5961 p->rng_fault_state = true;
5962 return NT_STATUS_NOT_IMPLEMENTED;
5963 }
5964
5965 /****************************************************************
5966 ****************************************************************/
5967
5968 NTSTATUS _samr_AddMultipleMembersToAlias(pipes_struct *p,
5969 struct samr_AddMultipleMembersToAlias *r)
5970 {
5971 p->rng_fault_state = true;
5972 return NT_STATUS_NOT_IMPLEMENTED;
5973 }
5974
5975 /****************************************************************
5976 ****************************************************************/
5977
5978 NTSTATUS _samr_RemoveMultipleMembersFromAlias(pipes_struct *p,
5979 struct samr_RemoveMultipleMembersFromAlias *r)
5980 {
5981 p->rng_fault_state = true;
5982 return NT_STATUS_NOT_IMPLEMENTED;
5983 }
5984
5985 /****************************************************************
5986 ****************************************************************/
5987
5988 NTSTATUS _samr_OemChangePasswordUser2(pipes_struct *p,
5989 struct samr_OemChangePasswordUser2 *r)
5990 {
5991 p->rng_fault_state = true;
5992 return NT_STATUS_NOT_IMPLEMENTED;
5993 }
5994
5995 /****************************************************************
5996 ****************************************************************/
5997
5998 NTSTATUS _samr_SetBootKeyInformation(pipes_struct *p,
5999 struct samr_SetBootKeyInformation *r)
6000 {
6001 p->rng_fault_state = true;
6002 return NT_STATUS_NOT_IMPLEMENTED;
6003 }
6004
6005 /****************************************************************
6006 ****************************************************************/
6007
6008 NTSTATUS _samr_GetBootKeyInformation(pipes_struct *p,
6009 struct samr_GetBootKeyInformation *r)
6010 {
6011 p->rng_fault_state = true;
6012 return NT_STATUS_NOT_IMPLEMENTED;
6013 }
6014
6015 /****************************************************************
6016 ****************************************************************/
6017
6018 NTSTATUS _samr_Connect3(pipes_struct *p,
6019 struct samr_Connect3 *r)
6020 {
6021 p->rng_fault_state = true;
6022 return NT_STATUS_NOT_IMPLEMENTED;
6023 }
6024
6025 /****************************************************************
6026 ****************************************************************/
6027
6028 NTSTATUS _samr_RidToSid(pipes_struct *p,
6029 struct samr_RidToSid *r)
6030 {
6031 p->rng_fault_state = true;
6032 return NT_STATUS_NOT_IMPLEMENTED;
6033 }
6034
6035 /****************************************************************
6036 ****************************************************************/
6037
6038 NTSTATUS _samr_SetDsrmPassword(pipes_struct *p,
6039 struct samr_SetDsrmPassword *r)
6040 {
6041 p->rng_fault_state = true;
6042 return NT_STATUS_NOT_IMPLEMENTED;
6043 }
6044
6045 /****************************************************************
6046 ****************************************************************/
6047
6048 NTSTATUS _samr_ValidatePassword(pipes_struct *p,
6049 struct samr_ValidatePassword *r)
6050 {
6051 p->rng_fault_state = true;
6052 return NT_STATUS_NOT_IMPLEMENTED;
6053 }
Samba GIT mirror