2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Marc Jacobsen 1999,
8 * Copyright (C) Jeremy Allison 2001-2005,
9 * Copyright (C) Jean François Micouleau 1998-2001,
10 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
11 * Copyright (C) Gerald (Jerry) Carter 2003-2004,
12 * Copyright (C) Simo Sorce 2003.
13 * Copyright (C) Volker Lendecke 2005.
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
23 * GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, write to the Free Software
27 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
31 * This is the implementation of the SAMR code.
37 #define DBGC_CLASS DBGC_RPC_SRV
39 #define SAMR_USR_RIGHTS_WRITE_PW \
40 ( READ_CONTROL_ACCESS | \
41 SA_RIGHT_USER_CHANGE_PASSWORD | \
42 SA_RIGHT_USER_SET_LOC_COM )
44 #define DISP_INFO_CACHE_TIMEOUT 10
46 typedef struct disp_info
{
47 struct disp_info
*next
, *prev
;
49 DOM_SID sid
; /* identify which domain this is. */
50 BOOL builtin_domain
; /* Quick flag to check if this is the builtin domain. */
51 struct pdb_search
*users
; /* querydispinfo 1 and 4 */
52 struct pdb_search
*machines
; /* querydispinfo 2 */
53 struct pdb_search
*groups
; /* querydispinfo 3 and 5, enumgroups */
54 struct pdb_search
*aliases
; /* enumaliases */
57 struct pdb_search
*enum_users
; /* enumusers with a mask */
60 smb_event_id_t di_cache_timeout_event
; /* cache idle timeout handler. */
63 /* We keep a static list of these by SID as modern clients close down
64 all resources between each request in a complete enumeration. */
66 static DISP_INFO
*disp_info_list
;
69 /* for use by the \PIPE\samr policy */
71 BOOL builtin_domain
; /* Quick flag to check if this is the builtin domain. */
72 uint32 status
; /* some sort of flag. best to record it. comes from opnum 0x39 */
78 static struct generic_mapping sam_generic_mapping
= {
79 GENERIC_RIGHTS_SAM_READ
,
80 GENERIC_RIGHTS_SAM_WRITE
,
81 GENERIC_RIGHTS_SAM_EXECUTE
,
82 GENERIC_RIGHTS_SAM_ALL_ACCESS
};
83 static struct generic_mapping dom_generic_mapping
= {
84 GENERIC_RIGHTS_DOMAIN_READ
,
85 GENERIC_RIGHTS_DOMAIN_WRITE
,
86 GENERIC_RIGHTS_DOMAIN_EXECUTE
,
87 GENERIC_RIGHTS_DOMAIN_ALL_ACCESS
};
88 static struct generic_mapping usr_generic_mapping
= {
89 GENERIC_RIGHTS_USER_READ
,
90 GENERIC_RIGHTS_USER_WRITE
,
91 GENERIC_RIGHTS_USER_EXECUTE
,
92 GENERIC_RIGHTS_USER_ALL_ACCESS
};
93 static struct generic_mapping grp_generic_mapping
= {
94 GENERIC_RIGHTS_GROUP_READ
,
95 GENERIC_RIGHTS_GROUP_WRITE
,
96 GENERIC_RIGHTS_GROUP_EXECUTE
,
97 GENERIC_RIGHTS_GROUP_ALL_ACCESS
};
98 static struct generic_mapping ali_generic_mapping
= {
99 GENERIC_RIGHTS_ALIAS_READ
,
100 GENERIC_RIGHTS_ALIAS_WRITE
,
101 GENERIC_RIGHTS_ALIAS_EXECUTE
,
102 GENERIC_RIGHTS_ALIAS_ALL_ACCESS
};
104 /*******************************************************************
105 *******************************************************************/
107 static NTSTATUS
make_samr_object_sd( TALLOC_CTX
*ctx
, SEC_DESC
**psd
, size_t *sd_size
,
108 struct generic_mapping
*map
,
109 DOM_SID
*sid
, uint32 sid_access
)
111 DOM_SID domadmin_sid
;
112 SEC_ACE ace
[5]; /* at most 5 entries */
118 /* basic access for Everyone */
120 init_sec_access(&mask
, map
->generic_execute
| map
->generic_read
);
121 init_sec_ace(&ace
[i
++], &global_sid_World
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
123 /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
125 init_sec_access(&mask
, map
->generic_all
);
127 init_sec_ace(&ace
[i
++], &global_sid_Builtin_Administrators
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
128 init_sec_ace(&ace
[i
++], &global_sid_Builtin_Account_Operators
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
130 /* Add Full Access for Domain Admins if we are a DC */
133 sid_copy( &domadmin_sid
, get_global_sam_sid() );
134 sid_append_rid( &domadmin_sid
, DOMAIN_GROUP_RID_ADMINS
);
135 init_sec_ace(&ace
[i
++], &domadmin_sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
138 /* if we have a sid, give it some special access */
141 init_sec_access( &mask
, sid_access
);
142 init_sec_ace(&ace
[i
++], sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, mask
, 0);
145 /* create the security descriptor */
147 if ((psa
= make_sec_acl(ctx
, NT4_ACL_REVISION
, i
, ace
)) == NULL
)
148 return NT_STATUS_NO_MEMORY
;
150 if ((*psd
= make_sec_desc(ctx
, SEC_DESC_REVISION
, SEC_DESC_SELF_RELATIVE
, NULL
, NULL
, NULL
, psa
, sd_size
)) == NULL
)
151 return NT_STATUS_NO_MEMORY
;
156 /*******************************************************************
157 Checks if access to an object should be granted, and returns that
158 level of access for further checks.
159 ********************************************************************/
161 static NTSTATUS
access_check_samr_object( SEC_DESC
*psd
, NT_USER_TOKEN
*token
,
162 SE_PRIV
*rights
, uint32 rights_mask
,
163 uint32 des_access
, uint32
*acc_granted
,
166 NTSTATUS status
= NT_STATUS_ACCESS_DENIED
;
167 uint32 saved_mask
= 0;
169 /* check privileges; certain SAM access bits should be overridden
170 by privileges (mostly having to do with creating/modifying/deleting
173 if ( rights
&& user_has_any_privilege( token
, rights
) ) {
175 saved_mask
= (des_access
& rights_mask
);
176 des_access
&= ~saved_mask
;
178 DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
183 /* check the security descriptor first */
185 if ( se_access_check(psd
, token
, des_access
, acc_granted
, &status
) )
188 /* give root a free pass */
190 if ( geteuid() == sec_initial_uid() ) {
192 DEBUG(4,("%s: ACCESS should be DENIED (requested: %#010x)\n", debug
, des_access
));
193 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
195 *acc_granted
= des_access
;
197 status
= NT_STATUS_OK
;
203 /* add in any bits saved during the privilege check (only
204 matters is status is ok) */
206 *acc_granted
|= rights_mask
;
208 DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
209 debug
, NT_STATUS_IS_OK(status
) ? "GRANTED" : "DENIED",
210 des_access
, *acc_granted
));
215 /*******************************************************************
216 Checks if access to a function can be granted
217 ********************************************************************/
219 static NTSTATUS
access_check_samr_function(uint32 acc_granted
, uint32 acc_required
, const char *debug
)
221 DEBUG(5,("%s: access check ((granted: %#010x; required: %#010x)\n",
222 debug
, acc_granted
, acc_required
));
224 /* check the security descriptor first */
226 if ( (acc_granted
&acc_required
) == acc_required
)
229 /* give root a free pass */
231 if (geteuid() == sec_initial_uid()) {
233 DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
234 debug
, acc_granted
, acc_required
));
235 DEBUGADD(4,("but overwritten by euid == 0\n"));
240 DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: %#010x)\n",
241 debug
, acc_granted
, acc_required
));
243 return NT_STATUS_ACCESS_DENIED
;
246 /*******************************************************************
247 Fetch or create a dispinfo struct.
248 ********************************************************************/
250 static DISP_INFO
*get_samr_dispinfo_by_sid(DOM_SID
*psid
, const char *sid_str
)
255 /* There are two cases to consider here:
256 1) The SID is a domain SID and we look for an equality match, or
257 2) This is an account SID and so we return the DISP_INFO* for our
260 if ( psid
&& sid_check_is_in_our_domain( psid
) ) {
261 DEBUG(10,("get_samr_dispinfo_by_sid: Replacing %s with our domain SID\n",
263 psid
= get_global_sam_sid();
266 for (dpi
= disp_info_list
; dpi
; dpi
= dpi
->next
) {
267 if (sid_equal(psid
, &dpi
->sid
)) {
272 /* This struct is never free'd - I'm using talloc so we
273 can get a list out of smbd using smbcontrol. There will
274 be one of these per SID we're authorative for. JRA. */
276 mem_ctx
= talloc_init("DISP_INFO for domain sid %s", sid_str
);
278 if ((dpi
= TALLOC_ZERO_P(mem_ctx
, DISP_INFO
)) == NULL
)
281 dpi
->mem_ctx
= mem_ctx
;
284 sid_copy( &dpi
->sid
, psid
);
285 dpi
->builtin_domain
= sid_check_is_builtin(psid
);
287 dpi
->builtin_domain
= False
;
290 DLIST_ADD(disp_info_list
, dpi
);
295 /*******************************************************************
296 Create a samr_info struct.
297 ********************************************************************/
299 static struct samr_info
*get_samr_info_by_sid(DOM_SID
*psid
)
301 struct samr_info
*info
;
306 sid_to_string(sid_str
, psid
);
308 fstrcpy(sid_str
,"(NULL)");
311 mem_ctx
= talloc_init("samr_info for domain sid %s", sid_str
);
313 if ((info
= TALLOC_ZERO_P(mem_ctx
, struct samr_info
)) == NULL
)
316 DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str
));
318 sid_copy( &info
->sid
, psid
);
319 info
->builtin_domain
= sid_check_is_builtin(psid
);
321 DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
322 info
->builtin_domain
= False
;
324 info
->mem_ctx
= mem_ctx
;
326 info
->disp_info
= get_samr_dispinfo_by_sid(psid
, sid_str
);
328 if (!info
->disp_info
) {
329 talloc_destroy(mem_ctx
);
336 /*******************************************************************
337 Function to free the per SID data.
338 ********************************************************************/
340 static void free_samr_cache(DISP_INFO
*disp_info
, const char *sid_str
)
342 DEBUG(10,("free_samr_cache: deleting cache for SID %s\n", sid_str
));
344 /* We need to become root here because the paged search might have to
345 * tell the LDAP server we're not interested in the rest anymore. */
349 if (disp_info
->users
) {
350 DEBUG(10,("free_samr_cache: deleting users cache\n"));
351 pdb_search_destroy(disp_info
->users
);
352 disp_info
->users
= NULL
;
354 if (disp_info
->machines
) {
355 DEBUG(10,("free_samr_cache: deleting machines cache\n"));
356 pdb_search_destroy(disp_info
->machines
);
357 disp_info
->machines
= NULL
;
359 if (disp_info
->groups
) {
360 DEBUG(10,("free_samr_cache: deleting groups cache\n"));
361 pdb_search_destroy(disp_info
->groups
);
362 disp_info
->groups
= NULL
;
364 if (disp_info
->aliases
) {
365 DEBUG(10,("free_samr_cache: deleting aliases cache\n"));
366 pdb_search_destroy(disp_info
->aliases
);
367 disp_info
->aliases
= NULL
;
369 if (disp_info
->enum_users
) {
370 DEBUG(10,("free_samr_cache: deleting enum_users cache\n"));
371 pdb_search_destroy(disp_info
->enum_users
);
372 disp_info
->enum_users
= NULL
;
374 disp_info
->enum_acb_mask
= 0;
379 /*******************************************************************
380 Function to free the per handle data.
381 ********************************************************************/
383 static void free_samr_info(void *ptr
)
385 struct samr_info
*info
=(struct samr_info
*) ptr
;
387 /* Only free the dispinfo cache if no one bothered to set up
390 if (info
->disp_info
&& info
->disp_info
->di_cache_timeout_event
== (smb_event_id_t
)0) {
392 sid_to_string(sid_str
, &info
->disp_info
->sid
);
393 free_samr_cache(info
->disp_info
, sid_str
);
396 talloc_destroy(info
->mem_ctx
);
399 /*******************************************************************
400 Idle event handler. Throw away the disp info cache.
401 ********************************************************************/
403 static void disp_info_cache_idle_timeout_handler(void **private_data
,
408 DISP_INFO
*disp_info
= (DISP_INFO
*)(*private_data
);
410 sid_to_string(sid_str
, &disp_info
->sid
);
412 free_samr_cache(disp_info
, sid_str
);
414 /* Remove the event. */
415 smb_unregister_idle_event(disp_info
->di_cache_timeout_event
);
416 disp_info
->di_cache_timeout_event
= (smb_event_id_t
)0;
418 DEBUG(10,("disp_info_cache_idle_timeout_handler: caching timed out for SID %s at %u\n",
419 sid_str
, (unsigned int)ev_now
));
422 /*******************************************************************
423 Setup cache removal idle event handler.
424 ********************************************************************/
426 static void set_disp_info_cache_timeout(DISP_INFO
*disp_info
, time_t secs_fromnow
)
430 sid_to_string(sid_str
, &disp_info
->sid
);
432 /* Remove any pending timeout and update. */
434 if (disp_info
->di_cache_timeout_event
) {
435 smb_unregister_idle_event(disp_info
->di_cache_timeout_event
);
436 disp_info
->di_cache_timeout_event
= (smb_event_id_t
)0;
439 DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for SID %s for %u seconds\n",
440 sid_str
, (unsigned int)secs_fromnow
));
442 disp_info
->di_cache_timeout_event
=
443 smb_register_idle_event(disp_info_cache_idle_timeout_handler
,
448 /*******************************************************************
449 Force flush any cache. We do this on any samr_set_xxx call.
450 We must also remove the timeout handler.
451 ********************************************************************/
453 static void force_flush_samr_cache(DISP_INFO
*disp_info
)
458 sid_to_string(sid_str
, &disp_info
->sid
);
459 if (disp_info
->di_cache_timeout_event
) {
460 smb_unregister_idle_event(disp_info
->di_cache_timeout_event
);
461 disp_info
->di_cache_timeout_event
= (smb_event_id_t
)0;
462 DEBUG(10,("force_flush_samr_cache: clearing idle event for SID %s\n",
465 free_samr_cache(disp_info
, sid_str
);
469 /*******************************************************************
470 Ensure password info is never given out. Paranioa... JRA.
471 ********************************************************************/
473 static void samr_clear_sam_passwd(struct samu
*sam_pass
)
479 /* These now zero out the old password */
481 pdb_set_lanman_passwd(sam_pass
, NULL
, PDB_DEFAULT
);
482 pdb_set_nt_passwd(sam_pass
, NULL
, PDB_DEFAULT
);
485 static uint32
count_sam_users(struct disp_info
*info
, uint32 acct_flags
)
487 struct samr_displayentry
*entry
;
489 if (info
->builtin_domain
) {
490 /* No users in builtin. */
494 if (info
->users
== NULL
) {
495 info
->users
= pdb_search_users(acct_flags
);
496 if (info
->users
== NULL
) {
500 /* Fetch the last possible entry, thus trigger an enumeration */
501 pdb_search_entries(info
->users
, 0xffffffff, 1, &entry
);
503 /* Ensure we cache this enumeration. */
504 set_disp_info_cache_timeout(info
, DISP_INFO_CACHE_TIMEOUT
);
506 return info
->users
->num_entries
;
509 static uint32
count_sam_groups(struct disp_info
*info
)
511 struct samr_displayentry
*entry
;
513 if (info
->builtin_domain
) {
514 /* No groups in builtin. */
518 if (info
->groups
== NULL
) {
519 info
->groups
= pdb_search_groups();
520 if (info
->groups
== NULL
) {
524 /* Fetch the last possible entry, thus trigger an enumeration */
525 pdb_search_entries(info
->groups
, 0xffffffff, 1, &entry
);
527 /* Ensure we cache this enumeration. */
528 set_disp_info_cache_timeout(info
, DISP_INFO_CACHE_TIMEOUT
);
530 return info
->groups
->num_entries
;
533 static uint32
count_sam_aliases(struct disp_info
*info
)
535 struct samr_displayentry
*entry
;
537 if (info
->aliases
== NULL
) {
538 info
->aliases
= pdb_search_aliases(&info
->sid
);
539 if (info
->aliases
== NULL
) {
543 /* Fetch the last possible entry, thus trigger an enumeration */
544 pdb_search_entries(info
->aliases
, 0xffffffff, 1, &entry
);
546 /* Ensure we cache this enumeration. */
547 set_disp_info_cache_timeout(info
, DISP_INFO_CACHE_TIMEOUT
);
549 return info
->aliases
->num_entries
;
552 /*******************************************************************
554 ********************************************************************/
556 NTSTATUS
_samr_close_hnd(pipes_struct
*p
, SAMR_Q_CLOSE_HND
*q_u
, SAMR_R_CLOSE_HND
*r_u
)
558 r_u
->status
= NT_STATUS_OK
;
560 /* close the policy handle */
561 if (!close_policy_hnd(p
, &q_u
->pol
))
562 return NT_STATUS_OBJECT_NAME_INVALID
;
564 DEBUG(5,("samr_reply_close_hnd: %d\n", __LINE__
));
569 /*******************************************************************
570 samr_reply_open_domain
571 ********************************************************************/
573 NTSTATUS
_samr_open_domain(pipes_struct
*p
, SAMR_Q_OPEN_DOMAIN
*q_u
, SAMR_R_OPEN_DOMAIN
*r_u
)
575 struct samr_info
*info
;
576 SEC_DESC
*psd
= NULL
;
578 uint32 des_access
= q_u
->flags
;
583 r_u
->status
= NT_STATUS_OK
;
585 /* find the connection policy handle. */
587 if ( !find_policy_by_hnd(p
, &q_u
->pol
, (void**)(void *)&info
) )
588 return NT_STATUS_INVALID_HANDLE
;
590 status
= access_check_samr_function( info
->acc_granted
,
591 SA_RIGHT_SAM_OPEN_DOMAIN
, "_samr_open_domain" );
593 if ( !NT_STATUS_IS_OK(status
) )
596 /*check if access can be granted as requested by client. */
598 make_samr_object_sd( p
->mem_ctx
, &psd
, &sd_size
, &dom_generic_mapping
, NULL
, 0 );
599 se_map_generic( &des_access
, &dom_generic_mapping
);
601 se_priv_copy( &se_rights
, &se_machine_account
);
602 se_priv_add( &se_rights
, &se_add_users
);
604 status
= access_check_samr_object( psd
, p
->pipe_user
.nt_user_token
,
605 &se_rights
, GENERIC_RIGHTS_DOMAIN_WRITE
, des_access
,
606 &acc_granted
, "_samr_open_domain" );
608 if ( !NT_STATUS_IS_OK(status
) )
611 if (!sid_check_is_domain(&q_u
->dom_sid
.sid
) &&
612 !sid_check_is_builtin(&q_u
->dom_sid
.sid
)) {
613 return NT_STATUS_NO_SUCH_DOMAIN
;
616 /* associate the domain SID with the (unique) handle. */
617 if ((info
= get_samr_info_by_sid(&q_u
->dom_sid
.sid
))==NULL
)
618 return NT_STATUS_NO_MEMORY
;
619 info
->acc_granted
= acc_granted
;
621 /* get a (unique) handle. open a policy on it. */
622 if (!create_policy_hnd(p
, &r_u
->domain_pol
, free_samr_info
, (void *)info
))
623 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
625 DEBUG(5,("samr_open_domain: %d\n", __LINE__
));
630 /*******************************************************************
631 _samr_get_usrdom_pwinfo
632 ********************************************************************/
634 NTSTATUS
_samr_get_usrdom_pwinfo(pipes_struct
*p
, SAMR_Q_GET_USRDOM_PWINFO
*q_u
, SAMR_R_GET_USRDOM_PWINFO
*r_u
)
636 struct samr_info
*info
= NULL
;
638 r_u
->status
= NT_STATUS_OK
;
640 /* find the policy handle. open a policy on it. */
641 if (!find_policy_by_hnd(p
, &q_u
->user_pol
, (void **)(void *)&info
))
642 return NT_STATUS_INVALID_HANDLE
;
644 if (!sid_check_is_in_our_domain(&info
->sid
))
645 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
647 init_samr_r_get_usrdom_pwinfo(r_u
, NT_STATUS_OK
);
649 DEBUG(5,("_samr_get_usrdom_pwinfo: %d\n", __LINE__
));
652 * NT sometimes return NT_STATUS_ACCESS_DENIED
653 * I don't know yet why.
659 /*******************************************************************
661 ********************************************************************/
663 NTSTATUS
_samr_set_sec_obj(pipes_struct
*p
, SAMR_Q_SET_SEC_OBJ
*q_u
, SAMR_R_SET_SEC_OBJ
*r_u
)
665 DEBUG(0,("_samr_set_sec_obj: Not yet implemented!\n"));
666 return NT_STATUS_NOT_IMPLEMENTED
;
669 /*******************************************************************
670 ********************************************************************/
672 static BOOL
get_lsa_policy_samr_sid( pipes_struct
*p
, POLICY_HND
*pol
,
673 DOM_SID
*sid
, uint32
*acc_granted
,
674 DISP_INFO
**ppdisp_info
)
676 struct samr_info
*info
= NULL
;
678 /* find the policy handle. open a policy on it. */
679 if (!find_policy_by_hnd(p
, pol
, (void **)(void *)&info
))
686 *acc_granted
= info
->acc_granted
;
688 *ppdisp_info
= info
->disp_info
;
694 /*******************************************************************
696 ********************************************************************/
698 NTSTATUS
_samr_query_sec_obj(pipes_struct
*p
, SAMR_Q_QUERY_SEC_OBJ
*q_u
, SAMR_R_QUERY_SEC_OBJ
*r_u
)
702 SEC_DESC
* psd
= NULL
;
706 r_u
->status
= NT_STATUS_OK
;
709 if (!get_lsa_policy_samr_sid(p
, &q_u
->user_pol
, &pol_sid
, &acc_granted
, NULL
))
710 return NT_STATUS_INVALID_HANDLE
;
712 DEBUG(10,("_samr_query_sec_obj: querying security on SID: %s\n", sid_to_string(str_sid
, &pol_sid
)));
714 /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
716 /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
717 if (pol_sid
.sid_rev_num
== 0) {
718 DEBUG(5,("_samr_query_sec_obj: querying security on SAM\n"));
719 r_u
->status
= make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &sam_generic_mapping
, NULL
, 0);
720 } else if (sid_equal(&pol_sid
,get_global_sam_sid())) {
721 /* check if it is our domain SID */
722 DEBUG(5,("_samr_query_sec_obj: querying security on Domain with SID: %s\n", sid_to_string(str_sid
, &pol_sid
)));
723 r_u
->status
= make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &dom_generic_mapping
, NULL
, 0);
724 } else if (sid_equal(&pol_sid
,&global_sid_Builtin
)) {
725 /* check if it is the Builtin Domain */
726 /* TODO: Builtin probably needs a different SD with restricted write access*/
727 DEBUG(5,("_samr_query_sec_obj: querying security on Builtin Domain with SID: %s\n", sid_to_string(str_sid
, &pol_sid
)));
728 r_u
->status
= make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &dom_generic_mapping
, NULL
, 0);
729 } else if (sid_check_is_in_our_domain(&pol_sid
) ||
730 sid_check_is_in_builtin(&pol_sid
)) {
731 /* TODO: different SDs have to be generated for aliases groups and users.
732 Currently all three get a default user SD */
733 DEBUG(10,("_samr_query_sec_obj: querying security on Object with SID: %s\n", sid_to_string(str_sid
, &pol_sid
)));
734 r_u
->status
= make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &usr_generic_mapping
, &pol_sid
, SAMR_USR_RIGHTS_WRITE_PW
);
736 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
739 if ((r_u
->buf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
740 return NT_STATUS_NO_MEMORY
;
742 if (NT_STATUS_IS_OK(r_u
->status
))
748 /*******************************************************************
749 makes a SAM_ENTRY / UNISTR2* structure from a user list.
750 ********************************************************************/
752 static NTSTATUS
make_user_sam_entry_list(TALLOC_CTX
*ctx
, SAM_ENTRY
**sam_pp
,
753 UNISTR2
**uni_name_pp
,
754 uint32 num_entries
, uint32 start_idx
,
755 struct samr_displayentry
*entries
)
764 if (num_entries
== 0)
767 sam
= TALLOC_ZERO_ARRAY(ctx
, SAM_ENTRY
, num_entries
);
769 uni_name
= TALLOC_ZERO_ARRAY(ctx
, UNISTR2
, num_entries
);
771 if (sam
== NULL
|| uni_name
== NULL
) {
772 DEBUG(0, ("make_user_sam_entry_list: talloc_zero failed!\n"));
773 return NT_STATUS_NO_MEMORY
;
776 for (i
= 0; i
< num_entries
; i
++) {
777 UNISTR2 uni_temp_name
;
779 * usrmgr expects a non-NULL terminated string with
780 * trust relationships
782 if (entries
[i
].acct_flags
& ACB_DOMTRUST
) {
783 init_unistr2(&uni_temp_name
, entries
[i
].account_name
,
786 init_unistr2(&uni_temp_name
, entries
[i
].account_name
,
790 init_sam_entry(&sam
[i
], &uni_temp_name
, entries
[i
].rid
);
791 copy_unistr2(&uni_name
[i
], &uni_temp_name
);
795 *uni_name_pp
= uni_name
;
799 /*******************************************************************
800 samr_reply_enum_dom_users
801 ********************************************************************/
803 NTSTATUS
_samr_enum_dom_users(pipes_struct
*p
, SAMR_Q_ENUM_DOM_USERS
*q_u
,
804 SAMR_R_ENUM_DOM_USERS
*r_u
)
806 struct samr_info
*info
= NULL
;
808 uint32 enum_context
=q_u
->start_idx
;
809 enum remote_arch_types ra_type
= get_remote_arch();
810 int max_sam_entries
= (ra_type
== RA_WIN95
) ? MAX_SAM_ENTRIES_W95
: MAX_SAM_ENTRIES_W2K
;
811 uint32 max_entries
= max_sam_entries
;
812 struct samr_displayentry
*entries
= NULL
;
814 r_u
->status
= NT_STATUS_OK
;
816 /* find the policy handle. open a policy on it. */
817 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
818 return NT_STATUS_INVALID_HANDLE
;
820 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(info
->acc_granted
,
821 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS
,
822 "_samr_enum_dom_users"))) {
826 DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__
));
828 if (info
->builtin_domain
) {
829 /* No users in builtin. */
830 init_samr_r_enum_dom_users(r_u
, q_u
->start_idx
, 0);
831 DEBUG(5,("_samr_enum_dom_users: No users in BUILTIN\n"));
839 if ((info
->disp_info
->enum_users
!= NULL
) &&
840 (info
->disp_info
->enum_acb_mask
!= q_u
->acb_mask
)) {
841 pdb_search_destroy(info
->disp_info
->enum_users
);
842 info
->disp_info
->enum_users
= NULL
;
845 if (info
->disp_info
->enum_users
== NULL
) {
846 info
->disp_info
->enum_users
= pdb_search_users(q_u
->acb_mask
);
847 info
->disp_info
->enum_acb_mask
= q_u
->acb_mask
;
850 if (info
->disp_info
->enum_users
== NULL
) {
851 /* END AS ROOT !!!! */
853 return NT_STATUS_ACCESS_DENIED
;
856 num_account
= pdb_search_entries(info
->disp_info
->enum_users
,
857 enum_context
, max_entries
,
860 /* END AS ROOT !!!! */
864 if (num_account
== 0) {
865 DEBUG(5, ("_samr_enum_dom_users: enumeration handle over "
870 r_u
->status
= make_user_sam_entry_list(p
->mem_ctx
, &r_u
->sam
,
872 num_account
, enum_context
,
875 if (!NT_STATUS_IS_OK(r_u
->status
))
878 if (max_entries
<= num_account
) {
879 r_u
->status
= STATUS_MORE_ENTRIES
;
881 r_u
->status
= NT_STATUS_OK
;
884 /* Ensure we cache this enumeration. */
885 set_disp_info_cache_timeout(info
->disp_info
, DISP_INFO_CACHE_TIMEOUT
);
887 DEBUG(5, ("_samr_enum_dom_users: %d\n", __LINE__
));
889 init_samr_r_enum_dom_users(r_u
, q_u
->start_idx
+ num_account
,
892 DEBUG(5,("_samr_enum_dom_users: %d\n", __LINE__
));
897 /*******************************************************************
898 makes a SAM_ENTRY / UNISTR2* structure from a group list.
899 ********************************************************************/
901 static void make_group_sam_entry_list(TALLOC_CTX
*ctx
, SAM_ENTRY
**sam_pp
,
902 UNISTR2
**uni_name_pp
,
903 uint32 num_sam_entries
,
904 struct samr_displayentry
*entries
)
913 if (num_sam_entries
== 0)
916 sam
= TALLOC_ZERO_ARRAY(ctx
, SAM_ENTRY
, num_sam_entries
);
917 uni_name
= TALLOC_ZERO_ARRAY(ctx
, UNISTR2
, num_sam_entries
);
919 if (sam
== NULL
|| uni_name
== NULL
) {
920 DEBUG(0, ("NULL pointers in SAMR_R_QUERY_DISPINFO\n"));
924 for (i
= 0; i
< num_sam_entries
; i
++) {
926 * JRA. I think this should include the null. TNG does not.
928 init_unistr2(&uni_name
[i
], entries
[i
].account_name
,
930 init_sam_entry(&sam
[i
], &uni_name
[i
], entries
[i
].rid
);
934 *uni_name_pp
= uni_name
;
937 /*******************************************************************
938 samr_reply_enum_dom_groups
939 ********************************************************************/
941 NTSTATUS
_samr_enum_dom_groups(pipes_struct
*p
, SAMR_Q_ENUM_DOM_GROUPS
*q_u
, SAMR_R_ENUM_DOM_GROUPS
*r_u
)
943 struct samr_info
*info
= NULL
;
944 struct samr_displayentry
*groups
;
947 r_u
->status
= NT_STATUS_OK
;
949 /* find the policy handle. open a policy on it. */
950 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
951 return NT_STATUS_INVALID_HANDLE
;
953 r_u
->status
= access_check_samr_function(info
->acc_granted
,
954 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS
,
955 "_samr_enum_dom_groups");
956 if (!NT_STATUS_IS_OK(r_u
->status
))
959 DEBUG(5,("samr_reply_enum_dom_groups: %d\n", __LINE__
));
961 if (info
->builtin_domain
) {
962 /* No groups in builtin. */
963 init_samr_r_enum_dom_groups(r_u
, q_u
->start_idx
, 0);
964 DEBUG(5,("_samr_enum_dom_users: No groups in BUILTIN\n"));
968 /* the domain group array is being allocated in the function below */
972 if (info
->disp_info
->groups
== NULL
) {
973 info
->disp_info
->groups
= pdb_search_groups();
975 if (info
->disp_info
->groups
== NULL
) {
977 return NT_STATUS_ACCESS_DENIED
;
981 num_groups
= pdb_search_entries(info
->disp_info
->groups
, q_u
->start_idx
,
982 MAX_SAM_ENTRIES
, &groups
);
985 /* Ensure we cache this enumeration. */
986 set_disp_info_cache_timeout(info
->disp_info
, DISP_INFO_CACHE_TIMEOUT
);
988 make_group_sam_entry_list(p
->mem_ctx
, &r_u
->sam
, &r_u
->uni_grp_name
,
991 init_samr_r_enum_dom_groups(r_u
, q_u
->start_idx
, num_groups
);
993 DEBUG(5,("samr_enum_dom_groups: %d\n", __LINE__
));
998 /*******************************************************************
999 samr_reply_enum_dom_aliases
1000 ********************************************************************/
1002 NTSTATUS
_samr_enum_dom_aliases(pipes_struct
*p
, SAMR_Q_ENUM_DOM_ALIASES
*q_u
, SAMR_R_ENUM_DOM_ALIASES
*r_u
)
1004 struct samr_info
*info
;
1005 struct samr_displayentry
*aliases
;
1006 uint32 num_aliases
= 0;
1008 /* find the policy handle. open a policy on it. */
1009 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1010 return NT_STATUS_INVALID_HANDLE
;
1012 r_u
->status
= access_check_samr_function(info
->acc_granted
,
1013 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS
,
1014 "_samr_enum_dom_aliases");
1015 if (!NT_STATUS_IS_OK(r_u
->status
))
1018 DEBUG(5,("samr_reply_enum_dom_aliases: sid %s\n",
1019 sid_string_static(&info
->sid
)));
1023 if (info
->disp_info
->aliases
== NULL
) {
1024 info
->disp_info
->aliases
= pdb_search_aliases(&info
->sid
);
1025 if (info
->disp_info
->aliases
== NULL
) {
1027 return NT_STATUS_ACCESS_DENIED
;
1031 num_aliases
= pdb_search_entries(info
->disp_info
->aliases
, q_u
->start_idx
,
1032 MAX_SAM_ENTRIES
, &aliases
);
1035 /* Ensure we cache this enumeration. */
1036 set_disp_info_cache_timeout(info
->disp_info
, DISP_INFO_CACHE_TIMEOUT
);
1038 make_group_sam_entry_list(p
->mem_ctx
, &r_u
->sam
, &r_u
->uni_grp_name
,
1039 num_aliases
, aliases
);
1041 init_samr_r_enum_dom_aliases(r_u
, q_u
->start_idx
+ num_aliases
,
1044 DEBUG(5,("samr_enum_dom_aliases: %d\n", __LINE__
));
1049 /*******************************************************************
1050 samr_reply_query_dispinfo
1051 ********************************************************************/
1053 NTSTATUS
_samr_query_dispinfo(pipes_struct
*p
, SAMR_Q_QUERY_DISPINFO
*q_u
,
1054 SAMR_R_QUERY_DISPINFO
*r_u
)
1056 struct samr_info
*info
= NULL
;
1057 uint32 struct_size
=0x20; /* W2K always reply that, client doesn't care */
1059 uint32 max_entries
=q_u
->max_entries
;
1060 uint32 enum_context
=q_u
->start_idx
;
1061 uint32 max_size
=q_u
->max_size
;
1063 SAM_DISPINFO_CTR
*ctr
;
1064 uint32 temp_size
=0, total_data_size
=0;
1065 NTSTATUS disp_ret
= NT_STATUS_UNSUCCESSFUL
;
1066 uint32 num_account
= 0;
1067 enum remote_arch_types ra_type
= get_remote_arch();
1068 int max_sam_entries
= (ra_type
== RA_WIN95
) ? MAX_SAM_ENTRIES_W95
: MAX_SAM_ENTRIES_W2K
;
1069 struct samr_displayentry
*entries
= NULL
;
1071 DEBUG(5, ("samr_reply_query_dispinfo: %d\n", __LINE__
));
1072 r_u
->status
= NT_STATUS_UNSUCCESSFUL
;
1074 /* find the policy handle. open a policy on it. */
1075 if (!find_policy_by_hnd(p
, &q_u
->domain_pol
, (void **)(void *)&info
))
1076 return NT_STATUS_INVALID_HANDLE
;
1079 * calculate how many entries we will return.
1081 * - the number of entries the client asked
1082 * - our limit on that
1083 * - the starting point (enumeration context)
1084 * - the buffer size the client will accept
1088 * We are a lot more like W2K. Instead of reading the SAM
1089 * each time to find the records we need to send back,
1090 * we read it once and link that copy to the sam handle.
1091 * For large user list (over the MAX_SAM_ENTRIES)
1092 * it's a definitive win.
1093 * second point to notice: between enumerations
1094 * our sam is now the same as it's a snapshoot.
1095 * third point: got rid of the static SAM_USER_21 struct
1096 * no more intermediate.
1097 * con: it uses much more memory, as a full copy is stored
1100 * If you want to change it, think twice and think
1101 * of the second point , that's really important.
1106 if ((q_u
->switch_level
< 1) || (q_u
->switch_level
> 5)) {
1107 DEBUG(0,("_samr_query_dispinfo: Unknown info level (%u)\n",
1108 (unsigned int)q_u
->switch_level
));
1109 return NT_STATUS_INVALID_INFO_CLASS
;
1112 /* first limit the number of entries we will return */
1113 if(max_entries
> max_sam_entries
) {
1114 DEBUG(5, ("samr_reply_query_dispinfo: client requested %d "
1115 "entries, limiting to %d\n", max_entries
,
1117 max_entries
= max_sam_entries
;
1120 /* calculate the size and limit on the number of entries we will
1123 temp_size
=max_entries
*struct_size
;
1125 if (temp_size
>max_size
) {
1126 max_entries
=MIN((max_size
/struct_size
),max_entries
);;
1127 DEBUG(5, ("samr_reply_query_dispinfo: buffer size limits to "
1128 "only %d entries\n", max_entries
));
1131 if (!(ctr
= TALLOC_ZERO_P(p
->mem_ctx
,SAM_DISPINFO_CTR
)))
1132 return NT_STATUS_NO_MEMORY
;
1138 /* THe following done as ROOT. Don't return without unbecome_root(). */
1140 switch (q_u
->switch_level
) {
1143 if (info
->disp_info
->users
== NULL
) {
1144 info
->disp_info
->users
= pdb_search_users(ACB_NORMAL
);
1145 if (info
->disp_info
->users
== NULL
) {
1147 return NT_STATUS_ACCESS_DENIED
;
1149 DEBUG(10,("samr_reply_query_dispinfo: starting user enumeration at index %u\n",
1150 (unsigned int)enum_context
));
1152 DEBUG(10,("samr_reply_query_dispinfo: using cached user enumeration at index %u\n",
1153 (unsigned int)enum_context
));
1156 num_account
= pdb_search_entries(info
->disp_info
->users
,
1157 enum_context
, max_entries
,
1161 if (info
->disp_info
->machines
== NULL
) {
1162 info
->disp_info
->machines
=
1163 pdb_search_users(ACB_WSTRUST
|ACB_SVRTRUST
);
1164 if (info
->disp_info
->machines
== NULL
) {
1166 return NT_STATUS_ACCESS_DENIED
;
1168 DEBUG(10,("samr_reply_query_dispinfo: starting machine enumeration at index %u\n",
1169 (unsigned int)enum_context
));
1171 DEBUG(10,("samr_reply_query_dispinfo: using cached machine enumeration at index %u\n",
1172 (unsigned int)enum_context
));
1175 num_account
= pdb_search_entries(info
->disp_info
->machines
,
1176 enum_context
, max_entries
,
1181 if (info
->disp_info
->groups
== NULL
) {
1182 info
->disp_info
->groups
= pdb_search_groups();
1183 if (info
->disp_info
->groups
== NULL
) {
1185 return NT_STATUS_ACCESS_DENIED
;
1187 DEBUG(10,("samr_reply_query_dispinfo: starting group enumeration at index %u\n",
1188 (unsigned int)enum_context
));
1190 DEBUG(10,("samr_reply_query_dispinfo: using cached group enumeration at index %u\n",
1191 (unsigned int)enum_context
));
1194 num_account
= pdb_search_entries(info
->disp_info
->groups
,
1195 enum_context
, max_entries
,
1200 smb_panic("info class changed");
1205 /* Now create reply structure */
1206 switch (q_u
->switch_level
) {
1208 disp_ret
= init_sam_dispinfo_1(p
->mem_ctx
, &ctr
->sam
.info1
,
1209 num_account
, enum_context
,
1213 disp_ret
= init_sam_dispinfo_2(p
->mem_ctx
, &ctr
->sam
.info2
,
1214 num_account
, enum_context
,
1218 disp_ret
= init_sam_dispinfo_3(p
->mem_ctx
, &ctr
->sam
.info3
,
1219 num_account
, enum_context
,
1223 disp_ret
= init_sam_dispinfo_4(p
->mem_ctx
, &ctr
->sam
.info4
,
1224 num_account
, enum_context
,
1228 disp_ret
= init_sam_dispinfo_5(p
->mem_ctx
, &ctr
->sam
.info5
,
1229 num_account
, enum_context
,
1233 smb_panic("info class changed");
1237 if (!NT_STATUS_IS_OK(disp_ret
))
1240 /* calculate the total size */
1241 total_data_size
=num_account
*struct_size
;
1244 r_u
->status
= STATUS_MORE_ENTRIES
;
1246 r_u
->status
= NT_STATUS_OK
;
1249 /* Ensure we cache this enumeration. */
1250 set_disp_info_cache_timeout(info
->disp_info
, DISP_INFO_CACHE_TIMEOUT
);
1252 DEBUG(5, ("_samr_query_dispinfo: %d\n", __LINE__
));
1254 init_samr_r_query_dispinfo(r_u
, num_account
, total_data_size
,
1255 temp_size
, q_u
->switch_level
, ctr
,
1262 /*******************************************************************
1263 samr_reply_query_aliasinfo
1264 ********************************************************************/
1266 NTSTATUS
_samr_query_aliasinfo(pipes_struct
*p
, SAMR_Q_QUERY_ALIASINFO
*q_u
, SAMR_R_QUERY_ALIASINFO
*r_u
)
1269 struct acct_info info
;
1273 r_u
->status
= NT_STATUS_OK
;
1275 DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__
));
1277 /* find the policy handle. open a policy on it. */
1278 if (!get_lsa_policy_samr_sid(p
, &q_u
->pol
, &sid
, &acc_granted
, NULL
))
1279 return NT_STATUS_INVALID_HANDLE
;
1280 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_ALIAS_LOOKUP_INFO
, "_samr_query_aliasinfo"))) {
1285 ret
= pdb_get_aliasinfo(&sid
, &info
);
1289 return NT_STATUS_NO_SUCH_ALIAS
;
1291 if ( !(r_u
->ctr
= TALLOC_ZERO_P( p
->mem_ctx
, ALIAS_INFO_CTR
)) )
1292 return NT_STATUS_NO_MEMORY
;
1295 switch (q_u
->level
) {
1297 r_u
->ctr
->level
= 1;
1298 init_samr_alias_info1(&r_u
->ctr
->alias
.info1
, info
.acct_name
, 1, info
.acct_desc
);
1301 r_u
->ctr
->level
= 3;
1302 init_samr_alias_info3(&r_u
->ctr
->alias
.info3
, info
.acct_desc
);
1305 return NT_STATUS_INVALID_INFO_CLASS
;
1308 DEBUG(5,("_samr_query_aliasinfo: %d\n", __LINE__
));
1314 /*******************************************************************
1315 samr_reply_lookup_ids
1316 ********************************************************************/
1318 uint32
_samr_lookup_ids(pipes_struct
*p
, SAMR_Q_LOOKUP_IDS
*q_u
, SAMR_R_LOOKUP_IDS
*r_u
)
1320 uint32 rid
[MAX_SAM_ENTRIES
];
1321 int num_rids
= q_u
->num_sids1
;
1323 r_u
->status
= NT_STATUS_OK
;
1325 DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__
));
1327 if (num_rids
> MAX_SAM_ENTRIES
) {
1328 num_rids
= MAX_SAM_ENTRIES
;
1329 DEBUG(5,("_samr_lookup_ids: truncating entries to %d\n", num_rids
));
1334 SMB_ASSERT_ARRAY(q_u
->uni_user_name
, num_rids
);
1336 for (i
= 0; i
< num_rids
&& status
== 0; i
++)
1338 struct sam_passwd
*sam_pass
;
1342 fstrcpy(user_name
, unistrn2(q_u
->uni_user_name
[i
].buffer
,
1343 q_u
->uni_user_name
[i
].uni_str_len
));
1345 /* find the user account */
1347 sam_pass
= get_smb21pwd_entry(user_name
, 0);
1350 if (sam_pass
== NULL
)
1352 status
= 0xC0000000 | NT_STATUS_NO_SUCH_USER
;
1357 rid
[i
] = sam_pass
->user_rid
;
1363 rid
[0] = BUILTIN_ALIAS_RID_USERS
;
1365 init_samr_r_lookup_ids(&r_u
, num_rids
, rid
, NT_STATUS_OK
);
1367 DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__
));
1373 /*******************************************************************
1375 ********************************************************************/
1377 NTSTATUS
_samr_lookup_names(pipes_struct
*p
, SAMR_Q_LOOKUP_NAMES
*q_u
, SAMR_R_LOOKUP_NAMES
*r_u
)
1379 uint32 rid
[MAX_SAM_ENTRIES
];
1380 enum SID_NAME_USE type
[MAX_SAM_ENTRIES
];
1382 int num_rids
= q_u
->num_names2
;
1387 r_u
->status
= NT_STATUS_OK
;
1389 DEBUG(5,("_samr_lookup_names: %d\n", __LINE__
));
1394 if (!get_lsa_policy_samr_sid(p
, &q_u
->pol
, &pol_sid
, &acc_granted
, NULL
)) {
1395 init_samr_r_lookup_names(p
->mem_ctx
, r_u
, 0, NULL
, NULL
, NT_STATUS_OBJECT_TYPE_MISMATCH
);
1399 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, 0, "_samr_lookup_names"))) { /* Don't know the acc_bits yet */
1403 if (num_rids
> MAX_SAM_ENTRIES
) {
1404 num_rids
= MAX_SAM_ENTRIES
;
1405 DEBUG(5,("_samr_lookup_names: truncating entries to %d\n", num_rids
));
1408 DEBUG(5,("_samr_lookup_names: looking name on SID %s\n", sid_to_string(sid_str
, &pol_sid
)));
1410 for (i
= 0; i
< num_rids
; i
++) {
1414 r_u
->status
= NT_STATUS_NONE_MAPPED
;
1415 type
[i
] = SID_NAME_UNKNOWN
;
1417 rid
[i
] = 0xffffffff;
1419 ret
= rpcstr_pull(name
, q_u
->uni_name
[i
].buffer
, sizeof(name
), q_u
->uni_name
[i
].uni_str_len
*2, 0);
1425 if (sid_check_is_builtin(&pol_sid
)) {
1426 if (lookup_builtin_name(name
, &rid
[i
])) {
1427 type
[i
] = SID_NAME_ALIAS
;
1430 lookup_global_sam_name(name
, 0, &rid
[i
], &type
[i
]);
1433 if (type
[i
] != SID_NAME_UNKNOWN
) {
1434 r_u
->status
= NT_STATUS_OK
;
1438 init_samr_r_lookup_names(p
->mem_ctx
, r_u
, num_rids
, rid
, (uint32
*)type
, r_u
->status
);
1440 DEBUG(5,("_samr_lookup_names: %d\n", __LINE__
));
1445 /*******************************************************************
1446 _samr_chgpasswd_user
1447 ********************************************************************/
1449 NTSTATUS
_samr_chgpasswd_user(pipes_struct
*p
, SAMR_Q_CHGPASSWD_USER
*q_u
, SAMR_R_CHGPASSWD_USER
*r_u
)
1454 DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__
));
1456 r_u
->status
= NT_STATUS_OK
;
1458 rpcstr_pull(user_name
, q_u
->uni_user_name
.buffer
, sizeof(user_name
), q_u
->uni_user_name
.uni_str_len
*2, 0);
1459 rpcstr_pull(wks
, q_u
->uni_dest_host
.buffer
, sizeof(wks
), q_u
->uni_dest_host
.uni_str_len
*2,0);
1461 DEBUG(5,("samr_chgpasswd_user: user: %s wks: %s\n", user_name
, wks
));
1464 * Pass the user through the NT -> unix user mapping
1468 (void)map_username(user_name
);
1471 * UNIX username case mangling not required, pass_oem_change
1472 * is case insensitive.
1475 r_u
->status
= pass_oem_change(user_name
, q_u
->lm_newpass
.pass
, q_u
->lm_oldhash
.hash
,
1476 q_u
->nt_newpass
.pass
, q_u
->nt_oldhash
.hash
, NULL
);
1478 init_samr_r_chgpasswd_user(r_u
, r_u
->status
);
1480 DEBUG(5,("_samr_chgpasswd_user: %d\n", __LINE__
));
1485 /*******************************************************************
1486 _samr_chgpasswd_user3
1487 ********************************************************************/
1489 NTSTATUS
_samr_chgpasswd_user3(pipes_struct
*p
, SAMR_Q_CHGPASSWD_USER3
*q_u
, SAMR_R_CHGPASSWD_USER3
*r_u
)
1493 uint32 reject_reason
;
1494 SAM_UNK_INFO_1
*info
= NULL
;
1495 SAMR_CHANGE_REJECT
*reject
= NULL
;
1497 DEBUG(5,("_samr_chgpasswd_user3: %d\n", __LINE__
));
1499 rpcstr_pull(user_name
, q_u
->uni_user_name
.buffer
, sizeof(user_name
), q_u
->uni_user_name
.uni_str_len
*2, 0);
1500 rpcstr_pull(wks
, q_u
->uni_dest_host
.buffer
, sizeof(wks
), q_u
->uni_dest_host
.uni_str_len
*2,0);
1502 DEBUG(5,("_samr_chgpasswd_user3: user: %s wks: %s\n", user_name
, wks
));
1505 * Pass the user through the NT -> unix user mapping
1509 (void)map_username(user_name
);
1512 * UNIX username case mangling not required, pass_oem_change
1513 * is case insensitive.
1516 r_u
->status
= pass_oem_change(user_name
, q_u
->lm_newpass
.pass
, q_u
->lm_oldhash
.hash
,
1517 q_u
->nt_newpass
.pass
, q_u
->nt_oldhash
.hash
, &reject_reason
);
1519 if (NT_STATUS_EQUAL(r_u
->status
, NT_STATUS_PASSWORD_RESTRICTION
) ||
1520 NT_STATUS_EQUAL(r_u
->status
, NT_STATUS_ACCOUNT_RESTRICTION
)) {
1522 uint32 min_pass_len
,pass_hist
,password_properties
;
1523 time_t u_expire
, u_min_age
;
1524 NTTIME nt_expire
, nt_min_age
;
1525 uint32 account_policy_temp
;
1527 if ((info
= TALLOC_ZERO_P(p
->mem_ctx
, SAM_UNK_INFO_1
)) == NULL
) {
1528 return NT_STATUS_NO_MEMORY
;
1531 if ((reject
= TALLOC_ZERO_P(p
->mem_ctx
, SAMR_CHANGE_REJECT
)) == NULL
) {
1532 return NT_STATUS_NO_MEMORY
;
1536 ZERO_STRUCTP(reject
);
1542 pdb_get_account_policy(AP_MIN_PASSWORD_LEN
, &account_policy_temp
);
1543 min_pass_len
= account_policy_temp
;
1545 pdb_get_account_policy(AP_PASSWORD_HISTORY
, &account_policy_temp
);
1546 pass_hist
= account_policy_temp
;
1548 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS
, &account_policy_temp
);
1549 password_properties
= account_policy_temp
;
1551 pdb_get_account_policy(AP_MAX_PASSWORD_AGE
, &account_policy_temp
);
1552 u_expire
= account_policy_temp
;
1554 pdb_get_account_policy(AP_MIN_PASSWORD_AGE
, &account_policy_temp
);
1555 u_min_age
= account_policy_temp
;
1561 unix_to_nt_time_abs(&nt_expire
, u_expire
);
1562 unix_to_nt_time_abs(&nt_min_age
, u_min_age
);
1564 init_unk_info1(info
, (uint16
)min_pass_len
, (uint16
)pass_hist
,
1565 password_properties
, nt_expire
, nt_min_age
);
1567 reject
->reject_reason
= reject_reason
;
1570 init_samr_r_chgpasswd_user3(r_u
, r_u
->status
, reject
, info
);
1572 DEBUG(5,("_samr_chgpasswd_user3: %d\n", __LINE__
));
1577 /*******************************************************************
1578 makes a SAMR_R_LOOKUP_RIDS structure.
1579 ********************************************************************/
1581 static BOOL
make_samr_lookup_rids(TALLOC_CTX
*ctx
, uint32 num_names
,
1582 const char **names
, UNIHDR
**pp_hdr_name
,
1583 UNISTR2
**pp_uni_name
)
1586 UNIHDR
*hdr_name
=NULL
;
1587 UNISTR2
*uni_name
=NULL
;
1589 *pp_uni_name
= NULL
;
1590 *pp_hdr_name
= NULL
;
1592 if (num_names
!= 0) {
1593 hdr_name
= TALLOC_ZERO_ARRAY(ctx
, UNIHDR
, num_names
);
1594 if (hdr_name
== NULL
)
1597 uni_name
= TALLOC_ZERO_ARRAY(ctx
,UNISTR2
, num_names
);
1598 if (uni_name
== NULL
)
1602 for (i
= 0; i
< num_names
; i
++) {
1603 DEBUG(10, ("names[%d]:%s\n", i
, names
[i
] && *names
[i
] ? names
[i
] : ""));
1604 init_unistr2(&uni_name
[i
], names
[i
], UNI_FLAGS_NONE
);
1605 init_uni_hdr(&hdr_name
[i
], &uni_name
[i
]);
1608 *pp_uni_name
= uni_name
;
1609 *pp_hdr_name
= hdr_name
;
1614 /*******************************************************************
1616 ********************************************************************/
1618 NTSTATUS
_samr_lookup_rids(pipes_struct
*p
, SAMR_Q_LOOKUP_RIDS
*q_u
, SAMR_R_LOOKUP_RIDS
*r_u
)
1621 uint32
*attrs
= NULL
;
1622 UNIHDR
*hdr_name
= NULL
;
1623 UNISTR2
*uni_name
= NULL
;
1625 int num_rids
= q_u
->num_rids1
;
1628 r_u
->status
= NT_STATUS_OK
;
1630 DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__
));
1632 /* find the policy handle. open a policy on it. */
1633 if (!get_lsa_policy_samr_sid(p
, &q_u
->pol
, &pol_sid
, &acc_granted
, NULL
))
1634 return NT_STATUS_INVALID_HANDLE
;
1636 if (num_rids
> 1000) {
1637 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
1638 "to samba4 idl this is not possible\n", num_rids
));
1639 return NT_STATUS_UNSUCCESSFUL
;
1642 names
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, const char *, num_rids
);
1643 attrs
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, uint32
, num_rids
);
1645 if ((num_rids
!= 0) && ((names
== NULL
) || (attrs
== NULL
)))
1646 return NT_STATUS_NO_MEMORY
;
1648 become_root(); /* lookup_sid can require root privs */
1649 r_u
->status
= pdb_lookup_rids(&pol_sid
, num_rids
, q_u
->rid
,
1653 if ( NT_STATUS_EQUAL(r_u
->status
, NT_STATUS_NONE_MAPPED
) && (num_rids
== 0) ) {
1654 r_u
->status
= NT_STATUS_OK
;
1657 if(!make_samr_lookup_rids(p
->mem_ctx
, num_rids
, names
,
1658 &hdr_name
, &uni_name
))
1659 return NT_STATUS_NO_MEMORY
;
1661 init_samr_r_lookup_rids(r_u
, num_rids
, hdr_name
, uni_name
, attrs
);
1663 DEBUG(5,("_samr_lookup_rids: %d\n", __LINE__
));
1668 /*******************************************************************
1669 _samr_open_user. Safe - gives out no passwd info.
1670 ********************************************************************/
1672 NTSTATUS
_samr_open_user(pipes_struct
*p
, SAMR_Q_OPEN_USER
*q_u
, SAMR_R_OPEN_USER
*r_u
)
1674 struct samu
*sampass
=NULL
;
1676 POLICY_HND domain_pol
= q_u
->domain_pol
;
1677 POLICY_HND
*user_pol
= &r_u
->user_pol
;
1678 struct samr_info
*info
= NULL
;
1679 SEC_DESC
*psd
= NULL
;
1681 uint32 des_access
= q_u
->access_mask
;
1687 r_u
->status
= NT_STATUS_OK
;
1689 /* find the domain policy handle and get domain SID / access bits in the domain policy. */
1691 if ( !get_lsa_policy_samr_sid(p
, &domain_pol
, &sid
, &acc_granted
, NULL
) )
1692 return NT_STATUS_INVALID_HANDLE
;
1694 nt_status
= access_check_samr_function( acc_granted
,
1695 SA_RIGHT_DOMAIN_OPEN_ACCOUNT
, "_samr_open_user" );
1697 if ( !NT_STATUS_IS_OK(nt_status
) )
1700 if ( !(sampass
= samu_new( p
->mem_ctx
)) ) {
1701 return NT_STATUS_NO_MEMORY
;
1704 /* append the user's RID to it */
1706 if (!sid_append_rid(&sid
, q_u
->user_rid
))
1707 return NT_STATUS_NO_SUCH_USER
;
1709 /* check if access can be granted as requested by client. */
1711 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &usr_generic_mapping
, &sid
, SAMR_USR_RIGHTS_WRITE_PW
);
1712 se_map_generic(&des_access
, &usr_generic_mapping
);
1714 se_priv_copy( &se_rights
, &se_machine_account
);
1715 se_priv_add( &se_rights
, &se_add_users
);
1717 nt_status
= access_check_samr_object(psd
, p
->pipe_user
.nt_user_token
,
1718 &se_rights
, GENERIC_RIGHTS_USER_WRITE
, des_access
,
1719 &acc_granted
, "_samr_open_user");
1721 if ( !NT_STATUS_IS_OK(nt_status
) )
1725 ret
=pdb_getsampwsid(sampass
, &sid
);
1728 /* check that the SID exists in our domain. */
1730 return NT_STATUS_NO_SUCH_USER
;
1733 TALLOC_FREE(sampass
);
1735 /* associate the user's SID and access bits with the new handle. */
1736 if ((info
= get_samr_info_by_sid(&sid
)) == NULL
)
1737 return NT_STATUS_NO_MEMORY
;
1738 info
->acc_granted
= acc_granted
;
1740 /* get a (unique) handle. open a policy on it. */
1741 if (!create_policy_hnd(p
, user_pol
, free_samr_info
, (void *)info
))
1742 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1747 /*************************************************************************
1748 get_user_info_7. Safe. Only gives out account_name.
1749 *************************************************************************/
1751 static NTSTATUS
get_user_info_7(TALLOC_CTX
*mem_ctx
, SAM_USER_INFO_7
*id7
, DOM_SID
*user_sid
)
1753 struct samu
*smbpass
=NULL
;
1756 if ( !(smbpass
= samu_new( mem_ctx
)) ) {
1757 return NT_STATUS_NO_MEMORY
;
1761 ret
= pdb_getsampwsid(smbpass
, user_sid
);
1765 DEBUG(4,("User %s not found\n", sid_string_static(user_sid
)));
1766 return NT_STATUS_NO_SUCH_USER
;
1769 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass
) ));
1772 init_sam_user_info7(id7
, pdb_get_username(smbpass
) );
1774 TALLOC_FREE(smbpass
);
1776 return NT_STATUS_OK
;
1779 /*************************************************************************
1780 get_user_info_9. Only gives out primary group SID.
1781 *************************************************************************/
1782 static NTSTATUS
get_user_info_9(TALLOC_CTX
*mem_ctx
, SAM_USER_INFO_9
* id9
, DOM_SID
*user_sid
)
1784 struct samu
*smbpass
=NULL
;
1787 if ( !(smbpass
= samu_new( mem_ctx
)) ) {
1788 return NT_STATUS_NO_MEMORY
;
1792 ret
= pdb_getsampwsid(smbpass
, user_sid
);
1796 DEBUG(4,("User %s not found\n", sid_string_static(user_sid
)));
1797 return NT_STATUS_NO_SUCH_USER
;
1800 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass
) ));
1803 init_sam_user_info9(id9
, pdb_get_group_rid(smbpass
) );
1805 TALLOC_FREE(smbpass
);
1807 return NT_STATUS_OK
;
1810 /*************************************************************************
1811 get_user_info_16. Safe. Only gives out acb bits.
1812 *************************************************************************/
1814 static NTSTATUS
get_user_info_16(TALLOC_CTX
*mem_ctx
, SAM_USER_INFO_16
*id16
, DOM_SID
*user_sid
)
1816 struct samu
*smbpass
=NULL
;
1819 if ( !(smbpass
= samu_new( mem_ctx
)) ) {
1820 return NT_STATUS_NO_MEMORY
;
1824 ret
= pdb_getsampwsid(smbpass
, user_sid
);
1828 DEBUG(4,("User %s not found\n", sid_string_static(user_sid
)));
1829 return NT_STATUS_NO_SUCH_USER
;
1832 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass
) ));
1835 init_sam_user_info16(id16
, pdb_get_acct_ctrl(smbpass
) );
1837 TALLOC_FREE(smbpass
);
1839 return NT_STATUS_OK
;
1842 /*************************************************************************
1843 get_user_info_18. OK - this is the killer as it gives out password info.
1844 Ensure that this is only allowed on an encrypted connection with a root
1846 *************************************************************************/
1848 static NTSTATUS
get_user_info_18(pipes_struct
*p
, TALLOC_CTX
*mem_ctx
, SAM_USER_INFO_18
* id18
, DOM_SID
*user_sid
)
1850 struct samu
*smbpass
=NULL
;
1853 if (p
->auth
.auth_type
!= PIPE_AUTH_TYPE_NTLMSSP
|| p
->auth
.auth_type
!= PIPE_AUTH_TYPE_SPNEGO_NTLMSSP
) {
1854 return NT_STATUS_ACCESS_DENIED
;
1857 if (p
->auth
.auth_level
!= PIPE_AUTH_LEVEL_PRIVACY
) {
1858 return NT_STATUS_ACCESS_DENIED
;
1862 * Do *NOT* do become_root()/unbecome_root() here ! JRA.
1865 if ( !(smbpass
= samu_new( mem_ctx
)) ) {
1866 return NT_STATUS_NO_MEMORY
;
1869 ret
= pdb_getsampwsid(smbpass
, user_sid
);
1872 DEBUG(4, ("User %s not found\n", sid_string_static(user_sid
)));
1873 TALLOC_FREE(smbpass
);
1874 return (geteuid() == (uid_t
)0) ? NT_STATUS_NO_SUCH_USER
: NT_STATUS_ACCESS_DENIED
;
1877 DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass
), pdb_get_acct_ctrl(smbpass
) ));
1879 if ( pdb_get_acct_ctrl(smbpass
) & ACB_DISABLED
) {
1880 TALLOC_FREE(smbpass
);
1881 return NT_STATUS_ACCOUNT_DISABLED
;
1885 init_sam_user_info18(id18
, pdb_get_lanman_passwd(smbpass
), pdb_get_nt_passwd(smbpass
));
1887 TALLOC_FREE(smbpass
);
1889 return NT_STATUS_OK
;
1892 /*************************************************************************
1894 *************************************************************************/
1896 static NTSTATUS
get_user_info_20(TALLOC_CTX
*mem_ctx
, SAM_USER_INFO_20
*id20
, DOM_SID
*user_sid
)
1898 struct samu
*sampass
=NULL
;
1901 if ( !(sampass
= samu_new( mem_ctx
)) ) {
1902 return NT_STATUS_NO_MEMORY
;
1906 ret
= pdb_getsampwsid(sampass
, user_sid
);
1910 DEBUG(4,("User %s not found\n", sid_string_static(user_sid
)));
1911 return NT_STATUS_NO_SUCH_USER
;
1914 samr_clear_sam_passwd(sampass
);
1916 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass
) ));
1919 init_sam_user_info20A(id20
, sampass
);
1921 TALLOC_FREE(sampass
);
1923 return NT_STATUS_OK
;
1926 /*************************************************************************
1928 *************************************************************************/
1930 static NTSTATUS
get_user_info_21(TALLOC_CTX
*mem_ctx
, SAM_USER_INFO_21
*id21
,
1931 DOM_SID
*user_sid
, DOM_SID
*domain_sid
)
1933 struct samu
*sampass
=NULL
;
1937 if ( !(sampass
= samu_new( mem_ctx
)) ) {
1938 return NT_STATUS_NO_MEMORY
;
1942 ret
= pdb_getsampwsid(sampass
, user_sid
);
1946 DEBUG(4,("User %s not found\n", sid_string_static(user_sid
)));
1947 return NT_STATUS_NO_SUCH_USER
;
1950 samr_clear_sam_passwd(sampass
);
1952 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass
) ));
1955 nt_status
= init_sam_user_info21A(id21
, sampass
, domain_sid
);
1957 TALLOC_FREE(sampass
);
1959 return NT_STATUS_OK
;
1962 /*******************************************************************
1963 _samr_query_userinfo
1964 ********************************************************************/
1966 NTSTATUS
_samr_query_userinfo(pipes_struct
*p
, SAMR_Q_QUERY_USERINFO
*q_u
, SAMR_R_QUERY_USERINFO
*r_u
)
1968 SAM_USERINFO_CTR
*ctr
;
1969 struct samr_info
*info
= NULL
;
1973 r_u
->status
=NT_STATUS_OK
;
1975 /* search for the handle */
1976 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
1977 return NT_STATUS_INVALID_HANDLE
;
1979 domain_sid
= info
->sid
;
1981 sid_split_rid(&domain_sid
, &rid
);
1983 if (!sid_check_is_in_our_domain(&info
->sid
))
1984 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
1986 DEBUG(5,("_samr_query_userinfo: sid:%s\n", sid_string_static(&info
->sid
)));
1988 ctr
= TALLOC_ZERO_P(p
->mem_ctx
, SAM_USERINFO_CTR
);
1990 return NT_STATUS_NO_MEMORY
;
1994 /* ok! user info levels (lots: see MSDEV help), off we go... */
1995 ctr
->switch_value
= q_u
->switch_value
;
1997 DEBUG(5,("_samr_query_userinfo: user info level: %d\n", q_u
->switch_value
));
1999 switch (q_u
->switch_value
) {
2001 ctr
->info
.id7
= TALLOC_ZERO_P(p
->mem_ctx
, SAM_USER_INFO_7
);
2002 if (ctr
->info
.id7
== NULL
)
2003 return NT_STATUS_NO_MEMORY
;
2005 if (!NT_STATUS_IS_OK(r_u
->status
= get_user_info_7(p
->mem_ctx
, ctr
->info
.id7
, &info
->sid
)))
2009 ctr
->info
.id9
= TALLOC_ZERO_P(p
->mem_ctx
, SAM_USER_INFO_9
);
2010 if (ctr
->info
.id9
== NULL
)
2011 return NT_STATUS_NO_MEMORY
;
2013 if (!NT_STATUS_IS_OK(r_u
->status
= get_user_info_9(p
->mem_ctx
, ctr
->info
.id9
, &info
->sid
)))
2017 ctr
->info
.id16
= TALLOC_ZERO_P(p
->mem_ctx
, SAM_USER_INFO_16
);
2018 if (ctr
->info
.id16
== NULL
)
2019 return NT_STATUS_NO_MEMORY
;
2021 if (!NT_STATUS_IS_OK(r_u
->status
= get_user_info_16(p
->mem_ctx
, ctr
->info
.id16
, &info
->sid
)))
2026 ctr
->info
.id18
= TALLOC_ZERO_P(p
->mem_ctx
, SAM_USER_INFO_18
);
2027 if (ctr
->info
.id18
== NULL
)
2028 return NT_STATUS_NO_MEMORY
;
2030 if (!NT_STATUS_IS_OK(r_u
->status
= get_user_info_18(p
, p
->mem_ctx
, ctr
->info
.id18
, &info
->sid
)))
2035 ctr
->info
.id20
= TALLOC_ZERO_P(p
->mem_ctx
,SAM_USER_INFO_20
);
2036 if (ctr
->info
.id20
== NULL
)
2037 return NT_STATUS_NO_MEMORY
;
2038 if (!NT_STATUS_IS_OK(r_u
->status
= get_user_info_20(p
->mem_ctx
, ctr
->info
.id20
, &info
->sid
)))
2043 ctr
->info
.id21
= TALLOC_ZERO_P(p
->mem_ctx
,SAM_USER_INFO_21
);
2044 if (ctr
->info
.id21
== NULL
)
2045 return NT_STATUS_NO_MEMORY
;
2046 if (!NT_STATUS_IS_OK(r_u
->status
= get_user_info_21(p
->mem_ctx
, ctr
->info
.id21
,
2047 &info
->sid
, &domain_sid
)))
2052 return NT_STATUS_INVALID_INFO_CLASS
;
2055 init_samr_r_query_userinfo(r_u
, ctr
, r_u
->status
);
2057 DEBUG(5,("_samr_query_userinfo: %d\n", __LINE__
));
2062 /*******************************************************************
2063 samr_reply_query_usergroups
2064 ********************************************************************/
2066 NTSTATUS
_samr_query_usergroups(pipes_struct
*p
, SAMR_Q_QUERY_USERGROUPS
*q_u
, SAMR_R_QUERY_USERGROUPS
*r_u
)
2068 struct samu
*sam_pass
=NULL
;
2072 DOM_GID
*gids
= NULL
;
2073 uint32 primary_group_rid
;
2074 size_t num_groups
= 0;
2082 * from the SID in the request:
2083 * we should send back the list of DOMAIN GROUPS
2084 * the user is a member of
2086 * and only the DOMAIN GROUPS
2087 * no ALIASES !!! neither aliases of the domain
2088 * nor aliases of the builtin SID
2093 r_u
->status
= NT_STATUS_OK
;
2095 DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__
));
2097 /* find the policy handle. open a policy on it. */
2098 if (!get_lsa_policy_samr_sid(p
, &q_u
->pol
, &sid
, &acc_granted
, NULL
))
2099 return NT_STATUS_INVALID_HANDLE
;
2101 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_USER_GET_GROUPS
, "_samr_query_usergroups"))) {
2105 if (!sid_check_is_in_our_domain(&sid
))
2106 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
2108 if ( !(sam_pass
= samu_new( p
->mem_ctx
)) ) {
2109 return NT_STATUS_NO_MEMORY
;
2113 ret
= pdb_getsampwsid(sam_pass
, &sid
);
2117 DEBUG(10, ("pdb_getsampwsid failed for %s\n",
2118 sid_string_static(&sid
)));
2119 return NT_STATUS_NO_SUCH_USER
;
2125 result
= pdb_enum_group_memberships(p
->mem_ctx
, sam_pass
,
2126 &sids
, &unix_gids
, &num_groups
);
2129 if (!NT_STATUS_IS_OK(result
)) {
2130 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
2131 sid_string_static(&sid
)));
2138 dom_gid
.attr
= (SE_GROUP_MANDATORY
|SE_GROUP_ENABLED_BY_DEFAULT
|
2141 if (!sid_peek_check_rid(get_global_sam_sid(),
2142 pdb_get_group_sid(sam_pass
),
2143 &primary_group_rid
)) {
2144 DEBUG(5, ("Group sid %s for user %s not in our domain\n",
2145 sid_string_static(pdb_get_group_sid(sam_pass
)),
2146 pdb_get_username(sam_pass
)));
2147 TALLOC_FREE(sam_pass
);
2148 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
2151 dom_gid
.g_rid
= primary_group_rid
;
2153 ADD_TO_ARRAY(p
->mem_ctx
, DOM_GID
, dom_gid
, &gids
, &num_gids
);
2155 for (i
=0; i
<num_groups
; i
++) {
2157 if (!sid_peek_check_rid(get_global_sam_sid(),
2158 &(sids
[i
]), &dom_gid
.g_rid
)) {
2159 DEBUG(10, ("Found sid %s not in our domain\n",
2160 sid_string_static(&sids
[i
])));
2164 if (dom_gid
.g_rid
== primary_group_rid
) {
2165 /* We added the primary group directly from the
2166 * sam_account. The other SIDs are unique from
2167 * enum_group_memberships */
2171 ADD_TO_ARRAY(p
->mem_ctx
, DOM_GID
, dom_gid
, &gids
, &num_gids
);
2174 /* construct the response. lkclXXXX: gids are not copied! */
2175 init_samr_r_query_usergroups(r_u
, num_gids
, gids
, r_u
->status
);
2177 DEBUG(5,("_samr_query_usergroups: %d\n", __LINE__
));
2182 /*******************************************************************
2183 _samr_query_dom_info
2184 ********************************************************************/
2186 NTSTATUS
_samr_query_dom_info(pipes_struct
*p
, SAMR_Q_QUERY_DOMAIN_INFO
*q_u
, SAMR_R_QUERY_DOMAIN_INFO
*r_u
)
2188 struct samr_info
*info
= NULL
;
2190 uint32 min_pass_len
,pass_hist
,password_properties
;
2191 time_t u_expire
, u_min_age
;
2192 NTTIME nt_expire
, nt_min_age
;
2194 time_t u_lock_duration
, u_reset_time
;
2195 NTTIME nt_lock_duration
, nt_reset_time
;
2200 uint32 account_policy_temp
;
2205 uint32 num_users
=0, num_groups
=0, num_aliases
=0;
2207 if ((ctr
= TALLOC_ZERO_P(p
->mem_ctx
, SAM_UNK_CTR
)) == NULL
) {
2208 return NT_STATUS_NO_MEMORY
;
2213 r_u
->status
= NT_STATUS_OK
;
2215 DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__
));
2217 /* find the policy handle. open a policy on it. */
2218 if (!find_policy_by_hnd(p
, &q_u
->domain_pol
, (void **)(void *)&info
)) {
2219 return NT_STATUS_INVALID_HANDLE
;
2222 switch (q_u
->switch_value
) {
2229 pdb_get_account_policy(AP_MIN_PASSWORD_LEN
, &account_policy_temp
);
2230 min_pass_len
= account_policy_temp
;
2232 pdb_get_account_policy(AP_PASSWORD_HISTORY
, &account_policy_temp
);
2233 pass_hist
= account_policy_temp
;
2235 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS
, &account_policy_temp
);
2236 password_properties
= account_policy_temp
;
2238 pdb_get_account_policy(AP_MAX_PASSWORD_AGE
, &account_policy_temp
);
2239 u_expire
= account_policy_temp
;
2241 pdb_get_account_policy(AP_MIN_PASSWORD_AGE
, &account_policy_temp
);
2242 u_min_age
= account_policy_temp
;
2248 unix_to_nt_time_abs(&nt_expire
, u_expire
);
2249 unix_to_nt_time_abs(&nt_min_age
, u_min_age
);
2251 init_unk_info1(&ctr
->info
.inf1
, (uint16
)min_pass_len
, (uint16
)pass_hist
,
2252 password_properties
, nt_expire
, nt_min_age
);
2260 num_users
= count_sam_users(info
->disp_info
, ACB_NORMAL
);
2261 num_groups
= count_sam_groups(info
->disp_info
);
2262 num_aliases
= count_sam_aliases(info
->disp_info
);
2264 pdb_get_account_policy(AP_TIME_TO_LOGOUT
, &account_policy_temp
);
2265 u_logout
= account_policy_temp
;
2267 unix_to_nt_time_abs(&nt_logout
, u_logout
);
2269 if (!pdb_get_seq_num(&seq_num
))
2270 seq_num
= time(NULL
);
2276 server_role
= ROLE_DOMAIN_PDC
;
2277 if (lp_server_role() == ROLE_DOMAIN_BDC
)
2278 server_role
= ROLE_DOMAIN_BDC
;
2280 init_unk_info2(&ctr
->info
.inf2
, lp_serverstring(), lp_workgroup(), global_myname(), seq_num
,
2281 num_users
, num_groups
, num_aliases
, nt_logout
, server_role
);
2291 pdb_get_account_policy(AP_TIME_TO_LOGOUT
, &ul
);
2292 u_logout
= (time_t)ul
;
2299 unix_to_nt_time_abs(&nt_logout
, u_logout
);
2301 init_unk_info3(&ctr
->info
.inf3
, nt_logout
);
2304 init_unk_info5(&ctr
->info
.inf5
, global_myname());
2307 init_unk_info6(&ctr
->info
.inf6
);
2310 server_role
= ROLE_DOMAIN_PDC
;
2311 if (lp_server_role() == ROLE_DOMAIN_BDC
)
2312 server_role
= ROLE_DOMAIN_BDC
;
2314 init_unk_info7(&ctr
->info
.inf7
, server_role
);
2322 if (!pdb_get_seq_num(&seq_num
)) {
2323 seq_num
= time(NULL
);
2330 init_unk_info8(&ctr
->info
.inf8
, (uint32
) seq_num
);
2338 pdb_get_account_policy(AP_LOCK_ACCOUNT_DURATION
, &account_policy_temp
);
2339 u_lock_duration
= account_policy_temp
;
2340 if (u_lock_duration
!= -1) {
2341 u_lock_duration
*= 60;
2344 pdb_get_account_policy(AP_RESET_COUNT_TIME
, &account_policy_temp
);
2345 u_reset_time
= account_policy_temp
* 60;
2347 pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT
, &account_policy_temp
);
2348 lockout
= account_policy_temp
;
2354 unix_to_nt_time_abs(&nt_lock_duration
, u_lock_duration
);
2355 unix_to_nt_time_abs(&nt_reset_time
, u_reset_time
);
2357 init_unk_info12(&ctr
->info
.inf12
, nt_lock_duration
, nt_reset_time
, (uint16
)lockout
);
2360 return NT_STATUS_INVALID_INFO_CLASS
;
2364 init_samr_r_query_dom_info(r_u
, q_u
->switch_value
, ctr
, NT_STATUS_OK
);
2366 DEBUG(5,("_samr_query_dom_info: %d\n", __LINE__
));
2371 /* W2k3 seems to use the same check for all 3 objects that can be created via
2372 * SAMR, if you try to create for example "Dialup" as an alias it says
2373 * "NT_STATUS_USER_EXISTS". This is racy, but we can't really lock the user
2376 static NTSTATUS
can_create(TALLOC_CTX
*mem_ctx
, const char *new_name
)
2378 enum SID_NAME_USE type
;
2381 DEBUG(10, ("Checking whether [%s] can be created\n", new_name
));
2384 /* Lookup in our local databases (only LOOKUP_NAME_ISOLATED set)
2385 * whether the name already exists */
2386 result
= lookup_name(mem_ctx
, new_name
, LOOKUP_NAME_ISOLATED
,
2387 NULL
, NULL
, NULL
, &type
);
2391 DEBUG(10, ("%s does not exist, can create it\n", new_name
));
2392 return NT_STATUS_OK
;
2395 DEBUG(5, ("trying to create %s, exists as %s\n",
2396 new_name
, sid_type_lookup(type
)));
2398 if (type
== SID_NAME_DOM_GRP
) {
2399 return NT_STATUS_GROUP_EXISTS
;
2401 if (type
== SID_NAME_ALIAS
) {
2402 return NT_STATUS_ALIAS_EXISTS
;
2405 /* Yes, the default is NT_STATUS_USER_EXISTS */
2406 return NT_STATUS_USER_EXISTS
;
2409 /*******************************************************************
2411 Create an account, can be either a normal user or a machine.
2412 This funcion will need to be updated for bdc/domain trusts.
2413 ********************************************************************/
2415 NTSTATUS
_samr_create_user(pipes_struct
*p
, SAMR_Q_CREATE_USER
*q_u
,
2416 SAMR_R_CREATE_USER
*r_u
)
2420 POLICY_HND dom_pol
= q_u
->domain_pol
;
2421 uint16 acb_info
= q_u
->acb_info
;
2422 POLICY_HND
*user_pol
= &r_u
->user_pol
;
2423 struct samr_info
*info
= NULL
;
2428 /* check this, when giving away 'add computer to domain' privs */
2429 uint32 des_access
= GENERIC_RIGHTS_USER_ALL_ACCESS
;
2430 BOOL can_add_account
= False
;
2432 DISP_INFO
*disp_info
= NULL
;
2434 /* Get the domain SID stored in the domain policy */
2435 if (!get_lsa_policy_samr_sid(p
, &dom_pol
, &sid
, &acc_granted
,
2437 return NT_STATUS_INVALID_HANDLE
;
2439 nt_status
= access_check_samr_function(acc_granted
,
2440 SA_RIGHT_DOMAIN_CREATE_USER
,
2441 "_samr_create_user");
2442 if (!NT_STATUS_IS_OK(nt_status
)) {
2446 if (!(acb_info
== ACB_NORMAL
|| acb_info
== ACB_DOMTRUST
||
2447 acb_info
== ACB_WSTRUST
|| acb_info
== ACB_SVRTRUST
)) {
2448 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
2449 this parameter is not an account type */
2450 return NT_STATUS_INVALID_PARAMETER
;
2453 account
= rpcstr_pull_unistr2_talloc(p
->mem_ctx
, &q_u
->uni_name
);
2454 if (account
== NULL
) {
2455 return NT_STATUS_NO_MEMORY
;
2458 nt_status
= can_create(p
->mem_ctx
, account
);
2459 if (!NT_STATUS_IS_OK(nt_status
)) {
2463 /* determine which user right we need to check based on the acb_info */
2465 if ( acb_info
& ACB_WSTRUST
)
2467 se_priv_copy( &se_rights
, &se_machine_account
);
2468 can_add_account
= user_has_privileges(
2469 p
->pipe_user
.nt_user_token
, &se_rights
);
2471 /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
2472 account for domain trusts and changes the ACB flags later */
2473 else if ( acb_info
& ACB_NORMAL
&&
2474 (account
[strlen(account
)-1] != '$') )
2476 se_priv_copy( &se_rights
, &se_add_users
);
2477 can_add_account
= user_has_privileges(
2478 p
->pipe_user
.nt_user_token
, &se_rights
);
2480 else /* implicit assumption of a BDC or domain trust account here
2481 * (we already check the flags earlier) */
2483 if ( lp_enable_privileges() ) {
2484 /* only Domain Admins can add a BDC or domain trust */
2485 se_priv_copy( &se_rights
, &se_priv_none
);
2486 can_add_account
= nt_token_check_domain_rid(
2487 p
->pipe_user
.nt_user_token
,
2488 DOMAIN_GROUP_RID_ADMINS
);
2492 DEBUG(5, ("_samr_create_user: %s can add this account : %s\n",
2493 p
->pipe_user_name
, can_add_account
? "True":"False" ));
2495 /********** BEGIN Admin BLOCK **********/
2497 if ( can_add_account
)
2500 nt_status
= pdb_create_user(p
->mem_ctx
, account
, acb_info
,
2503 if ( can_add_account
)
2506 /********** END Admin BLOCK **********/
2508 /* now check for failure */
2510 if ( !NT_STATUS_IS_OK(nt_status
) )
2513 /* Get the user's SID */
2515 sid_compose(&sid
, get_global_sam_sid(), r_u
->user_rid
);
2517 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &usr_generic_mapping
,
2518 &sid
, SAMR_USR_RIGHTS_WRITE_PW
);
2519 se_map_generic(&des_access
, &usr_generic_mapping
);
2521 nt_status
= access_check_samr_object(psd
, p
->pipe_user
.nt_user_token
,
2522 &se_rights
, GENERIC_RIGHTS_USER_WRITE
, des_access
,
2523 &acc_granted
, "_samr_create_user");
2525 if ( !NT_STATUS_IS_OK(nt_status
) ) {
2529 /* associate the user's SID with the new handle. */
2530 if ((info
= get_samr_info_by_sid(&sid
)) == NULL
) {
2531 return NT_STATUS_NO_MEMORY
;
2536 info
->acc_granted
= acc_granted
;
2538 /* get a (unique) handle. open a policy on it. */
2539 if (!create_policy_hnd(p
, user_pol
, free_samr_info
, (void *)info
)) {
2540 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2543 /* After a "set" ensure we have no cached display info. */
2544 force_flush_samr_cache(info
->disp_info
);
2546 r_u
->access_granted
= acc_granted
;
2548 return NT_STATUS_OK
;
2551 /*******************************************************************
2552 samr_reply_connect_anon
2553 ********************************************************************/
2555 NTSTATUS
_samr_connect_anon(pipes_struct
*p
, SAMR_Q_CONNECT_ANON
*q_u
, SAMR_R_CONNECT_ANON
*r_u
)
2557 struct samr_info
*info
= NULL
;
2558 uint32 des_access
= q_u
->access_mask
;
2562 if (!pipe_access_check(p
)) {
2563 DEBUG(3, ("access denied to samr_connect_anon\n"));
2564 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
2568 /* set up the SAMR connect_anon response */
2570 r_u
->status
= NT_STATUS_OK
;
2572 /* associate the user's SID with the new handle. */
2573 if ((info
= get_samr_info_by_sid(NULL
)) == NULL
)
2574 return NT_STATUS_NO_MEMORY
;
2576 /* don't give away the farm but this is probably ok. The SA_RIGHT_SAM_ENUM_DOMAINS
2577 was observed from a win98 client trying to enumerate users (when configured
2578 user level access control on shares) --jerry */
2580 if (des_access
== MAXIMUM_ALLOWED_ACCESS
) {
2581 /* Map to max possible knowing we're filtered below. */
2582 des_access
= GENERIC_ALL_ACCESS
;
2585 se_map_generic( &des_access
, &sam_generic_mapping
);
2586 info
->acc_granted
= des_access
& (SA_RIGHT_SAM_ENUM_DOMAINS
|SA_RIGHT_SAM_OPEN_DOMAIN
);
2588 info
->status
= q_u
->unknown_0
;
2590 /* get a (unique) handle. open a policy on it. */
2591 if (!create_policy_hnd(p
, &r_u
->connect_pol
, free_samr_info
, (void *)info
))
2592 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2597 /*******************************************************************
2599 ********************************************************************/
2601 NTSTATUS
_samr_connect(pipes_struct
*p
, SAMR_Q_CONNECT
*q_u
, SAMR_R_CONNECT
*r_u
)
2603 struct samr_info
*info
= NULL
;
2604 SEC_DESC
*psd
= NULL
;
2606 uint32 des_access
= q_u
->access_mask
;
2611 DEBUG(5,("_samr_connect: %d\n", __LINE__
));
2615 if (!pipe_access_check(p
)) {
2616 DEBUG(3, ("access denied to samr_connect\n"));
2617 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
2621 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &sam_generic_mapping
, NULL
, 0);
2622 se_map_generic(&des_access
, &sam_generic_mapping
);
2624 nt_status
= access_check_samr_object(psd
, p
->pipe_user
.nt_user_token
,
2625 NULL
, 0, des_access
, &acc_granted
, "_samr_connect");
2627 if ( !NT_STATUS_IS_OK(nt_status
) )
2630 r_u
->status
= NT_STATUS_OK
;
2632 /* associate the user's SID and access granted with the new handle. */
2633 if ((info
= get_samr_info_by_sid(NULL
)) == NULL
)
2634 return NT_STATUS_NO_MEMORY
;
2636 info
->acc_granted
= acc_granted
;
2637 info
->status
= q_u
->access_mask
;
2639 /* get a (unique) handle. open a policy on it. */
2640 if (!create_policy_hnd(p
, &r_u
->connect_pol
, free_samr_info
, (void *)info
))
2641 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2643 DEBUG(5,("_samr_connect: %d\n", __LINE__
));
2648 /*******************************************************************
2650 ********************************************************************/
2652 NTSTATUS
_samr_connect4(pipes_struct
*p
, SAMR_Q_CONNECT4
*q_u
, SAMR_R_CONNECT4
*r_u
)
2654 struct samr_info
*info
= NULL
;
2655 SEC_DESC
*psd
= NULL
;
2657 uint32 des_access
= q_u
->access_mask
;
2662 DEBUG(5,("_samr_connect4: %d\n", __LINE__
));
2666 if (!pipe_access_check(p
)) {
2667 DEBUG(3, ("access denied to samr_connect4\n"));
2668 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
2672 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &sam_generic_mapping
, NULL
, 0);
2673 se_map_generic(&des_access
, &sam_generic_mapping
);
2675 nt_status
= access_check_samr_object(psd
, p
->pipe_user
.nt_user_token
,
2676 NULL
, 0, des_access
, &acc_granted
, "_samr_connect4");
2678 if ( !NT_STATUS_IS_OK(nt_status
) )
2681 r_u
->status
= NT_STATUS_OK
;
2683 /* associate the user's SID and access granted with the new handle. */
2684 if ((info
= get_samr_info_by_sid(NULL
)) == NULL
)
2685 return NT_STATUS_NO_MEMORY
;
2687 info
->acc_granted
= acc_granted
;
2688 info
->status
= q_u
->access_mask
;
2690 /* get a (unique) handle. open a policy on it. */
2691 if (!create_policy_hnd(p
, &r_u
->connect_pol
, free_samr_info
, (void *)info
))
2692 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2694 DEBUG(5,("_samr_connect: %d\n", __LINE__
));
2699 /*******************************************************************
2701 ********************************************************************/
2703 NTSTATUS
_samr_connect5(pipes_struct
*p
, SAMR_Q_CONNECT5
*q_u
, SAMR_R_CONNECT5
*r_u
)
2705 struct samr_info
*info
= NULL
;
2706 SEC_DESC
*psd
= NULL
;
2708 uint32 des_access
= q_u
->access_mask
;
2714 DEBUG(5,("_samr_connect5: %d\n", __LINE__
));
2720 if (!pipe_access_check(p
)) {
2721 DEBUG(3, ("access denied to samr_connect5\n"));
2722 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
2726 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &sam_generic_mapping
, NULL
, 0);
2727 se_map_generic(&des_access
, &sam_generic_mapping
);
2729 nt_status
= access_check_samr_object(psd
, p
->pipe_user
.nt_user_token
,
2730 NULL
, 0, des_access
, &acc_granted
, "_samr_connect5");
2732 if ( !NT_STATUS_IS_OK(nt_status
) )
2735 /* associate the user's SID and access granted with the new handle. */
2736 if ((info
= get_samr_info_by_sid(NULL
)) == NULL
)
2737 return NT_STATUS_NO_MEMORY
;
2739 info
->acc_granted
= acc_granted
;
2740 info
->status
= q_u
->access_mask
;
2742 /* get a (unique) handle. open a policy on it. */
2743 if (!create_policy_hnd(p
, &pol
, free_samr_info
, (void *)info
))
2744 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2746 DEBUG(5,("_samr_connect: %d\n", __LINE__
));
2748 init_samr_r_connect5(r_u
, &pol
, NT_STATUS_OK
);
2753 /**********************************************************************
2754 api_samr_lookup_domain
2755 **********************************************************************/
2757 NTSTATUS
_samr_lookup_domain(pipes_struct
*p
, SAMR_Q_LOOKUP_DOMAIN
*q_u
, SAMR_R_LOOKUP_DOMAIN
*r_u
)
2759 struct samr_info
*info
;
2760 fstring domain_name
;
2763 r_u
->status
= NT_STATUS_OK
;
2765 if (!find_policy_by_hnd(p
, &q_u
->connect_pol
, (void**)(void *)&info
))
2766 return NT_STATUS_INVALID_HANDLE
;
2768 /* win9x user manager likes to use SA_RIGHT_SAM_ENUM_DOMAINS here.
2769 Reverted that change so we will work with RAS servers again */
2771 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(info
->acc_granted
,
2772 SA_RIGHT_SAM_OPEN_DOMAIN
, "_samr_lookup_domain")))
2777 rpcstr_pull(domain_name
, q_u
->uni_domain
.buffer
, sizeof(domain_name
), q_u
->uni_domain
.uni_str_len
*2, 0);
2781 if (strequal(domain_name
, builtin_domain_name())) {
2782 sid_copy(&sid
, &global_sid_Builtin
);
2784 if (!secrets_fetch_domain_sid(domain_name
, &sid
)) {
2785 r_u
->status
= NT_STATUS_NO_SUCH_DOMAIN
;
2789 DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name
, sid_string_static(&sid
)));
2791 init_samr_r_lookup_domain(r_u
, &sid
, r_u
->status
);
2796 /******************************************************************
2797 makes a SAMR_R_ENUM_DOMAINS structure.
2798 ********************************************************************/
2800 static BOOL
make_enum_domains(TALLOC_CTX
*ctx
, SAM_ENTRY
**pp_sam
,
2801 UNISTR2
**pp_uni_name
, uint32 num_sam_entries
, fstring doms
[])
2807 DEBUG(5, ("make_enum_domains\n"));
2810 *pp_uni_name
= NULL
;
2812 if (num_sam_entries
== 0)
2815 sam
= TALLOC_ZERO_ARRAY(ctx
, SAM_ENTRY
, num_sam_entries
);
2816 uni_name
= TALLOC_ZERO_ARRAY(ctx
, UNISTR2
, num_sam_entries
);
2818 if (sam
== NULL
|| uni_name
== NULL
)
2821 for (i
= 0; i
< num_sam_entries
; i
++) {
2822 init_unistr2(&uni_name
[i
], doms
[i
], UNI_FLAGS_NONE
);
2823 init_sam_entry(&sam
[i
], &uni_name
[i
], 0);
2827 *pp_uni_name
= uni_name
;
2832 /**********************************************************************
2833 api_samr_enum_domains
2834 **********************************************************************/
2836 NTSTATUS
_samr_enum_domains(pipes_struct
*p
, SAMR_Q_ENUM_DOMAINS
*q_u
, SAMR_R_ENUM_DOMAINS
*r_u
)
2838 struct samr_info
*info
;
2839 uint32 num_entries
= 2;
2843 r_u
->status
= NT_STATUS_OK
;
2845 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void**)(void *)&info
))
2846 return NT_STATUS_INVALID_HANDLE
;
2848 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(info
->acc_granted
, SA_RIGHT_SAM_ENUM_DOMAINS
, "_samr_enum_domains"))) {
2852 name
= get_global_sam_name();
2854 fstrcpy(dom
[0],name
);
2856 fstrcpy(dom
[1],"Builtin");
2858 if (!make_enum_domains(p
->mem_ctx
, &r_u
->sam
, &r_u
->uni_dom_name
, num_entries
, dom
))
2859 return NT_STATUS_NO_MEMORY
;
2861 init_samr_r_enum_domains(r_u
, q_u
->start_idx
+ num_entries
, num_entries
);
2866 /*******************************************************************
2868 ********************************************************************/
2870 NTSTATUS
_samr_open_alias(pipes_struct
*p
, SAMR_Q_OPEN_ALIAS
*q_u
, SAMR_R_OPEN_ALIAS
*r_u
)
2873 POLICY_HND domain_pol
= q_u
->dom_pol
;
2874 uint32 alias_rid
= q_u
->rid_alias
;
2875 POLICY_HND
*alias_pol
= &r_u
->pol
;
2876 struct samr_info
*info
= NULL
;
2877 SEC_DESC
*psd
= NULL
;
2879 uint32 des_access
= q_u
->access_mask
;
2884 r_u
->status
= NT_STATUS_OK
;
2886 /* find the domain policy and get the SID / access bits stored in the domain policy */
2888 if ( !get_lsa_policy_samr_sid(p
, &domain_pol
, &sid
, &acc_granted
, NULL
) )
2889 return NT_STATUS_INVALID_HANDLE
;
2891 status
= access_check_samr_function(acc_granted
,
2892 SA_RIGHT_DOMAIN_OPEN_ACCOUNT
, "_samr_open_alias");
2894 if ( !NT_STATUS_IS_OK(status
) )
2897 /* append the alias' RID to it */
2899 if (!sid_append_rid(&sid
, alias_rid
))
2900 return NT_STATUS_NO_SUCH_ALIAS
;
2902 /*check if access can be granted as requested by client. */
2904 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &ali_generic_mapping
, NULL
, 0);
2905 se_map_generic(&des_access
,&ali_generic_mapping
);
2907 se_priv_copy( &se_rights
, &se_add_users
);
2910 status
= access_check_samr_object(psd
, p
->pipe_user
.nt_user_token
,
2911 &se_rights
, GENERIC_RIGHTS_ALIAS_WRITE
, des_access
,
2912 &acc_granted
, "_samr_open_alias");
2914 if ( !NT_STATUS_IS_OK(status
) )
2918 /* Check we actually have the requested alias */
2919 enum SID_NAME_USE type
;
2924 result
= lookup_sid(NULL
, &sid
, NULL
, NULL
, &type
);
2927 if (!result
|| (type
!= SID_NAME_ALIAS
)) {
2928 return NT_STATUS_NO_SUCH_ALIAS
;
2931 /* make sure there is a mapping */
2933 if ( !sid_to_gid( &sid
, &gid
) ) {
2934 return NT_STATUS_NO_SUCH_ALIAS
;
2939 /* associate the alias SID with the new handle. */
2940 if ((info
= get_samr_info_by_sid(&sid
)) == NULL
)
2941 return NT_STATUS_NO_MEMORY
;
2943 info
->acc_granted
= acc_granted
;
2945 /* get a (unique) handle. open a policy on it. */
2946 if (!create_policy_hnd(p
, alias_pol
, free_samr_info
, (void *)info
))
2947 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
2952 /*******************************************************************
2954 ********************************************************************/
2955 static NTSTATUS
set_user_info_7(TALLOC_CTX
*mem_ctx
,
2956 const SAM_USER_INFO_7
*id7
, struct samu
*pwd
)
2962 DEBUG(5, ("set_user_info_7: NULL id7\n"));
2964 return NT_STATUS_ACCESS_DENIED
;
2967 if(!rpcstr_pull(new_name
, id7
->uni_name
.buffer
, sizeof(new_name
), id7
->uni_name
.uni_str_len
*2, 0)) {
2968 DEBUG(5, ("set_user_info_7: failed to get new username\n"));
2970 return NT_STATUS_ACCESS_DENIED
;
2973 /* check to see if the new username already exists. Note: we can't
2974 reliably lock all backends, so there is potentially the
2975 possibility that a user can be created in between this check and
2976 the rename. The rename should fail, but may not get the
2977 exact same failure status code. I think this is small enough
2978 of a window for this type of operation and the results are
2979 simply that the rename fails with a slightly different status
2980 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
2982 rc
= can_create(mem_ctx
, new_name
);
2983 if (!NT_STATUS_IS_OK(rc
)) {
2987 rc
= pdb_rename_sam_account(pwd
, new_name
);
2993 /*******************************************************************
2995 ********************************************************************/
2997 static BOOL
set_user_info_16(const SAM_USER_INFO_16
*id16
, struct samu
*pwd
)
3000 DEBUG(5, ("set_user_info_16: NULL id16\n"));
3005 /* FIX ME: check if the value is really changed --metze */
3006 if (!pdb_set_acct_ctrl(pwd
, id16
->acb_info
, PDB_CHANGED
)) {
3011 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd
))) {
3021 /*******************************************************************
3023 ********************************************************************/
3025 static BOOL
set_user_info_18(SAM_USER_INFO_18
*id18
, struct samu
*pwd
)
3029 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
3034 if (!pdb_set_lanman_passwd (pwd
, id18
->lm_pwd
, PDB_CHANGED
)) {
3038 if (!pdb_set_nt_passwd (pwd
, id18
->nt_pwd
, PDB_CHANGED
)) {
3042 if (!pdb_set_pass_changed_now (pwd
)) {
3047 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd
))) {
3056 /*******************************************************************
3058 ********************************************************************/
3060 static BOOL
set_user_info_20(SAM_USER_INFO_20
*id20
, struct samu
*pwd
)
3063 DEBUG(5, ("set_user_info_20: NULL id20\n"));
3067 copy_id20_to_sam_passwd(pwd
, id20
);
3069 /* write the change out */
3070 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd
))) {
3079 /*******************************************************************
3081 ********************************************************************/
3083 static NTSTATUS
set_user_info_21(TALLOC_CTX
*mem_ctx
, SAM_USER_INFO_21
*id21
,
3090 DEBUG(5, ("set_user_info_21: NULL id21\n"));
3091 return NT_STATUS_INVALID_PARAMETER
;
3094 /* we need to separately check for an account rename first */
3095 if (rpcstr_pull(new_name
, id21
->uni_user_name
.buffer
,
3096 sizeof(new_name
), id21
->uni_user_name
.uni_str_len
*2, 0) &&
3097 (!strequal(new_name
, pdb_get_username(pwd
)))) {
3099 /* check to see if the new username already exists. Note: we can't
3100 reliably lock all backends, so there is potentially the
3101 possibility that a user can be created in between this check and
3102 the rename. The rename should fail, but may not get the
3103 exact same failure status code. I think this is small enough
3104 of a window for this type of operation and the results are
3105 simply that the rename fails with a slightly different status
3106 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3108 status
= can_create(mem_ctx
, new_name
);
3109 if (!NT_STATUS_IS_OK(status
)) {
3113 status
= pdb_rename_sam_account(pwd
, new_name
);
3115 if (!NT_STATUS_IS_OK(status
)) {
3116 DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
3117 nt_errstr(status
)));
3122 /* set the new username so that later
3123 functions can work on the new account */
3124 pdb_set_username(pwd
, new_name
, PDB_SET
);
3127 copy_id21_to_sam_passwd(pwd
, id21
);
3130 * The funny part about the previous two calls is
3131 * that pwd still has the password hashes from the
3132 * passdb entry. These have not been updated from
3133 * id21. I don't know if they need to be set. --jerry
3136 if ( IS_SAM_CHANGED(pwd
, PDB_GROUPSID
) ) {
3137 status
= pdb_set_unix_primary_group(mem_ctx
, pwd
);
3138 if ( !NT_STATUS_IS_OK(status
) ) {
3143 /* Don't worry about writing out the user account since the
3144 primary group SID is generated solely from the user's Unix
3147 /* write the change out */
3148 if(!NT_STATUS_IS_OK(status
= pdb_update_sam_account(pwd
))) {
3155 return NT_STATUS_OK
;
3158 /*******************************************************************
3160 ********************************************************************/
3162 static NTSTATUS
set_user_info_23(TALLOC_CTX
*mem_ctx
, SAM_USER_INFO_23
*id23
,
3165 pstring plaintext_buf
;
3171 DEBUG(5, ("set_user_info_23: NULL id23\n"));
3172 return NT_STATUS_INVALID_PARAMETER
;
3175 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
3176 pdb_get_username(pwd
)));
3178 acct_ctrl
= pdb_get_acct_ctrl(pwd
);
3180 if (!decode_pw_buffer(id23
->pass
, plaintext_buf
, 256, &len
, STR_UNICODE
)) {
3182 return NT_STATUS_INVALID_PARAMETER
;
3185 if (!pdb_set_plaintext_passwd (pwd
, plaintext_buf
)) {
3187 return NT_STATUS_ACCESS_DENIED
;
3190 copy_id23_to_sam_passwd(pwd
, id23
);
3192 /* if it's a trust account, don't update /etc/passwd */
3193 if ( ( (acct_ctrl
& ACB_DOMTRUST
) == ACB_DOMTRUST
) ||
3194 ( (acct_ctrl
& ACB_WSTRUST
) == ACB_WSTRUST
) ||
3195 ( (acct_ctrl
& ACB_SVRTRUST
) == ACB_SVRTRUST
) ) {
3196 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
3198 /* update the UNIX password */
3199 if (lp_unix_password_sync() ) {
3200 struct passwd
*passwd
= Get_Pwnam(pdb_get_username(pwd
));
3202 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3205 if(!chgpasswd(pdb_get_username(pwd
), passwd
, "", plaintext_buf
, True
)) {
3207 return NT_STATUS_ACCESS_DENIED
;
3212 ZERO_STRUCT(plaintext_buf
);
3214 if (IS_SAM_CHANGED(pwd
, PDB_GROUPSID
) &&
3215 (!NT_STATUS_IS_OK(status
= pdb_set_unix_primary_group(mem_ctx
,
3221 if(!NT_STATUS_IS_OK(status
= pdb_update_sam_account(pwd
))) {
3228 return NT_STATUS_OK
;
3231 /*******************************************************************
3233 ********************************************************************/
3235 static BOOL
set_user_info_pw(uint8
*pass
, struct samu
*pwd
)
3238 pstring plaintext_buf
;
3241 DEBUG(5, ("Attempting administrator password change for user %s\n",
3242 pdb_get_username(pwd
)));
3244 acct_ctrl
= pdb_get_acct_ctrl(pwd
);
3246 ZERO_STRUCT(plaintext_buf
);
3248 if (!decode_pw_buffer(pass
, plaintext_buf
, 256, &len
, STR_UNICODE
)) {
3253 if (!pdb_set_plaintext_passwd (pwd
, plaintext_buf
)) {
3258 /* if it's a trust account, don't update /etc/passwd */
3259 if ( ( (acct_ctrl
& ACB_DOMTRUST
) == ACB_DOMTRUST
) ||
3260 ( (acct_ctrl
& ACB_WSTRUST
) == ACB_WSTRUST
) ||
3261 ( (acct_ctrl
& ACB_SVRTRUST
) == ACB_SVRTRUST
) ) {
3262 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
3264 /* update the UNIX password */
3265 if (lp_unix_password_sync()) {
3266 struct passwd
*passwd
= Get_Pwnam(pdb_get_username(pwd
));
3268 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3271 if(!chgpasswd(pdb_get_username(pwd
), passwd
, "", plaintext_buf
, True
)) {
3278 ZERO_STRUCT(plaintext_buf
);
3280 DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
3282 /* update the SAMBA password */
3283 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd
))) {
3293 /*******************************************************************
3294 samr_reply_set_userinfo
3295 ********************************************************************/
3297 NTSTATUS
_samr_set_userinfo(pipes_struct
*p
, SAMR_Q_SET_USERINFO
*q_u
, SAMR_R_SET_USERINFO
*r_u
)
3299 struct samu
*pwd
= NULL
;
3301 POLICY_HND
*pol
= &q_u
->pol
;
3302 uint16 switch_value
= q_u
->switch_value
;
3303 SAM_USERINFO_CTR
*ctr
= q_u
->ctr
;
3305 uint32 acc_required
;
3307 BOOL has_enough_rights
= False
;
3309 DISP_INFO
*disp_info
= NULL
;
3311 DEBUG(5, ("_samr_set_userinfo: %d\n", __LINE__
));
3313 r_u
->status
= NT_STATUS_OK
;
3315 /* find the policy handle. open a policy on it. */
3316 if (!get_lsa_policy_samr_sid(p
, pol
, &sid
, &acc_granted
, &disp_info
))
3317 return NT_STATUS_INVALID_HANDLE
;
3319 /* observed when joining an XP client to a Samba domain */
3321 acc_required
= SA_RIGHT_USER_SET_PASSWORD
| SA_RIGHT_USER_SET_ATTRIBUTES
| SA_RIGHT_USER_ACCT_FLAGS_EXPIRY
;
3323 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, acc_required
, "_samr_set_userinfo"))) {
3327 DEBUG(5, ("_samr_set_userinfo: sid:%s, level:%d\n", sid_string_static(&sid
), switch_value
));
3330 DEBUG(5, ("_samr_set_userinfo: NULL info level\n"));
3331 return NT_STATUS_INVALID_INFO_CLASS
;
3334 if ( !(pwd
= samu_new( NULL
)) ) {
3335 return NT_STATUS_NO_MEMORY
;
3339 ret
= pdb_getsampwsid(pwd
, &sid
);
3344 return NT_STATUS_NO_SUCH_USER
;
3347 /* deal with machine password changes differently from userinfo changes */
3348 /* check to see if we have the sufficient rights */
3350 acb_info
= pdb_get_acct_ctrl(pwd
);
3351 if ( acb_info
& ACB_WSTRUST
)
3352 has_enough_rights
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_machine_account
);
3353 else if ( acb_info
& ACB_NORMAL
)
3354 has_enough_rights
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_add_users
);
3355 else if ( acb_info
& (ACB_SVRTRUST
|ACB_DOMTRUST
) ) {
3356 if ( lp_enable_privileges() )
3357 has_enough_rights
= nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
);
3360 DEBUG(5, ("_samr_set_userinfo: %s does%s possess sufficient rights\n",
3361 p
->pipe_user_name
, has_enough_rights
? "" : " not"));
3363 /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
3365 if ( has_enough_rights
)
3368 /* ok! user info levels (lots: see MSDEV help), off we go... */
3370 switch (switch_value
) {
3372 if (!set_user_info_18(ctr
->info
.id18
, pwd
))
3373 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
3377 if (!p
->session_key
.length
) {
3378 r_u
->status
= NT_STATUS_NO_USER_SESSION_KEY
;
3380 SamOEMhashBlob(ctr
->info
.id24
->pass
, 516, &p
->session_key
);
3382 dump_data(100, (char *)ctr
->info
.id24
->pass
, 516);
3384 if (!set_user_info_pw(ctr
->info
.id24
->pass
, pwd
))
3385 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
3389 if (!p
->session_key
.length
) {
3390 r_u
->status
= NT_STATUS_NO_USER_SESSION_KEY
;
3392 encode_or_decode_arc4_passwd_buffer(ctr
->info
.id25
->pass
, &p
->session_key
);
3394 dump_data(100, (char *)ctr
->info
.id25
->pass
, 532);
3396 if (!set_user_info_pw(ctr
->info
.id25
->pass
, pwd
))
3397 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
3401 if (!p
->session_key
.length
) {
3402 r_u
->status
= NT_STATUS_NO_USER_SESSION_KEY
;
3404 encode_or_decode_arc4_passwd_buffer(ctr
->info
.id26
->pass
, &p
->session_key
);
3406 dump_data(100, (char *)ctr
->info
.id26
->pass
, 516);
3408 if (!set_user_info_pw(ctr
->info
.id26
->pass
, pwd
))
3409 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
3413 if (!p
->session_key
.length
) {
3414 r_u
->status
= NT_STATUS_NO_USER_SESSION_KEY
;
3416 SamOEMhashBlob(ctr
->info
.id23
->pass
, 516, &p
->session_key
);
3418 dump_data(100, (char *)ctr
->info
.id23
->pass
, 516);
3420 r_u
->status
= set_user_info_23(p
->mem_ctx
,
3421 ctr
->info
.id23
, pwd
);
3425 r_u
->status
= NT_STATUS_INVALID_INFO_CLASS
;
3429 if ( has_enough_rights
)
3432 /* ================ END SeMachineAccountPrivilege BLOCK ================ */
3434 if (NT_STATUS_IS_OK(r_u
->status
)) {
3435 force_flush_samr_cache(disp_info
);
3441 /*******************************************************************
3442 samr_reply_set_userinfo2
3443 ********************************************************************/
3445 NTSTATUS
_samr_set_userinfo2(pipes_struct
*p
, SAMR_Q_SET_USERINFO2
*q_u
, SAMR_R_SET_USERINFO2
*r_u
)
3447 struct samu
*pwd
= NULL
;
3449 SAM_USERINFO_CTR
*ctr
= q_u
->ctr
;
3450 POLICY_HND
*pol
= &q_u
->pol
;
3451 uint16 switch_value
= q_u
->switch_value
;
3453 uint32 acc_required
;
3455 BOOL has_enough_rights
= False
;
3457 DISP_INFO
*disp_info
= NULL
;
3459 DEBUG(5, ("samr_reply_set_userinfo2: %d\n", __LINE__
));
3461 r_u
->status
= NT_STATUS_OK
;
3463 /* find the policy handle. open a policy on it. */
3464 if (!get_lsa_policy_samr_sid(p
, pol
, &sid
, &acc_granted
, &disp_info
))
3465 return NT_STATUS_INVALID_HANDLE
;
3467 /* observed when joining XP client to Samba domain */
3469 acc_required
= SA_RIGHT_USER_SET_PASSWORD
| SA_RIGHT_USER_SET_ATTRIBUTES
| SA_RIGHT_USER_ACCT_FLAGS_EXPIRY
;
3471 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, acc_required
, "_samr_set_userinfo2"))) {
3475 DEBUG(5, ("samr_reply_set_userinfo2: sid:%s\n", sid_string_static(&sid
)));
3478 DEBUG(5, ("samr_reply_set_userinfo2: NULL info level\n"));
3479 return NT_STATUS_INVALID_INFO_CLASS
;
3482 switch_value
=ctr
->switch_value
;
3484 if ( !(pwd
= samu_new( NULL
)) ) {
3485 return NT_STATUS_NO_MEMORY
;
3489 ret
= pdb_getsampwsid(pwd
, &sid
);
3494 return NT_STATUS_NO_SUCH_USER
;
3497 acb_info
= pdb_get_acct_ctrl(pwd
);
3498 if ( acb_info
& ACB_WSTRUST
)
3499 has_enough_rights
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_machine_account
);
3500 else if ( acb_info
& ACB_NORMAL
)
3501 has_enough_rights
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_add_users
);
3502 else if ( acb_info
& (ACB_SVRTRUST
|ACB_DOMTRUST
) ) {
3503 if ( lp_enable_privileges() )
3504 has_enough_rights
= nt_token_check_domain_rid( p
->pipe_user
.nt_user_token
, DOMAIN_GROUP_RID_ADMINS
);
3507 DEBUG(5, ("_samr_set_userinfo2: %s does%s possess sufficient rights\n",
3508 p
->pipe_user_name
, has_enough_rights
? "" : " not"));
3510 /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
3512 if ( has_enough_rights
)
3515 /* ok! user info levels (lots: see MSDEV help), off we go... */
3517 switch (switch_value
) {
3519 r_u
->status
= set_user_info_7(p
->mem_ctx
,
3520 ctr
->info
.id7
, pwd
);
3523 if (!set_user_info_16(ctr
->info
.id16
, pwd
))
3524 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
3527 /* Used by AS/U JRA. */
3528 if (!set_user_info_18(ctr
->info
.id18
, pwd
))
3529 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
3532 if (!set_user_info_20(ctr
->info
.id20
, pwd
))
3533 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
3536 r_u
->status
= set_user_info_21(p
->mem_ctx
,
3537 ctr
->info
.id21
, pwd
);
3540 if (!p
->session_key
.length
) {
3541 r_u
->status
= NT_STATUS_NO_USER_SESSION_KEY
;
3543 SamOEMhashBlob(ctr
->info
.id23
->pass
, 516, &p
->session_key
);
3545 dump_data(100, (char *)ctr
->info
.id23
->pass
, 516);
3547 r_u
->status
= set_user_info_23(p
->mem_ctx
,
3548 ctr
->info
.id23
, pwd
);
3551 if (!p
->session_key
.length
) {
3552 r_u
->status
= NT_STATUS_NO_USER_SESSION_KEY
;
3554 encode_or_decode_arc4_passwd_buffer(ctr
->info
.id26
->pass
, &p
->session_key
);
3556 dump_data(100, (char *)ctr
->info
.id26
->pass
, 516);
3558 if (!set_user_info_pw(ctr
->info
.id26
->pass
, pwd
))
3559 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
3562 r_u
->status
= NT_STATUS_INVALID_INFO_CLASS
;
3565 if ( has_enough_rights
)
3568 /* ================ END SeMachineAccountPrivilege BLOCK ================ */
3570 if (NT_STATUS_IS_OK(r_u
->status
)) {
3571 force_flush_samr_cache(disp_info
);
3577 /*********************************************************************
3578 _samr_query_aliasmem
3579 *********************************************************************/
3581 NTSTATUS
_samr_query_useraliases(pipes_struct
*p
, SAMR_Q_QUERY_USERALIASES
*q_u
, SAMR_R_QUERY_USERALIASES
*r_u
)
3583 size_t num_alias_rids
;
3585 struct samr_info
*info
= NULL
;
3593 r_u
->status
= NT_STATUS_OK
;
3595 DEBUG(5,("_samr_query_useraliases: %d\n", __LINE__
));
3597 /* find the policy handle. open a policy on it. */
3598 if (!find_policy_by_hnd(p
, &q_u
->pol
, (void **)(void *)&info
))
3599 return NT_STATUS_INVALID_HANDLE
;
3601 ntstatus1
= access_check_samr_function(info
->acc_granted
, SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM
, "_samr_query_useraliases");
3602 ntstatus2
= access_check_samr_function(info
->acc_granted
, SA_RIGHT_DOMAIN_OPEN_ACCOUNT
, "_samr_query_useraliases");
3604 if (!NT_STATUS_IS_OK(ntstatus1
) || !NT_STATUS_IS_OK(ntstatus2
)) {
3605 if (!(NT_STATUS_EQUAL(ntstatus1
,NT_STATUS_ACCESS_DENIED
) && NT_STATUS_IS_OK(ntstatus2
)) &&
3606 !(NT_STATUS_EQUAL(ntstatus1
,NT_STATUS_ACCESS_DENIED
) && NT_STATUS_IS_OK(ntstatus1
))) {
3607 return (NT_STATUS_IS_OK(ntstatus1
)) ? ntstatus2
: ntstatus1
;
3611 if (!sid_check_is_domain(&info
->sid
) &&
3612 !sid_check_is_builtin(&info
->sid
))
3613 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
3615 members
= TALLOC_ARRAY(p
->mem_ctx
, DOM_SID
, q_u
->num_sids1
);
3617 if (members
== NULL
)
3618 return NT_STATUS_NO_MEMORY
;
3620 for (i
=0; i
<q_u
->num_sids1
; i
++)
3621 sid_copy(&members
[i
], &q_u
->sid
[i
].sid
);
3627 ntstatus1
= pdb_enum_alias_memberships(p
->mem_ctx
, &info
->sid
, members
,
3629 &alias_rids
, &num_alias_rids
);
3632 if (!NT_STATUS_IS_OK(ntstatus1
)) {
3636 init_samr_r_query_useraliases(r_u
, num_alias_rids
, alias_rids
,
3638 return NT_STATUS_OK
;
3641 /*********************************************************************
3642 _samr_query_aliasmem
3643 *********************************************************************/
3645 NTSTATUS
_samr_query_aliasmem(pipes_struct
*p
, SAMR_Q_QUERY_ALIASMEM
*q_u
, SAMR_R_QUERY_ALIASMEM
*r_u
)
3649 size_t num_sids
= 0;
3657 /* find the policy handle. open a policy on it. */
3658 if (!get_lsa_policy_samr_sid(p
, &q_u
->alias_pol
, &alias_sid
, &acc_granted
, NULL
))
3659 return NT_STATUS_INVALID_HANDLE
;
3661 if (!NT_STATUS_IS_OK(r_u
->status
=
3662 access_check_samr_function(acc_granted
, SA_RIGHT_ALIAS_GET_MEMBERS
, "_samr_query_aliasmem"))) {
3666 DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid
)));
3668 status
= pdb_enum_aliasmem(&alias_sid
, &sids
, &num_sids
);
3670 if (!NT_STATUS_IS_OK(status
)) {
3674 sid
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, DOM_SID2
, num_sids
);
3675 if (num_sids
!=0 && sid
== NULL
) {
3677 return NT_STATUS_NO_MEMORY
;
3680 for (i
= 0; i
< num_sids
; i
++) {
3681 init_dom_sid2(&sid
[i
], &sids
[i
]);
3684 init_samr_r_query_aliasmem(r_u
, num_sids
, sid
, NT_STATUS_OK
);
3688 return NT_STATUS_OK
;
3691 /*********************************************************************
3692 _samr_query_groupmem
3693 *********************************************************************/
3695 NTSTATUS
_samr_query_groupmem(pipes_struct
*p
, SAMR_Q_QUERY_GROUPMEM
*q_u
, SAMR_R_QUERY_GROUPMEM
*r_u
)
3698 fstring group_sid_str
;
3699 size_t i
, num_members
;
3708 /* find the policy handle. open a policy on it. */
3709 if (!get_lsa_policy_samr_sid(p
, &q_u
->group_pol
, &group_sid
, &acc_granted
, NULL
))
3710 return NT_STATUS_INVALID_HANDLE
;
3712 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_GROUP_GET_MEMBERS
, "_samr_query_groupmem"))) {
3716 sid_to_string(group_sid_str
, &group_sid
);
3717 DEBUG(10, ("sid is %s\n", group_sid_str
));
3719 if (!sid_check_is_in_our_domain(&group_sid
)) {
3720 DEBUG(3, ("sid %s is not in our domain\n", group_sid_str
));
3721 return NT_STATUS_NO_SUCH_GROUP
;
3724 DEBUG(10, ("lookup on Domain SID\n"));
3727 result
= pdb_enum_group_members(p
->mem_ctx
, &group_sid
,
3728 &rid
, &num_members
);
3731 if (!NT_STATUS_IS_OK(result
))
3734 attr
=TALLOC_ZERO_ARRAY(p
->mem_ctx
, uint32
, num_members
);
3736 if ((num_members
!=0) && (rid
==NULL
))
3737 return NT_STATUS_NO_MEMORY
;
3739 for (i
=0; i
<num_members
; i
++)
3740 attr
[i
] = SID_NAME_USER
;
3742 init_samr_r_query_groupmem(r_u
, num_members
, rid
, attr
, NT_STATUS_OK
);
3744 return NT_STATUS_OK
;
3747 /*********************************************************************
3749 *********************************************************************/
3751 NTSTATUS
_samr_add_aliasmem(pipes_struct
*p
, SAMR_Q_ADD_ALIASMEM
*q_u
, SAMR_R_ADD_ALIASMEM
*r_u
)
3756 BOOL can_add_accounts
;
3758 DISP_INFO
*disp_info
= NULL
;
3760 /* Find the policy handle. Open a policy on it. */
3761 if (!get_lsa_policy_samr_sid(p
, &q_u
->alias_pol
, &alias_sid
, &acc_granted
, &disp_info
))
3762 return NT_STATUS_INVALID_HANDLE
;
3764 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_ALIAS_ADD_MEMBER
, "_samr_add_aliasmem"))) {
3768 DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid
)));
3770 se_priv_copy( &se_rights
, &se_add_users
);
3771 can_add_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_rights
);
3773 /******** BEGIN SeAddUsers BLOCK *********/
3775 if ( can_add_accounts
)
3778 ret
= pdb_add_aliasmem(&alias_sid
, &q_u
->sid
.sid
);
3780 if ( can_add_accounts
)
3783 /******** END SeAddUsers BLOCK *********/
3785 if (NT_STATUS_IS_OK(ret
)) {
3786 force_flush_samr_cache(disp_info
);
3792 /*********************************************************************
3794 *********************************************************************/
3796 NTSTATUS
_samr_del_aliasmem(pipes_struct
*p
, SAMR_Q_DEL_ALIASMEM
*q_u
, SAMR_R_DEL_ALIASMEM
*r_u
)
3801 BOOL can_add_accounts
;
3803 DISP_INFO
*disp_info
= NULL
;
3805 /* Find the policy handle. Open a policy on it. */
3806 if (!get_lsa_policy_samr_sid(p
, &q_u
->alias_pol
, &alias_sid
, &acc_granted
, &disp_info
))
3807 return NT_STATUS_INVALID_HANDLE
;
3809 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_ALIAS_REMOVE_MEMBER
, "_samr_del_aliasmem"))) {
3813 DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
3814 sid_string_static(&alias_sid
)));
3816 se_priv_copy( &se_rights
, &se_add_users
);
3817 can_add_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_rights
);
3819 /******** BEGIN SeAddUsers BLOCK *********/
3821 if ( can_add_accounts
)
3824 ret
= pdb_del_aliasmem(&alias_sid
, &q_u
->sid
.sid
);
3826 if ( can_add_accounts
)
3829 /******** END SeAddUsers BLOCK *********/
3831 if (NT_STATUS_IS_OK(ret
)) {
3832 force_flush_samr_cache(disp_info
);
3838 /*********************************************************************
3840 *********************************************************************/
3842 NTSTATUS
_samr_add_groupmem(pipes_struct
*p
, SAMR_Q_ADD_GROUPMEM
*q_u
, SAMR_R_ADD_GROUPMEM
*r_u
)
3848 BOOL can_add_accounts
;
3849 DISP_INFO
*disp_info
= NULL
;
3851 /* Find the policy handle. Open a policy on it. */
3852 if (!get_lsa_policy_samr_sid(p
, &q_u
->pol
, &group_sid
, &acc_granted
, &disp_info
))
3853 return NT_STATUS_INVALID_HANDLE
;
3855 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_GROUP_ADD_MEMBER
, "_samr_add_groupmem"))) {
3859 DEBUG(10, ("sid is %s\n", sid_string_static(&group_sid
)));
3861 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid
,
3863 return NT_STATUS_INVALID_HANDLE
;
3866 se_priv_copy( &se_rights
, &se_add_users
);
3867 can_add_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_rights
);
3869 /******** BEGIN SeAddUsers BLOCK *********/
3871 if ( can_add_accounts
)
3874 r_u
->status
= pdb_add_groupmem(p
->mem_ctx
, group_rid
, q_u
->rid
);
3876 if ( can_add_accounts
)
3879 /******** END SeAddUsers BLOCK *********/
3881 force_flush_samr_cache(disp_info
);
3886 /*********************************************************************
3888 *********************************************************************/
3890 NTSTATUS
_samr_del_groupmem(pipes_struct
*p
, SAMR_Q_DEL_GROUPMEM
*q_u
, SAMR_R_DEL_GROUPMEM
*r_u
)
3896 BOOL can_add_accounts
;
3897 DISP_INFO
*disp_info
= NULL
;
3900 * delete the group member named q_u->rid
3901 * who is a member of the sid associated with the handle
3902 * the rid is a user's rid as the group is a domain group.
3905 /* Find the policy handle. Open a policy on it. */
3906 if (!get_lsa_policy_samr_sid(p
, &q_u
->pol
, &group_sid
, &acc_granted
, &disp_info
))
3907 return NT_STATUS_INVALID_HANDLE
;
3909 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_GROUP_REMOVE_MEMBER
, "_samr_del_groupmem"))) {
3913 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid
,
3915 return NT_STATUS_INVALID_HANDLE
;
3918 se_priv_copy( &se_rights
, &se_add_users
);
3919 can_add_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_rights
);
3921 /******** BEGIN SeAddUsers BLOCK *********/
3923 if ( can_add_accounts
)
3926 r_u
->status
= pdb_del_groupmem(p
->mem_ctx
, group_rid
, q_u
->rid
);
3928 if ( can_add_accounts
)
3931 /******** END SeAddUsers BLOCK *********/
3933 force_flush_samr_cache(disp_info
);
3938 /*********************************************************************
3939 _samr_delete_dom_user
3940 *********************************************************************/
3942 NTSTATUS
_samr_delete_dom_user(pipes_struct
*p
, SAMR_Q_DELETE_DOM_USER
*q_u
, SAMR_R_DELETE_DOM_USER
*r_u
)
3945 struct samu
*sam_pass
=NULL
;
3947 BOOL can_add_accounts
;
3949 DISP_INFO
*disp_info
= NULL
;
3951 DEBUG(5, ("_samr_delete_dom_user: %d\n", __LINE__
));
3953 /* Find the policy handle. Open a policy on it. */
3954 if (!get_lsa_policy_samr_sid(p
, &q_u
->user_pol
, &user_sid
, &acc_granted
, &disp_info
))
3955 return NT_STATUS_INVALID_HANDLE
;
3957 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, STD_RIGHT_DELETE_ACCESS
, "_samr_delete_dom_user"))) {
3961 if (!sid_check_is_in_our_domain(&user_sid
))
3962 return NT_STATUS_CANNOT_DELETE
;
3964 /* check if the user exists before trying to delete */
3965 if ( !(sam_pass
= samu_new( NULL
)) ) {
3966 return NT_STATUS_NO_MEMORY
;
3969 if(!pdb_getsampwsid(sam_pass
, &user_sid
)) {
3970 DEBUG(5,("_samr_delete_dom_user:User %s doesn't exist.\n",
3971 sid_string_static(&user_sid
)));
3972 TALLOC_FREE(sam_pass
);
3973 return NT_STATUS_NO_SUCH_USER
;
3976 acb_info
= pdb_get_acct_ctrl(sam_pass
);
3978 /* For machine accounts it's the SeMachineAccountPrivilege that counts. */
3979 if ( acb_info
& ACB_WSTRUST
) {
3980 can_add_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_machine_account
);
3982 can_add_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_add_users
);
3985 /******** BEGIN SeAddUsers BLOCK *********/
3987 if ( can_add_accounts
)
3990 r_u
->status
= pdb_delete_user(p
->mem_ctx
, sam_pass
);
3992 if ( can_add_accounts
)
3995 /******** END SeAddUsers BLOCK *********/
3997 if ( !NT_STATUS_IS_OK(r_u
->status
) ) {
3998 DEBUG(5,("_samr_delete_dom_user: Failed to delete entry for "
3999 "user %s: %s.\n", pdb_get_username(sam_pass
),
4000 nt_errstr(r_u
->status
)));
4001 TALLOC_FREE(sam_pass
);
4006 TALLOC_FREE(sam_pass
);
4008 if (!close_policy_hnd(p
, &q_u
->user_pol
))
4009 return NT_STATUS_OBJECT_NAME_INVALID
;
4011 force_flush_samr_cache(disp_info
);
4013 return NT_STATUS_OK
;
4016 /*********************************************************************
4017 _samr_delete_dom_group
4018 *********************************************************************/
4020 NTSTATUS
_samr_delete_dom_group(pipes_struct
*p
, SAMR_Q_DELETE_DOM_GROUP
*q_u
, SAMR_R_DELETE_DOM_GROUP
*r_u
)
4026 BOOL can_add_accounts
;
4027 DISP_INFO
*disp_info
= NULL
;
4029 DEBUG(5, ("samr_delete_dom_group: %d\n", __LINE__
));
4031 /* Find the policy handle. Open a policy on it. */
4032 if (!get_lsa_policy_samr_sid(p
, &q_u
->group_pol
, &group_sid
, &acc_granted
, &disp_info
))
4033 return NT_STATUS_INVALID_HANDLE
;
4035 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, STD_RIGHT_DELETE_ACCESS
, "_samr_delete_dom_group"))) {
4039 DEBUG(10, ("sid is %s\n", sid_string_static(&group_sid
)));
4041 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid
,
4043 return NT_STATUS_NO_SUCH_GROUP
;
4046 se_priv_copy( &se_rights
, &se_add_users
);
4047 can_add_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_rights
);
4049 /******** BEGIN SeAddUsers BLOCK *********/
4051 if ( can_add_accounts
)
4054 r_u
->status
= pdb_delete_dom_group(p
->mem_ctx
, group_rid
);
4056 if ( can_add_accounts
)
4059 /******** END SeAddUsers BLOCK *********/
4061 if ( !NT_STATUS_IS_OK(r_u
->status
) ) {
4062 DEBUG(5,("_samr_delete_dom_group: Failed to delete mapping "
4063 "entry for group %s: %s\n",
4064 sid_string_static(&group_sid
),
4065 nt_errstr(r_u
->status
)));
4069 if (!close_policy_hnd(p
, &q_u
->group_pol
))
4070 return NT_STATUS_OBJECT_NAME_INVALID
;
4072 force_flush_samr_cache(disp_info
);
4074 return NT_STATUS_OK
;
4077 /*********************************************************************
4078 _samr_delete_dom_alias
4079 *********************************************************************/
4081 NTSTATUS
_samr_delete_dom_alias(pipes_struct
*p
, SAMR_Q_DELETE_DOM_ALIAS
*q_u
, SAMR_R_DELETE_DOM_ALIAS
*r_u
)
4086 BOOL can_add_accounts
;
4088 DISP_INFO
*disp_info
= NULL
;
4090 DEBUG(5, ("_samr_delete_dom_alias: %d\n", __LINE__
));
4092 /* Find the policy handle. Open a policy on it. */
4093 if (!get_lsa_policy_samr_sid(p
, &q_u
->alias_pol
, &alias_sid
, &acc_granted
, &disp_info
))
4094 return NT_STATUS_INVALID_HANDLE
;
4096 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, STD_RIGHT_DELETE_ACCESS
, "_samr_delete_dom_alias"))) {
4100 DEBUG(10, ("sid is %s\n", sid_string_static(&alias_sid
)));
4102 if (!sid_check_is_in_our_domain(&alias_sid
))
4103 return NT_STATUS_NO_SUCH_ALIAS
;
4105 DEBUG(10, ("lookup on Local SID\n"));
4107 se_priv_copy( &se_rights
, &se_add_users
);
4108 can_add_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_rights
);
4110 /******** BEGIN SeAddUsers BLOCK *********/
4112 if ( can_add_accounts
)
4115 /* Have passdb delete the alias */
4116 ret
= pdb_delete_alias(&alias_sid
);
4118 if ( can_add_accounts
)
4121 /******** END SeAddUsers BLOCK *********/
4124 return NT_STATUS_ACCESS_DENIED
;
4126 if (!close_policy_hnd(p
, &q_u
->alias_pol
))
4127 return NT_STATUS_OBJECT_NAME_INVALID
;
4129 force_flush_samr_cache(disp_info
);
4131 return NT_STATUS_OK
;
4134 /*********************************************************************
4135 _samr_create_dom_group
4136 *********************************************************************/
4138 NTSTATUS
_samr_create_dom_group(pipes_struct
*p
, SAMR_Q_CREATE_DOM_GROUP
*q_u
, SAMR_R_CREATE_DOM_GROUP
*r_u
)
4143 struct samr_info
*info
;
4146 BOOL can_add_accounts
;
4147 DISP_INFO
*disp_info
= NULL
;
4149 /* Find the policy handle. Open a policy on it. */
4150 if (!get_lsa_policy_samr_sid(p
, &q_u
->pol
, &dom_sid
, &acc_granted
, &disp_info
))
4151 return NT_STATUS_INVALID_HANDLE
;
4153 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_DOMAIN_CREATE_GROUP
, "_samr_create_dom_group"))) {
4157 if (!sid_equal(&dom_sid
, get_global_sam_sid()))
4158 return NT_STATUS_ACCESS_DENIED
;
4160 name
= rpcstr_pull_unistr2_talloc(p
->mem_ctx
, &q_u
->uni_acct_desc
);
4162 return NT_STATUS_NO_MEMORY
;
4165 r_u
->status
= can_create(p
->mem_ctx
, name
);
4166 if (!NT_STATUS_IS_OK(r_u
->status
)) {
4170 se_priv_copy( &se_rights
, &se_add_users
);
4171 can_add_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_rights
);
4173 /******** BEGIN SeAddUsers BLOCK *********/
4175 if ( can_add_accounts
)
4178 /* check that we successfully create the UNIX group */
4180 r_u
->status
= pdb_create_dom_group(p
->mem_ctx
, name
, &r_u
->rid
);
4182 if ( can_add_accounts
)
4185 /******** END SeAddUsers BLOCK *********/
4187 /* check if we should bail out here */
4189 if ( !NT_STATUS_IS_OK(r_u
->status
) )
4192 sid_compose(&info_sid
, get_global_sam_sid(), r_u
->rid
);
4194 if ((info
= get_samr_info_by_sid(&info_sid
)) == NULL
)
4195 return NT_STATUS_NO_MEMORY
;
4197 /* they created it; let the user do what he wants with it */
4199 info
->acc_granted
= GENERIC_RIGHTS_GROUP_ALL_ACCESS
;
4201 /* get a (unique) handle. open a policy on it. */
4202 if (!create_policy_hnd(p
, &r_u
->pol
, free_samr_info
, (void *)info
))
4203 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
4205 force_flush_samr_cache(disp_info
);
4207 return NT_STATUS_OK
;
4210 /*********************************************************************
4211 _samr_create_dom_alias
4212 *********************************************************************/
4214 NTSTATUS
_samr_create_dom_alias(pipes_struct
*p
, SAMR_Q_CREATE_DOM_ALIAS
*q_u
, SAMR_R_CREATE_DOM_ALIAS
*r_u
)
4219 struct samr_info
*info
;
4224 BOOL can_add_accounts
;
4225 DISP_INFO
*disp_info
= NULL
;
4227 /* Find the policy handle. Open a policy on it. */
4228 if (!get_lsa_policy_samr_sid(p
, &q_u
->dom_pol
, &dom_sid
, &acc_granted
, &disp_info
))
4229 return NT_STATUS_INVALID_HANDLE
;
4231 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_DOMAIN_CREATE_ALIAS
, "_samr_create_alias"))) {
4235 if (!sid_equal(&dom_sid
, get_global_sam_sid()))
4236 return NT_STATUS_ACCESS_DENIED
;
4238 unistr2_to_ascii(name
, &q_u
->uni_acct_desc
, sizeof(name
)-1);
4240 se_priv_copy( &se_rights
, &se_add_users
);
4241 can_add_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_rights
);
4243 result
= can_create(p
->mem_ctx
, name
);
4244 if (!NT_STATUS_IS_OK(result
)) {
4248 /******** BEGIN SeAddUsers BLOCK *********/
4250 if ( can_add_accounts
)
4253 /* Have passdb create the alias */
4254 result
= pdb_create_alias(name
, &r_u
->rid
);
4256 if ( can_add_accounts
)
4259 /******** END SeAddUsers BLOCK *********/
4261 if (!NT_STATUS_IS_OK(result
)) {
4262 DEBUG(10, ("pdb_create_alias failed: %s\n",
4263 nt_errstr(result
)));
4267 sid_copy(&info_sid
, get_global_sam_sid());
4268 sid_append_rid(&info_sid
, r_u
->rid
);
4270 if (!sid_to_gid(&info_sid
, &gid
)) {
4271 DEBUG(10, ("Could not find alias just created\n"));
4272 return NT_STATUS_ACCESS_DENIED
;
4275 /* check if the group has been successfully created */
4276 if ( getgrgid(gid
) == NULL
) {
4277 DEBUG(10, ("getgrgid(%d) of just created alias failed\n",
4279 return NT_STATUS_ACCESS_DENIED
;
4282 if ((info
= get_samr_info_by_sid(&info_sid
)) == NULL
)
4283 return NT_STATUS_NO_MEMORY
;
4285 /* they created it; let the user do what he wants with it */
4287 info
->acc_granted
= GENERIC_RIGHTS_ALIAS_ALL_ACCESS
;
4289 /* get a (unique) handle. open a policy on it. */
4290 if (!create_policy_hnd(p
, &r_u
->alias_pol
, free_samr_info
, (void *)info
))
4291 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
4293 force_flush_samr_cache(disp_info
);
4295 return NT_STATUS_OK
;
4298 /*********************************************************************
4299 _samr_query_groupinfo
4301 sends the name/comment pair of a domain group
4302 level 1 send also the number of users of that group
4303 *********************************************************************/
4305 NTSTATUS
_samr_query_groupinfo(pipes_struct
*p
, SAMR_Q_QUERY_GROUPINFO
*q_u
, SAMR_R_QUERY_GROUPINFO
*r_u
)
4309 GROUP_INFO_CTR
*ctr
;
4313 if (!get_lsa_policy_samr_sid(p
, &q_u
->pol
, &group_sid
, &acc_granted
, NULL
))
4314 return NT_STATUS_INVALID_HANDLE
;
4316 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_GROUP_LOOKUP_INFO
, "_samr_query_groupinfo"))) {
4321 ret
= get_domain_group_from_sid(group_sid
, &map
);
4324 return NT_STATUS_INVALID_HANDLE
;
4326 ctr
=TALLOC_ZERO_P(p
->mem_ctx
, GROUP_INFO_CTR
);
4328 return NT_STATUS_NO_MEMORY
;
4330 switch (q_u
->switch_level
) {
4335 ctr
->switch_value1
= 1;
4338 r_u
->status
= pdb_enum_group_members(
4339 p
->mem_ctx
, &group_sid
, &members
, &num_members
);
4342 if (!NT_STATUS_IS_OK(r_u
->status
)) {
4346 init_samr_group_info1(&ctr
->group
.info1
, map
.nt_name
,
4347 map
.comment
, num_members
);
4351 ctr
->switch_value1
= 3;
4352 init_samr_group_info3(&ctr
->group
.info3
);
4355 ctr
->switch_value1
= 4;
4356 init_samr_group_info4(&ctr
->group
.info4
, map
.comment
);
4359 return NT_STATUS_INVALID_INFO_CLASS
;
4362 init_samr_r_query_groupinfo(r_u
, ctr
, NT_STATUS_OK
);
4364 return NT_STATUS_OK
;
4367 /*********************************************************************
4370 update a domain group's comment.
4371 *********************************************************************/
4373 NTSTATUS
_samr_set_groupinfo(pipes_struct
*p
, SAMR_Q_SET_GROUPINFO
*q_u
, SAMR_R_SET_GROUPINFO
*r_u
)
4377 GROUP_INFO_CTR
*ctr
;
4381 BOOL can_mod_accounts
;
4382 DISP_INFO
*disp_info
= NULL
;
4384 if (!get_lsa_policy_samr_sid(p
, &q_u
->pol
, &group_sid
, &acc_granted
, &disp_info
))
4385 return NT_STATUS_INVALID_HANDLE
;
4387 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_GROUP_SET_INFO
, "_samr_set_groupinfo"))) {
4392 result
= get_domain_group_from_sid(group_sid
, &map
);
4395 return NT_STATUS_NO_SUCH_GROUP
;
4399 switch (ctr
->switch_value1
) {
4401 unistr2_to_ascii(map
.comment
, &(ctr
->group
.info1
.uni_acct_desc
), sizeof(map
.comment
)-1);
4404 unistr2_to_ascii(map
.comment
, &(ctr
->group
.info4
.uni_acct_desc
), sizeof(map
.comment
)-1);
4407 return NT_STATUS_INVALID_INFO_CLASS
;
4410 can_mod_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_add_users
);
4412 /******** BEGIN SeAddUsers BLOCK *********/
4414 if ( can_mod_accounts
)
4417 ret
= pdb_update_group_mapping_entry(&map
);
4419 if ( can_mod_accounts
)
4422 /******** End SeAddUsers BLOCK *********/
4424 if (NT_STATUS_IS_OK(ret
)) {
4425 force_flush_samr_cache(disp_info
);
4431 /*********************************************************************
4434 update an alias's comment.
4435 *********************************************************************/
4437 NTSTATUS
_samr_set_aliasinfo(pipes_struct
*p
, SAMR_Q_SET_ALIASINFO
*q_u
, SAMR_R_SET_ALIASINFO
*r_u
)
4440 struct acct_info info
;
4441 ALIAS_INFO_CTR
*ctr
;
4444 BOOL can_mod_accounts
;
4445 DISP_INFO
*disp_info
= NULL
;
4447 if (!get_lsa_policy_samr_sid(p
, &q_u
->alias_pol
, &group_sid
, &acc_granted
, &disp_info
))
4448 return NT_STATUS_INVALID_HANDLE
;
4450 if (!NT_STATUS_IS_OK(r_u
->status
= access_check_samr_function(acc_granted
, SA_RIGHT_ALIAS_SET_INFO
, "_samr_set_aliasinfo"))) {
4456 switch (ctr
->level
) {
4458 if ( ctr
->alias
.info3
.description
.string
) {
4459 unistr2_to_ascii( info
.acct_desc
,
4460 ctr
->alias
.info3
.description
.string
,
4461 sizeof(info
.acct_desc
)-1 );
4464 fstrcpy( info
.acct_desc
, "" );
4467 return NT_STATUS_INVALID_INFO_CLASS
;
4470 can_mod_accounts
= user_has_privileges( p
->pipe_user
.nt_user_token
, &se_add_users
);
4472 /******** BEGIN SeAddUsers BLOCK *********/
4474 if ( can_mod_accounts
)
4477 ret
= pdb_set_aliasinfo( &group_sid
, &info
);
4479 if ( can_mod_accounts
)
4482 /******** End SeAddUsers BLOCK *********/
4485 force_flush_samr_cache(disp_info
);
4488 return ret
? NT_STATUS_OK
: NT_STATUS_ACCESS_DENIED
;
4491 /*********************************************************************
4492 _samr_get_dom_pwinfo
4493 *********************************************************************/
4495 NTSTATUS
_samr_get_dom_pwinfo(pipes_struct
*p
, SAMR_Q_GET_DOM_PWINFO
*q_u
, SAMR_R_GET_DOM_PWINFO
*r_u
)
4497 /* Perform access check. Since this rpc does not require a
4498 policy handle it will not be caught by the access checks on
4499 SAMR_CONNECT or SAMR_CONNECT_ANON. */
4501 if (!pipe_access_check(p
)) {
4502 DEBUG(3, ("access denied to samr_get_dom_pwinfo\n"));
4503 r_u
->status
= NT_STATUS_ACCESS_DENIED
;
4507 /* Actually, returning zeros here works quite well :-). */
4509 return NT_STATUS_OK
;
4512 /*********************************************************************
4514 *********************************************************************/
4516 NTSTATUS
_samr_open_group(pipes_struct
*p
, SAMR_Q_OPEN_GROUP
*q_u
, SAMR_R_OPEN_GROUP
*r_u
)
4521 struct samr_info
*info
;
4522 SEC_DESC
*psd
= NULL
;
4524 uint32 des_access
= q_u
->access_mask
;
4531 if (!get_lsa_policy_samr_sid(p
, &q_u
->domain_pol
, &sid
, &acc_granted
, NULL
))
4532 return NT_STATUS_INVALID_HANDLE
;
4534 status
= access_check_samr_function(acc_granted
,
4535 SA_RIGHT_DOMAIN_OPEN_ACCOUNT
, "_samr_open_group");
4537 if ( !NT_STATUS_IS_OK(status
) )
4540 /*check if access can be granted as requested by client. */
4541 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &grp_generic_mapping
, NULL
, 0);
4542 se_map_generic(&des_access
,&grp_generic_mapping
);
4544 se_priv_copy( &se_rights
, &se_add_users
);
4546 status
= access_check_samr_object(psd
, p
->pipe_user
.nt_user_token
,
4547 &se_rights
, GENERIC_RIGHTS_GROUP_WRITE
, des_access
,
4548 &acc_granted
, "_samr_open_group");
4550 if ( !NT_STATUS_IS_OK(status
) )
4553 /* this should not be hard-coded like this */
4555 if (!sid_equal(&sid
, get_global_sam_sid()))
4556 return NT_STATUS_ACCESS_DENIED
;
4558 sid_copy(&info_sid
, get_global_sam_sid());
4559 sid_append_rid(&info_sid
, q_u
->rid_group
);
4560 sid_to_string(sid_string
, &info_sid
);
4562 if ((info
= get_samr_info_by_sid(&info_sid
)) == NULL
)
4563 return NT_STATUS_NO_MEMORY
;
4565 info
->acc_granted
= acc_granted
;
4567 DEBUG(10, ("_samr_open_group:Opening SID: %s\n", sid_string
));
4569 /* check if that group really exists */
4571 ret
= get_domain_group_from_sid(info
->sid
, &map
);
4574 return NT_STATUS_NO_SUCH_GROUP
;
4576 /* get a (unique) handle. open a policy on it. */
4577 if (!create_policy_hnd(p
, &r_u
->pol
, free_samr_info
, (void *)info
))
4578 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
4580 return NT_STATUS_OK
;
4583 /*********************************************************************
4584 _samr_remove_sid_foreign_domain
4585 *********************************************************************/
4587 NTSTATUS
_samr_remove_sid_foreign_domain(pipes_struct
*p
,
4588 SAMR_Q_REMOVE_SID_FOREIGN_DOMAIN
*q_u
,
4589 SAMR_R_REMOVE_SID_FOREIGN_DOMAIN
*r_u
)
4591 DOM_SID delete_sid
, domain_sid
;
4594 DISP_INFO
*disp_info
= NULL
;
4596 sid_copy( &delete_sid
, &q_u
->sid
.sid
);
4598 DEBUG(5,("_samr_remove_sid_foreign_domain: removing SID [%s]\n",
4599 sid_string_static(&delete_sid
)));
4601 /* Find the policy handle. Open a policy on it. */
4603 if (!get_lsa_policy_samr_sid(p
, &q_u
->dom_pol
, &domain_sid
,
4604 &acc_granted
, &disp_info
))
4605 return NT_STATUS_INVALID_HANDLE
;
4607 result
= access_check_samr_function(acc_granted
, STD_RIGHT_DELETE_ACCESS
,
4608 "_samr_remove_sid_foreign_domain");
4610 if (!NT_STATUS_IS_OK(result
))
4613 DEBUG(8, ("_samr_remove_sid_foreign_domain:sid is %s\n",
4614 sid_string_static(&domain_sid
)));
4616 /* we can only delete a user from a group since we don't have
4617 nested groups anyways. So in the latter case, just say OK */
4619 /* TODO: The above comment nowadays is bogus. Since we have nested
4620 * groups now, and aliases members are never reported out of the unix
4621 * group membership, the "just say OK" makes this call a no-op. For
4622 * us. This needs fixing however. */
4624 /* I've only ever seen this in the wild when deleting a user from
4625 * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
4626 * is the user about to be deleted. I very much suspect this is the
4627 * only application of this call. To verify this, let people report
4630 if (!sid_check_is_builtin(&domain_sid
)) {
4631 DEBUG(1,("_samr_remove_sid_foreign_domain: domain_sid = %s, "
4632 "global_sam_sid() = %s\n",
4633 sid_string_static(&domain_sid
),
4634 sid_string_static(get_global_sam_sid())));
4635 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
4636 return NT_STATUS_OK
;
4639 force_flush_samr_cache(disp_info
);
4641 result
= NT_STATUS_OK
;
4646 /*******************************************************************
4647 _samr_query_domain_info2
4648 ********************************************************************/
4650 NTSTATUS
_samr_query_domain_info2(pipes_struct
*p
,
4651 SAMR_Q_QUERY_DOMAIN_INFO2
*q_u
,
4652 SAMR_R_QUERY_DOMAIN_INFO2
*r_u
)
4654 struct samr_info
*info
= NULL
;
4656 uint32 min_pass_len
,pass_hist
,password_properties
;
4657 time_t u_expire
, u_min_age
;
4658 NTTIME nt_expire
, nt_min_age
;
4660 time_t u_lock_duration
, u_reset_time
;
4661 NTTIME nt_lock_duration
, nt_reset_time
;
4667 uint32 num_users
=0, num_groups
=0, num_aliases
=0;
4669 uint32 account_policy_temp
;
4674 if ((ctr
= TALLOC_ZERO_P(p
->mem_ctx
, SAM_UNK_CTR
)) == NULL
)
4675 return NT_STATUS_NO_MEMORY
;
4679 r_u
->status
= NT_STATUS_OK
;
4681 DEBUG(5,("_samr_query_domain_info2: %d\n", __LINE__
));
4683 /* find the policy handle. open a policy on it. */
4684 if (!find_policy_by_hnd(p
, &q_u
->domain_pol
, (void **)(void *)&info
))
4685 return NT_STATUS_INVALID_HANDLE
;
4687 switch (q_u
->switch_value
) {
4689 pdb_get_account_policy(AP_MIN_PASSWORD_LEN
, &account_policy_temp
);
4690 min_pass_len
= account_policy_temp
;
4692 pdb_get_account_policy(AP_PASSWORD_HISTORY
, &account_policy_temp
);
4693 pass_hist
= account_policy_temp
;
4695 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS
, &account_policy_temp
);
4696 password_properties
= account_policy_temp
;
4698 pdb_get_account_policy(AP_MAX_PASSWORD_AGE
, &account_policy_temp
);
4699 u_expire
= account_policy_temp
;
4701 pdb_get_account_policy(AP_MIN_PASSWORD_AGE
, &account_policy_temp
);
4702 u_min_age
= account_policy_temp
;
4704 unix_to_nt_time_abs(&nt_expire
, u_expire
);
4705 unix_to_nt_time_abs(&nt_min_age
, u_min_age
);
4707 init_unk_info1(&ctr
->info
.inf1
, (uint16
)min_pass_len
, (uint16
)pass_hist
,
4708 password_properties
, nt_expire
, nt_min_age
);
4712 num_users
= count_sam_users(info
->disp_info
, ACB_NORMAL
);
4713 num_groups
= count_sam_groups(info
->disp_info
);
4714 num_aliases
= count_sam_aliases(info
->disp_info
);
4717 pdb_get_account_policy(AP_TIME_TO_LOGOUT
, &account_policy_temp
);
4718 u_logout
= account_policy_temp
;
4720 unix_to_nt_time_abs(&nt_logout
, u_logout
);
4722 if (!pdb_get_seq_num(&seq_num
))
4723 seq_num
= time(NULL
);
4725 server_role
= ROLE_DOMAIN_PDC
;
4726 if (lp_server_role() == ROLE_DOMAIN_BDC
)
4727 server_role
= ROLE_DOMAIN_BDC
;
4729 init_unk_info2(&ctr
->info
.inf2
, lp_serverstring(), lp_workgroup(), global_myname(), seq_num
,
4730 num_users
, num_groups
, num_aliases
, nt_logout
, server_role
);
4733 pdb_get_account_policy(AP_TIME_TO_LOGOUT
, &account_policy_temp
);
4734 u_logout
= account_policy_temp
;
4736 unix_to_nt_time_abs(&nt_logout
, u_logout
);
4738 init_unk_info3(&ctr
->info
.inf3
, nt_logout
);
4741 init_unk_info5(&ctr
->info
.inf5
, global_myname());
4744 init_unk_info6(&ctr
->info
.inf6
);
4747 server_role
= ROLE_DOMAIN_PDC
;
4748 if (lp_server_role() == ROLE_DOMAIN_BDC
)
4749 server_role
= ROLE_DOMAIN_BDC
;
4751 init_unk_info7(&ctr
->info
.inf7
, server_role
);
4754 if (!pdb_get_seq_num(&seq_num
))
4755 seq_num
= time(NULL
);
4757 init_unk_info8(&ctr
->info
.inf8
, (uint32
) seq_num
);
4760 pdb_get_account_policy(AP_LOCK_ACCOUNT_DURATION
, &account_policy_temp
);
4761 u_lock_duration
= account_policy_temp
;
4762 if (u_lock_duration
!= -1)
4763 u_lock_duration
*= 60;
4765 pdb_get_account_policy(AP_RESET_COUNT_TIME
, &account_policy_temp
);
4766 u_reset_time
= account_policy_temp
* 60;
4768 pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT
, &account_policy_temp
);
4769 lockout
= account_policy_temp
;
4771 unix_to_nt_time_abs(&nt_lock_duration
, u_lock_duration
);
4772 unix_to_nt_time_abs(&nt_reset_time
, u_reset_time
);
4774 init_unk_info12(&ctr
->info
.inf12
, nt_lock_duration
, nt_reset_time
, (uint16
)lockout
);
4777 return NT_STATUS_INVALID_INFO_CLASS
;
4780 init_samr_r_samr_query_domain_info2(r_u
, q_u
->switch_value
, ctr
, NT_STATUS_OK
);
4782 DEBUG(5,("_samr_query_domain_info2: %d\n", __LINE__
));
4787 /*******************************************************************
4789 ********************************************************************/
4791 NTSTATUS
_samr_set_dom_info(pipes_struct
*p
, SAMR_Q_SET_DOMAIN_INFO
*q_u
, SAMR_R_SET_DOMAIN_INFO
*r_u
)
4793 time_t u_expire
, u_min_age
;
4795 time_t u_lock_duration
, u_reset_time
;
4797 r_u
->status
= NT_STATUS_OK
;
4799 DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__
));
4801 /* find the policy handle. open a policy on it. */
4802 if (!find_policy_by_hnd(p
, &q_u
->domain_pol
, NULL
))
4803 return NT_STATUS_INVALID_HANDLE
;
4805 DEBUG(5,("_samr_set_dom_info: switch_value: %d\n", q_u
->switch_value
));
4807 switch (q_u
->switch_value
) {
4809 u_expire
=nt_time_to_unix_abs(&q_u
->ctr
->info
.inf1
.expire
);
4810 u_min_age
=nt_time_to_unix_abs(&q_u
->ctr
->info
.inf1
.min_passwordage
);
4812 pdb_set_account_policy(AP_MIN_PASSWORD_LEN
, (uint32
)q_u
->ctr
->info
.inf1
.min_length_password
);
4813 pdb_set_account_policy(AP_PASSWORD_HISTORY
, (uint32
)q_u
->ctr
->info
.inf1
.password_history
);
4814 pdb_set_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS
, (uint32
)q_u
->ctr
->info
.inf1
.password_properties
);
4815 pdb_set_account_policy(AP_MAX_PASSWORD_AGE
, (int)u_expire
);
4816 pdb_set_account_policy(AP_MIN_PASSWORD_AGE
, (int)u_min_age
);
4821 u_logout
=nt_time_to_unix_abs(&q_u
->ctr
->info
.inf3
.logout
);
4822 pdb_set_account_policy(AP_TIME_TO_LOGOUT
, (int)u_logout
);
4831 u_lock_duration
=nt_time_to_unix_abs(&q_u
->ctr
->info
.inf12
.duration
);
4832 if (u_lock_duration
!= -1)
4833 u_lock_duration
/= 60;
4835 u_reset_time
=nt_time_to_unix_abs(&q_u
->ctr
->info
.inf12
.reset_count
)/60;
4837 pdb_set_account_policy(AP_LOCK_ACCOUNT_DURATION
, (int)u_lock_duration
);
4838 pdb_set_account_policy(AP_RESET_COUNT_TIME
, (int)u_reset_time
);
4839 pdb_set_account_policy(AP_BAD_ATTEMPT_LOCKOUT
, (uint32
)q_u
->ctr
->info
.inf12
.bad_attempt_lockout
);
4842 return NT_STATUS_INVALID_INFO_CLASS
;
4845 init_samr_r_set_domain_info(r_u
, NT_STATUS_OK
);
4847 DEBUG(5,("_samr_set_dom_info: %d\n", __LINE__
));