?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
netapi: add NetFileEnum to public header.
[Samba.git] / source / rpc_server / srv_samr_nt.c
blob1b1e98c049cc0ade0cdc9d7bcec8d9b8b8d2eccc
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Marc Jacobsen 1999,
8 * Copyright (C) Jeremy Allison 2001-2005,
9 * Copyright (C) Jean François Micouleau 1998-2001,
10 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
11 * Copyright (C) Gerald (Jerry) Carter 2003-2004,
12 * Copyright (C) Simo Sorce 2003.
13 * Copyright (C) Volker Lendecke 2005.
14 * Copyright (C) Guenther Deschner 2008.
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 3 of the License, or
19 * (at your option) any later version.
20 *
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
25 *
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
28 */
29
30 /*
31 * This is the implementation of the SAMR code.
32 */
33
34 #include "includes.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_RPC_SRV
38
39 #define SAMR_USR_RIGHTS_WRITE_PW \
40 ( READ_CONTROL_ACCESS | \
41 SA_RIGHT_USER_CHANGE_PASSWORD | \
42 SA_RIGHT_USER_SET_LOC_COM )
43 #define SAMR_USR_RIGHTS_CANT_WRITE_PW \
44 ( READ_CONTROL_ACCESS | SA_RIGHT_USER_SET_LOC_COM )
45
46 #define DISP_INFO_CACHE_TIMEOUT 10
47
48 typedef struct disp_info {
49 DOM_SID sid; /* identify which domain this is. */
50 bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
51 struct pdb_search *users; /* querydispinfo 1 and 4 */
52 struct pdb_search *machines; /* querydispinfo 2 */
53 struct pdb_search *groups; /* querydispinfo 3 and 5, enumgroups */
54 struct pdb_search *aliases; /* enumaliases */
55
56 uint16 enum_acb_mask;
57 struct pdb_search *enum_users; /* enumusers with a mask */
58
59 struct timed_event *cache_timeout_event; /* cache idle timeout
60 * handler. */
61 } DISP_INFO;
62
63 /* We keep a static list of these by SID as modern clients close down
64 all resources between each request in a complete enumeration. */
65
66 struct samr_info {
67 /* for use by the \PIPE\samr policy */
68 DOM_SID sid;
69 bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
70 uint32 status; /* some sort of flag. best to record it. comes from opnum 0x39 */
71 uint32 acc_granted;
72 DISP_INFO *disp_info;
73 TALLOC_CTX *mem_ctx;
74 };
75
76 static const struct generic_mapping sam_generic_mapping = {
77 GENERIC_RIGHTS_SAM_READ,
78 GENERIC_RIGHTS_SAM_WRITE,
79 GENERIC_RIGHTS_SAM_EXECUTE,
80 GENERIC_RIGHTS_SAM_ALL_ACCESS};
81 static const struct generic_mapping dom_generic_mapping = {
82 GENERIC_RIGHTS_DOMAIN_READ,
83 GENERIC_RIGHTS_DOMAIN_WRITE,
84 GENERIC_RIGHTS_DOMAIN_EXECUTE,
85 GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
86 static const struct generic_mapping usr_generic_mapping = {
87 GENERIC_RIGHTS_USER_READ,
88 GENERIC_RIGHTS_USER_WRITE,
89 GENERIC_RIGHTS_USER_EXECUTE,
90 GENERIC_RIGHTS_USER_ALL_ACCESS};
91 static const struct generic_mapping usr_nopwchange_generic_mapping = {
92 GENERIC_RIGHTS_USER_READ,
93 GENERIC_RIGHTS_USER_WRITE,
94 GENERIC_RIGHTS_USER_EXECUTE & ~SA_RIGHT_USER_CHANGE_PASSWORD,
95 GENERIC_RIGHTS_USER_ALL_ACCESS};
96 static const struct generic_mapping grp_generic_mapping = {
97 GENERIC_RIGHTS_GROUP_READ,
98 GENERIC_RIGHTS_GROUP_WRITE,
99 GENERIC_RIGHTS_GROUP_EXECUTE,
100 GENERIC_RIGHTS_GROUP_ALL_ACCESS};
101 static const struct generic_mapping ali_generic_mapping = {
102 GENERIC_RIGHTS_ALIAS_READ,
103 GENERIC_RIGHTS_ALIAS_WRITE,
104 GENERIC_RIGHTS_ALIAS_EXECUTE,
105 GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
106
107 /*******************************************************************
108 *******************************************************************/
109
110 static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size,
111 const struct generic_mapping *map,
112 DOM_SID *sid, uint32 sid_access )
113 {
114 DOM_SID domadmin_sid;
115 SEC_ACE ace[5]; /* at most 5 entries */
116 SEC_ACCESS mask;
117 size_t i = 0;
118
119 SEC_ACL *psa = NULL;
120
121 /* basic access for Everyone */
122
123 init_sec_access(&mask, map->generic_execute | map->generic_read );
124 init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
125
126 /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
127
128 init_sec_access(&mask, map->generic_all);
129
130 init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
131 init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
132
133 /* Add Full Access for Domain Admins if we are a DC */
134
135 if ( IS_DC ) {
136 sid_copy( &domadmin_sid, get_global_sam_sid() );
137 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
138 init_sec_ace(&ace[i++], &domadmin_sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
139 }
140
141 /* if we have a sid, give it some special access */
142
143 if ( sid ) {
144 init_sec_access( &mask, sid_access );
145 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, mask, 0);
146 }
147
148 /* create the security descriptor */
149
150 if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
151 return NT_STATUS_NO_MEMORY;
152
153 if ((*psd = make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
154 SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL,
155 psa, sd_size)) == NULL)
156 return NT_STATUS_NO_MEMORY;
157
158 return NT_STATUS_OK;
159 }
160
161 /*******************************************************************
162 Checks if access to an object should be granted, and returns that
163 level of access for further checks.
164 ********************************************************************/
165
166 static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
167 SE_PRIV *rights, uint32 rights_mask,
168 uint32 des_access, uint32 *acc_granted,
169 const char *debug )
170 {
171 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
172 uint32 saved_mask = 0;
173
174 /* check privileges; certain SAM access bits should be overridden
175 by privileges (mostly having to do with creating/modifying/deleting
176 users and groups) */
177
178 if ( rights && user_has_any_privilege( token, rights ) ) {
179
180 saved_mask = (des_access & rights_mask);
181 des_access &= ~saved_mask;
182
183 DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
184 rights_mask));
185 }
186
187
188 /* check the security descriptor first */
189
190 if ( se_access_check(psd, token, des_access, acc_granted, &status) )
191 goto done;
192
193 /* give root a free pass */
194
195 if ( geteuid() == sec_initial_uid() ) {
196
197 DEBUG(4,("%s: ACCESS should be DENIED (requested: %#010x)\n", debug, des_access));
198 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
199
200 *acc_granted = des_access;
201
202 status = NT_STATUS_OK;
203 goto done;
204 }
205
206
207 done:
208 /* add in any bits saved during the privilege check (only
209 matters is status is ok) */
210
211 *acc_granted |= rights_mask;
212
213 DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
214 debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED",
215 des_access, *acc_granted));
216
217 return status;
218 }
219
220 /*******************************************************************
221 Checks if access to a function can be granted
222 ********************************************************************/
223
224 static NTSTATUS access_check_samr_function(uint32 acc_granted, uint32 acc_required, const char *debug)
225 {
226 DEBUG(5,("%s: access check ((granted: %#010x; required: %#010x)\n",
227 debug, acc_granted, acc_required));
228
229 /* check the security descriptor first */
230
231 if ( (acc_granted&acc_required) == acc_required )
232 return NT_STATUS_OK;
233
234 /* give root a free pass */
235
236 if (geteuid() == sec_initial_uid()) {
237
238 DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
239 debug, acc_granted, acc_required));
240 DEBUGADD(4,("but overwritten by euid == 0\n"));
241
242 return NT_STATUS_OK;
243 }
244
245 DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: %#010x)\n",
246 debug, acc_granted, acc_required));
247
248 return NT_STATUS_ACCESS_DENIED;
249 }
250
251 /*******************************************************************
252 Fetch or create a dispinfo struct.
253 ********************************************************************/
254
255 static DISP_INFO *get_samr_dispinfo_by_sid(DOM_SID *psid)
256 {
257 /*
258 * We do a static cache for DISP_INFO's here. Explanation can be found
259 * in Jeremy's checkin message to r11793:
260 *
261 * Fix the SAMR cache so it works across completely insane
262 * client behaviour (ie.:
263 * open pipe/open SAMR handle/enumerate 0 - 1024
264 * close SAMR handle, close pipe.
265 * open pipe/open SAMR handle/enumerate 1024 - 2048...
266 * close SAMR handle, close pipe.
267 * And on ad-nausium. Amazing.... probably object-oriented
268 * client side programming in action yet again.
269 * This change should *massively* improve performance when
270 * enumerating users from an LDAP database.
271 * Jeremy.
272 *
273 * "Our" and the builtin domain are the only ones where we ever
274 * enumerate stuff, so just cache 2 entries.
275 */
276
277 static struct disp_info builtin_dispinfo;
278 static struct disp_info domain_dispinfo;
279
280 /* There are two cases to consider here:
281 1) The SID is a domain SID and we look for an equality match, or
282 2) This is an account SID and so we return the DISP_INFO* for our
283 domain */
284
285 if (psid == NULL) {
286 return NULL;
287 }
288
289 if (sid_check_is_builtin(psid) || sid_check_is_in_builtin(psid)) {
290 /*
291 * Necessary only once, but it does not really hurt.
292 */
293 sid_copy(&builtin_dispinfo.sid, &global_sid_Builtin);
294
295 return &builtin_dispinfo;
296 }
297
298 if (sid_check_is_domain(psid) || sid_check_is_in_our_domain(psid)) {
299 /*
300 * Necessary only once, but it does not really hurt.
301 */
302 sid_copy(&domain_dispinfo.sid, get_global_sam_sid());
303
304 return &domain_dispinfo;
305 }
306
307 return NULL;
308 }
309
310 /*******************************************************************
311 Create a samr_info struct.
312 ********************************************************************/
313
314 static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
315 {
316 struct samr_info *info;
317 fstring sid_str;
318 TALLOC_CTX *mem_ctx;
319
320 if (psid) {
321 sid_to_fstring(sid_str, psid);
322 } else {
323 fstrcpy(sid_str,"(NULL)");
324 }
325
326 mem_ctx = talloc_init("samr_info for domain sid %s", sid_str);
327
328 if ((info = TALLOC_ZERO_P(mem_ctx, struct samr_info)) == NULL)
329 return NULL;
330
331 DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str));
332 if (psid) {
333 sid_copy( &info->sid, psid);
334 info->builtin_domain = sid_check_is_builtin(psid);
335 } else {
336 DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
337 info->builtin_domain = False;
338 }
339 info->mem_ctx = mem_ctx;
340
341 info->disp_info = get_samr_dispinfo_by_sid(psid);
342
343 return info;
344 }
345
346 /*******************************************************************
347 Function to free the per SID data.
348 ********************************************************************/
349
350 static void free_samr_cache(DISP_INFO *disp_info)
351 {
352 DEBUG(10, ("free_samr_cache: deleting cache for SID %s\n",
353 sid_string_dbg(&disp_info->sid)));
354
355 /* We need to become root here because the paged search might have to
356 * tell the LDAP server we're not interested in the rest anymore. */
357
358 become_root();
359
360 if (disp_info->users) {
361 DEBUG(10,("free_samr_cache: deleting users cache\n"));
362 pdb_search_destroy(disp_info->users);
363 disp_info->users = NULL;
364 }
365 if (disp_info->machines) {
366 DEBUG(10,("free_samr_cache: deleting machines cache\n"));
367 pdb_search_destroy(disp_info->machines);
368 disp_info->machines = NULL;
369 }
370 if (disp_info->groups) {
371 DEBUG(10,("free_samr_cache: deleting groups cache\n"));
372 pdb_search_destroy(disp_info->groups);
373 disp_info->groups = NULL;
374 }
375 if (disp_info->aliases) {
376 DEBUG(10,("free_samr_cache: deleting aliases cache\n"));
377 pdb_search_destroy(disp_info->aliases);
378 disp_info->aliases = NULL;
379 }
380 if (disp_info->enum_users) {
381 DEBUG(10,("free_samr_cache: deleting enum_users cache\n"));
382 pdb_search_destroy(disp_info->enum_users);
383 disp_info->enum_users = NULL;
384 }
385 disp_info->enum_acb_mask = 0;
386
387 unbecome_root();
388 }
389
390 /*******************************************************************
391 Function to free the per handle data.
392 ********************************************************************/
393
394 static void free_samr_info(void *ptr)
395 {
396 struct samr_info *info=(struct samr_info *) ptr;
397
398 /* Only free the dispinfo cache if no one bothered to set up
399 a timeout. */
400
401 if (info->disp_info && info->disp_info->cache_timeout_event == NULL) {
402 free_samr_cache(info->disp_info);
403 }
404
405 talloc_destroy(info->mem_ctx);
406 }
407
408 /*******************************************************************
409 Idle event handler. Throw away the disp info cache.
410 ********************************************************************/
411
412 static void disp_info_cache_idle_timeout_handler(struct event_context *ev_ctx,
413 struct timed_event *te,
414 const struct timeval *now,
415 void *private_data)
416 {
417 DISP_INFO *disp_info = (DISP_INFO *)private_data;
418
419 TALLOC_FREE(disp_info->cache_timeout_event);
420
421 DEBUG(10, ("disp_info_cache_idle_timeout_handler: caching timed "
422 "out\n"));
423 free_samr_cache(disp_info);
424 }
425
426 /*******************************************************************
427 Setup cache removal idle event handler.
428 ********************************************************************/
429
430 static void set_disp_info_cache_timeout(DISP_INFO *disp_info, time_t secs_fromnow)
431 {
432 /* Remove any pending timeout and update. */
433
434 TALLOC_FREE(disp_info->cache_timeout_event);
435
436 DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for "
437 "SID %s for %u seconds\n", sid_string_dbg(&disp_info->sid),
438 (unsigned int)secs_fromnow ));
439
440 disp_info->cache_timeout_event = event_add_timed(
441 smbd_event_context(), NULL,
442 timeval_current_ofs(secs_fromnow, 0),
443 "disp_info_cache_idle_timeout_handler",
444 disp_info_cache_idle_timeout_handler, (void *)disp_info);
445 }
446
447 /*******************************************************************
448 Force flush any cache. We do this on any samr_set_xxx call.
449 We must also remove the timeout handler.
450 ********************************************************************/
451
452 static void force_flush_samr_cache(DISP_INFO *disp_info)
453 {
454 if ((disp_info == NULL) || (disp_info->cache_timeout_event == NULL)) {
455 return;
456 }
457
458 DEBUG(10,("force_flush_samr_cache: clearing idle event\n"));
459 TALLOC_FREE(disp_info->cache_timeout_event);
460 free_samr_cache(disp_info);
461 }
462
463 /*******************************************************************
464 Ensure password info is never given out. Paranioa... JRA.
465 ********************************************************************/
466
467 static void samr_clear_sam_passwd(struct samu *sam_pass)
468 {
469
470 if (!sam_pass)
471 return;
472
473 /* These now zero out the old password */
474
475 pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
476 pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
477 }
478
479 static uint32 count_sam_users(struct disp_info *info, uint32 acct_flags)
480 {
481 struct samr_displayentry *entry;
482
483 if (info->builtin_domain) {
484 /* No users in builtin. */
485 return 0;
486 }
487
488 if (info->users == NULL) {
489 info->users = pdb_search_users(acct_flags);
490 if (info->users == NULL) {
491 return 0;
492 }
493 }
494 /* Fetch the last possible entry, thus trigger an enumeration */
495 pdb_search_entries(info->users, 0xffffffff, 1, &entry);
496
497 /* Ensure we cache this enumeration. */
498 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
499
500 return info->users->num_entries;
501 }
502
503 static uint32 count_sam_groups(struct disp_info *info)
504 {
505 struct samr_displayentry *entry;
506
507 if (info->builtin_domain) {
508 /* No groups in builtin. */
509 return 0;
510 }
511
512 if (info->groups == NULL) {
513 info->groups = pdb_search_groups();
514 if (info->groups == NULL) {
515 return 0;
516 }
517 }
518 /* Fetch the last possible entry, thus trigger an enumeration */
519 pdb_search_entries(info->groups, 0xffffffff, 1, &entry);
520
521 /* Ensure we cache this enumeration. */
522 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
523
524 return info->groups->num_entries;
525 }
526
527 static uint32 count_sam_aliases(struct disp_info *info)
528 {
529 struct samr_displayentry *entry;
530
531 if (info->aliases == NULL) {
532 info->aliases = pdb_search_aliases(&info->sid);
533 if (info->aliases == NULL) {
534 return 0;
535 }
536 }
537 /* Fetch the last possible entry, thus trigger an enumeration */
538 pdb_search_entries(info->aliases, 0xffffffff, 1, &entry);
539
540 /* Ensure we cache this enumeration. */
541 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
542
543 return info->aliases->num_entries;
544 }
545
546 /*******************************************************************
547 _samr_Close
548 ********************************************************************/
549
550 NTSTATUS _samr_Close(pipes_struct *p, struct samr_Close *r)
551 {
552 if (!close_policy_hnd(p, r->in.handle)) {
553 return NT_STATUS_INVALID_HANDLE;
554 }
555
556 ZERO_STRUCTP(r->out.handle);
557
558 return NT_STATUS_OK;
559 }
560
561 /*******************************************************************
562 _samr_OpenDomain
563 ********************************************************************/
564
565 NTSTATUS _samr_OpenDomain(pipes_struct *p,
566 struct samr_OpenDomain *r)
567 {
568 struct samr_info *info;
569 SEC_DESC *psd = NULL;
570 uint32 acc_granted;
571 uint32 des_access = r->in.access_mask;
572 NTSTATUS status;
573 size_t sd_size;
574 SE_PRIV se_rights;
575
576 /* find the connection policy handle. */
577
578 if ( !find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info) )
579 return NT_STATUS_INVALID_HANDLE;
580
581 status = access_check_samr_function(info->acc_granted,
582 SA_RIGHT_SAM_OPEN_DOMAIN,
583 "_samr_OpenDomain" );
584
585 if ( !NT_STATUS_IS_OK(status) )
586 return status;
587
588 /*check if access can be granted as requested by client. */
589
590 make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
591 se_map_generic( &des_access, &dom_generic_mapping );
592
593 se_priv_copy( &se_rights, &se_machine_account );
594 se_priv_add( &se_rights, &se_add_users );
595
596 status = access_check_samr_object( psd, p->pipe_user.nt_user_token,
597 &se_rights, GENERIC_RIGHTS_DOMAIN_WRITE, des_access,
598 &acc_granted, "_samr_OpenDomain" );
599
600 if ( !NT_STATUS_IS_OK(status) )
601 return status;
602
603 if (!sid_check_is_domain(r->in.sid) &&
604 !sid_check_is_builtin(r->in.sid)) {
605 return NT_STATUS_NO_SUCH_DOMAIN;
606 }
607
608 /* associate the domain SID with the (unique) handle. */
609 if ((info = get_samr_info_by_sid(r->in.sid))==NULL)
610 return NT_STATUS_NO_MEMORY;
611 info->acc_granted = acc_granted;
612
613 /* get a (unique) handle. open a policy on it. */
614 if (!create_policy_hnd(p, r->out.domain_handle, free_samr_info, (void *)info))
615 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
616
617 DEBUG(5,("_samr_OpenDomain: %d\n", __LINE__));
618
619 return NT_STATUS_OK;
620 }
621
622 /*******************************************************************
623 _samr_GetUserPwInfo
624 ********************************************************************/
625
626 NTSTATUS _samr_GetUserPwInfo(pipes_struct *p,
627 struct samr_GetUserPwInfo *r)
628 {
629 struct samr_info *info = NULL;
630 enum lsa_SidType sid_type;
631 uint32_t min_password_length = 0;
632 uint32_t password_properties = 0;
633 bool ret = false;
634 NTSTATUS status;
635
636 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
637
638 /* find the policy handle. open a policy on it. */
639 if (!find_policy_by_hnd(p, r->in.user_handle, (void **)(void *)&info)) {
640 return NT_STATUS_INVALID_HANDLE;
641 }
642
643 status = access_check_samr_function(info->acc_granted,
644 SAMR_USER_ACCESS_GET_ATTRIBUTES,
645 "_samr_GetUserPwInfo" );
646 if (!NT_STATUS_IS_OK(status)) {
647 return status;
648 }
649
650 if (!sid_check_is_in_our_domain(&info->sid)) {
651 return NT_STATUS_OBJECT_TYPE_MISMATCH;
652 }
653
654 become_root();
655 ret = lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, &sid_type);
656 unbecome_root();
657 if (ret == false) {
658 return NT_STATUS_NO_SUCH_USER;
659 }
660
661 switch (sid_type) {
662 case SID_NAME_USER:
663 become_root();
664 pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
665 &min_password_length);
666 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
667 &password_properties);
668 unbecome_root();
669
670 if (lp_check_password_script() && *lp_check_password_script()) {
671 password_properties |= DOMAIN_PASSWORD_COMPLEX;
672 }
673
674 break;
675 default:
676 break;
677 }
678
679 r->out.info->min_password_length = min_password_length;
680 r->out.info->password_properties = password_properties;
681
682 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
683
684 return NT_STATUS_OK;
685 }
686
687 /*******************************************************************
688 ********************************************************************/
689
690 static bool get_lsa_policy_samr_sid( pipes_struct *p, POLICY_HND *pol,
691 DOM_SID *sid, uint32 *acc_granted,
692 DISP_INFO **ppdisp_info)
693 {
694 struct samr_info *info = NULL;
695
696 /* find the policy handle. open a policy on it. */
697 if (!find_policy_by_hnd(p, pol, (void **)(void *)&info))
698 return False;
699
700 if (!info)
701 return False;
702
703 *sid = info->sid;
704 *acc_granted = info->acc_granted;
705 if (ppdisp_info) {
706 *ppdisp_info = info->disp_info;
707 }
708
709 return True;
710 }
711
712 /*******************************************************************
713 _samr_SetSecurity
714 ********************************************************************/
715
716 NTSTATUS _samr_SetSecurity(pipes_struct *p,
717 struct samr_SetSecurity *r)
718 {
719 DOM_SID pol_sid;
720 uint32 acc_granted, i;
721 SEC_ACL *dacl;
722 bool ret;
723 struct samu *sampass=NULL;
724 NTSTATUS status;
725
726 if (!get_lsa_policy_samr_sid(p, r->in.handle, &pol_sid, &acc_granted, NULL))
727 return NT_STATUS_INVALID_HANDLE;
728
729 if (!(sampass = samu_new( p->mem_ctx))) {
730 DEBUG(0,("No memory!\n"));
731 return NT_STATUS_NO_MEMORY;
732 }
733
734 /* get the user record */
735 become_root();
736 ret = pdb_getsampwsid(sampass, &pol_sid);
737 unbecome_root();
738
739 if (!ret) {
740 DEBUG(4, ("User %s not found\n", sid_string_dbg(&pol_sid)));
741 TALLOC_FREE(sampass);
742 return NT_STATUS_INVALID_HANDLE;
743 }
744
745 dacl = r->in.sdbuf->sd->dacl;
746 for (i=0; i < dacl->num_aces; i++) {
747 if (sid_equal(&pol_sid, &dacl->aces[i].trustee)) {
748 ret = pdb_set_pass_can_change(sampass,
749 (dacl->aces[i].access_mask &
750 SA_RIGHT_USER_CHANGE_PASSWORD) ?
751 True: False);
752 break;
753 }
754 }
755
756 if (!ret) {
757 TALLOC_FREE(sampass);
758 return NT_STATUS_ACCESS_DENIED;
759 }
760
761 status = access_check_samr_function(acc_granted,
762 SA_RIGHT_USER_SET_ATTRIBUTES,
763 "_samr_SetSecurity");
764 if (NT_STATUS_IS_OK(status)) {
765 become_root();
766 status = pdb_update_sam_account(sampass);
767 unbecome_root();
768 }
769
770 TALLOC_FREE(sampass);
771
772 return status;
773 }
774
775 /*******************************************************************
776 build correct perms based on policies and password times for _samr_query_sec_obj
777 *******************************************************************/
778 static bool check_change_pw_access(TALLOC_CTX *mem_ctx, DOM_SID *user_sid)
779 {
780 struct samu *sampass=NULL;
781 bool ret;
782
783 if ( !(sampass = samu_new( mem_ctx )) ) {
784 DEBUG(0,("No memory!\n"));
785 return False;
786 }
787
788 become_root();
789 ret = pdb_getsampwsid(sampass, user_sid);
790 unbecome_root();
791
792 if (ret == False) {
793 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
794 TALLOC_FREE(sampass);
795 return False;
796 }
797
798 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass) ));
799
800 if (pdb_get_pass_can_change(sampass)) {
801 TALLOC_FREE(sampass);
802 return True;
803 }
804 TALLOC_FREE(sampass);
805 return False;
806 }
807
808
809 /*******************************************************************
810 _samr_QuerySecurity
811 ********************************************************************/
812
813 NTSTATUS _samr_QuerySecurity(pipes_struct *p,
814 struct samr_QuerySecurity *r)
815 {
816 NTSTATUS status;
817 DOM_SID pol_sid;
818 SEC_DESC * psd = NULL;
819 uint32 acc_granted;
820 size_t sd_size;
821
822 /* Get the SID. */
823 if (!get_lsa_policy_samr_sid(p, r->in.handle, &pol_sid, &acc_granted, NULL))
824 return NT_STATUS_INVALID_HANDLE;
825
826 DEBUG(10,("_samr_QuerySecurity: querying security on SID: %s\n",
827 sid_string_dbg(&pol_sid)));
828
829 /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
830
831 /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
832 if (pol_sid.sid_rev_num == 0) {
833 DEBUG(5,("_samr_QuerySecurity: querying security on SAM\n"));
834 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
835 } else if (sid_equal(&pol_sid,get_global_sam_sid())) {
836 /* check if it is our domain SID */
837 DEBUG(5,("_samr_QuerySecurity: querying security on Domain "
838 "with SID: %s\n", sid_string_dbg(&pol_sid)));
839 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
840 } else if (sid_equal(&pol_sid,&global_sid_Builtin)) {
841 /* check if it is the Builtin Domain */
842 /* TODO: Builtin probably needs a different SD with restricted write access*/
843 DEBUG(5,("_samr_QuerySecurity: querying security on Builtin "
844 "Domain with SID: %s\n", sid_string_dbg(&pol_sid)));
845 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
846 } else if (sid_check_is_in_our_domain(&pol_sid) ||
847 sid_check_is_in_builtin(&pol_sid)) {
848 /* TODO: different SDs have to be generated for aliases groups and users.
849 Currently all three get a default user SD */
850 DEBUG(10,("_samr_QuerySecurity: querying security on Object "
851 "with SID: %s\n", sid_string_dbg(&pol_sid)));
852 if (check_change_pw_access(p->mem_ctx, &pol_sid)) {
853 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
854 &pol_sid, SAMR_USR_RIGHTS_WRITE_PW);
855 } else {
856 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_nopwchange_generic_mapping,
857 &pol_sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
858 }
859 } else {
860 return NT_STATUS_OBJECT_TYPE_MISMATCH;
861 }
862
863 if ((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
864 return NT_STATUS_NO_MEMORY;
865
866 return status;
867 }
868
869 /*******************************************************************
870 makes a SAM_ENTRY / UNISTR2* structure from a user list.
871 ********************************************************************/
872
873 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx,
874 struct samr_SamEntry **sam_pp,
875 uint32_t num_entries,
876 uint32_t start_idx,
877 struct samr_displayentry *entries)
878 {
879 uint32_t i;
880 struct samr_SamEntry *sam;
881
882 *sam_pp = NULL;
883
884 if (num_entries == 0) {
885 return NT_STATUS_OK;
886 }
887
888 sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_entries);
889 if (sam == NULL) {
890 DEBUG(0, ("make_user_sam_entry_list: TALLOC_ZERO failed!\n"));
891 return NT_STATUS_NO_MEMORY;
892 }
893
894 for (i = 0; i < num_entries; i++) {
895 #if 0
896 /*
897 * usrmgr expects a non-NULL terminated string with
898 * trust relationships
899 */
900 if (entries[i].acct_flags & ACB_DOMTRUST) {
901 init_unistr2(&uni_temp_name, entries[i].account_name,
902 UNI_FLAGS_NONE);
903 } else {
904 init_unistr2(&uni_temp_name, entries[i].account_name,
905 UNI_STR_TERMINATE);
906 }
907 #endif
908 init_lsa_String(&sam[i].name, entries[i].account_name);
909 sam[i].idx = entries[i].rid;
910 }
911
912 *sam_pp = sam;
913
914 return NT_STATUS_OK;
915 }
916
917 #define MAX_SAM_ENTRIES MAX_SAM_ENTRIES_W2K
918
919 /*******************************************************************
920 _samr_EnumDomainUsers
921 ********************************************************************/
922
923 NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
924 struct samr_EnumDomainUsers *r)
925 {
926 NTSTATUS status;
927 struct samr_info *info = NULL;
928 int num_account;
929 uint32 enum_context = *r->in.resume_handle;
930 enum remote_arch_types ra_type = get_remote_arch();
931 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
932 uint32 max_entries = max_sam_entries;
933 struct samr_displayentry *entries = NULL;
934 struct samr_SamArray *samr_array = NULL;
935 struct samr_SamEntry *samr_entries = NULL;
936
937 /* find the policy handle. open a policy on it. */
938 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
939 return NT_STATUS_INVALID_HANDLE;
940
941 status = access_check_samr_function(info->acc_granted,
942 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
943 "_samr_EnumDomainUsers");
944 if (!NT_STATUS_IS_OK(status)) {
945 return status;
946 }
947
948 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
949
950 if (info->builtin_domain) {
951 /* No users in builtin. */
952 *r->out.resume_handle = *r->in.resume_handle;
953 DEBUG(5,("_samr_EnumDomainUsers: No users in BUILTIN\n"));
954 return status;
955 }
956
957 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
958 if (!samr_array) {
959 return NT_STATUS_NO_MEMORY;
960 }
961
962 become_root();
963
964 /* AS ROOT !!!! */
965
966 if ((info->disp_info->enum_users != NULL) &&
967 (info->disp_info->enum_acb_mask != r->in.acct_flags)) {
968 pdb_search_destroy(info->disp_info->enum_users);
969 info->disp_info->enum_users = NULL;
970 }
971
972 if (info->disp_info->enum_users == NULL) {
973 info->disp_info->enum_users = pdb_search_users(r->in.acct_flags);
974 info->disp_info->enum_acb_mask = r->in.acct_flags;
975 }
976
977 if (info->disp_info->enum_users == NULL) {
978 /* END AS ROOT !!!! */
979 unbecome_root();
980 return NT_STATUS_ACCESS_DENIED;
981 }
982
983 num_account = pdb_search_entries(info->disp_info->enum_users,
984 enum_context, max_entries,
985 &entries);
986
987 /* END AS ROOT !!!! */
988
989 unbecome_root();
990
991 if (num_account == 0) {
992 DEBUG(5, ("_samr_EnumDomainUsers: enumeration handle over "
993 "total entries\n"));
994 *r->out.resume_handle = *r->in.resume_handle;
995 return NT_STATUS_OK;
996 }
997
998 status = make_user_sam_entry_list(p->mem_ctx, &samr_entries,
999 num_account, enum_context,
1000 entries);
1001 if (!NT_STATUS_IS_OK(status)) {
1002 return status;
1003 }
1004
1005 if (max_entries <= num_account) {
1006 status = STATUS_MORE_ENTRIES;
1007 } else {
1008 status = NT_STATUS_OK;
1009 }
1010
1011 /* Ensure we cache this enumeration. */
1012 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1013
1014 DEBUG(5, ("_samr_EnumDomainUsers: %d\n", __LINE__));
1015
1016 samr_array->count = num_account;
1017 samr_array->entries = samr_entries;
1018
1019 *r->out.resume_handle = *r->in.resume_handle + num_account;
1020 *r->out.sam = samr_array;
1021 *r->out.num_entries = num_account;
1022
1023 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
1024
1025 return status;
1026 }
1027
1028 /*******************************************************************
1029 makes a SAM_ENTRY / UNISTR2* structure from a group list.
1030 ********************************************************************/
1031
1032 static void make_group_sam_entry_list(TALLOC_CTX *ctx,
1033 struct samr_SamEntry **sam_pp,
1034 uint32_t num_sam_entries,
1035 struct samr_displayentry *entries)
1036 {
1037 struct samr_SamEntry *sam;
1038 uint32_t i;
1039
1040 *sam_pp = NULL;
1041
1042 if (num_sam_entries == 0) {
1043 return;
1044 }
1045
1046 sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_sam_entries);
1047 if (sam == NULL) {
1048 return;
1049 }
1050
1051 for (i = 0; i < num_sam_entries; i++) {
1052 /*
1053 * JRA. I think this should include the null. TNG does not.
1054 */
1055 init_lsa_String(&sam[i].name, entries[i].account_name);
1056 sam[i].idx = entries[i].rid;
1057 }
1058
1059 *sam_pp = sam;
1060 }
1061
1062 /*******************************************************************
1063 _samr_EnumDomainGroups
1064 ********************************************************************/
1065
1066 NTSTATUS _samr_EnumDomainGroups(pipes_struct *p,
1067 struct samr_EnumDomainGroups *r)
1068 {
1069 NTSTATUS status;
1070 struct samr_info *info = NULL;
1071 struct samr_displayentry *groups;
1072 uint32 num_groups;
1073 struct samr_SamArray *samr_array = NULL;
1074 struct samr_SamEntry *samr_entries = NULL;
1075
1076 /* find the policy handle. open a policy on it. */
1077 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1078 return NT_STATUS_INVALID_HANDLE;
1079
1080 status = access_check_samr_function(info->acc_granted,
1081 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
1082 "_samr_EnumDomainGroups");
1083 if (!NT_STATUS_IS_OK(status)) {
1084 return status;
1085 }
1086
1087 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1088
1089 if (info->builtin_domain) {
1090 /* No groups in builtin. */
1091 *r->out.resume_handle = *r->in.resume_handle;
1092 DEBUG(5,("_samr_EnumDomainGroups: No groups in BUILTIN\n"));
1093 return status;
1094 }
1095
1096 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1097 if (!samr_array) {
1098 return NT_STATUS_NO_MEMORY;
1099 }
1100
1101 /* the domain group array is being allocated in the function below */
1102
1103 become_root();
1104
1105 if (info->disp_info->groups == NULL) {
1106 info->disp_info->groups = pdb_search_groups();
1107
1108 if (info->disp_info->groups == NULL) {
1109 unbecome_root();
1110 return NT_STATUS_ACCESS_DENIED;
1111 }
1112 }
1113
1114 num_groups = pdb_search_entries(info->disp_info->groups,
1115 *r->in.resume_handle,
1116 MAX_SAM_ENTRIES, &groups);
1117 unbecome_root();
1118
1119 /* Ensure we cache this enumeration. */
1120 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1121
1122 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1123 num_groups, groups);
1124
1125 samr_array->count = num_groups;
1126 samr_array->entries = samr_entries;
1127
1128 *r->out.sam = samr_array;
1129 *r->out.num_entries = num_groups;
1130 /* this was missing, IMHO:
1131 *r->out.resume_handle = num_groups + *r->in.resume_handle;
1132 */
1133
1134 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1135
1136 return status;
1137 }
1138
1139 /*******************************************************************
1140 _samr_EnumDomainAliases
1141 ********************************************************************/
1142
1143 NTSTATUS _samr_EnumDomainAliases(pipes_struct *p,
1144 struct samr_EnumDomainAliases *r)
1145 {
1146 NTSTATUS status;
1147 struct samr_info *info;
1148 struct samr_displayentry *aliases;
1149 uint32 num_aliases = 0;
1150 struct samr_SamArray *samr_array = NULL;
1151 struct samr_SamEntry *samr_entries = NULL;
1152
1153 /* find the policy handle. open a policy on it. */
1154 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1155 return NT_STATUS_INVALID_HANDLE;
1156
1157 status = access_check_samr_function(info->acc_granted,
1158 SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
1159 "_samr_EnumDomainAliases");
1160 if (!NT_STATUS_IS_OK(status)) {
1161 return status;
1162 }
1163
1164 DEBUG(5,("_samr_EnumDomainAliases: sid %s\n",
1165 sid_string_dbg(&info->sid)));
1166
1167 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1168 if (!samr_array) {
1169 return NT_STATUS_NO_MEMORY;
1170 }
1171
1172 become_root();
1173
1174 if (info->disp_info->aliases == NULL) {
1175 info->disp_info->aliases = pdb_search_aliases(&info->sid);
1176 if (info->disp_info->aliases == NULL) {
1177 unbecome_root();
1178 return NT_STATUS_ACCESS_DENIED;
1179 }
1180 }
1181
1182 num_aliases = pdb_search_entries(info->disp_info->aliases,
1183 *r->in.resume_handle,
1184 MAX_SAM_ENTRIES, &aliases);
1185 unbecome_root();
1186
1187 /* Ensure we cache this enumeration. */
1188 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1189
1190 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1191 num_aliases, aliases);
1192
1193 DEBUG(5,("_samr_EnumDomainAliases: %d\n", __LINE__));
1194
1195 samr_array->count = num_aliases;
1196 samr_array->entries = samr_entries;
1197
1198 *r->out.sam = samr_array;
1199 *r->out.num_entries = num_aliases;
1200 *r->out.resume_handle = num_aliases + *r->in.resume_handle;
1201
1202 return status;
1203 }
1204
1205 /*******************************************************************
1206 inits a samr_DispInfoGeneral structure.
1207 ********************************************************************/
1208
1209 static NTSTATUS init_samr_dispinfo_1(TALLOC_CTX *ctx,
1210 struct samr_DispInfoGeneral *r,
1211 uint32_t num_entries,
1212 uint32_t start_idx,
1213 struct samr_displayentry *entries)
1214 {
1215 uint32 i;
1216
1217 DEBUG(10, ("init_samr_dispinfo_1: num_entries: %d\n", num_entries));
1218
1219 if (num_entries == 0) {
1220 return NT_STATUS_OK;
1221 }
1222
1223 r->count = num_entries;
1224
1225 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryGeneral, num_entries);
1226 if (!r->entries) {
1227 return NT_STATUS_NO_MEMORY;
1228 }
1229
1230 for (i = 0; i < num_entries ; i++) {
1231
1232 init_lsa_String(&r->entries[i].account_name,
1233 entries[i].account_name);
1234
1235 init_lsa_String(&r->entries[i].description,
1236 entries[i].description);
1237
1238 init_lsa_String(&r->entries[i].full_name,
1239 entries[i].fullname);
1240
1241 r->entries[i].rid = entries[i].rid;
1242 r->entries[i].acct_flags = entries[i].acct_flags;
1243 r->entries[i].idx = start_idx+i+1;
1244 }
1245
1246 return NT_STATUS_OK;
1247 }
1248
1249 /*******************************************************************
1250 inits a samr_DispInfoFull structure.
1251 ********************************************************************/
1252
1253 static NTSTATUS init_samr_dispinfo_2(TALLOC_CTX *ctx,
1254 struct samr_DispInfoFull *r,
1255 uint32_t num_entries,
1256 uint32_t start_idx,
1257 struct samr_displayentry *entries)
1258 {
1259 uint32_t i;
1260
1261 DEBUG(10, ("init_samr_dispinfo_2: num_entries: %d\n", num_entries));
1262
1263 if (num_entries == 0) {
1264 return NT_STATUS_OK;
1265 }
1266
1267 r->count = num_entries;
1268
1269 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFull, num_entries);
1270 if (!r->entries) {
1271 return NT_STATUS_NO_MEMORY;
1272 }
1273
1274 for (i = 0; i < num_entries ; i++) {
1275
1276 init_lsa_String(&r->entries[i].account_name,
1277 entries[i].account_name);
1278
1279 init_lsa_String(&r->entries[i].description,
1280 entries[i].description);
1281
1282 r->entries[i].rid = entries[i].rid;
1283 r->entries[i].acct_flags = entries[i].acct_flags;
1284 r->entries[i].idx = start_idx+i+1;
1285 }
1286
1287 return NT_STATUS_OK;
1288 }
1289
1290 /*******************************************************************
1291 inits a samr_DispInfoFullGroups structure.
1292 ********************************************************************/
1293
1294 static NTSTATUS init_samr_dispinfo_3(TALLOC_CTX *ctx,
1295 struct samr_DispInfoFullGroups *r,
1296 uint32_t num_entries,
1297 uint32_t start_idx,
1298 struct samr_displayentry *entries)
1299 {
1300 uint32_t i;
1301
1302 DEBUG(5, ("init_samr_dispinfo_3: num_entries: %d\n", num_entries));
1303
1304 if (num_entries == 0) {
1305 return NT_STATUS_OK;
1306 }
1307
1308 r->count = num_entries;
1309
1310 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFullGroup, num_entries);
1311 if (!r->entries) {
1312 return NT_STATUS_NO_MEMORY;
1313 }
1314
1315 for (i = 0; i < num_entries ; i++) {
1316
1317 init_lsa_String(&r->entries[i].account_name,
1318 entries[i].account_name);
1319
1320 init_lsa_String(&r->entries[i].description,
1321 entries[i].description);
1322
1323 r->entries[i].rid = entries[i].rid;
1324 r->entries[i].acct_flags = entries[i].acct_flags;
1325 r->entries[i].idx = start_idx+i+1;
1326 }
1327
1328 return NT_STATUS_OK;
1329 }
1330
1331 /*******************************************************************
1332 inits a samr_DispInfoAscii structure.
1333 ********************************************************************/
1334
1335 static NTSTATUS init_samr_dispinfo_4(TALLOC_CTX *ctx,
1336 struct samr_DispInfoAscii *r,
1337 uint32_t num_entries,
1338 uint32_t start_idx,
1339 struct samr_displayentry *entries)
1340 {
1341 uint32_t i;
1342
1343 DEBUG(5, ("init_samr_dispinfo_4: num_entries: %d\n", num_entries));
1344
1345 if (num_entries == 0) {
1346 return NT_STATUS_OK;
1347 }
1348
1349 r->count = num_entries;
1350
1351 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1352 if (!r->entries) {
1353 return NT_STATUS_NO_MEMORY;
1354 }
1355
1356 for (i = 0; i < num_entries ; i++) {
1357
1358 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1359 entries[i].account_name);
1360
1361 r->entries[i].idx = start_idx+i+1;
1362 }
1363
1364 return NT_STATUS_OK;
1365 }
1366
1367 /*******************************************************************
1368 inits a samr_DispInfoAscii structure.
1369 ********************************************************************/
1370
1371 static NTSTATUS init_samr_dispinfo_5(TALLOC_CTX *ctx,
1372 struct samr_DispInfoAscii *r,
1373 uint32_t num_entries,
1374 uint32_t start_idx,
1375 struct samr_displayentry *entries)
1376 {
1377 uint32_t i;
1378
1379 DEBUG(5, ("init_samr_dispinfo_5: num_entries: %d\n", num_entries));
1380
1381 if (num_entries == 0) {
1382 return NT_STATUS_OK;
1383 }
1384
1385 r->count = num_entries;
1386
1387 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1388 if (!r->entries) {
1389 return NT_STATUS_NO_MEMORY;
1390 }
1391
1392 for (i = 0; i < num_entries ; i++) {
1393
1394 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1395 entries[i].account_name);
1396
1397 r->entries[i].idx = start_idx+i+1;
1398 }
1399
1400 return NT_STATUS_OK;
1401 }
1402
1403 /*******************************************************************
1404 _samr_QueryDisplayInfo
1405 ********************************************************************/
1406
1407 NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
1408 struct samr_QueryDisplayInfo *r)
1409 {
1410 NTSTATUS status;
1411 struct samr_info *info = NULL;
1412 uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
1413
1414 uint32 max_entries = r->in.max_entries;
1415 uint32 enum_context = r->in.start_idx;
1416 uint32 max_size = r->in.buf_size;
1417
1418 union samr_DispInfo *disp_info = r->out.info;
1419
1420 uint32 temp_size=0, total_data_size=0;
1421 NTSTATUS disp_ret = NT_STATUS_UNSUCCESSFUL;
1422 uint32 num_account = 0;
1423 enum remote_arch_types ra_type = get_remote_arch();
1424 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
1425 struct samr_displayentry *entries = NULL;
1426
1427 DEBUG(5,("_samr_QueryDisplayInfo: %d\n", __LINE__));
1428
1429 /* find the policy handle. open a policy on it. */
1430 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1431 return NT_STATUS_INVALID_HANDLE;
1432
1433 /*
1434 * calculate how many entries we will return.
1435 * based on
1436 * - the number of entries the client asked
1437 * - our limit on that
1438 * - the starting point (enumeration context)
1439 * - the buffer size the client will accept
1440 */
1441
1442 /*
1443 * We are a lot more like W2K. Instead of reading the SAM
1444 * each time to find the records we need to send back,
1445 * we read it once and link that copy to the sam handle.
1446 * For large user list (over the MAX_SAM_ENTRIES)
1447 * it's a definitive win.
1448 * second point to notice: between enumerations
1449 * our sam is now the same as it's a snapshoot.
1450 * third point: got rid of the static SAM_USER_21 struct
1451 * no more intermediate.
1452 * con: it uses much more memory, as a full copy is stored
1453 * in memory.
1454 *
1455 * If you want to change it, think twice and think
1456 * of the second point , that's really important.
1457 *
1458 * JFM, 12/20/2001
1459 */
1460
1461 if ((r->in.level < 1) || (r->in.level > 5)) {
1462 DEBUG(0,("_samr_QueryDisplayInfo: Unknown info level (%u)\n",
1463 (unsigned int)r->in.level ));
1464 return NT_STATUS_INVALID_INFO_CLASS;
1465 }
1466
1467 /* first limit the number of entries we will return */
1468 if(max_entries > max_sam_entries) {
1469 DEBUG(5, ("_samr_QueryDisplayInfo: client requested %d "
1470 "entries, limiting to %d\n", max_entries,
1471 max_sam_entries));
1472 max_entries = max_sam_entries;
1473 }
1474
1475 /* calculate the size and limit on the number of entries we will
1476 * return */
1477
1478 temp_size=max_entries*struct_size;
1479
1480 if (temp_size>max_size) {
1481 max_entries=MIN((max_size/struct_size),max_entries);;
1482 DEBUG(5, ("_samr_QueryDisplayInfo: buffer size limits to "
1483 "only %d entries\n", max_entries));
1484 }
1485
1486 become_root();
1487
1488 /* THe following done as ROOT. Don't return without unbecome_root(). */
1489
1490 switch (r->in.level) {
1491 case 0x1:
1492 case 0x4:
1493 if (info->disp_info->users == NULL) {
1494 info->disp_info->users = pdb_search_users(ACB_NORMAL);
1495 if (info->disp_info->users == NULL) {
1496 unbecome_root();
1497 return NT_STATUS_ACCESS_DENIED;
1498 }
1499 DEBUG(10,("_samr_QueryDisplayInfo: starting user enumeration at index %u\n",
1500 (unsigned int)enum_context ));
1501 } else {
1502 DEBUG(10,("_samr_QueryDisplayInfo: using cached user enumeration at index %u\n",
1503 (unsigned int)enum_context ));
1504 }
1505
1506 num_account = pdb_search_entries(info->disp_info->users,
1507 enum_context, max_entries,
1508 &entries);
1509 break;
1510 case 0x2:
1511 if (info->disp_info->machines == NULL) {
1512 info->disp_info->machines =
1513 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
1514 if (info->disp_info->machines == NULL) {
1515 unbecome_root();
1516 return NT_STATUS_ACCESS_DENIED;
1517 }
1518 DEBUG(10,("_samr_QueryDisplayInfo: starting machine enumeration at index %u\n",
1519 (unsigned int)enum_context ));
1520 } else {
1521 DEBUG(10,("_samr_QueryDisplayInfo: using cached machine enumeration at index %u\n",
1522 (unsigned int)enum_context ));
1523 }
1524
1525 num_account = pdb_search_entries(info->disp_info->machines,
1526 enum_context, max_entries,
1527 &entries);
1528 break;
1529 case 0x3:
1530 case 0x5:
1531 if (info->disp_info->groups == NULL) {
1532 info->disp_info->groups = pdb_search_groups();
1533 if (info->disp_info->groups == NULL) {
1534 unbecome_root();
1535 return NT_STATUS_ACCESS_DENIED;
1536 }
1537 DEBUG(10,("_samr_QueryDisplayInfo: starting group enumeration at index %u\n",
1538 (unsigned int)enum_context ));
1539 } else {
1540 DEBUG(10,("_samr_QueryDisplayInfo: using cached group enumeration at index %u\n",
1541 (unsigned int)enum_context ));
1542 }
1543
1544 num_account = pdb_search_entries(info->disp_info->groups,
1545 enum_context, max_entries,
1546 &entries);
1547 break;
1548 default:
1549 unbecome_root();
1550 smb_panic("info class changed");
1551 break;
1552 }
1553 unbecome_root();
1554
1555
1556 /* Now create reply structure */
1557 switch (r->in.level) {
1558 case 0x1:
1559 disp_ret = init_samr_dispinfo_1(p->mem_ctx, &disp_info->info1,
1560 num_account, enum_context,
1561 entries);
1562 break;
1563 case 0x2:
1564 disp_ret = init_samr_dispinfo_2(p->mem_ctx, &disp_info->info2,
1565 num_account, enum_context,
1566 entries);
1567 break;
1568 case 0x3:
1569 disp_ret = init_samr_dispinfo_3(p->mem_ctx, &disp_info->info3,
1570 num_account, enum_context,
1571 entries);
1572 break;
1573 case 0x4:
1574 disp_ret = init_samr_dispinfo_4(p->mem_ctx, &disp_info->info4,
1575 num_account, enum_context,
1576 entries);
1577 break;
1578 case 0x5:
1579 disp_ret = init_samr_dispinfo_5(p->mem_ctx, &disp_info->info5,
1580 num_account, enum_context,
1581 entries);
1582 break;
1583 default:
1584 smb_panic("info class changed");
1585 break;
1586 }
1587
1588 if (!NT_STATUS_IS_OK(disp_ret))
1589 return disp_ret;
1590
1591 /* calculate the total size */
1592 total_data_size=num_account*struct_size;
1593
1594 if (num_account) {
1595 status = STATUS_MORE_ENTRIES;
1596 } else {
1597 status = NT_STATUS_OK;
1598 }
1599
1600 /* Ensure we cache this enumeration. */
1601 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1602
1603 DEBUG(5, ("_samr_QueryDisplayInfo: %d\n", __LINE__));
1604
1605 *r->out.total_size = total_data_size;
1606 *r->out.returned_size = temp_size;
1607
1608 return status;
1609 }
1610
1611 /****************************************************************
1612 _samr_QueryDisplayInfo2
1613 ****************************************************************/
1614
1615 NTSTATUS _samr_QueryDisplayInfo2(pipes_struct *p,
1616 struct samr_QueryDisplayInfo2 *r)
1617 {
1618 struct samr_QueryDisplayInfo q;
1619
1620 q.in.domain_handle = r->in.domain_handle;
1621 q.in.level = r->in.level;
1622 q.in.start_idx = r->in.start_idx;
1623 q.in.max_entries = r->in.max_entries;
1624 q.in.buf_size = r->in.buf_size;
1625
1626 q.out.total_size = r->out.total_size;
1627 q.out.returned_size = r->out.returned_size;
1628 q.out.info = r->out.info;
1629
1630 return _samr_QueryDisplayInfo(p, &q);
1631 }
1632
1633 /****************************************************************
1634 _samr_QueryDisplayInfo3
1635 ****************************************************************/
1636
1637 NTSTATUS _samr_QueryDisplayInfo3(pipes_struct *p,
1638 struct samr_QueryDisplayInfo3 *r)
1639 {
1640 struct samr_QueryDisplayInfo q;
1641
1642 q.in.domain_handle = r->in.domain_handle;
1643 q.in.level = r->in.level;
1644 q.in.start_idx = r->in.start_idx;
1645 q.in.max_entries = r->in.max_entries;
1646 q.in.buf_size = r->in.buf_size;
1647
1648 q.out.total_size = r->out.total_size;
1649 q.out.returned_size = r->out.returned_size;
1650 q.out.info = r->out.info;
1651
1652 return _samr_QueryDisplayInfo(p, &q);
1653 }
1654
1655 /*******************************************************************
1656 _samr_QueryAliasInfo
1657 ********************************************************************/
1658
1659 NTSTATUS _samr_QueryAliasInfo(pipes_struct *p,
1660 struct samr_QueryAliasInfo *r)
1661 {
1662 DOM_SID sid;
1663 struct acct_info info;
1664 uint32 acc_granted;
1665 NTSTATUS status;
1666 union samr_AliasInfo *alias_info = NULL;
1667 const char *alias_name = NULL;
1668 const char *alias_description = NULL;
1669
1670 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1671
1672 alias_info = TALLOC_ZERO_P(p->mem_ctx, union samr_AliasInfo);
1673 if (!alias_info) {
1674 return NT_STATUS_NO_MEMORY;
1675 }
1676
1677 /* find the policy handle. open a policy on it. */
1678 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &sid, &acc_granted, NULL))
1679 return NT_STATUS_INVALID_HANDLE;
1680
1681 status = access_check_samr_function(acc_granted,
1682 SA_RIGHT_ALIAS_LOOKUP_INFO,
1683 "_samr_QueryAliasInfo");
1684 if (!NT_STATUS_IS_OK(status)) {
1685 return status;
1686 }
1687
1688 become_root();
1689 status = pdb_get_aliasinfo(&sid, &info);
1690 unbecome_root();
1691
1692 if ( !NT_STATUS_IS_OK(status))
1693 return status;
1694
1695 /* FIXME: info contains fstrings */
1696 alias_name = talloc_strdup(r, info.acct_name);
1697 alias_description = talloc_strdup(r, info.acct_desc);
1698
1699 switch (r->in.level) {
1700 case ALIASINFOALL:
1701 init_samr_alias_info1(&alias_info->all,
1702 alias_name,
1703 1,
1704 alias_description);
1705 break;
1706 case ALIASINFODESCRIPTION:
1707 init_samr_alias_info3(&alias_info->description,
1708 alias_description);
1709 break;
1710 default:
1711 return NT_STATUS_INVALID_INFO_CLASS;
1712 }
1713
1714 *r->out.info = alias_info;
1715
1716 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1717
1718 return NT_STATUS_OK;
1719 }
1720
1721 #if 0
1722 /*******************************************************************
1723 samr_reply_lookup_ids
1724 ********************************************************************/
1725
1726 uint32 _samr_lookup_ids(pipes_struct *p, SAMR_Q_LOOKUP_IDS *q_u, SAMR_R_LOOKUP_IDS *r_u)
1727 {
1728 uint32 rid[MAX_SAM_ENTRIES];
1729 int num_rids = q_u->num_sids1;
1730
1731 r_u->status = NT_STATUS_OK;
1732
1733 DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1734
1735 if (num_rids > MAX_SAM_ENTRIES) {
1736 num_rids = MAX_SAM_ENTRIES;
1737 DEBUG(5,("_samr_lookup_ids: truncating entries to %d\n", num_rids));
1738 }
1739
1740 #if 0
1741 int i;
1742 SMB_ASSERT_ARRAY(q_u->uni_user_name, num_rids);
1743
1744 for (i = 0; i < num_rids && status == 0; i++)
1745 {
1746 struct sam_passwd *sam_pass;
1747 fstring user_name;
1748
1749
1750 fstrcpy(user_name, unistrn2(q_u->uni_user_name[i].buffer,
1751 q_u->uni_user_name[i].uni_str_len));
1752
1753 /* find the user account */
1754 become_root();
1755 sam_pass = get_smb21pwd_entry(user_name, 0);
1756 unbecome_root();
1757
1758 if (sam_pass == NULL)
1759 {
1760 status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
1761 rid[i] = 0;
1762 }
1763 else
1764 {
1765 rid[i] = sam_pass->user_rid;
1766 }
1767 }
1768 #endif
1769
1770 num_rids = 1;
1771 rid[0] = BUILTIN_ALIAS_RID_USERS;
1772
1773 init_samr_r_lookup_ids(&r_u, num_rids, rid, NT_STATUS_OK);
1774
1775 DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
1776
1777 return r_u->status;
1778 }
1779 #endif
1780
1781 /*******************************************************************
1782 _samr_LookupNames
1783 ********************************************************************/
1784
1785 NTSTATUS _samr_LookupNames(pipes_struct *p,
1786 struct samr_LookupNames *r)
1787 {
1788 NTSTATUS status;
1789 uint32 *rid;
1790 enum lsa_SidType *type;
1791 int i;
1792 int num_rids = r->in.num_names;
1793 DOM_SID pol_sid;
1794 uint32 acc_granted;
1795 struct samr_Ids rids, types;
1796
1797 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1798
1799 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL)) {
1800 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1801 }
1802
1803 status = access_check_samr_function(acc_granted,
1804 0, /* Don't know the acc_bits yet */
1805 "_samr_LookupNames");
1806 if (!NT_STATUS_IS_OK(status)) {
1807 return status;
1808 }
1809
1810 if (num_rids > MAX_SAM_ENTRIES) {
1811 num_rids = MAX_SAM_ENTRIES;
1812 DEBUG(5,("_samr_LookupNames: truncating entries to %d\n", num_rids));
1813 }
1814
1815 rid = talloc_array(p->mem_ctx, uint32, num_rids);
1816 NT_STATUS_HAVE_NO_MEMORY(rid);
1817
1818 type = talloc_array(p->mem_ctx, enum lsa_SidType, num_rids);
1819 NT_STATUS_HAVE_NO_MEMORY(type);
1820
1821 DEBUG(5,("_samr_LookupNames: looking name on SID %s\n",
1822 sid_string_dbg(&pol_sid)));
1823
1824 for (i = 0; i < num_rids; i++) {
1825
1826 status = NT_STATUS_NONE_MAPPED;
1827 type[i] = SID_NAME_UNKNOWN;
1828
1829 rid[i] = 0xffffffff;
1830
1831 if (sid_check_is_builtin(&pol_sid)) {
1832 if (lookup_builtin_name(r->in.names[i].string,
1833 &rid[i]))
1834 {
1835 type[i] = SID_NAME_ALIAS;
1836 }
1837 } else {
1838 lookup_global_sam_name(r->in.names[i].string, 0,
1839 &rid[i], &type[i]);
1840 }
1841
1842 if (type[i] != SID_NAME_UNKNOWN) {
1843 status = NT_STATUS_OK;
1844 }
1845 }
1846
1847 rids.count = num_rids;
1848 rids.ids = rid;
1849
1850 types.count = num_rids;
1851 types.ids = type;
1852
1853 *r->out.rids = rids;
1854 *r->out.types = types;
1855
1856 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1857
1858 return status;
1859 }
1860
1861 /*******************************************************************
1862 _samr_ChangePasswordUser2
1863 ********************************************************************/
1864
1865 NTSTATUS _samr_ChangePasswordUser2(pipes_struct *p,
1866 struct samr_ChangePasswordUser2 *r)
1867 {
1868 NTSTATUS status;
1869 fstring user_name;
1870 fstring wks;
1871
1872 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1873
1874 fstrcpy(user_name, r->in.account->string);
1875 fstrcpy(wks, r->in.server->string);
1876
1877 DEBUG(5,("_samr_ChangePasswordUser2: user: %s wks: %s\n", user_name, wks));
1878
1879 /*
1880 * Pass the user through the NT -> unix user mapping
1881 * function.
1882 */
1883
1884 (void)map_username(user_name);
1885
1886 /*
1887 * UNIX username case mangling not required, pass_oem_change
1888 * is case insensitive.
1889 */
1890
1891 status = pass_oem_change(user_name,
1892 r->in.lm_password->data,
1893 r->in.lm_verifier->hash,
1894 r->in.nt_password->data,
1895 r->in.nt_verifier->hash,
1896 NULL);
1897
1898 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1899
1900 return status;
1901 }
1902
1903 /*******************************************************************
1904 _samr_ChangePasswordUser3
1905 ********************************************************************/
1906
1907 NTSTATUS _samr_ChangePasswordUser3(pipes_struct *p,
1908 struct samr_ChangePasswordUser3 *r)
1909 {
1910 NTSTATUS status;
1911 fstring user_name;
1912 const char *wks = NULL;
1913 uint32 reject_reason;
1914 struct samr_DomInfo1 *dominfo = NULL;
1915 struct samr_ChangeReject *reject = NULL;
1916
1917 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
1918
1919 fstrcpy(user_name, r->in.account->string);
1920 if (r->in.server && r->in.server->string) {
1921 wks = r->in.server->string;
1922 }
1923
1924 DEBUG(5,("_samr_ChangePasswordUser3: user: %s wks: %s\n", user_name, wks));
1925
1926 /*
1927 * Pass the user through the NT -> unix user mapping
1928 * function.
1929 */
1930
1931 (void)map_username(user_name);
1932
1933 /*
1934 * UNIX username case mangling not required, pass_oem_change
1935 * is case insensitive.
1936 */
1937
1938 status = pass_oem_change(user_name,
1939 r->in.lm_password->data,
1940 r->in.lm_verifier->hash,
1941 r->in.nt_password->data,
1942 r->in.nt_verifier->hash,
1943 &reject_reason);
1944
1945 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) ||
1946 NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_RESTRICTION)) {
1947
1948 uint32 min_pass_len,pass_hist,password_properties;
1949 time_t u_expire, u_min_age;
1950 NTTIME nt_expire, nt_min_age;
1951 uint32 account_policy_temp;
1952
1953 dominfo = TALLOC_ZERO_P(p->mem_ctx, struct samr_DomInfo1);
1954 if (!dominfo) {
1955 return NT_STATUS_NO_MEMORY;
1956 }
1957
1958 reject = TALLOC_ZERO_P(p->mem_ctx, struct samr_ChangeReject);
1959 if (!reject) {
1960 return NT_STATUS_NO_MEMORY;
1961 }
1962
1963 become_root();
1964
1965 /* AS ROOT !!! */
1966
1967 pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp);
1968 min_pass_len = account_policy_temp;
1969
1970 pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
1971 pass_hist = account_policy_temp;
1972
1973 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
1974 password_properties = account_policy_temp;
1975
1976 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
1977 u_expire = account_policy_temp;
1978
1979 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
1980 u_min_age = account_policy_temp;
1981
1982 /* !AS ROOT */
1983
1984 unbecome_root();
1985
1986 unix_to_nt_time_abs(&nt_expire, u_expire);
1987 unix_to_nt_time_abs(&nt_min_age, u_min_age);
1988
1989 if (lp_check_password_script() && *lp_check_password_script()) {
1990 password_properties |= DOMAIN_PASSWORD_COMPLEX;
1991 }
1992
1993 init_samr_DomInfo1(dominfo,
1994 min_pass_len,
1995 pass_hist,
1996 password_properties,
1997 u_expire,
1998 u_min_age);
1999
2000 reject->reason = reject_reason;
2001
2002 *r->out.dominfo = dominfo;
2003 *r->out.reject = reject;
2004 }
2005
2006 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
2007
2008 return status;
2009 }
2010
2011 /*******************************************************************
2012 makes a SAMR_R_LOOKUP_RIDS structure.
2013 ********************************************************************/
2014
2015 static bool make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
2016 const char **names,
2017 struct lsa_String **lsa_name_array_p)
2018 {
2019 struct lsa_String *lsa_name_array = NULL;
2020 uint32_t i;
2021
2022 *lsa_name_array_p = NULL;
2023
2024 if (num_names != 0) {
2025 lsa_name_array = TALLOC_ZERO_ARRAY(ctx, struct lsa_String, num_names);
2026 if (!lsa_name_array) {
2027 return false;
2028 }
2029 }
2030
2031 for (i = 0; i < num_names; i++) {
2032 DEBUG(10, ("names[%d]:%s\n", i, names[i] && *names[i] ? names[i] : ""));
2033 init_lsa_String(&lsa_name_array[i], names[i]);
2034 }
2035
2036 *lsa_name_array_p = lsa_name_array;
2037
2038 return true;
2039 }
2040
2041 /*******************************************************************
2042 _samr_LookupRids
2043 ********************************************************************/
2044
2045 NTSTATUS _samr_LookupRids(pipes_struct *p,
2046 struct samr_LookupRids *r)
2047 {
2048 NTSTATUS status;
2049 const char **names;
2050 enum lsa_SidType *attrs = NULL;
2051 uint32 *wire_attrs = NULL;
2052 DOM_SID pol_sid;
2053 int num_rids = (int)r->in.num_rids;
2054 uint32 acc_granted;
2055 int i;
2056 struct lsa_Strings names_array;
2057 struct samr_Ids types_array;
2058 struct lsa_String *lsa_names = NULL;
2059
2060 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2061
2062 /* find the policy handle. open a policy on it. */
2063 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL))
2064 return NT_STATUS_INVALID_HANDLE;
2065
2066 if (num_rids > 1000) {
2067 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
2068 "to samba4 idl this is not possible\n", num_rids));
2069 return NT_STATUS_UNSUCCESSFUL;
2070 }
2071
2072 if (num_rids) {
2073 names = TALLOC_ZERO_ARRAY(p->mem_ctx, const char *, num_rids);
2074 attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, enum lsa_SidType, num_rids);
2075 wire_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids);
2076
2077 if ((names == NULL) || (attrs == NULL) || (wire_attrs==NULL))
2078 return NT_STATUS_NO_MEMORY;
2079 } else {
2080 names = NULL;
2081 attrs = NULL;
2082 wire_attrs = NULL;
2083 }
2084
2085 become_root(); /* lookup_sid can require root privs */
2086 status = pdb_lookup_rids(&pol_sid, num_rids, r->in.rids,
2087 names, attrs);
2088 unbecome_root();
2089
2090 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) && (num_rids == 0)) {
2091 status = NT_STATUS_OK;
2092 }
2093
2094 if (!make_samr_lookup_rids(p->mem_ctx, num_rids, names,
2095 &lsa_names)) {
2096 return NT_STATUS_NO_MEMORY;
2097 }
2098
2099 /* Convert from enum lsa_SidType to uint32 for wire format. */
2100 for (i = 0; i < num_rids; i++) {
2101 wire_attrs[i] = (uint32)attrs[i];
2102 }
2103
2104 names_array.count = num_rids;
2105 names_array.names = lsa_names;
2106
2107 types_array.count = num_rids;
2108 types_array.ids = wire_attrs;
2109
2110 *r->out.names = names_array;
2111 *r->out.types = types_array;
2112
2113 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2114
2115 return status;
2116 }
2117
2118 /*******************************************************************
2119 _samr_OpenUser
2120 ********************************************************************/
2121
2122 NTSTATUS _samr_OpenUser(pipes_struct *p,
2123 struct samr_OpenUser *r)
2124 {
2125 struct samu *sampass=NULL;
2126 DOM_SID sid;
2127 POLICY_HND domain_pol = *r->in.domain_handle;
2128 POLICY_HND *user_pol = r->out.user_handle;
2129 struct samr_info *info = NULL;
2130 SEC_DESC *psd = NULL;
2131 uint32 acc_granted;
2132 uint32 des_access = r->in.access_mask;
2133 size_t sd_size;
2134 bool ret;
2135 NTSTATUS nt_status;
2136 SE_PRIV se_rights;
2137
2138 /* find the domain policy handle and get domain SID / access bits in the domain policy. */
2139
2140 if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted, NULL) )
2141 return NT_STATUS_INVALID_HANDLE;
2142
2143 nt_status = access_check_samr_function(acc_granted,
2144 SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
2145 "_samr_OpenUser" );
2146
2147 if ( !NT_STATUS_IS_OK(nt_status) )
2148 return nt_status;
2149
2150 if ( !(sampass = samu_new( p->mem_ctx )) ) {
2151 return NT_STATUS_NO_MEMORY;
2152 }
2153
2154 /* append the user's RID to it */
2155
2156 if (!sid_append_rid(&sid, r->in.rid))
2157 return NT_STATUS_NO_SUCH_USER;
2158
2159 /* check if access can be granted as requested by client. */
2160
2161 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
2162 se_map_generic(&des_access, &usr_generic_mapping);
2163
2164 se_priv_copy( &se_rights, &se_machine_account );
2165 se_priv_add( &se_rights, &se_add_users );
2166
2167 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2168 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
2169 &acc_granted, "_samr_OpenUser");
2170
2171 if ( !NT_STATUS_IS_OK(nt_status) )
2172 return nt_status;
2173
2174 become_root();
2175 ret=pdb_getsampwsid(sampass, &sid);
2176 unbecome_root();
2177
2178 /* check that the SID exists in our domain. */
2179 if (ret == False) {
2180 return NT_STATUS_NO_SUCH_USER;
2181 }
2182
2183 TALLOC_FREE(sampass);
2184
2185 /* associate the user's SID and access bits with the new handle. */
2186 if ((info = get_samr_info_by_sid(&sid)) == NULL)
2187 return NT_STATUS_NO_MEMORY;
2188 info->acc_granted = acc_granted;
2189
2190 /* get a (unique) handle. open a policy on it. */
2191 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info))
2192 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2193
2194 return NT_STATUS_OK;
2195 }
2196
2197 /*************************************************************************
2198 *************************************************************************/
2199
2200 static NTSTATUS init_samr_parameters_string(TALLOC_CTX *mem_ctx,
2201 DATA_BLOB *blob,
2202 struct lsa_BinaryString **_r)
2203 {
2204 struct lsa_BinaryString *r;
2205
2206 if (!blob || !_r) {
2207 return NT_STATUS_INVALID_PARAMETER;
2208 }
2209
2210 r = TALLOC_ZERO_P(mem_ctx, struct lsa_BinaryString);
2211 if (!r) {
2212 return NT_STATUS_NO_MEMORY;
2213 }
2214
2215 r->array = TALLOC_ZERO_ARRAY(mem_ctx, uint16_t, blob->length/2);
2216 if (!r->array) {
2217 return NT_STATUS_NO_MEMORY;
2218 }
2219 memcpy(r->array, blob->data, blob->length);
2220 r->size = blob->length;
2221 r->length = blob->length;
2222
2223 if (!r->array) {
2224 return NT_STATUS_NO_MEMORY;
2225 }
2226
2227 *_r = r;
2228
2229 return NT_STATUS_OK;
2230 }
2231
2232 /*************************************************************************
2233 get_user_info_7. Safe. Only gives out account_name.
2234 *************************************************************************/
2235
2236 static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx,
2237 struct samr_UserInfo7 *r,
2238 DOM_SID *user_sid)
2239 {
2240 struct samu *smbpass=NULL;
2241 bool ret;
2242 const char *account_name = NULL;
2243
2244 ZERO_STRUCTP(r);
2245
2246 if ( !(smbpass = samu_new( mem_ctx )) ) {
2247 return NT_STATUS_NO_MEMORY;
2248 }
2249
2250 become_root();
2251 ret = pdb_getsampwsid(smbpass, user_sid);
2252 unbecome_root();
2253
2254 if ( !ret ) {
2255 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2256 return NT_STATUS_NO_SUCH_USER;
2257 }
2258
2259 account_name = talloc_strdup(mem_ctx, pdb_get_username(smbpass));
2260 if (!account_name) {
2261 TALLOC_FREE(smbpass);
2262 return NT_STATUS_NO_MEMORY;
2263 }
2264 TALLOC_FREE(smbpass);
2265
2266 DEBUG(3,("User:[%s]\n", account_name));
2267
2268 init_samr_user_info7(r, account_name);
2269
2270 return NT_STATUS_OK;
2271 }
2272
2273 /*************************************************************************
2274 get_user_info_9. Only gives out primary group SID.
2275 *************************************************************************/
2276
2277 static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx,
2278 struct samr_UserInfo9 *r,
2279 DOM_SID *user_sid)
2280 {
2281 struct samu *smbpass=NULL;
2282 bool ret;
2283
2284 ZERO_STRUCTP(r);
2285
2286 if ( !(smbpass = samu_new( mem_ctx )) ) {
2287 return NT_STATUS_NO_MEMORY;
2288 }
2289
2290 become_root();
2291 ret = pdb_getsampwsid(smbpass, user_sid);
2292 unbecome_root();
2293
2294 if (ret==False) {
2295 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2296 TALLOC_FREE(smbpass);
2297 return NT_STATUS_NO_SUCH_USER;
2298 }
2299
2300 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
2301
2302 init_samr_user_info9(r, pdb_get_group_rid(smbpass));
2303
2304 TALLOC_FREE(smbpass);
2305
2306 return NT_STATUS_OK;
2307 }
2308
2309 /*************************************************************************
2310 get_user_info_16. Safe. Only gives out acb bits.
2311 *************************************************************************/
2312
2313 static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx,
2314 struct samr_UserInfo16 *r,
2315 DOM_SID *user_sid)
2316 {
2317 struct samu *smbpass=NULL;
2318 bool ret;
2319
2320 ZERO_STRUCTP(r);
2321
2322 if ( !(smbpass = samu_new( mem_ctx )) ) {
2323 return NT_STATUS_NO_MEMORY;
2324 }
2325
2326 become_root();
2327 ret = pdb_getsampwsid(smbpass, user_sid);
2328 unbecome_root();
2329
2330 if (ret==False) {
2331 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2332 TALLOC_FREE(smbpass);
2333 return NT_STATUS_NO_SUCH_USER;
2334 }
2335
2336 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
2337
2338 init_samr_user_info16(r, pdb_get_acct_ctrl(smbpass));
2339
2340 TALLOC_FREE(smbpass);
2341
2342 return NT_STATUS_OK;
2343 }
2344
2345 /*************************************************************************
2346 get_user_info_18. OK - this is the killer as it gives out password info.
2347 Ensure that this is only allowed on an encrypted connection with a root
2348 user. JRA.
2349 *************************************************************************/
2350
2351 static NTSTATUS get_user_info_18(pipes_struct *p,
2352 TALLOC_CTX *mem_ctx,
2353 struct samr_UserInfo18 *r,
2354 DOM_SID *user_sid)
2355 {
2356 struct samu *smbpass=NULL;
2357 bool ret;
2358
2359 ZERO_STRUCTP(r);
2360
2361 if (p->auth.auth_type != PIPE_AUTH_TYPE_NTLMSSP || p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) {
2362 return NT_STATUS_ACCESS_DENIED;
2363 }
2364
2365 if (p->auth.auth_level != PIPE_AUTH_LEVEL_PRIVACY) {
2366 return NT_STATUS_ACCESS_DENIED;
2367 }
2368
2369 /*
2370 * Do *NOT* do become_root()/unbecome_root() here ! JRA.
2371 */
2372
2373 if ( !(smbpass = samu_new( mem_ctx )) ) {
2374 return NT_STATUS_NO_MEMORY;
2375 }
2376
2377 ret = pdb_getsampwsid(smbpass, user_sid);
2378
2379 if (ret == False) {
2380 DEBUG(4, ("User %s not found\n", sid_string_dbg(user_sid)));
2381 TALLOC_FREE(smbpass);
2382 return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
2383 }
2384
2385 DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
2386
2387 if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
2388 TALLOC_FREE(smbpass);
2389 return NT_STATUS_ACCOUNT_DISABLED;
2390 }
2391
2392 init_samr_user_info18(r, pdb_get_lanman_passwd(smbpass),
2393 pdb_get_nt_passwd(smbpass));
2394
2395 TALLOC_FREE(smbpass);
2396
2397 return NT_STATUS_OK;
2398 }
2399
2400 /*************************************************************************
2401 get_user_info_20
2402 *************************************************************************/
2403
2404 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
2405 struct samr_UserInfo20 *r,
2406 DOM_SID *user_sid)
2407 {
2408 struct samu *sampass=NULL;
2409 bool ret;
2410 const char *munged_dial = NULL;
2411 DATA_BLOB blob;
2412 NTSTATUS status;
2413 struct lsa_BinaryString *parameters = NULL;
2414
2415 ZERO_STRUCTP(r);
2416
2417 if ( !(sampass = samu_new( mem_ctx )) ) {
2418 return NT_STATUS_NO_MEMORY;
2419 }
2420
2421 become_root();
2422 ret = pdb_getsampwsid(sampass, user_sid);
2423 unbecome_root();
2424
2425 if (ret == False) {
2426 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2427 TALLOC_FREE(sampass);
2428 return NT_STATUS_NO_SUCH_USER;
2429 }
2430
2431 munged_dial = pdb_get_munged_dial(sampass);
2432
2433 samr_clear_sam_passwd(sampass);
2434
2435 DEBUG(3,("User:[%s] has [%s] (length: %d)\n", pdb_get_username(sampass),
2436 munged_dial, (int)strlen(munged_dial)));
2437
2438 if (munged_dial) {
2439 blob = base64_decode_data_blob(munged_dial);
2440 } else {
2441 blob = data_blob_string_const("");
2442 }
2443
2444 status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
2445 data_blob_free(&blob);
2446 TALLOC_FREE(sampass);
2447 if (!NT_STATUS_IS_OK(status)) {
2448 return status;
2449 }
2450
2451 init_samr_user_info20(r, parameters);
2452
2453 return NT_STATUS_OK;
2454 }
2455
2456
2457 /*************************************************************************
2458 get_user_info_21
2459 *************************************************************************/
2460
2461 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
2462 struct samr_UserInfo21 *r,
2463 DOM_SID *user_sid,
2464 DOM_SID *domain_sid)
2465 {
2466 NTSTATUS status;
2467 struct samu *pw = NULL;
2468 bool ret;
2469 const DOM_SID *sid_user, *sid_group;
2470 uint32_t rid, primary_gid;
2471 NTTIME last_logon, last_logoff, last_password_change,
2472 acct_expiry, allow_password_change, force_password_change;
2473 time_t must_change_time;
2474 uint8_t password_expired;
2475 const char *account_name, *full_name, *home_directory, *home_drive,
2476 *logon_script, *profile_path, *description,
2477 *workstations, *comment;
2478 struct samr_LogonHours logon_hours;
2479 struct lsa_BinaryString *parameters = NULL;
2480 const char *munged_dial = NULL;
2481 DATA_BLOB blob;
2482
2483 ZERO_STRUCTP(r);
2484
2485 if (!(pw = samu_new(mem_ctx))) {
2486 return NT_STATUS_NO_MEMORY;
2487 }
2488
2489 become_root();
2490 ret = pdb_getsampwsid(pw, user_sid);
2491 unbecome_root();
2492
2493 if (ret == False) {
2494 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2495 TALLOC_FREE(pw);
2496 return NT_STATUS_NO_SUCH_USER;
2497 }
2498
2499 samr_clear_sam_passwd(pw);
2500
2501 DEBUG(3,("User:[%s]\n", pdb_get_username(pw)));
2502
2503 sid_user = pdb_get_user_sid(pw);
2504
2505 if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2506 DEBUG(0, ("get_user_info_21: User %s has SID %s, \nwhich conflicts with "
2507 "the domain sid %s. Failing operation.\n",
2508 pdb_get_username(pw), sid_string_dbg(sid_user),
2509 sid_string_dbg(domain_sid)));
2510 TALLOC_FREE(pw);
2511 return NT_STATUS_UNSUCCESSFUL;
2512 }
2513
2514 become_root();
2515 sid_group = pdb_get_group_sid(pw);
2516 unbecome_root();
2517
2518 if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2519 DEBUG(0, ("get_user_info_21: User %s has Primary Group SID %s, \n"
2520 "which conflicts with the domain sid %s. Failing operation.\n",
2521 pdb_get_username(pw), sid_string_dbg(sid_group),
2522 sid_string_dbg(domain_sid)));
2523 TALLOC_FREE(pw);
2524 return NT_STATUS_UNSUCCESSFUL;
2525 }
2526
2527 unix_to_nt_time(&last_logon, pdb_get_logon_time(pw));
2528 unix_to_nt_time(&last_logoff, pdb_get_logoff_time(pw));
2529 unix_to_nt_time(&acct_expiry, pdb_get_kickoff_time(pw));
2530 unix_to_nt_time(&last_password_change, pdb_get_pass_last_set_time(pw));
2531 unix_to_nt_time(&allow_password_change, pdb_get_pass_can_change_time(pw));
2532
2533 must_change_time = pdb_get_pass_must_change_time(pw);
2534 if (must_change_time == get_time_t_max()) {
2535 unix_to_nt_time_abs(&force_password_change, must_change_time);
2536 } else {
2537 unix_to_nt_time(&force_password_change, must_change_time);
2538 }
2539
2540 if (pdb_get_pass_must_change_time(pw) == 0) {
2541 password_expired = PASS_MUST_CHANGE_AT_NEXT_LOGON;
2542 } else {
2543 password_expired = 0;
2544 }
2545
2546 munged_dial = pdb_get_munged_dial(pw);
2547 if (munged_dial) {
2548 blob = base64_decode_data_blob(munged_dial);
2549 } else {
2550 blob = data_blob_string_const("");
2551 }
2552
2553 status = init_samr_parameters_string(mem_ctx, &blob, &parameters);
2554 data_blob_free(&blob);
2555 if (!NT_STATUS_IS_OK(status)) {
2556 TALLOC_FREE(pw);
2557 return status;
2558 }
2559
2560 account_name = talloc_strdup(mem_ctx, pdb_get_username(pw));
2561 full_name = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2562 home_directory = talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2563 home_drive = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2564 logon_script = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2565 profile_path = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2566 description = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2567 workstations = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2568 comment = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2569
2570 logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
2571 #if 0
2572
2573 /*
2574 Look at a user on a real NT4 PDC with usrmgr, press
2575 'ok'. Then you will see that fields_present is set to
2576 0x08f827fa. Look at the user immediately after that again,
2577 and you will see that 0x00fffff is returned. This solves
2578 the problem that you get access denied after having looked
2579 at the user.
2580 -- Volker
2581 */
2582
2583 #endif
2584
2585 init_samr_user_info21(r,
2586 last_logon,
2587 last_logoff,
2588 last_password_change,
2589 acct_expiry,
2590 allow_password_change,
2591 force_password_change,
2592 account_name,
2593 full_name,
2594 home_directory,
2595 home_drive,
2596 logon_script,
2597 profile_path,
2598 description,
2599 workstations,
2600 comment,
2601 parameters,
2602 rid,
2603 primary_gid,
2604 pdb_get_acct_ctrl(pw),
2605 pdb_build_fields_present(pw),
2606 logon_hours,
2607 pdb_get_bad_password_count(pw),
2608 pdb_get_logon_count(pw),
2609 0, /* country_code */
2610 0, /* code_page */
2611 0, /* nt_password_set */
2612 0, /* lm_password_set */
2613 password_expired);
2614 TALLOC_FREE(pw);
2615
2616 return NT_STATUS_OK;
2617 }
2618
2619 /*******************************************************************
2620 _samr_QueryUserInfo
2621 ********************************************************************/
2622
2623 NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
2624 struct samr_QueryUserInfo *r)
2625 {
2626 NTSTATUS status;
2627 union samr_UserInfo *user_info = NULL;
2628 struct samr_info *info = NULL;
2629 DOM_SID domain_sid;
2630 uint32 rid;
2631
2632 /* search for the handle */
2633 if (!find_policy_by_hnd(p, r->in.user_handle, (void **)(void *)&info))
2634 return NT_STATUS_INVALID_HANDLE;
2635
2636 domain_sid = info->sid;
2637
2638 sid_split_rid(&domain_sid, &rid);
2639
2640 if (!sid_check_is_in_our_domain(&info->sid))
2641 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2642
2643 DEBUG(5,("_samr_QueryUserInfo: sid:%s\n",
2644 sid_string_dbg(&info->sid)));
2645
2646 user_info = TALLOC_ZERO_P(p->mem_ctx, union samr_UserInfo);
2647 if (!user_info) {
2648 return NT_STATUS_NO_MEMORY;
2649 }
2650
2651 DEBUG(5,("_samr_QueryUserInfo: user info level: %d\n", r->in.level));
2652
2653 switch (r->in.level) {
2654 case 7:
2655 status = get_user_info_7(p->mem_ctx, &user_info->info7, &info->sid);
2656 if (!NT_STATUS_IS_OK(status)) {
2657 return status;
2658 }
2659 break;
2660 case 9:
2661 status = get_user_info_9(p->mem_ctx, &user_info->info9, &info->sid);
2662 if (!NT_STATUS_IS_OK(status)) {
2663 return status;
2664 }
2665 break;
2666 case 16:
2667 status = get_user_info_16(p->mem_ctx, &user_info->info16, &info->sid);
2668 if (!NT_STATUS_IS_OK(status)) {
2669 return status;
2670 }
2671 break;
2672
2673 case 18:
2674 status = get_user_info_18(p, p->mem_ctx, &user_info->info18, &info->sid);
2675 if (!NT_STATUS_IS_OK(status)) {
2676 return status;
2677 }
2678 break;
2679
2680 case 20:
2681 status = get_user_info_20(p->mem_ctx, &user_info->info20, &info->sid);
2682 if (!NT_STATUS_IS_OK(status)) {
2683 return status;
2684 }
2685 break;
2686
2687 case 21:
2688 status = get_user_info_21(p->mem_ctx, &user_info->info21,
2689 &info->sid, &domain_sid);
2690 if (!NT_STATUS_IS_OK(status)) {
2691 return status;
2692 }
2693 break;
2694
2695 default:
2696 return NT_STATUS_INVALID_INFO_CLASS;
2697 }
2698
2699 *r->out.info = user_info;
2700
2701 DEBUG(5,("_samr_QueryUserInfo: %d\n", __LINE__));
2702
2703 return status;
2704 }
2705
2706 /*******************************************************************
2707 _samr_GetGroupsForUser
2708 ********************************************************************/
2709
2710 NTSTATUS _samr_GetGroupsForUser(pipes_struct *p,
2711 struct samr_GetGroupsForUser *r)
2712 {
2713 struct samu *sam_pass=NULL;
2714 DOM_SID sid;
2715 DOM_SID *sids;
2716 struct samr_RidWithAttribute dom_gid;
2717 struct samr_RidWithAttribute *gids = NULL;
2718 uint32 primary_group_rid;
2719 size_t num_groups = 0;
2720 gid_t *unix_gids;
2721 size_t i, num_gids;
2722 uint32 acc_granted;
2723 bool ret;
2724 NTSTATUS result;
2725 bool success = False;
2726
2727 struct samr_RidWithAttributeArray *rids = NULL;
2728
2729 /*
2730 * from the SID in the request:
2731 * we should send back the list of DOMAIN GROUPS
2732 * the user is a member of
2733 *
2734 * and only the DOMAIN GROUPS
2735 * no ALIASES !!! neither aliases of the domain
2736 * nor aliases of the builtin SID
2737 *
2738 * JFM, 12/2/2001
2739 */
2740
2741 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
2742
2743 rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidWithAttributeArray);
2744 if (!rids) {
2745 return NT_STATUS_NO_MEMORY;
2746 }
2747
2748 /* find the policy handle. open a policy on it. */
2749 if (!get_lsa_policy_samr_sid(p, r->in.user_handle, &sid, &acc_granted, NULL))
2750 return NT_STATUS_INVALID_HANDLE;
2751
2752 result = access_check_samr_function(acc_granted,
2753 SA_RIGHT_USER_GET_GROUPS,
2754 "_samr_GetGroupsForUser");
2755 if (!NT_STATUS_IS_OK(result)) {
2756 return result;
2757 }
2758
2759 if (!sid_check_is_in_our_domain(&sid))
2760 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2761
2762 if ( !(sam_pass = samu_new( p->mem_ctx )) ) {
2763 return NT_STATUS_NO_MEMORY;
2764 }
2765
2766 become_root();
2767 ret = pdb_getsampwsid(sam_pass, &sid);
2768 unbecome_root();
2769
2770 if (!ret) {
2771 DEBUG(10, ("pdb_getsampwsid failed for %s\n",
2772 sid_string_dbg(&sid)));
2773 return NT_STATUS_NO_SUCH_USER;
2774 }
2775
2776 sids = NULL;
2777
2778 /* make both calls inside the root block */
2779 become_root();
2780 result = pdb_enum_group_memberships(p->mem_ctx, sam_pass,
2781 &sids, &unix_gids, &num_groups);
2782 if ( NT_STATUS_IS_OK(result) ) {
2783 success = sid_peek_check_rid(get_global_sam_sid(),
2784 pdb_get_group_sid(sam_pass),
2785 &primary_group_rid);
2786 }
2787 unbecome_root();
2788
2789 if (!NT_STATUS_IS_OK(result)) {
2790 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
2791 sid_string_dbg(&sid)));
2792 return result;
2793 }
2794
2795 if ( !success ) {
2796 DEBUG(5, ("Group sid %s for user %s not in our domain\n",
2797 sid_string_dbg(pdb_get_group_sid(sam_pass)),
2798 pdb_get_username(sam_pass)));
2799 TALLOC_FREE(sam_pass);
2800 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2801 }
2802
2803 gids = NULL;
2804 num_gids = 0;
2805
2806 dom_gid.attributes = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
2807 SE_GROUP_ENABLED);
2808 dom_gid.rid = primary_group_rid;
2809 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
2810
2811 for (i=0; i<num_groups; i++) {
2812
2813 if (!sid_peek_check_rid(get_global_sam_sid(),
2814 &(sids[i]), &dom_gid.rid)) {
2815 DEBUG(10, ("Found sid %s not in our domain\n",
2816 sid_string_dbg(&sids[i])));
2817 continue;
2818 }
2819
2820 if (dom_gid.rid == primary_group_rid) {
2821 /* We added the primary group directly from the
2822 * sam_account. The other SIDs are unique from
2823 * enum_group_memberships */
2824 continue;
2825 }
2826
2827 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
2828 }
2829
2830 rids->count = num_gids;
2831 rids->rids = gids;
2832
2833 *r->out.rids = rids;
2834
2835 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
2836
2837 return result;
2838 }
2839
2840 /*******************************************************************
2841 samr_QueryDomainInfo_internal
2842 ********************************************************************/
2843
2844 static NTSTATUS samr_QueryDomainInfo_internal(const char *fn_name,
2845 pipes_struct *p,
2846 struct policy_handle *handle,
2847 uint32_t level,
2848 union samr_DomainInfo **dom_info_ptr)
2849 {
2850 NTSTATUS status = NT_STATUS_OK;
2851 struct samr_info *info = NULL;
2852 union samr_DomainInfo *dom_info;
2853 uint32 min_pass_len,pass_hist,password_properties;
2854 time_t u_expire, u_min_age;
2855 NTTIME nt_expire, nt_min_age;
2856
2857 time_t u_lock_duration, u_reset_time;
2858 NTTIME nt_lock_duration, nt_reset_time;
2859 uint32 lockout;
2860 time_t u_logout;
2861 NTTIME nt_logout;
2862
2863 uint32 account_policy_temp;
2864
2865 time_t seq_num;
2866 uint32 server_role;
2867
2868 uint32 num_users=0, num_groups=0, num_aliases=0;
2869
2870 DEBUG(5,("%s: %d\n", fn_name, __LINE__));
2871
2872 dom_info = TALLOC_ZERO_P(p->mem_ctx, union samr_DomainInfo);
2873 if (!dom_info) {
2874 return NT_STATUS_NO_MEMORY;
2875 }
2876
2877 *dom_info_ptr = dom_info;
2878
2879 /* find the policy handle. open a policy on it. */
2880 if (!find_policy_by_hnd(p, handle, (void **)(void *)&info)) {
2881 return NT_STATUS_INVALID_HANDLE;
2882 }
2883
2884 switch (level) {
2885 case 0x01:
2886
2887 become_root();
2888
2889 /* AS ROOT !!! */
2890
2891 pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp);
2892 min_pass_len = account_policy_temp;
2893
2894 pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
2895 pass_hist = account_policy_temp;
2896
2897 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
2898 password_properties = account_policy_temp;
2899
2900 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
2901 u_expire = account_policy_temp;
2902
2903 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
2904 u_min_age = account_policy_temp;
2905
2906 /* !AS ROOT */
2907
2908 unbecome_root();
2909
2910 unix_to_nt_time_abs(&nt_expire, u_expire);
2911 unix_to_nt_time_abs(&nt_min_age, u_min_age);
2912
2913 init_samr_DomInfo1(&dom_info->info1,
2914 (uint16)min_pass_len,
2915 (uint16)pass_hist,
2916 password_properties,
2917 nt_expire,
2918 nt_min_age);
2919 break;
2920 case 0x02:
2921
2922 become_root();
2923
2924 /* AS ROOT !!! */
2925
2926 num_users = count_sam_users(info->disp_info, ACB_NORMAL);
2927 num_groups = count_sam_groups(info->disp_info);
2928 num_aliases = count_sam_aliases(info->disp_info);
2929
2930 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &account_policy_temp);
2931 u_logout = account_policy_temp;
2932
2933 unix_to_nt_time_abs(&nt_logout, u_logout);
2934
2935 if (!pdb_get_seq_num(&seq_num))
2936 seq_num = time(NULL);
2937
2938 /* !AS ROOT */
2939
2940 unbecome_root();
2941
2942 server_role = ROLE_DOMAIN_PDC;
2943 if (lp_server_role() == ROLE_DOMAIN_BDC)
2944 server_role = ROLE_DOMAIN_BDC;
2945
2946 init_samr_DomInfo2(&dom_info->info2,
2947 nt_logout,
2948 lp_serverstring(),
2949 lp_workgroup(),
2950 global_myname(),
2951 seq_num,
2952 1,
2953 server_role,
2954 1,
2955 num_users,
2956 num_groups,
2957 num_aliases);
2958 break;
2959 case 0x03:
2960
2961 become_root();
2962
2963 /* AS ROOT !!! */
2964
2965 {
2966 uint32 ul;
2967 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &ul);
2968 u_logout = (time_t)ul;
2969 }
2970
2971 /* !AS ROOT */
2972
2973 unbecome_root();
2974
2975 unix_to_nt_time_abs(&nt_logout, u_logout);
2976
2977 init_samr_DomInfo3(&dom_info->info3,
2978 nt_logout);
2979
2980 break;
2981 case 0x04:
2982 init_samr_DomInfo4(&dom_info->info4,
2983 lp_serverstring());
2984 break;
2985 case 0x05:
2986 init_samr_DomInfo5(&dom_info->info5,
2987 get_global_sam_name());
2988 break;
2989 case 0x06:
2990 /* NT returns its own name when a PDC. win2k and later
2991 * only the name of the PDC if itself is a BDC (samba4
2992 * idl) */
2993 init_samr_DomInfo6(&dom_info->info6,
2994 global_myname());
2995 break;
2996 case 0x07:
2997 server_role = ROLE_DOMAIN_PDC;
2998 if (lp_server_role() == ROLE_DOMAIN_BDC)
2999 server_role = ROLE_DOMAIN_BDC;
3000
3001 init_samr_DomInfo7(&dom_info->info7,
3002 server_role);
3003 break;
3004 case 0x08:
3005
3006 become_root();
3007
3008 /* AS ROOT !!! */
3009
3010 if (!pdb_get_seq_num(&seq_num)) {
3011 seq_num = time(NULL);
3012 }
3013
3014 /* !AS ROOT */
3015
3016 unbecome_root();
3017
3018 init_samr_DomInfo8(&dom_info->info8,
3019 seq_num,
3020 0);
3021 break;
3022 case 0x0c:
3023
3024 become_root();
3025
3026 /* AS ROOT !!! */
3027
3028 pdb_get_account_policy(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
3029 u_lock_duration = account_policy_temp;
3030 if (u_lock_duration != -1) {
3031 u_lock_duration *= 60;
3032 }
3033
3034 pdb_get_account_policy(AP_RESET_COUNT_TIME, &account_policy_temp);
3035 u_reset_time = account_policy_temp * 60;
3036
3037 pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
3038 lockout = account_policy_temp;
3039
3040 /* !AS ROOT */
3041
3042 unbecome_root();
3043
3044 unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
3045 unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
3046
3047 init_samr_DomInfo12(&dom_info->info12,
3048 nt_lock_duration,
3049 nt_reset_time,
3050 (uint16)lockout);
3051 break;
3052 default:
3053 return NT_STATUS_INVALID_INFO_CLASS;
3054 }
3055
3056 DEBUG(5,("%s: %d\n", fn_name, __LINE__));
3057
3058 return status;
3059 }
3060
3061 /*******************************************************************
3062 _samr_QueryDomainInfo
3063 ********************************************************************/
3064
3065 NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
3066 struct samr_QueryDomainInfo *r)
3067 {
3068 return samr_QueryDomainInfo_internal("_samr_QueryDomainInfo",
3069 p,
3070 r->in.domain_handle,
3071 r->in.level,
3072 r->out.info);
3073 }
3074
3075 /* W2k3 seems to use the same check for all 3 objects that can be created via
3076 * SAMR, if you try to create for example "Dialup" as an alias it says
3077 * "NT_STATUS_USER_EXISTS". This is racy, but we can't really lock the user
3078 * database. */
3079
3080 static NTSTATUS can_create(TALLOC_CTX *mem_ctx, const char *new_name)
3081 {
3082 enum lsa_SidType type;
3083 bool result;
3084
3085 DEBUG(10, ("Checking whether [%s] can be created\n", new_name));
3086
3087 become_root();
3088 /* Lookup in our local databases (LOOKUP_NAME_REMOTE not set)
3089 * whether the name already exists */
3090 result = lookup_name(mem_ctx, new_name, LOOKUP_NAME_LOCAL,
3091 NULL, NULL, NULL, &type);
3092 unbecome_root();
3093
3094 if (!result) {
3095 DEBUG(10, ("%s does not exist, can create it\n", new_name));
3096 return NT_STATUS_OK;
3097 }
3098
3099 DEBUG(5, ("trying to create %s, exists as %s\n",
3100 new_name, sid_type_lookup(type)));
3101
3102 if (type == SID_NAME_DOM_GRP) {
3103 return NT_STATUS_GROUP_EXISTS;
3104 }
3105 if (type == SID_NAME_ALIAS) {
3106 return NT_STATUS_ALIAS_EXISTS;
3107 }
3108
3109 /* Yes, the default is NT_STATUS_USER_EXISTS */
3110 return NT_STATUS_USER_EXISTS;
3111 }
3112
3113 /*******************************************************************
3114 _samr_CreateUser2
3115 ********************************************************************/
3116
3117 NTSTATUS _samr_CreateUser2(pipes_struct *p,
3118 struct samr_CreateUser2 *r)
3119 {
3120 const char *account = NULL;
3121 DOM_SID sid;
3122 POLICY_HND dom_pol = *r->in.domain_handle;
3123 uint32_t acb_info = r->in.acct_flags;
3124 POLICY_HND *user_pol = r->out.user_handle;
3125 struct samr_info *info = NULL;
3126 NTSTATUS nt_status;
3127 uint32 acc_granted;
3128 SEC_DESC *psd;
3129 size_t sd_size;
3130 /* check this, when giving away 'add computer to domain' privs */
3131 uint32 des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
3132 bool can_add_account = False;
3133 SE_PRIV se_rights;
3134 DISP_INFO *disp_info = NULL;
3135
3136 /* Get the domain SID stored in the domain policy */
3137 if (!get_lsa_policy_samr_sid(p, &dom_pol, &sid, &acc_granted,
3138 &disp_info))
3139 return NT_STATUS_INVALID_HANDLE;
3140
3141 nt_status = access_check_samr_function(acc_granted,
3142 SA_RIGHT_DOMAIN_CREATE_USER,
3143 "_samr_CreateUser2");
3144 if (!NT_STATUS_IS_OK(nt_status)) {
3145 return nt_status;
3146 }
3147
3148 if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST ||
3149 acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
3150 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
3151 this parameter is not an account type */
3152 return NT_STATUS_INVALID_PARAMETER;
3153 }
3154
3155 account = r->in.account_name->string;
3156 if (account == NULL) {
3157 return NT_STATUS_NO_MEMORY;
3158 }
3159
3160 nt_status = can_create(p->mem_ctx, account);
3161 if (!NT_STATUS_IS_OK(nt_status)) {
3162 return nt_status;
3163 }
3164
3165 /* determine which user right we need to check based on the acb_info */
3166
3167 if ( acb_info & ACB_WSTRUST )
3168 {
3169 se_priv_copy( &se_rights, &se_machine_account );
3170 can_add_account = user_has_privileges(
3171 p->pipe_user.nt_user_token, &se_rights );
3172 }
3173 /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
3174 account for domain trusts and changes the ACB flags later */
3175 else if ( acb_info & ACB_NORMAL &&
3176 (account[strlen(account)-1] != '$') )
3177 {
3178 se_priv_copy( &se_rights, &se_add_users );
3179 can_add_account = user_has_privileges(
3180 p->pipe_user.nt_user_token, &se_rights );
3181 }
3182 else /* implicit assumption of a BDC or domain trust account here
3183 * (we already check the flags earlier) */
3184 {
3185 if ( lp_enable_privileges() ) {
3186 /* only Domain Admins can add a BDC or domain trust */
3187 se_priv_copy( &se_rights, &se_priv_none );
3188 can_add_account = nt_token_check_domain_rid(
3189 p->pipe_user.nt_user_token,
3190 DOMAIN_GROUP_RID_ADMINS );
3191 }
3192 }
3193
3194 DEBUG(5, ("_samr_CreateUser2: %s can add this account : %s\n",
3195 uidtoname(p->pipe_user.ut.uid),
3196 can_add_account ? "True":"False" ));
3197
3198 /********** BEGIN Admin BLOCK **********/
3199
3200 if ( can_add_account )
3201 become_root();
3202
3203 nt_status = pdb_create_user(p->mem_ctx, account, acb_info,
3204 r->out.rid);
3205
3206 if ( can_add_account )
3207 unbecome_root();
3208
3209 /********** END Admin BLOCK **********/
3210
3211 /* now check for failure */
3212
3213 if ( !NT_STATUS_IS_OK(nt_status) )
3214 return nt_status;
3215
3216 /* Get the user's SID */
3217
3218 sid_compose(&sid, get_global_sam_sid(), *r->out.rid);
3219
3220 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
3221 &sid, SAMR_USR_RIGHTS_WRITE_PW);
3222 se_map_generic(&des_access, &usr_generic_mapping);
3223
3224 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3225 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
3226 &acc_granted, "_samr_CreateUser2");
3227
3228 if ( !NT_STATUS_IS_OK(nt_status) ) {
3229 return nt_status;
3230 }
3231
3232 /* associate the user's SID with the new handle. */
3233 if ((info = get_samr_info_by_sid(&sid)) == NULL) {
3234 return NT_STATUS_NO_MEMORY;
3235 }
3236
3237 ZERO_STRUCTP(info);
3238 info->sid = sid;
3239 info->acc_granted = acc_granted;
3240
3241 /* get a (unique) handle. open a policy on it. */
3242 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info)) {
3243 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3244 }
3245
3246 /* After a "set" ensure we have no cached display info. */
3247 force_flush_samr_cache(info->disp_info);
3248
3249 *r->out.access_granted = acc_granted;
3250
3251 return NT_STATUS_OK;
3252 }
3253
3254 /*******************************************************************
3255 _samr_Connect
3256 ********************************************************************/
3257
3258 NTSTATUS _samr_Connect(pipes_struct *p,
3259 struct samr_Connect *r)
3260 {
3261 struct samr_info *info = NULL;
3262 uint32 des_access = r->in.access_mask;
3263
3264 /* Access check */
3265
3266 if (!pipe_access_check(p)) {
3267 DEBUG(3, ("access denied to _samr_Connect\n"));
3268 return NT_STATUS_ACCESS_DENIED;
3269 }
3270
3271 /* set up the SAMR connect_anon response */
3272
3273 /* associate the user's SID with the new handle. */
3274 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3275 return NT_STATUS_NO_MEMORY;
3276
3277 /* don't give away the farm but this is probably ok. The SA_RIGHT_SAM_ENUM_DOMAINS
3278 was observed from a win98 client trying to enumerate users (when configured
3279 user level access control on shares) --jerry */
3280
3281 if (des_access == MAXIMUM_ALLOWED_ACCESS) {
3282 /* Map to max possible knowing we're filtered below. */
3283 des_access = GENERIC_ALL_ACCESS;
3284 }
3285
3286 se_map_generic( &des_access, &sam_generic_mapping );
3287 info->acc_granted = des_access & (SA_RIGHT_SAM_ENUM_DOMAINS|SA_RIGHT_SAM_OPEN_DOMAIN);
3288
3289 /* get a (unique) handle. open a policy on it. */
3290 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3291 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3292
3293 return NT_STATUS_OK;
3294 }
3295
3296 /*******************************************************************
3297 _samr_Connect2
3298 ********************************************************************/
3299
3300 NTSTATUS _samr_Connect2(pipes_struct *p,
3301 struct samr_Connect2 *r)
3302 {
3303 struct samr_info *info = NULL;
3304 SEC_DESC *psd = NULL;
3305 uint32 acc_granted;
3306 uint32 des_access = r->in.access_mask;
3307 NTSTATUS nt_status;
3308 size_t sd_size;
3309
3310
3311 DEBUG(5,("_samr_Connect2: %d\n", __LINE__));
3312
3313 /* Access check */
3314
3315 if (!pipe_access_check(p)) {
3316 DEBUG(3, ("access denied to _samr_Connect2\n"));
3317 return NT_STATUS_ACCESS_DENIED;
3318 }
3319
3320 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3321 se_map_generic(&des_access, &sam_generic_mapping);
3322
3323 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3324 NULL, 0, des_access, &acc_granted, "_samr_Connect2");
3325
3326 if ( !NT_STATUS_IS_OK(nt_status) )
3327 return nt_status;
3328
3329 /* associate the user's SID and access granted with the new handle. */
3330 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3331 return NT_STATUS_NO_MEMORY;
3332
3333 info->acc_granted = acc_granted;
3334 info->status = r->in.access_mask; /* this looks so wrong... - gd */
3335
3336 /* get a (unique) handle. open a policy on it. */
3337 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3338 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3339
3340 DEBUG(5,("_samr_Connect2: %d\n", __LINE__));
3341
3342 return nt_status;
3343 }
3344
3345 /*******************************************************************
3346 _samr_Connect4
3347 ********************************************************************/
3348
3349 NTSTATUS _samr_Connect4(pipes_struct *p,
3350 struct samr_Connect4 *r)
3351 {
3352 struct samr_info *info = NULL;
3353 SEC_DESC *psd = NULL;
3354 uint32 acc_granted;
3355 uint32 des_access = r->in.access_mask;
3356 NTSTATUS nt_status;
3357 size_t sd_size;
3358
3359
3360 DEBUG(5,("_samr_Connect4: %d\n", __LINE__));
3361
3362 /* Access check */
3363
3364 if (!pipe_access_check(p)) {
3365 DEBUG(3, ("access denied to samr_Connect4\n"));
3366 return NT_STATUS_ACCESS_DENIED;
3367 }
3368
3369 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3370 se_map_generic(&des_access, &sam_generic_mapping);
3371
3372 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3373 NULL, 0, des_access, &acc_granted, "_samr_Connect4");
3374
3375 if ( !NT_STATUS_IS_OK(nt_status) )
3376 return nt_status;
3377
3378 /* associate the user's SID and access granted with the new handle. */
3379 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3380 return NT_STATUS_NO_MEMORY;
3381
3382 info->acc_granted = acc_granted;
3383 info->status = r->in.access_mask; /* ??? */
3384
3385 /* get a (unique) handle. open a policy on it. */
3386 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3387 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3388
3389 DEBUG(5,("_samr_Connect4: %d\n", __LINE__));
3390
3391 return NT_STATUS_OK;
3392 }
3393
3394 /*******************************************************************
3395 _samr_Connect5
3396 ********************************************************************/
3397
3398 NTSTATUS _samr_Connect5(pipes_struct *p,
3399 struct samr_Connect5 *r)
3400 {
3401 struct samr_info *info = NULL;
3402 SEC_DESC *psd = NULL;
3403 uint32 acc_granted;
3404 uint32 des_access = r->in.access_mask;
3405 NTSTATUS nt_status;
3406 size_t sd_size;
3407 struct samr_ConnectInfo1 info1;
3408
3409 DEBUG(5,("_samr_Connect5: %d\n", __LINE__));
3410
3411 /* Access check */
3412
3413 if (!pipe_access_check(p)) {
3414 DEBUG(3, ("access denied to samr_Connect5\n"));
3415 return NT_STATUS_ACCESS_DENIED;
3416 }
3417
3418 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3419 se_map_generic(&des_access, &sam_generic_mapping);
3420
3421 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3422 NULL, 0, des_access, &acc_granted, "_samr_Connect5");
3423
3424 if ( !NT_STATUS_IS_OK(nt_status) )
3425 return nt_status;
3426
3427 /* associate the user's SID and access granted with the new handle. */
3428 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3429 return NT_STATUS_NO_MEMORY;
3430
3431 info->acc_granted = acc_granted;
3432 info->status = r->in.access_mask; /* ??? */
3433
3434 /* get a (unique) handle. open a policy on it. */
3435 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3436 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3437
3438 DEBUG(5,("_samr_Connect5: %d\n", __LINE__));
3439
3440 info1.client_version = SAMR_CONNECT_AFTER_W2K;
3441 info1.unknown2 = 0;
3442
3443 *r->out.level_out = 1;
3444 r->out.info_out->info1 = info1;
3445
3446 return NT_STATUS_OK;
3447 }
3448
3449 /**********************************************************************
3450 _samr_LookupDomain
3451 **********************************************************************/
3452
3453 NTSTATUS _samr_LookupDomain(pipes_struct *p,
3454 struct samr_LookupDomain *r)
3455 {
3456 NTSTATUS status = NT_STATUS_OK;
3457 struct samr_info *info;
3458 const char *domain_name;
3459 DOM_SID *sid = NULL;
3460
3461 if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
3462 return NT_STATUS_INVALID_HANDLE;
3463
3464 /* win9x user manager likes to use SA_RIGHT_SAM_ENUM_DOMAINS here.
3465 Reverted that change so we will work with RAS servers again */
3466
3467 status = access_check_samr_function(info->acc_granted,
3468 SA_RIGHT_SAM_OPEN_DOMAIN,
3469 "_samr_LookupDomain");
3470 if (!NT_STATUS_IS_OK(status)) {
3471 return status;
3472 }
3473
3474 domain_name = r->in.domain_name->string;
3475
3476 sid = TALLOC_ZERO_P(p->mem_ctx, struct dom_sid2);
3477 if (!sid) {
3478 return NT_STATUS_NO_MEMORY;
3479 }
3480
3481 if (strequal(domain_name, builtin_domain_name())) {
3482 sid_copy(sid, &global_sid_Builtin);
3483 } else {
3484 if (!secrets_fetch_domain_sid(domain_name, sid)) {
3485 status = NT_STATUS_NO_SUCH_DOMAIN;
3486 }
3487 }
3488
3489 DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name,
3490 sid_string_dbg(sid)));
3491
3492 *r->out.sid = sid;
3493
3494 return status;
3495 }
3496
3497 /**********************************************************************
3498 _samr_EnumDomains
3499 **********************************************************************/
3500
3501 NTSTATUS _samr_EnumDomains(pipes_struct *p,
3502 struct samr_EnumDomains *r)
3503 {
3504 NTSTATUS status;
3505 struct samr_info *info;
3506 uint32_t num_entries = 2;
3507 struct samr_SamEntry *entry_array = NULL;
3508 struct samr_SamArray *sam;
3509
3510 if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
3511 return NT_STATUS_INVALID_HANDLE;
3512
3513 status = access_check_samr_function(info->acc_granted,
3514 SA_RIGHT_SAM_ENUM_DOMAINS,
3515 "_samr_EnumDomains");
3516 if (!NT_STATUS_IS_OK(status)) {
3517 return status;
3518 }
3519
3520 sam = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
3521 if (!sam) {
3522 return NT_STATUS_NO_MEMORY;
3523 }
3524
3525 entry_array = TALLOC_ZERO_ARRAY(p->mem_ctx,
3526 struct samr_SamEntry,
3527 num_entries);
3528 if (!entry_array) {
3529 return NT_STATUS_NO_MEMORY;
3530 }
3531
3532 entry_array[0].idx = 0;
3533 init_lsa_String(&entry_array[0].name, get_global_sam_name());
3534
3535 entry_array[1].idx = 1;
3536 init_lsa_String(&entry_array[1].name, "Builtin");
3537
3538 sam->count = num_entries;
3539 sam->entries = entry_array;
3540
3541 *r->out.sam = sam;
3542 *r->out.num_entries = num_entries;
3543
3544 return status;
3545 }
3546
3547 /*******************************************************************
3548 _samr_OpenAlias
3549 ********************************************************************/
3550
3551 NTSTATUS _samr_OpenAlias(pipes_struct *p,
3552 struct samr_OpenAlias *r)
3553 {
3554 DOM_SID sid;
3555 POLICY_HND domain_pol = *r->in.domain_handle;
3556 uint32 alias_rid = r->in.rid;
3557 POLICY_HND *alias_pol = r->out.alias_handle;
3558 struct samr_info *info = NULL;
3559 SEC_DESC *psd = NULL;
3560 uint32 acc_granted;
3561 uint32 des_access = r->in.access_mask;
3562 size_t sd_size;
3563 NTSTATUS status;
3564 SE_PRIV se_rights;
3565
3566 /* find the domain policy and get the SID / access bits stored in the domain policy */
3567
3568 if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted, NULL) )
3569 return NT_STATUS_INVALID_HANDLE;
3570
3571 status = access_check_samr_function(acc_granted,
3572 SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
3573 "_samr_OpenAlias");
3574
3575 if ( !NT_STATUS_IS_OK(status) )
3576 return status;
3577
3578 /* append the alias' RID to it */
3579
3580 if (!sid_append_rid(&sid, alias_rid))
3581 return NT_STATUS_NO_SUCH_ALIAS;
3582
3583 /*check if access can be granted as requested by client. */
3584
3585 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
3586 se_map_generic(&des_access,&ali_generic_mapping);
3587
3588 se_priv_copy( &se_rights, &se_add_users );
3589
3590
3591 status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3592 &se_rights, GENERIC_RIGHTS_ALIAS_WRITE, des_access,
3593 &acc_granted, "_samr_OpenAlias");
3594
3595 if ( !NT_STATUS_IS_OK(status) )
3596 return status;
3597
3598 {
3599 /* Check we actually have the requested alias */
3600 enum lsa_SidType type;
3601 bool result;
3602 gid_t gid;
3603
3604 become_root();
3605 result = lookup_sid(NULL, &sid, NULL, NULL, &type);
3606 unbecome_root();
3607
3608 if (!result || (type != SID_NAME_ALIAS)) {
3609 return NT_STATUS_NO_SUCH_ALIAS;
3610 }
3611
3612 /* make sure there is a mapping */
3613
3614 if ( !sid_to_gid( &sid, &gid ) ) {
3615 return NT_STATUS_NO_SUCH_ALIAS;
3616 }
3617
3618 }
3619
3620 /* associate the alias SID with the new handle. */
3621 if ((info = get_samr_info_by_sid(&sid)) == NULL)
3622 return NT_STATUS_NO_MEMORY;
3623
3624 info->acc_granted = acc_granted;
3625
3626 /* get a (unique) handle. open a policy on it. */
3627 if (!create_policy_hnd(p, alias_pol, free_samr_info, (void *)info))
3628 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3629
3630 return NT_STATUS_OK;
3631 }
3632
3633 /*******************************************************************
3634 set_user_info_7
3635 ********************************************************************/
3636
3637 static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
3638 struct samr_UserInfo7 *id7,
3639 struct samu *pwd)
3640 {
3641 NTSTATUS rc;
3642
3643 if (id7 == NULL) {
3644 DEBUG(5, ("set_user_info_7: NULL id7\n"));
3645 TALLOC_FREE(pwd);
3646 return NT_STATUS_ACCESS_DENIED;
3647 }
3648
3649 if (!id7->account_name.string) {
3650 DEBUG(5, ("set_user_info_7: failed to get new username\n"));
3651 TALLOC_FREE(pwd);
3652 return NT_STATUS_ACCESS_DENIED;
3653 }
3654
3655 /* check to see if the new username already exists. Note: we can't
3656 reliably lock all backends, so there is potentially the
3657 possibility that a user can be created in between this check and
3658 the rename. The rename should fail, but may not get the
3659 exact same failure status code. I think this is small enough
3660 of a window for this type of operation and the results are
3661 simply that the rename fails with a slightly different status
3662 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3663
3664 rc = can_create(mem_ctx, id7->account_name.string);
3665 if (!NT_STATUS_IS_OK(rc)) {
3666 return rc;
3667 }
3668
3669 rc = pdb_rename_sam_account(pwd, id7->account_name.string);
3670
3671 TALLOC_FREE(pwd);
3672 return rc;
3673 }
3674
3675 /*******************************************************************
3676 set_user_info_16
3677 ********************************************************************/
3678
3679 static bool set_user_info_16(struct samr_UserInfo16 *id16,
3680 struct samu *pwd)
3681 {
3682 if (id16 == NULL) {
3683 DEBUG(5, ("set_user_info_16: NULL id16\n"));
3684 TALLOC_FREE(pwd);
3685 return False;
3686 }
3687
3688 /* FIX ME: check if the value is really changed --metze */
3689 if (!pdb_set_acct_ctrl(pwd, id16->acct_flags, PDB_CHANGED)) {
3690 TALLOC_FREE(pwd);
3691 return False;
3692 }
3693
3694 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3695 TALLOC_FREE(pwd);
3696 return False;
3697 }
3698
3699 TALLOC_FREE(pwd);
3700
3701 return True;
3702 }
3703
3704 /*******************************************************************
3705 set_user_info_18
3706 ********************************************************************/
3707
3708 static bool set_user_info_18(struct samr_UserInfo18 *id18,
3709 struct samu *pwd)
3710 {
3711 if (id18 == NULL) {
3712 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
3713 TALLOC_FREE(pwd);
3714 return False;
3715 }
3716
3717 if (!pdb_set_lanman_passwd (pwd, id18->lm_pwd.hash, PDB_CHANGED)) {
3718 TALLOC_FREE(pwd);
3719 return False;
3720 }
3721 if (!pdb_set_nt_passwd (pwd, id18->nt_pwd.hash, PDB_CHANGED)) {
3722 TALLOC_FREE(pwd);
3723 return False;
3724 }
3725 if (!pdb_set_pass_last_set_time (pwd, time(NULL), PDB_CHANGED)) {
3726 TALLOC_FREE(pwd);
3727 return False;
3728 }
3729
3730 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3731 TALLOC_FREE(pwd);
3732 return False;
3733 }
3734
3735 TALLOC_FREE(pwd);
3736 return True;
3737 }
3738
3739 /*******************************************************************
3740 set_user_info_20
3741 ********************************************************************/
3742
3743 static bool set_user_info_20(struct samr_UserInfo20 *id20,
3744 struct samu *pwd)
3745 {
3746 if (id20 == NULL) {
3747 DEBUG(5, ("set_user_info_20: NULL id20\n"));
3748 return False;
3749 }
3750
3751 copy_id20_to_sam_passwd(pwd, id20);
3752
3753 /* write the change out */
3754 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3755 TALLOC_FREE(pwd);
3756 return False;
3757 }
3758
3759 TALLOC_FREE(pwd);
3760
3761 return True;
3762 }
3763
3764 /*******************************************************************
3765 set_user_info_21
3766 ********************************************************************/
3767
3768 static NTSTATUS set_user_info_21(TALLOC_CTX *mem_ctx,
3769 struct samr_UserInfo21 *id21,
3770 struct samu *pwd)
3771 {
3772 NTSTATUS status;
3773
3774 if (id21 == NULL) {
3775 DEBUG(5, ("set_user_info_21: NULL id21\n"));
3776 return NT_STATUS_INVALID_PARAMETER;
3777 }
3778
3779 /* we need to separately check for an account rename first */
3780
3781 if (id21->account_name.string &&
3782 (!strequal(id21->account_name.string, pdb_get_username(pwd))))
3783 {
3784
3785 /* check to see if the new username already exists. Note: we can't
3786 reliably lock all backends, so there is potentially the
3787 possibility that a user can be created in between this check and
3788 the rename. The rename should fail, but may not get the
3789 exact same failure status code. I think this is small enough
3790 of a window for this type of operation and the results are
3791 simply that the rename fails with a slightly different status
3792 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3793
3794 status = can_create(mem_ctx, id21->account_name.string);
3795 if (!NT_STATUS_IS_OK(status)) {
3796 return status;
3797 }
3798
3799 status = pdb_rename_sam_account(pwd, id21->account_name.string);
3800
3801 if (!NT_STATUS_IS_OK(status)) {
3802 DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
3803 nt_errstr(status)));
3804 TALLOC_FREE(pwd);
3805 return status;
3806 }
3807
3808 /* set the new username so that later
3809 functions can work on the new account */
3810 pdb_set_username(pwd, id21->account_name.string, PDB_SET);
3811 }
3812
3813 copy_id21_to_sam_passwd("INFO_21", pwd, id21);
3814
3815 /*
3816 * The funny part about the previous two calls is
3817 * that pwd still has the password hashes from the
3818 * passdb entry. These have not been updated from
3819 * id21. I don't know if they need to be set. --jerry
3820 */
3821
3822 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
3823 status = pdb_set_unix_primary_group(mem_ctx, pwd);
3824 if ( !NT_STATUS_IS_OK(status) ) {
3825 return status;
3826 }
3827 }
3828
3829 /* Don't worry about writing out the user account since the
3830 primary group SID is generated solely from the user's Unix
3831 primary group. */
3832
3833 /* write the change out */
3834 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3835 TALLOC_FREE(pwd);
3836 return status;
3837 }
3838
3839 TALLOC_FREE(pwd);
3840
3841 return NT_STATUS_OK;
3842 }
3843
3844 /*******************************************************************
3845 set_user_info_23
3846 ********************************************************************/
3847
3848 static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
3849 struct samr_UserInfo23 *id23,
3850 struct samu *pwd)
3851 {
3852 char *plaintext_buf = NULL;
3853 uint32 len = 0;
3854 uint16 acct_ctrl;
3855 NTSTATUS status;
3856
3857 if (id23 == NULL) {
3858 DEBUG(5, ("set_user_info_23: NULL id23\n"));
3859 return NT_STATUS_INVALID_PARAMETER;
3860 }
3861
3862 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
3863 pdb_get_username(pwd)));
3864
3865 acct_ctrl = pdb_get_acct_ctrl(pwd);
3866
3867 if (!decode_pw_buffer(mem_ctx,
3868 id23->password.data,
3869 &plaintext_buf,
3870 &len,
3871 STR_UNICODE)) {
3872 TALLOC_FREE(pwd);
3873 return NT_STATUS_INVALID_PARAMETER;
3874 }
3875
3876 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
3877 TALLOC_FREE(pwd);
3878 return NT_STATUS_ACCESS_DENIED;
3879 }
3880
3881 copy_id23_to_sam_passwd(pwd, id23);
3882
3883 /* if it's a trust account, don't update /etc/passwd */
3884 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
3885 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
3886 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
3887 DEBUG(5, ("Changing trust account. Not updating /etc/passwd\n"));
3888 } else {
3889 /* update the UNIX password */
3890 if (lp_unix_password_sync() ) {
3891 struct passwd *passwd;
3892 if (pdb_get_username(pwd) == NULL) {
3893 DEBUG(1, ("chgpasswd: User without name???\n"));
3894 TALLOC_FREE(pwd);
3895 return NT_STATUS_ACCESS_DENIED;
3896 }
3897
3898 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
3899 if (passwd == NULL) {
3900 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3901 }
3902
3903 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
3904 TALLOC_FREE(pwd);
3905 return NT_STATUS_ACCESS_DENIED;
3906 }
3907 TALLOC_FREE(passwd);
3908 }
3909 }
3910
3911 memset(plaintext_buf, '\0', strlen(plaintext_buf));
3912
3913 if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) &&
3914 (!NT_STATUS_IS_OK(status = pdb_set_unix_primary_group(mem_ctx,
3915 pwd)))) {
3916 TALLOC_FREE(pwd);
3917 return status;
3918 }
3919
3920 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3921 TALLOC_FREE(pwd);
3922 return status;
3923 }
3924
3925 TALLOC_FREE(pwd);
3926
3927 return NT_STATUS_OK;
3928 }
3929
3930 /*******************************************************************
3931 set_user_info_pw
3932 ********************************************************************/
3933
3934 static bool set_user_info_pw(uint8 *pass, struct samu *pwd,
3935 int level)
3936 {
3937 uint32 len = 0;
3938 char *plaintext_buf = NULL;
3939 uint32 acct_ctrl;
3940 time_t last_set_time;
3941 enum pdb_value_state last_set_state;
3942
3943 DEBUG(5, ("Attempting administrator password change for user %s\n",
3944 pdb_get_username(pwd)));
3945
3946 acct_ctrl = pdb_get_acct_ctrl(pwd);
3947 /* we need to know if it's expired, because this is an admin change, not a
3948 user change, so it's still expired when we're done */
3949 last_set_state = pdb_get_init_flags(pwd, PDB_PASSLASTSET);
3950 last_set_time = pdb_get_pass_last_set_time(pwd);
3951
3952 if (!decode_pw_buffer(talloc_tos(),
3953 pass,
3954 &plaintext_buf,
3955 &len,
3956 STR_UNICODE)) {
3957 TALLOC_FREE(pwd);
3958 return False;
3959 }
3960
3961 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
3962 TALLOC_FREE(pwd);
3963 return False;
3964 }
3965
3966 /* if it's a trust account, don't update /etc/passwd */
3967 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
3968 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
3969 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
3970 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
3971 } else {
3972 /* update the UNIX password */
3973 if (lp_unix_password_sync()) {
3974 struct passwd *passwd;
3975
3976 if (pdb_get_username(pwd) == NULL) {
3977 DEBUG(1, ("chgpasswd: User without name???\n"));
3978 TALLOC_FREE(pwd);
3979 return False;
3980 }
3981
3982 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
3983 if (passwd == NULL) {
3984 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3985 }
3986
3987 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
3988 TALLOC_FREE(pwd);
3989 return False;
3990 }
3991 TALLOC_FREE(passwd);
3992 }
3993 }
3994
3995 memset(plaintext_buf, '\0', strlen(plaintext_buf));
3996
3997 /*
3998 * A level 25 change does reset the pwdlastset field, a level 24
3999 * change does not. I know this is probably not the full story, but
4000 * it is needed to make XP join LDAP correctly, without it the later
4001 * auth2 check can fail with PWD_MUST_CHANGE.
4002 */
4003 if (level != 25) {
4004 /*
4005 * restore last set time as this is an admin change, not a
4006 * user pw change
4007 */
4008 pdb_set_pass_last_set_time (pwd, last_set_time,
4009 last_set_state);
4010 }
4011
4012 DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
4013
4014 /* update the SAMBA password */
4015 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
4016 TALLOC_FREE(pwd);
4017 return False;
4018 }
4019
4020 TALLOC_FREE(pwd);
4021
4022 return True;
4023 }
4024
4025 /*******************************************************************
4026 set_user_info_25
4027 ********************************************************************/
4028
4029 static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx,
4030 struct samr_UserInfo25 *id25,
4031 struct samu *pwd)
4032 {
4033 NTSTATUS status;
4034
4035 if (id25 == NULL) {
4036 DEBUG(5, ("set_user_info_25: NULL id25\n"));
4037 return NT_STATUS_INVALID_PARAMETER;
4038 }
4039
4040 copy_id25_to_sam_passwd(pwd, id25);
4041
4042 /* write the change out */
4043 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4044 TALLOC_FREE(pwd);
4045 return status;
4046 }
4047
4048 /*
4049 * We need to "pdb_update_sam_account" before the unix primary group
4050 * is set, because the idealx scripts would also change the
4051 * sambaPrimaryGroupSid using the ldap replace method. pdb_ldap uses
4052 * the delete explicit / add explicit, which would then fail to find
4053 * the previous primaryGroupSid value.
4054 */
4055
4056 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
4057 status = pdb_set_unix_primary_group(mem_ctx, pwd);
4058 if ( !NT_STATUS_IS_OK(status) ) {
4059 return status;
4060 }
4061 }
4062
4063 /* WARNING: No TALLOC_FREE(pwd), we are about to set the password
4064 * hereafter! */
4065
4066 return NT_STATUS_OK;
4067 }
4068
4069 /*******************************************************************
4070 samr_SetUserInfo_internal
4071 ********************************************************************/
4072
4073 static NTSTATUS samr_SetUserInfo_internal(const char *fn_name,
4074 pipes_struct *p,
4075 struct policy_handle *user_handle,
4076 uint16_t level,
4077 union samr_UserInfo *info)
4078 {
4079 NTSTATUS status;
4080 struct samu *pwd = NULL;
4081 DOM_SID sid;
4082 POLICY_HND *pol = user_handle;
4083 uint16_t switch_value = level;
4084 uint32_t acc_granted;
4085 uint32_t acc_required;
4086 bool ret;
4087 bool has_enough_rights = False;
4088 uint32_t acb_info;
4089 DISP_INFO *disp_info = NULL;
4090
4091 DEBUG(5,("%s: %d\n", fn_name, __LINE__));
4092
4093 /* find the policy handle. open a policy on it. */
4094 if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info)) {
4095 return NT_STATUS_INVALID_HANDLE;
4096 }
4097
4098 /* This is tricky. A WinXP domain join sets
4099 (SA_RIGHT_USER_SET_PASSWORD|SA_RIGHT_USER_SET_ATTRIBUTES|SA_RIGHT_USER_ACCT_FLAGS_EXPIRY)
4100 The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser(). But the
4101 standard Win32 API calls just ask for SA_RIGHT_USER_SET_PASSWORD in the SamrOpenUser().
4102 This should be enough for levels 18, 24, 25,& 26. Info level 23 can set more so
4103 we'll use the set from the WinXP join as the basis. */
4104
4105 switch (switch_value) {
4106 case 18:
4107 case 24:
4108 case 25:
4109 case 26:
4110 acc_required = SA_RIGHT_USER_SET_PASSWORD;
4111 break;
4112 default:
4113 acc_required = SA_RIGHT_USER_SET_PASSWORD |
4114 SA_RIGHT_USER_SET_ATTRIBUTES |
4115 SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
4116 break;
4117 }
4118
4119 status = access_check_samr_function(acc_granted,
4120 acc_required,
4121 fn_name);
4122 if (!NT_STATUS_IS_OK(status)) {
4123 return status;
4124 }
4125
4126 DEBUG(5, ("%s: sid:%s, level:%d\n",
4127 fn_name, sid_string_dbg(&sid), switch_value));
4128
4129 if (info == NULL) {
4130 DEBUG(5, ("%s: NULL info level\n", fn_name));
4131 return NT_STATUS_INVALID_INFO_CLASS;
4132 }
4133
4134 if (!(pwd = samu_new(NULL))) {
4135 return NT_STATUS_NO_MEMORY;
4136 }
4137
4138 become_root();
4139 ret = pdb_getsampwsid(pwd, &sid);
4140 unbecome_root();
4141
4142 if (!ret) {
4143 TALLOC_FREE(pwd);
4144 return NT_STATUS_NO_SUCH_USER;
4145 }
4146
4147 /* deal with machine password changes differently from userinfo changes */
4148 /* check to see if we have the sufficient rights */
4149
4150 acb_info = pdb_get_acct_ctrl(pwd);
4151 if (acb_info & ACB_WSTRUST)
4152 has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
4153 &se_machine_account);
4154 else if (acb_info & ACB_NORMAL)
4155 has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
4156 &se_add_users);
4157 else if (acb_info & (ACB_SVRTRUST|ACB_DOMTRUST)) {
4158 if (lp_enable_privileges()) {
4159 has_enough_rights = nt_token_check_domain_rid(p->pipe_user.nt_user_token,
4160 DOMAIN_GROUP_RID_ADMINS);
4161 }
4162 }
4163
4164 DEBUG(5, ("%s: %s does%s possess sufficient rights\n",
4165 fn_name,
4166 uidtoname(p->pipe_user.ut.uid),
4167 has_enough_rights ? "" : " not"));
4168
4169 /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
4170
4171 if (has_enough_rights) {
4172 become_root();
4173 }
4174
4175 /* ok! user info levels (lots: see MSDEV help), off we go... */
4176
4177 switch (switch_value) {
4178
4179 case 7:
4180 status = set_user_info_7(p->mem_ctx,
4181 &info->info7, pwd);
4182 break;
4183
4184 case 16:
4185 if (!set_user_info_16(&info->info16, pwd)) {
4186 status = NT_STATUS_ACCESS_DENIED;
4187 }
4188 break;
4189
4190 case 18:
4191 /* Used by AS/U JRA. */
4192 if (!set_user_info_18(&info->info18, pwd)) {
4193 status = NT_STATUS_ACCESS_DENIED;
4194 }
4195 break;
4196
4197 case 20:
4198 if (!set_user_info_20(&info->info20, pwd)) {
4199 status = NT_STATUS_ACCESS_DENIED;
4200 }
4201 break;
4202
4203 case 21:
4204 status = set_user_info_21(p->mem_ctx,
4205 &info->info21, pwd);
4206 break;
4207
4208 case 23:
4209 if (!p->server_info->user_session_key.length) {
4210 status = NT_STATUS_NO_USER_SESSION_KEY;
4211 }
4212 SamOEMhashBlob(info->info23.password.data, 516,
4213 &p->server_info->user_session_key);
4214
4215 dump_data(100, info->info23.password.data, 516);
4216
4217 status = set_user_info_23(p->mem_ctx,
4218 &info->info23, pwd);
4219 break;
4220
4221 case 24:
4222 if (!p->server_info->user_session_key.length) {
4223 status = NT_STATUS_NO_USER_SESSION_KEY;
4224 }
4225 SamOEMhashBlob(info->info24.password.data,
4226 516,
4227 &p->server_info->user_session_key);
4228
4229 dump_data(100, info->info24.password.data, 516);
4230
4231 if (!set_user_info_pw(info->info24.password.data, pwd,
4232 switch_value)) {
4233 status = NT_STATUS_ACCESS_DENIED;
4234 }
4235 break;
4236
4237 case 25:
4238 if (!p->server_info->user_session_key.length) {
4239 status = NT_STATUS_NO_USER_SESSION_KEY;
4240 }
4241 encode_or_decode_arc4_passwd_buffer(
4242 info->info25.password.data,
4243 &p->server_info->user_session_key);
4244
4245 dump_data(100, info->info25.password.data, 532);
4246
4247 status = set_user_info_25(p->mem_ctx,
4248 &info->info25, pwd);
4249 if (!NT_STATUS_IS_OK(status)) {
4250 goto done;
4251 }
4252 if (!set_user_info_pw(info->info25.password.data, pwd,
4253 switch_value)) {
4254 status = NT_STATUS_ACCESS_DENIED;
4255 }
4256 break;
4257
4258 case 26:
4259 if (!p->server_info->user_session_key.length) {
4260 status = NT_STATUS_NO_USER_SESSION_KEY;
4261 }
4262 encode_or_decode_arc4_passwd_buffer(
4263 info->info26.password.data,
4264 &p->server_info->user_session_key);
4265
4266 dump_data(100, info->info26.password.data, 516);
4267
4268 if (!set_user_info_pw(info->info26.password.data, pwd,
4269 switch_value)) {
4270 status = NT_STATUS_ACCESS_DENIED;
4271 }
4272 break;
4273
4274 default:
4275 status = NT_STATUS_INVALID_INFO_CLASS;
4276 }
4277
4278 done:
4279
4280 if (has_enough_rights) {
4281 unbecome_root();
4282 }
4283
4284 /* ================ END SeMachineAccountPrivilege BLOCK ================ */
4285
4286 if (NT_STATUS_IS_OK(status)) {
4287 force_flush_samr_cache(disp_info);
4288 }
4289
4290 return status;
4291 }
4292
4293 /*******************************************************************
4294 _samr_SetUserInfo
4295 ********************************************************************/
4296
4297 NTSTATUS _samr_SetUserInfo(pipes_struct *p,
4298 struct samr_SetUserInfo *r)
4299 {
4300 return samr_SetUserInfo_internal("_samr_SetUserInfo",
4301 p,
4302 r->in.user_handle,
4303 r->in.level,
4304 r->in.info);
4305 }
4306
4307 /*******************************************************************
4308 _samr_SetUserInfo2
4309 ********************************************************************/
4310
4311 NTSTATUS _samr_SetUserInfo2(pipes_struct *p,
4312 struct samr_SetUserInfo2 *r)
4313 {
4314 return samr_SetUserInfo_internal("_samr_SetUserInfo2",
4315 p,
4316 r->in.user_handle,
4317 r->in.level,
4318 r->in.info);
4319 }
4320
4321 /*********************************************************************
4322 _samr_GetAliasMembership
4323 *********************************************************************/
4324
4325 NTSTATUS _samr_GetAliasMembership(pipes_struct *p,
4326 struct samr_GetAliasMembership *r)
4327 {
4328 size_t num_alias_rids;
4329 uint32 *alias_rids;
4330 struct samr_info *info = NULL;
4331 size_t i;
4332
4333 NTSTATUS ntstatus1;
4334 NTSTATUS ntstatus2;
4335
4336 DOM_SID *members;
4337
4338 DEBUG(5,("_samr_GetAliasMembership: %d\n", __LINE__));
4339
4340 /* find the policy handle. open a policy on it. */
4341 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
4342 return NT_STATUS_INVALID_HANDLE;
4343
4344 ntstatus1 = access_check_samr_function(info->acc_granted,
4345 SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM,
4346 "_samr_GetAliasMembership");
4347 ntstatus2 = access_check_samr_function(info->acc_granted,
4348 SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
4349 "_samr_GetAliasMembership");
4350
4351 if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
4352 if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
4353 !(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus1))) {
4354 return (NT_STATUS_IS_OK(ntstatus1)) ? ntstatus2 : ntstatus1;
4355 }
4356 }
4357
4358 if (!sid_check_is_domain(&info->sid) &&
4359 !sid_check_is_builtin(&info->sid))
4360 return NT_STATUS_OBJECT_TYPE_MISMATCH;
4361
4362 if (r->in.sids->num_sids) {
4363 members = TALLOC_ARRAY(p->mem_ctx, DOM_SID, r->in.sids->num_sids);
4364
4365 if (members == NULL)
4366 return NT_STATUS_NO_MEMORY;
4367 } else {
4368 members = NULL;
4369 }
4370
4371 for (i=0; i<r->in.sids->num_sids; i++)
4372 sid_copy(&members[i], r->in.sids->sids[i].sid);
4373
4374 alias_rids = NULL;
4375 num_alias_rids = 0;
4376
4377 become_root();
4378 ntstatus1 = pdb_enum_alias_memberships(p->mem_ctx, &info->sid, members,
4379 r->in.sids->num_sids,
4380 &alias_rids, &num_alias_rids);
4381 unbecome_root();
4382
4383 if (!NT_STATUS_IS_OK(ntstatus1)) {
4384 return ntstatus1;
4385 }
4386
4387 r->out.rids->count = num_alias_rids;
4388 r->out.rids->ids = alias_rids;
4389
4390 return NT_STATUS_OK;
4391 }
4392
4393 /*********************************************************************
4394 _samr_GetMembersInAlias
4395 *********************************************************************/
4396
4397 NTSTATUS _samr_GetMembersInAlias(pipes_struct *p,
4398 struct samr_GetMembersInAlias *r)
4399 {
4400 NTSTATUS status;
4401 size_t i;
4402 size_t num_sids = 0;
4403 struct lsa_SidPtr *sids = NULL;
4404 DOM_SID *pdb_sids = NULL;
4405
4406 DOM_SID alias_sid;
4407
4408 uint32 acc_granted;
4409
4410 /* find the policy handle. open a policy on it. */
4411 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, NULL))
4412 return NT_STATUS_INVALID_HANDLE;
4413
4414 status = access_check_samr_function(acc_granted,
4415 SA_RIGHT_ALIAS_GET_MEMBERS,
4416 "_samr_GetMembersInAlias");
4417 if (!NT_STATUS_IS_OK(status)) {
4418 return status;
4419 }
4420
4421 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4422
4423 become_root();
4424 status = pdb_enum_aliasmem(&alias_sid, &pdb_sids, &num_sids);
4425 unbecome_root();
4426
4427 if (!NT_STATUS_IS_OK(status)) {
4428 return status;
4429 }
4430
4431 if (num_sids) {
4432 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr, num_sids);
4433 if (sids == NULL) {
4434 TALLOC_FREE(pdb_sids);
4435 return NT_STATUS_NO_MEMORY;
4436 }
4437 }
4438
4439 for (i = 0; i < num_sids; i++) {
4440 sids[i].sid = sid_dup_talloc(p->mem_ctx, &pdb_sids[i]);
4441 if (!sids[i].sid) {
4442 TALLOC_FREE(pdb_sids);
4443 return NT_STATUS_NO_MEMORY;
4444 }
4445 }
4446
4447 r->out.sids->num_sids = num_sids;
4448 r->out.sids->sids = sids;
4449
4450 TALLOC_FREE(pdb_sids);
4451
4452 return NT_STATUS_OK;
4453 }
4454
4455 /*********************************************************************
4456 _samr_QueryGroupMember
4457 *********************************************************************/
4458
4459 NTSTATUS _samr_QueryGroupMember(pipes_struct *p,
4460 struct samr_QueryGroupMember *r)
4461 {
4462 DOM_SID group_sid;
4463 size_t i, num_members;
4464
4465 uint32 *rid=NULL;
4466 uint32 *attr=NULL;
4467
4468 uint32 acc_granted;
4469
4470 NTSTATUS status;
4471 struct samr_RidTypeArray *rids = NULL;
4472
4473 rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidTypeArray);
4474 if (!rids) {
4475 return NT_STATUS_NO_MEMORY;
4476 }
4477
4478 /* find the policy handle. open a policy on it. */
4479 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, NULL))
4480 return NT_STATUS_INVALID_HANDLE;
4481
4482 status = access_check_samr_function(acc_granted,
4483 SA_RIGHT_GROUP_GET_MEMBERS,
4484 "_samr_QueryGroupMember");
4485 if (!NT_STATUS_IS_OK(status)) {
4486 return status;
4487 }
4488
4489 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4490
4491 if (!sid_check_is_in_our_domain(&group_sid)) {
4492 DEBUG(3, ("sid %s is not in our domain\n",
4493 sid_string_dbg(&group_sid)));
4494 return NT_STATUS_NO_SUCH_GROUP;
4495 }
4496
4497 DEBUG(10, ("lookup on Domain SID\n"));
4498
4499 become_root();
4500 status = pdb_enum_group_members(p->mem_ctx, &group_sid,
4501 &rid, &num_members);
4502 unbecome_root();
4503
4504 if (!NT_STATUS_IS_OK(status))
4505 return status;
4506
4507 if (num_members) {
4508 attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_members);
4509 if (attr == NULL) {
4510 return NT_STATUS_NO_MEMORY;
4511 }
4512 } else {
4513 attr = NULL;
4514 }
4515
4516 for (i=0; i<num_members; i++)
4517 attr[i] = SID_NAME_USER;
4518
4519 rids->count = num_members;
4520 rids->types = attr;
4521 rids->rids = rid;
4522
4523 *r->out.rids = rids;
4524
4525 return NT_STATUS_OK;
4526 }
4527
4528 /*********************************************************************
4529 _samr_AddAliasMember
4530 *********************************************************************/
4531
4532 NTSTATUS _samr_AddAliasMember(pipes_struct *p,
4533 struct samr_AddAliasMember *r)
4534 {
4535 DOM_SID alias_sid;
4536 uint32 acc_granted;
4537 SE_PRIV se_rights;
4538 bool can_add_accounts;
4539 NTSTATUS status;
4540 DISP_INFO *disp_info = NULL;
4541
4542 /* Find the policy handle. Open a policy on it. */
4543 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4544 return NT_STATUS_INVALID_HANDLE;
4545
4546 status = access_check_samr_function(acc_granted,
4547 SA_RIGHT_ALIAS_ADD_MEMBER,
4548 "_samr_AddAliasMember");
4549 if (!NT_STATUS_IS_OK(status)) {
4550 return status;
4551 }
4552
4553 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4554
4555 se_priv_copy( &se_rights, &se_add_users );
4556 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4557
4558 /******** BEGIN SeAddUsers BLOCK *********/
4559
4560 if ( can_add_accounts )
4561 become_root();
4562
4563 status = pdb_add_aliasmem(&alias_sid, r->in.sid);
4564
4565 if ( can_add_accounts )
4566 unbecome_root();
4567
4568 /******** END SeAddUsers BLOCK *********/
4569
4570 if (NT_STATUS_IS_OK(status)) {
4571 force_flush_samr_cache(disp_info);
4572 }
4573
4574 return status;
4575 }
4576
4577 /*********************************************************************
4578 _samr_DeleteAliasMember
4579 *********************************************************************/
4580
4581 NTSTATUS _samr_DeleteAliasMember(pipes_struct *p,
4582 struct samr_DeleteAliasMember *r)
4583 {
4584 DOM_SID alias_sid;
4585 uint32 acc_granted;
4586 SE_PRIV se_rights;
4587 bool can_add_accounts;
4588 NTSTATUS status;
4589 DISP_INFO *disp_info = NULL;
4590
4591 /* Find the policy handle. Open a policy on it. */
4592 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4593 return NT_STATUS_INVALID_HANDLE;
4594
4595 status = access_check_samr_function(acc_granted,
4596 SA_RIGHT_ALIAS_REMOVE_MEMBER,
4597 "_samr_DeleteAliasMember");
4598 if (!NT_STATUS_IS_OK(status)) {
4599 return status;
4600 }
4601
4602 DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
4603 sid_string_dbg(&alias_sid)));
4604
4605 se_priv_copy( &se_rights, &se_add_users );
4606 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4607
4608 /******** BEGIN SeAddUsers BLOCK *********/
4609
4610 if ( can_add_accounts )
4611 become_root();
4612
4613 status = pdb_del_aliasmem(&alias_sid, r->in.sid);
4614
4615 if ( can_add_accounts )
4616 unbecome_root();
4617
4618 /******** END SeAddUsers BLOCK *********/
4619
4620 if (NT_STATUS_IS_OK(status)) {
4621 force_flush_samr_cache(disp_info);
4622 }
4623
4624 return status;
4625 }
4626
4627 /*********************************************************************
4628 _samr_AddGroupMember
4629 *********************************************************************/
4630
4631 NTSTATUS _samr_AddGroupMember(pipes_struct *p,
4632 struct samr_AddGroupMember *r)
4633 {
4634 NTSTATUS status;
4635 DOM_SID group_sid;
4636 uint32 group_rid;
4637 uint32 acc_granted;
4638 SE_PRIV se_rights;
4639 bool can_add_accounts;
4640 DISP_INFO *disp_info = NULL;
4641
4642 /* Find the policy handle. Open a policy on it. */
4643 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4644 return NT_STATUS_INVALID_HANDLE;
4645
4646 status = access_check_samr_function(acc_granted,
4647 SA_RIGHT_GROUP_ADD_MEMBER,
4648 "_samr_AddGroupMember");
4649 if (!NT_STATUS_IS_OK(status)) {
4650 return status;
4651 }
4652
4653 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4654
4655 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4656 &group_rid)) {
4657 return NT_STATUS_INVALID_HANDLE;
4658 }
4659
4660 se_priv_copy( &se_rights, &se_add_users );
4661 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4662
4663 /******** BEGIN SeAddUsers BLOCK *********/
4664
4665 if ( can_add_accounts )
4666 become_root();
4667
4668 status = pdb_add_groupmem(p->mem_ctx, group_rid, r->in.rid);
4669
4670 if ( can_add_accounts )
4671 unbecome_root();
4672
4673 /******** END SeAddUsers BLOCK *********/
4674
4675 force_flush_samr_cache(disp_info);
4676
4677 return status;
4678 }
4679
4680 /*********************************************************************
4681 _samr_DeleteGroupMember
4682 *********************************************************************/
4683
4684 NTSTATUS _samr_DeleteGroupMember(pipes_struct *p,
4685 struct samr_DeleteGroupMember *r)
4686
4687 {
4688 NTSTATUS status;
4689 DOM_SID group_sid;
4690 uint32 group_rid;
4691 uint32 acc_granted;
4692 SE_PRIV se_rights;
4693 bool can_add_accounts;
4694 DISP_INFO *disp_info = NULL;
4695
4696 /*
4697 * delete the group member named r->in.rid
4698 * who is a member of the sid associated with the handle
4699 * the rid is a user's rid as the group is a domain group.
4700 */
4701
4702 /* Find the policy handle. Open a policy on it. */
4703 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4704 return NT_STATUS_INVALID_HANDLE;
4705
4706 status = access_check_samr_function(acc_granted,
4707 SA_RIGHT_GROUP_REMOVE_MEMBER,
4708 "_samr_DeleteGroupMember");
4709 if (!NT_STATUS_IS_OK(status)) {
4710 return status;
4711 }
4712
4713 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4714 &group_rid)) {
4715 return NT_STATUS_INVALID_HANDLE;
4716 }
4717
4718 se_priv_copy( &se_rights, &se_add_users );
4719 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4720
4721 /******** BEGIN SeAddUsers BLOCK *********/
4722
4723 if ( can_add_accounts )
4724 become_root();
4725
4726 status = pdb_del_groupmem(p->mem_ctx, group_rid, r->in.rid);
4727
4728 if ( can_add_accounts )
4729 unbecome_root();
4730
4731 /******** END SeAddUsers BLOCK *********/
4732
4733 force_flush_samr_cache(disp_info);
4734
4735 return status;
4736 }
4737
4738 /*********************************************************************
4739 _samr_DeleteUser
4740 *********************************************************************/
4741
4742 NTSTATUS _samr_DeleteUser(pipes_struct *p,
4743 struct samr_DeleteUser *r)
4744 {
4745 NTSTATUS status;
4746 DOM_SID user_sid;
4747 struct samu *sam_pass=NULL;
4748 uint32 acc_granted;
4749 bool can_add_accounts;
4750 uint32 acb_info;
4751 DISP_INFO *disp_info = NULL;
4752 bool ret;
4753
4754 DEBUG(5, ("_samr_DeleteUser: %d\n", __LINE__));
4755
4756 /* Find the policy handle. Open a policy on it. */
4757 if (!get_lsa_policy_samr_sid(p, r->in.user_handle, &user_sid, &acc_granted, &disp_info))
4758 return NT_STATUS_INVALID_HANDLE;
4759
4760 status = access_check_samr_function(acc_granted,
4761 STD_RIGHT_DELETE_ACCESS,
4762 "_samr_DeleteUser");
4763 if (!NT_STATUS_IS_OK(status)) {
4764 return status;
4765 }
4766
4767 if (!sid_check_is_in_our_domain(&user_sid))
4768 return NT_STATUS_CANNOT_DELETE;
4769
4770 /* check if the user exists before trying to delete */
4771 if ( !(sam_pass = samu_new( NULL )) ) {
4772 return NT_STATUS_NO_MEMORY;
4773 }
4774
4775 become_root();
4776 ret = pdb_getsampwsid(sam_pass, &user_sid);
4777 unbecome_root();
4778
4779 if( !ret ) {
4780 DEBUG(5,("_samr_DeleteUser: User %s doesn't exist.\n",
4781 sid_string_dbg(&user_sid)));
4782 TALLOC_FREE(sam_pass);
4783 return NT_STATUS_NO_SUCH_USER;
4784 }
4785
4786 acb_info = pdb_get_acct_ctrl(sam_pass);
4787
4788 /* For machine accounts it's the SeMachineAccountPrivilege that counts. */
4789 if ( acb_info & ACB_WSTRUST ) {
4790 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account );
4791 } else {
4792 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
4793 }
4794
4795 /******** BEGIN SeAddUsers BLOCK *********/
4796
4797 if ( can_add_accounts )
4798 become_root();
4799
4800 status = pdb_delete_user(p->mem_ctx, sam_pass);
4801
4802 if ( can_add_accounts )
4803 unbecome_root();
4804
4805 /******** END SeAddUsers BLOCK *********/
4806
4807 if ( !NT_STATUS_IS_OK(status) ) {
4808 DEBUG(5,("_samr_DeleteUser: Failed to delete entry for "
4809 "user %s: %s.\n", pdb_get_username(sam_pass),
4810 nt_errstr(status)));
4811 TALLOC_FREE(sam_pass);
4812 return status;
4813 }
4814
4815
4816 TALLOC_FREE(sam_pass);
4817
4818 if (!close_policy_hnd(p, r->in.user_handle))
4819 return NT_STATUS_OBJECT_NAME_INVALID;
4820
4821 force_flush_samr_cache(disp_info);
4822
4823 return NT_STATUS_OK;
4824 }
4825
4826 /*********************************************************************
4827 _samr_DeleteDomainGroup
4828 *********************************************************************/
4829
4830 NTSTATUS _samr_DeleteDomainGroup(pipes_struct *p,
4831 struct samr_DeleteDomainGroup *r)
4832 {
4833 NTSTATUS status;
4834 DOM_SID group_sid;
4835 uint32 group_rid;
4836 uint32 acc_granted;
4837 SE_PRIV se_rights;
4838 bool can_add_accounts;
4839 DISP_INFO *disp_info = NULL;
4840
4841 DEBUG(5, ("samr_DeleteDomainGroup: %d\n", __LINE__));
4842
4843 /* Find the policy handle. Open a policy on it. */
4844 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4845 return NT_STATUS_INVALID_HANDLE;
4846
4847 status = access_check_samr_function(acc_granted,
4848 STD_RIGHT_DELETE_ACCESS,
4849 "_samr_DeleteDomainGroup");
4850 if (!NT_STATUS_IS_OK(status)) {
4851 return status;
4852 }
4853
4854 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4855
4856 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4857 &group_rid)) {
4858 return NT_STATUS_NO_SUCH_GROUP;
4859 }
4860
4861 se_priv_copy( &se_rights, &se_add_users );
4862 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4863
4864 /******** BEGIN SeAddUsers BLOCK *********/
4865
4866 if ( can_add_accounts )
4867 become_root();
4868
4869 status = pdb_delete_dom_group(p->mem_ctx, group_rid);
4870
4871 if ( can_add_accounts )
4872 unbecome_root();
4873
4874 /******** END SeAddUsers BLOCK *********/
4875
4876 if ( !NT_STATUS_IS_OK(status) ) {
4877 DEBUG(5,("_samr_DeleteDomainGroup: Failed to delete mapping "
4878 "entry for group %s: %s\n",
4879 sid_string_dbg(&group_sid),
4880 nt_errstr(status)));
4881 return status;
4882 }
4883
4884 if (!close_policy_hnd(p, r->in.group_handle))
4885 return NT_STATUS_OBJECT_NAME_INVALID;
4886
4887 force_flush_samr_cache(disp_info);
4888
4889 return NT_STATUS_OK;
4890 }
4891
4892 /*********************************************************************
4893 _samr_DeleteDomAlias
4894 *********************************************************************/
4895
4896 NTSTATUS _samr_DeleteDomAlias(pipes_struct *p,
4897 struct samr_DeleteDomAlias *r)
4898 {
4899 DOM_SID alias_sid;
4900 uint32 acc_granted;
4901 SE_PRIV se_rights;
4902 bool can_add_accounts;
4903 NTSTATUS status;
4904 DISP_INFO *disp_info = NULL;
4905
4906 DEBUG(5, ("_samr_DeleteDomAlias: %d\n", __LINE__));
4907
4908 /* Find the policy handle. Open a policy on it. */
4909 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4910 return NT_STATUS_INVALID_HANDLE;
4911
4912 /* copy the handle to the outgoing reply */
4913
4914 memcpy(r->out.alias_handle, r->in.alias_handle, sizeof(r->out.alias_handle));
4915
4916 status = access_check_samr_function(acc_granted,
4917 STD_RIGHT_DELETE_ACCESS,
4918 "_samr_DeleteDomAlias");
4919 if (!NT_STATUS_IS_OK(status)) {
4920 return status;
4921 }
4922
4923 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4924
4925 /* Don't let Windows delete builtin groups */
4926
4927 if ( sid_check_is_in_builtin( &alias_sid ) ) {
4928 return NT_STATUS_SPECIAL_ACCOUNT;
4929 }
4930
4931 if (!sid_check_is_in_our_domain(&alias_sid))
4932 return NT_STATUS_NO_SUCH_ALIAS;
4933
4934 DEBUG(10, ("lookup on Local SID\n"));
4935
4936 se_priv_copy( &se_rights, &se_add_users );
4937 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4938
4939 /******** BEGIN SeAddUsers BLOCK *********/
4940
4941 if ( can_add_accounts )
4942 become_root();
4943
4944 /* Have passdb delete the alias */
4945 status = pdb_delete_alias(&alias_sid);
4946
4947 if ( can_add_accounts )
4948 unbecome_root();
4949
4950 /******** END SeAddUsers BLOCK *********/
4951
4952 if ( !NT_STATUS_IS_OK(status))
4953 return status;
4954
4955 if (!close_policy_hnd(p, r->in.alias_handle))
4956 return NT_STATUS_OBJECT_NAME_INVALID;
4957
4958 force_flush_samr_cache(disp_info);
4959
4960 return NT_STATUS_OK;
4961 }
4962
4963 /*********************************************************************
4964 _samr_CreateDomainGroup
4965 *********************************************************************/
4966
4967 NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
4968 struct samr_CreateDomainGroup *r)
4969
4970 {
4971 NTSTATUS status;
4972 DOM_SID dom_sid;
4973 DOM_SID info_sid;
4974 const char *name;
4975 struct samr_info *info;
4976 uint32 acc_granted;
4977 SE_PRIV se_rights;
4978 bool can_add_accounts;
4979 DISP_INFO *disp_info = NULL;
4980
4981 /* Find the policy handle. Open a policy on it. */
4982 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
4983 return NT_STATUS_INVALID_HANDLE;
4984
4985 status = access_check_samr_function(acc_granted,
4986 SA_RIGHT_DOMAIN_CREATE_GROUP,
4987 "_samr_CreateDomainGroup");
4988 if (!NT_STATUS_IS_OK(status)) {
4989 return status;
4990 }
4991
4992 if (!sid_equal(&dom_sid, get_global_sam_sid()))
4993 return NT_STATUS_ACCESS_DENIED;
4994
4995 name = r->in.name->string;
4996 if (name == NULL) {
4997 return NT_STATUS_NO_MEMORY;
4998 }
4999
5000 status = can_create(p->mem_ctx, name);
5001 if (!NT_STATUS_IS_OK(status)) {
5002 return status;
5003 }
5004
5005 se_priv_copy( &se_rights, &se_add_users );
5006 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
5007
5008 /******** BEGIN SeAddUsers BLOCK *********/
5009
5010 if ( can_add_accounts )
5011 become_root();
5012
5013 /* check that we successfully create the UNIX group */
5014
5015 status = pdb_create_dom_group(p->mem_ctx, name, r->out.rid);
5016
5017 if ( can_add_accounts )
5018 unbecome_root();
5019
5020 /******** END SeAddUsers BLOCK *********/
5021
5022 /* check if we should bail out here */
5023
5024 if ( !NT_STATUS_IS_OK(status) )
5025 return status;
5026
5027 sid_compose(&info_sid, get_global_sam_sid(), *r->out.rid);
5028
5029 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5030 return NT_STATUS_NO_MEMORY;
5031
5032 /* they created it; let the user do what he wants with it */
5033
5034 info->acc_granted = GENERIC_RIGHTS_GROUP_ALL_ACCESS;
5035
5036 /* get a (unique) handle. open a policy on it. */
5037 if (!create_policy_hnd(p, r->out.group_handle, free_samr_info, (void *)info))
5038 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5039
5040 force_flush_samr_cache(disp_info);
5041
5042 return NT_STATUS_OK;
5043 }
5044
5045 /*********************************************************************
5046 _samr_CreateDomAlias
5047 *********************************************************************/
5048
5049 NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
5050 struct samr_CreateDomAlias *r)
5051 {
5052 DOM_SID dom_sid;
5053 DOM_SID info_sid;
5054 const char *name = NULL;
5055 struct samr_info *info;
5056 uint32 acc_granted;
5057 gid_t gid;
5058 NTSTATUS result;
5059 SE_PRIV se_rights;
5060 bool can_add_accounts;
5061 DISP_INFO *disp_info = NULL;
5062
5063 /* Find the policy handle. Open a policy on it. */
5064 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
5065 return NT_STATUS_INVALID_HANDLE;
5066
5067 result = access_check_samr_function(acc_granted,
5068 SA_RIGHT_DOMAIN_CREATE_ALIAS,
5069 "_samr_CreateDomAlias");
5070 if (!NT_STATUS_IS_OK(result)) {
5071 return result;
5072 }
5073
5074 if (!sid_equal(&dom_sid, get_global_sam_sid()))
5075 return NT_STATUS_ACCESS_DENIED;
5076
5077 name = r->in.alias_name->string;
5078
5079 se_priv_copy( &se_rights, &se_add_users );
5080 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
5081
5082 result = can_create(p->mem_ctx, name);
5083 if (!NT_STATUS_IS_OK(result)) {
5084 return result;
5085 }
5086
5087 /******** BEGIN SeAddUsers BLOCK *********/
5088
5089 if ( can_add_accounts )
5090 become_root();
5091
5092 /* Have passdb create the alias */
5093 result = pdb_create_alias(name, r->out.rid);
5094
5095 if ( can_add_accounts )
5096 unbecome_root();
5097
5098 /******** END SeAddUsers BLOCK *********/
5099
5100 if (!NT_STATUS_IS_OK(result)) {
5101 DEBUG(10, ("pdb_create_alias failed: %s\n",
5102 nt_errstr(result)));
5103 return result;
5104 }
5105
5106 sid_copy(&info_sid, get_global_sam_sid());
5107 sid_append_rid(&info_sid, *r->out.rid);
5108
5109 if (!sid_to_gid(&info_sid, &gid)) {
5110 DEBUG(10, ("Could not find alias just created\n"));
5111 return NT_STATUS_ACCESS_DENIED;
5112 }
5113
5114 /* check if the group has been successfully created */
5115 if ( getgrgid(gid) == NULL ) {
5116 DEBUG(10, ("getgrgid(%d) of just created alias failed\n",
5117 gid));
5118 return NT_STATUS_ACCESS_DENIED;
5119 }
5120
5121 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5122 return NT_STATUS_NO_MEMORY;
5123
5124 /* they created it; let the user do what he wants with it */
5125
5126 info->acc_granted = GENERIC_RIGHTS_ALIAS_ALL_ACCESS;
5127
5128 /* get a (unique) handle. open a policy on it. */
5129 if (!create_policy_hnd(p, r->out.alias_handle, free_samr_info, (void *)info))
5130 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5131
5132 force_flush_samr_cache(disp_info);
5133
5134 return NT_STATUS_OK;
5135 }
5136
5137 /*********************************************************************
5138 _samr_QueryGroupInfo
5139 *********************************************************************/
5140
5141 NTSTATUS _samr_QueryGroupInfo(pipes_struct *p,
5142 struct samr_QueryGroupInfo *r)
5143 {
5144 NTSTATUS status;
5145 DOM_SID group_sid;
5146 GROUP_MAP map;
5147 union samr_GroupInfo *info = NULL;
5148 uint32 acc_granted;
5149 bool ret;
5150 uint32_t attributes = SE_GROUP_MANDATORY |
5151 SE_GROUP_ENABLED_BY_DEFAULT |
5152 SE_GROUP_ENABLED;
5153 const char *group_name = NULL;
5154 const char *group_description = NULL;
5155
5156 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, NULL))
5157 return NT_STATUS_INVALID_HANDLE;
5158
5159 status = access_check_samr_function(acc_granted,
5160 SA_RIGHT_GROUP_LOOKUP_INFO,
5161 "_samr_QueryGroupInfo");
5162 if (!NT_STATUS_IS_OK(status)) {
5163 return status;
5164 }
5165
5166 become_root();
5167 ret = get_domain_group_from_sid(group_sid, &map);
5168 unbecome_root();
5169 if (!ret)
5170 return NT_STATUS_INVALID_HANDLE;
5171
5172 /* FIXME: map contains fstrings */
5173 group_name = talloc_strdup(r, map.nt_name);
5174 group_description = talloc_strdup(r, map.comment);
5175
5176 info = TALLOC_ZERO_P(p->mem_ctx, union samr_GroupInfo);
5177 if (!info) {
5178 return NT_STATUS_NO_MEMORY;
5179 }
5180
5181 switch (r->in.level) {
5182 case 1: {
5183 uint32 *members;
5184 size_t num_members;
5185
5186 become_root();
5187 status = pdb_enum_group_members(
5188 p->mem_ctx, &group_sid, &members, &num_members);
5189 unbecome_root();
5190
5191 if (!NT_STATUS_IS_OK(status)) {
5192 return status;
5193 }
5194
5195 init_samr_group_info1(&info->all,
5196 group_name,
5197 attributes,
5198 num_members,
5199 group_description);
5200 break;
5201 }
5202 case 2:
5203 init_samr_group_info2(&info->name,
5204 group_name);
5205 break;
5206 case 3:
5207 init_samr_group_info3(&info->attributes,
5208 attributes);
5209 break;
5210 case 4:
5211 init_samr_group_info4(&info->description,
5212 group_description);
5213 break;
5214 case 5: {
5215 /*
5216 uint32 *members;
5217 size_t num_members;
5218 */
5219
5220 /*
5221 become_root();
5222 status = pdb_enum_group_members(
5223 p->mem_ctx, &group_sid, &members, &num_members);
5224 unbecome_root();
5225
5226 if (!NT_STATUS_IS_OK(status)) {
5227 return status;
5228 }
5229 */
5230 init_samr_group_info5(&info->all2,
5231 group_name,
5232 attributes,
5233 0, /* num_members - in w2k3 this is always 0 */
5234 group_description);
5235
5236 break;
5237 }
5238 default:
5239 return NT_STATUS_INVALID_INFO_CLASS;
5240 }
5241
5242 *r->out.info = info;
5243
5244 return NT_STATUS_OK;
5245 }
5246
5247 /*********************************************************************
5248 _samr_SetGroupInfo
5249 *********************************************************************/
5250
5251 NTSTATUS _samr_SetGroupInfo(pipes_struct *p,
5252 struct samr_SetGroupInfo *r)
5253 {
5254 DOM_SID group_sid;
5255 GROUP_MAP map;
5256 uint32 acc_granted;
5257 NTSTATUS status;
5258 bool ret;
5259 bool can_mod_accounts;
5260 DISP_INFO *disp_info = NULL;
5261
5262 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
5263 return NT_STATUS_INVALID_HANDLE;
5264
5265 status = access_check_samr_function(acc_granted,
5266 SA_RIGHT_GROUP_SET_INFO,
5267 "_samr_SetGroupInfo");
5268 if (!NT_STATUS_IS_OK(status)) {
5269 return status;
5270 }
5271
5272 become_root();
5273 ret = get_domain_group_from_sid(group_sid, &map);
5274 unbecome_root();
5275 if (!ret)
5276 return NT_STATUS_NO_SUCH_GROUP;
5277
5278 switch (r->in.level) {
5279 case 1:
5280 fstrcpy(map.comment, r->in.info->all.description.string);
5281 break;
5282 case 4:
5283 fstrcpy(map.comment, r->in.info->description.string);
5284 break;
5285 default:
5286 return NT_STATUS_INVALID_INFO_CLASS;
5287 }
5288
5289 can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
5290
5291 /******** BEGIN SeAddUsers BLOCK *********/
5292
5293 if ( can_mod_accounts )
5294 become_root();
5295
5296 status = pdb_update_group_mapping_entry(&map);
5297
5298 if ( can_mod_accounts )
5299 unbecome_root();
5300
5301 /******** End SeAddUsers BLOCK *********/
5302
5303 if (NT_STATUS_IS_OK(status)) {
5304 force_flush_samr_cache(disp_info);
5305 }
5306
5307 return status;
5308 }
5309
5310 /*********************************************************************
5311 _samr_SetAliasInfo
5312 *********************************************************************/
5313
5314 NTSTATUS _samr_SetAliasInfo(pipes_struct *p,
5315 struct samr_SetAliasInfo *r)
5316 {
5317 DOM_SID group_sid;
5318 struct acct_info info;
5319 uint32 acc_granted;
5320 bool can_mod_accounts;
5321 NTSTATUS status;
5322 DISP_INFO *disp_info = NULL;
5323
5324 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &group_sid, &acc_granted, &disp_info))
5325 return NT_STATUS_INVALID_HANDLE;
5326
5327 status = access_check_samr_function(acc_granted,
5328 SA_RIGHT_ALIAS_SET_INFO,
5329 "_samr_SetAliasInfo");
5330 if (!NT_STATUS_IS_OK(status)) {
5331 return status;
5332 }
5333
5334 /* get the current group information */
5335
5336 become_root();
5337 status = pdb_get_aliasinfo( &group_sid, &info );
5338 unbecome_root();
5339
5340 if ( !NT_STATUS_IS_OK(status))
5341 return status;
5342
5343 switch (r->in.level) {
5344 case ALIASINFONAME:
5345 {
5346 fstring group_name;
5347
5348 /* We currently do not support renaming groups in the
5349 the BUILTIN domain. Refer to util_builtin.c to understand
5350 why. The eventually needs to be fixed to be like Windows
5351 where you can rename builtin groups, just not delete them */
5352
5353 if ( sid_check_is_in_builtin( &group_sid ) ) {
5354 return NT_STATUS_SPECIAL_ACCOUNT;
5355 }
5356
5357 /* There has to be a valid name (and it has to be different) */
5358
5359 if ( !r->in.info->name.string )
5360 return NT_STATUS_INVALID_PARAMETER;
5361
5362 /* If the name is the same just reply "ok". Yes this
5363 doesn't allow you to change the case of a group name. */
5364
5365 if ( strequal( r->in.info->name.string, info.acct_name ) )
5366 return NT_STATUS_OK;
5367
5368 fstrcpy( info.acct_name, r->in.info->name.string);
5369
5370 /* make sure the name doesn't already exist as a user
5371 or local group */
5372
5373 fstr_sprintf( group_name, "%s\\%s", global_myname(), info.acct_name );
5374 status = can_create( p->mem_ctx, group_name );
5375 if ( !NT_STATUS_IS_OK( status ) )
5376 return status;
5377 break;
5378 }
5379 case ALIASINFODESCRIPTION:
5380 if (r->in.info->description.string) {
5381 fstrcpy(info.acct_desc,
5382 r->in.info->description.string);
5383 } else {
5384 fstrcpy( info.acct_desc, "" );
5385 }
5386 break;
5387 default:
5388 return NT_STATUS_INVALID_INFO_CLASS;
5389 }
5390
5391 can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
5392
5393 /******** BEGIN SeAddUsers BLOCK *********/
5394
5395 if ( can_mod_accounts )
5396 become_root();
5397
5398 status = pdb_set_aliasinfo( &group_sid, &info );
5399
5400 if ( can_mod_accounts )
5401 unbecome_root();
5402
5403 /******** End SeAddUsers BLOCK *********/
5404
5405 if (NT_STATUS_IS_OK(status))
5406 force_flush_samr_cache(disp_info);
5407
5408 return status;
5409 }
5410
5411 /****************************************************************
5412 _samr_GetDomPwInfo
5413 ****************************************************************/
5414
5415 NTSTATUS _samr_GetDomPwInfo(pipes_struct *p,
5416 struct samr_GetDomPwInfo *r)
5417 {
5418 uint32_t min_password_length = 0;
5419 uint32_t password_properties = 0;
5420
5421 /* Perform access check. Since this rpc does not require a
5422 policy handle it will not be caught by the access checks on
5423 SAMR_CONNECT or SAMR_CONNECT_ANON. */
5424
5425 if (!pipe_access_check(p)) {
5426 DEBUG(3, ("access denied to _samr_GetDomPwInfo\n"));
5427 return NT_STATUS_ACCESS_DENIED;
5428 }
5429
5430 become_root();
5431 pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
5432 &min_password_length);
5433 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
5434 &password_properties);
5435 unbecome_root();
5436
5437 if (lp_check_password_script() && *lp_check_password_script()) {
5438 password_properties |= DOMAIN_PASSWORD_COMPLEX;
5439 }
5440
5441 r->out.info->min_password_length = min_password_length;
5442 r->out.info->password_properties = password_properties;
5443
5444 return NT_STATUS_OK;
5445 }
5446
5447 /*********************************************************************
5448 _samr_OpenGroup
5449 *********************************************************************/
5450
5451 NTSTATUS _samr_OpenGroup(pipes_struct *p,
5452 struct samr_OpenGroup *r)
5453
5454 {
5455 DOM_SID sid;
5456 DOM_SID info_sid;
5457 GROUP_MAP map;
5458 struct samr_info *info;
5459 SEC_DESC *psd = NULL;
5460 uint32 acc_granted;
5461 uint32 des_access = r->in.access_mask;
5462 size_t sd_size;
5463 NTSTATUS status;
5464 fstring sid_string;
5465 bool ret;
5466 SE_PRIV se_rights;
5467
5468 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid, &acc_granted, NULL))
5469 return NT_STATUS_INVALID_HANDLE;
5470
5471 status = access_check_samr_function(acc_granted,
5472 SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
5473 "_samr_OpenGroup");
5474
5475 if ( !NT_STATUS_IS_OK(status) )
5476 return status;
5477
5478 /*check if access can be granted as requested by client. */
5479 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
5480 se_map_generic(&des_access,&grp_generic_mapping);
5481
5482 se_priv_copy( &se_rights, &se_add_users );
5483
5484 status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
5485 &se_rights, GENERIC_RIGHTS_GROUP_WRITE, des_access,
5486 &acc_granted, "_samr_OpenGroup");
5487
5488 if ( !NT_STATUS_IS_OK(status) )
5489 return status;
5490
5491 /* this should not be hard-coded like this */
5492
5493 if (!sid_equal(&sid, get_global_sam_sid()))
5494 return NT_STATUS_ACCESS_DENIED;
5495
5496 sid_copy(&info_sid, get_global_sam_sid());
5497 sid_append_rid(&info_sid, r->in.rid);
5498 sid_to_fstring(sid_string, &info_sid);
5499
5500 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5501 return NT_STATUS_NO_MEMORY;
5502
5503 info->acc_granted = acc_granted;
5504
5505 DEBUG(10, ("_samr_OpenGroup:Opening SID: %s\n", sid_string));
5506
5507 /* check if that group really exists */
5508 become_root();
5509 ret = get_domain_group_from_sid(info->sid, &map);
5510 unbecome_root();
5511 if (!ret)
5512 return NT_STATUS_NO_SUCH_GROUP;
5513
5514 /* get a (unique) handle. open a policy on it. */
5515 if (!create_policy_hnd(p, r->out.group_handle, free_samr_info, (void *)info))
5516 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5517
5518 return NT_STATUS_OK;
5519 }
5520
5521 /*********************************************************************
5522 _samr_RemoveMemberFromForeignDomain
5523 *********************************************************************/
5524
5525 NTSTATUS _samr_RemoveMemberFromForeignDomain(pipes_struct *p,
5526 struct samr_RemoveMemberFromForeignDomain *r)
5527 {
5528 DOM_SID delete_sid, domain_sid;
5529 uint32 acc_granted;
5530 NTSTATUS result;
5531 DISP_INFO *disp_info = NULL;
5532
5533 sid_copy( &delete_sid, r->in.sid );
5534
5535 DEBUG(5,("_samr_RemoveMemberFromForeignDomain: removing SID [%s]\n",
5536 sid_string_dbg(&delete_sid)));
5537
5538 /* Find the policy handle. Open a policy on it. */
5539
5540 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &domain_sid,
5541 &acc_granted, &disp_info))
5542 return NT_STATUS_INVALID_HANDLE;
5543
5544 result = access_check_samr_function(acc_granted,
5545 STD_RIGHT_DELETE_ACCESS,
5546 "_samr_RemoveMemberFromForeignDomain");
5547
5548 if (!NT_STATUS_IS_OK(result))
5549 return result;
5550
5551 DEBUG(8, ("_samr_RemoveMemberFromForeignDomain: sid is %s\n",
5552 sid_string_dbg(&domain_sid)));
5553
5554 /* we can only delete a user from a group since we don't have
5555 nested groups anyways. So in the latter case, just say OK */
5556
5557 /* TODO: The above comment nowadays is bogus. Since we have nested
5558 * groups now, and aliases members are never reported out of the unix
5559 * group membership, the "just say OK" makes this call a no-op. For
5560 * us. This needs fixing however. */
5561
5562 /* I've only ever seen this in the wild when deleting a user from
5563 * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
5564 * is the user about to be deleted. I very much suspect this is the
5565 * only application of this call. To verify this, let people report
5566 * other cases. */
5567
5568 if (!sid_check_is_builtin(&domain_sid)) {
5569 DEBUG(1,("_samr_RemoveMemberFromForeignDomain: domain_sid = %s, "
5570 "global_sam_sid() = %s\n",
5571 sid_string_dbg(&domain_sid),
5572 sid_string_dbg(get_global_sam_sid())));
5573 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
5574 return NT_STATUS_OK;
5575 }
5576
5577 force_flush_samr_cache(disp_info);
5578
5579 result = NT_STATUS_OK;
5580
5581 return result;
5582 }
5583
5584 /*******************************************************************
5585 _samr_QueryDomainInfo2
5586 ********************************************************************/
5587
5588 NTSTATUS _samr_QueryDomainInfo2(pipes_struct *p,
5589 struct samr_QueryDomainInfo2 *r)
5590 {
5591 return samr_QueryDomainInfo_internal("_samr_QueryDomainInfo2",
5592 p,
5593 r->in.domain_handle,
5594 r->in.level,
5595 r->out.info);
5596 }
5597
5598 /*******************************************************************
5599 _samr_SetDomainInfo
5600 ********************************************************************/
5601
5602 NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
5603 struct samr_SetDomainInfo *r)
5604 {
5605 time_t u_expire, u_min_age;
5606 time_t u_logout;
5607 time_t u_lock_duration, u_reset_time;
5608
5609 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
5610
5611 /* find the policy handle. open a policy on it. */
5612 if (!find_policy_by_hnd(p, r->in.domain_handle, NULL))
5613 return NT_STATUS_INVALID_HANDLE;
5614
5615 DEBUG(5,("_samr_SetDomainInfo: level: %d\n", r->in.level));
5616
5617 switch (r->in.level) {
5618 case 0x01:
5619 u_expire=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.max_password_age);
5620 u_min_age=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.min_password_age);
5621 pdb_set_account_policy(AP_MIN_PASSWORD_LEN, (uint32)r->in.info->info1.min_password_length);
5622 pdb_set_account_policy(AP_PASSWORD_HISTORY, (uint32)r->in.info->info1.password_history_length);
5623 pdb_set_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, (uint32)r->in.info->info1.password_properties);
5624 pdb_set_account_policy(AP_MAX_PASSWORD_AGE, (int)u_expire);
5625 pdb_set_account_policy(AP_MIN_PASSWORD_AGE, (int)u_min_age);
5626 break;
5627 case 0x02:
5628 break;
5629 case 0x03:
5630 u_logout=nt_time_to_unix_abs((NTTIME *)&r->in.info->info3.force_logoff_time);
5631 pdb_set_account_policy(AP_TIME_TO_LOGOUT, (int)u_logout);
5632 break;
5633 case 0x05:
5634 break;
5635 case 0x06:
5636 break;
5637 case 0x07:
5638 break;
5639 case 0x0c:
5640 u_lock_duration=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_duration);
5641 if (u_lock_duration != -1)
5642 u_lock_duration /= 60;
5643
5644 u_reset_time=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_window)/60;
5645
5646 pdb_set_account_policy(AP_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
5647 pdb_set_account_policy(AP_RESET_COUNT_TIME, (int)u_reset_time);
5648 pdb_set_account_policy(AP_BAD_ATTEMPT_LOCKOUT, (uint32)r->in.info->info12.lockout_threshold);
5649 break;
5650 default:
5651 return NT_STATUS_INVALID_INFO_CLASS;
5652 }
5653
5654 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
5655
5656 return NT_STATUS_OK;
5657 }
5658
5659 /****************************************************************
5660 _samr_GetDisplayEnumerationIndex
5661 ****************************************************************/
5662
5663 NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
5664 struct samr_GetDisplayEnumerationIndex *r)
5665 {
5666 struct samr_info *info = NULL;
5667 uint32_t max_entries = (uint32_t) -1;
5668 uint32_t enum_context = 0;
5669 int i;
5670 uint32_t num_account = 0;
5671 struct samr_displayentry *entries = NULL;
5672
5673 DEBUG(5,("_samr_GetDisplayEnumerationIndex: %d\n", __LINE__));
5674
5675 /* find the policy handle. open a policy on it. */
5676 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
5677 return NT_STATUS_INVALID_HANDLE;
5678 }
5679
5680 if ((r->in.level < 1) || (r->in.level > 3)) {
5681 DEBUG(0,("_samr_GetDisplayEnumerationIndex: "
5682 "Unknown info level (%u)\n",
5683 r->in.level));
5684 return NT_STATUS_INVALID_INFO_CLASS;
5685 }
5686
5687 become_root();
5688
5689 /* The following done as ROOT. Don't return without unbecome_root(). */
5690
5691 switch (r->in.level) {
5692 case 1:
5693 if (info->disp_info->users == NULL) {
5694 info->disp_info->users = pdb_search_users(ACB_NORMAL);
5695 if (info->disp_info->users == NULL) {
5696 unbecome_root();
5697 return NT_STATUS_ACCESS_DENIED;
5698 }
5699 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5700 "starting user enumeration at index %u\n",
5701 (unsigned int)enum_context));
5702 } else {
5703 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5704 "using cached user enumeration at index %u\n",
5705 (unsigned int)enum_context));
5706 }
5707 num_account = pdb_search_entries(info->disp_info->users,
5708 enum_context, max_entries,
5709 &entries);
5710 break;
5711 case 2:
5712 if (info->disp_info->machines == NULL) {
5713 info->disp_info->machines =
5714 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
5715 if (info->disp_info->machines == NULL) {
5716 unbecome_root();
5717 return NT_STATUS_ACCESS_DENIED;
5718 }
5719 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5720 "starting machine enumeration at index %u\n",
5721 (unsigned int)enum_context));
5722 } else {
5723 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5724 "using cached machine enumeration at index %u\n",
5725 (unsigned int)enum_context));
5726 }
5727 num_account = pdb_search_entries(info->disp_info->machines,
5728 enum_context, max_entries,
5729 &entries);
5730 break;
5731 case 3:
5732 if (info->disp_info->groups == NULL) {
5733 info->disp_info->groups = pdb_search_groups();
5734 if (info->disp_info->groups == NULL) {
5735 unbecome_root();
5736 return NT_STATUS_ACCESS_DENIED;
5737 }
5738 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5739 "starting group enumeration at index %u\n",
5740 (unsigned int)enum_context));
5741 } else {
5742 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5743 "using cached group enumeration at index %u\n",
5744 (unsigned int)enum_context));
5745 }
5746 num_account = pdb_search_entries(info->disp_info->groups,
5747 enum_context, max_entries,
5748 &entries);
5749 break;
5750 default:
5751 unbecome_root();
5752 smb_panic("info class changed");
5753 break;
5754 }
5755
5756 unbecome_root();
5757
5758 /* Ensure we cache this enumeration. */
5759 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
5760
5761 DEBUG(10,("_samr_GetDisplayEnumerationIndex: looking for :%s\n",
5762 r->in.name->string));
5763
5764 for (i=0; i<num_account; i++) {
5765 if (strequal(entries[i].account_name, r->in.name->string)) {
5766 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5767 "found %s at idx %d\n",
5768 r->in.name->string, i));
5769 *r->out.idx = i;
5770 return NT_STATUS_OK;
5771 }
5772 }
5773
5774 /* assuming account_name lives at the very end */
5775 *r->out.idx = num_account;
5776
5777 return NT_STATUS_NO_MORE_ENTRIES;
5778 }
5779
5780 /****************************************************************
5781 _samr_GetDisplayEnumerationIndex2
5782 ****************************************************************/
5783
5784 NTSTATUS _samr_GetDisplayEnumerationIndex2(pipes_struct *p,
5785 struct samr_GetDisplayEnumerationIndex2 *r)
5786 {
5787 struct samr_GetDisplayEnumerationIndex q;
5788
5789 q.in.domain_handle = r->in.domain_handle;
5790 q.in.level = r->in.level;
5791 q.in.name = r->in.name;
5792
5793 q.out.idx = r->out.idx;
5794
5795 return _samr_GetDisplayEnumerationIndex(p, &q);
5796 }
5797
5798 /****************************************************************
5799 ****************************************************************/
5800
5801 NTSTATUS _samr_Shutdown(pipes_struct *p,
5802 struct samr_Shutdown *r)
5803 {
5804 p->rng_fault_state = true;
5805 return NT_STATUS_NOT_IMPLEMENTED;
5806 }
5807
5808 /****************************************************************
5809 ****************************************************************/
5810
5811 NTSTATUS _samr_CreateUser(pipes_struct *p,
5812 struct samr_CreateUser *r)
5813 {
5814 p->rng_fault_state = true;
5815 return NT_STATUS_NOT_IMPLEMENTED;
5816 }
5817
5818 /****************************************************************
5819 ****************************************************************/
5820
5821 NTSTATUS _samr_SetMemberAttributesOfGroup(pipes_struct *p,
5822 struct samr_SetMemberAttributesOfGroup *r)
5823 {
5824 p->rng_fault_state = true;
5825 return NT_STATUS_NOT_IMPLEMENTED;
5826 }
5827
5828 /****************************************************************
5829 ****************************************************************/
5830
5831 NTSTATUS _samr_ChangePasswordUser(pipes_struct *p,
5832 struct samr_ChangePasswordUser *r)
5833 {
5834 p->rng_fault_state = true;
5835 return NT_STATUS_NOT_IMPLEMENTED;
5836 }
5837
5838 /****************************************************************
5839 ****************************************************************/
5840
5841 NTSTATUS _samr_TestPrivateFunctionsDomain(pipes_struct *p,
5842 struct samr_TestPrivateFunctionsDomain *r)
5843 {
5844 p->rng_fault_state = true;
5845 return NT_STATUS_NOT_IMPLEMENTED;
5846 }
5847
5848 /****************************************************************
5849 ****************************************************************/
5850
5851 NTSTATUS _samr_TestPrivateFunctionsUser(pipes_struct *p,
5852 struct samr_TestPrivateFunctionsUser *r)
5853 {
5854 p->rng_fault_state = true;
5855 return NT_STATUS_NOT_IMPLEMENTED;
5856 }
5857
5858 /****************************************************************
5859 ****************************************************************/
5860
5861 NTSTATUS _samr_QueryUserInfo2(pipes_struct *p,
5862 struct samr_QueryUserInfo2 *r)
5863 {
5864 p->rng_fault_state = true;
5865 return NT_STATUS_NOT_IMPLEMENTED;
5866 }
5867
5868 /****************************************************************
5869 ****************************************************************/
5870
5871 NTSTATUS _samr_AddMultipleMembersToAlias(pipes_struct *p,
5872 struct samr_AddMultipleMembersToAlias *r)
5873 {
5874 p->rng_fault_state = true;
5875 return NT_STATUS_NOT_IMPLEMENTED;
5876 }
5877
5878 /****************************************************************
5879 ****************************************************************/
5880
5881 NTSTATUS _samr_RemoveMultipleMembersFromAlias(pipes_struct *p,
5882 struct samr_RemoveMultipleMembersFromAlias *r)
5883 {
5884 p->rng_fault_state = true;
5885 return NT_STATUS_NOT_IMPLEMENTED;
5886 }
5887
5888 /****************************************************************
5889 ****************************************************************/
5890
5891 NTSTATUS _samr_OemChangePasswordUser2(pipes_struct *p,
5892 struct samr_OemChangePasswordUser2 *r)
5893 {
5894 p->rng_fault_state = true;
5895 return NT_STATUS_NOT_IMPLEMENTED;
5896 }
5897
5898 /****************************************************************
5899 ****************************************************************/
5900
5901 NTSTATUS _samr_SetBootKeyInformation(pipes_struct *p,
5902 struct samr_SetBootKeyInformation *r)
5903 {
5904 p->rng_fault_state = true;
5905 return NT_STATUS_NOT_IMPLEMENTED;
5906 }
5907
5908 /****************************************************************
5909 ****************************************************************/
5910
5911 NTSTATUS _samr_GetBootKeyInformation(pipes_struct *p,
5912 struct samr_GetBootKeyInformation *r)
5913 {
5914 p->rng_fault_state = true;
5915 return NT_STATUS_NOT_IMPLEMENTED;
5916 }
5917
5918 /****************************************************************
5919 ****************************************************************/
5920
5921 NTSTATUS _samr_Connect3(pipes_struct *p,
5922 struct samr_Connect3 *r)
5923 {
5924 p->rng_fault_state = true;
5925 return NT_STATUS_NOT_IMPLEMENTED;
5926 }
5927
5928 /****************************************************************
5929 ****************************************************************/
5930
5931 NTSTATUS _samr_RidToSid(pipes_struct *p,
5932 struct samr_RidToSid *r)
5933 {
5934 p->rng_fault_state = true;
5935 return NT_STATUS_NOT_IMPLEMENTED;
5936 }
5937
5938 /****************************************************************
5939 ****************************************************************/
5940
5941 NTSTATUS _samr_SetDsrmPassword(pipes_struct *p,
5942 struct samr_SetDsrmPassword *r)
5943 {
5944 p->rng_fault_state = true;
5945 return NT_STATUS_NOT_IMPLEMENTED;
5946 }
5947
5948 /****************************************************************
5949 ****************************************************************/
5950
5951 NTSTATUS _samr_ValidatePassword(pipes_struct *p,
5952 struct samr_ValidatePassword *r)
5953 {
5954 p->rng_fault_state = true;
5955 return NT_STATUS_NOT_IMPLEMENTED;
5956 }
Samba GIT mirror